[codex] Add run save snapshots

[CompleteDotTech]

Summary

• Add opt-in run save snapshot capture via STS2_MCP_SNAPSHOTS=1, with optional STS2_MCP_SNAPSHOT_DIR.
• Add /api/v1/snapshots GET/POST handlers for listing, manual snapshot creation, and guarded restore to current-run save slots.
• Add MCP wrappers, docs, and endpoint audit coverage for snapshot APIs.

Behavior

• Automatic snapshots subscribe to the game save event when snapshots are enabled.
• Restore is rejected while a run is in progress and backs up any current-run save before overwrite.
• Restore destinations are derived from the active profile/save roots, not trusted SourceSavePath metadata.
• Snapshot request validation reports malformed requests before feature-disabled state, so clients get stable missing_snapshot_id, missing_action, and invalid_action_type errors.

Review Fixes

• Deserialize snapshot POST JSON directly from the request stream.
• Enumerate immediate snapshot directories instead of recursively searching arbitrary trees.
• Reconstruct snapshot file paths from the snapshot directory and supported save filename, ignoring persisted absolute snapshot paths.
• Block unsupported save filenames and derive restore destinations from the active profile to avoid arbitrary file overwrite via malformed metadata.
• Log full snapshot exceptions and metadata parse failures.
• Avoid serializing reconstructed SnapshotPath and SnapshotSavePath into metadata.json.
• Use a HashSet<char> and StringBuilder for snapshot ID path-part sanitization.

Validation

• python3 -m py_compile scripts/audit_endpoints.py scripts/test_mcp_server.py mcp/server.py
• python3 scripts/audit_endpoints.py --skip-live
• uv run --project mcp python scripts/test_mcp_server.py
• /mnt/c/Program Files/dotnet/dotnet.exe build STS2_MCP.csproj -c Release -o out/STS2_MCP -p:STS2GameDir="C:\\Program Files (x86)\\Steam\\steamapps\\common\\Slay the Spire 2"
• python3 scripts/audit_endpoints.py --base-url http://127.0.0.1:15526
• Relaunched with STS2_MCP_SNAPSHOTS=1 and a temp snapshot root, verified GET /api/v1/snapshots reports enabled: true, POST /api/v1/snapshots create returns a full snapshot payload for run modded:profile1:1778295706, listing returns the new snapshot, and resume during combat returns HTTP 409 run_in_progress.
• Gemini review was requested again after fixes; current PR review threads have no unresolved, non-outdated conversations.

[gemini-code-assist]

Code Review

This pull request introduces run snapshot support to the STS2_MCP mod, allowing users to capture and restore game saves via new API endpoints and MCP tools. Key changes include the addition of McpMod.Snapshots.cs for snapshot management, integration into the HTTP bridge, and comprehensive documentation and test updates. Feedback focuses on improving performance by deserializing JSON directly from the request stream and optimizing the snapshot enumeration process to avoid recursive directory searches.

[CompleteDotTech]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a run snapshot system for the STS2_MCP mod, enabling users to capture, list, and resume game saves through new API endpoints. The feature includes automatic snapshotting upon game saves (when enabled via environment variables), manual snapshot creation, and a restoration process that includes automatic backups of existing saves. Feedback identifies a security risk regarding arbitrary file overwrites through unvalidated restore paths, suggests improving the robustness of snapshot discovery when files are moved, and recommends better error logging and handling during snapshot enumeration.

[CompleteDotTech]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive snapshot system for game saves, enabling users to create, list, and resume save states through new API endpoints and MCP tools. The implementation includes automatic snapshotting on game saves, manual creation with state-specific restrictions (such as blocking snapshots on map or shop screens), and secure restoration logic that derives paths from active profiles. Documentation, audit scripts, and tests have been updated to support this feature. Feedback suggests using [JsonIgnore] on specific metadata properties to avoid serializing redundant path information that is reconstructed at runtime.

[CompleteDotTech]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a snapshot system for game saves, allowing users to list, create, and resume snapshots through new API endpoints and MCP tools. The system includes automatic snapshotting on save (opt-in via environment variables), manual creation with state validation to prevent inconsistent saves, and a restoration flow that includes safety backups. Feedback was provided regarding the performance of the path sanitization logic, suggesting a more efficient implementation using a HashSet and StringBuilder.

[CompleteDotTech]

/gemini review

[CompleteDotTech]

/gemini review

[gemini-code-assist]

Code Review

This pull request introduces a comprehensive snapshot system for game saves, allowing for automatic and manual capture of run states. It adds new API endpoints (/api/v1/snapshots) for listing, creating, and resuming snapshots, complete with metadata extraction and state validation to prevent snapshots in unsupported scenarios like shops or the map screen. The changes also include updates to documentation, MCP tool wrappers, and audit scripts to ensure the feature is well-documented and tested. I have no feedback to provide as no review comments were submitted.

[gemini-code-assist]

Code Review

This pull request implements a run snapshot system for the STS2 MCP mod, allowing users to capture and restore game saves via new API endpoints and MCP tools. Key features include automatic snapshotting on game save, manual snapshot creation with validation to prevent inconsistent states, and a restoration flow that creates backups of existing saves. The changes also include comprehensive documentation updates, new audit scripts to ensure metadata safety, and unit tests for the new functionality. I have no feedback to provide.