Transition to Spring Boot Server & Pygame Client

[dmccoystephenson]

(TBD)

[Copilot]

@dmccoystephenson I've opened a new pull request, #302, to work on those changes. Once the pull request is ready, I'll request review from you.

[Copilot]

Pull request overview

Copilot reviewed 167 out of 200 changed files in this pull request and generated 6 comments.

Comments suppressed due to low confidence (2)

server/src/main/java/com/preponderous/roam/model/entity/ChickenMeat.java:1

• Inconsistent image filename convention. ChickenMeat uses 'chickenMeat.png' while DeerMeat references 'chicken.png'. The filename should be 'chicken_meat.png' or similar to match the entity name pattern.

package com.preponderous.roam.model.entity;

server/src/main/java/com/preponderous/roam/model/entity/ChickenMeat.java:1

• Inconsistent image filename convention. ChickenMeat uses 'chickenMeat.png' while DeerMeat references 'chicken.png'. The filename should be 'chicken_meat.png' or similar to match the entity name pattern.

package com.preponderous.roam.model.entity;

---

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

[Copilot]

Incorrect image path for DeerMeat. Using 'chicken.png' instead of 'deerMeat.png' which will display the wrong sprite for deer meat items.

[Copilot]

CORS configuration allows localhost ports 8080, 3000, and 5000, but port 8080 is the server's own port. This could enable self-XSS attacks. Remove port 8080 from allowed origins unless there's a specific need for the server to make CORS requests to itself.

Suggested change

	// Development default: use specific port instead of invalid wildcard
	allowedOrigins = "http://localhost:8080,http://localhost:3000,http://localhost:5000";
	// Development default: use specific ports instead of invalid wildcard
	allowedOrigins = "http://localhost:3000,http://localhost:5000";

[Copilot]

Inconsistent image filename. The client uses 'stone_item.png' while the server model uses 'stone.png' (server/src/main/java/com/preponderous/roam/model/entity/Stone.java line 15). This inconsistency may cause rendering issues.

Suggested change

	DrawableEntity.__init__(self, "Stone", "assets/images/stone_item.png")
	DrawableEntity.__init__(self, "Stone", "assets/images/stone.png")

[Copilot]

The comment states auto-save is 'disabled by default to avoid unexpected background writes' but doesn't explain the tradeoff. Consider clarifying that users need to manually save or risk losing progress, and provide guidance on when to enable this feature.

Suggested change

	auto-save: false # Disabled by default to avoid unexpected background writes; set to true to enable periodic automatic saves and reduce risk of data loss on crashes
	auto-save: false # Disabled by default to avoid unexpected background writes; when false, users must save manually and may lose recent progress on crashes. Enable (set to true) in environments where periodic background writes are acceptable to reduce data-loss risk.

[Copilot]

Good security practice enforcing explicit password requirement. However, the script doesn't validate the password is non-trivial (e.g., not 'password' or 'admin'). Consider adding minimum password strength validation for production use.

Suggested change

	# Require an explicit database password to avoid using insecure defaults
	if [ -z "${DB_PASSWORD}" ]; then
	echo "Error: DATABASE_PASSWORD environment variable is not set." >&2
	echo "Refusing to run backup with a default or empty database password." >&2
	echo "Please set DATABASE_PASSWORD to the database user's password and rerun this script." >&2
	# Require an explicit, non-trivial database password to avoid using insecure defaults
	WEAK_PASSWORDS=("password" "admin" "123456" "12345678" "qwerty" "letmein" "${DB_USER}" "${DB_NAME}")
	is_weak_password=0
	for weak in "${WEAK_PASSWORDS[@]}"; do
	if [ -n "${weak}" ] && [ "${DB_PASSWORD}" = "${weak}" ]; then
	is_weak_password=1
	break
	fi
	done
	password_length=${#DB_PASSWORD}
	if [ -z "${DB_PASSWORD}" ] || [ "${password_length}" -lt 8 ] || [ "${is_weak_password}" -eq 1 ]; then
	echo "Error: DATABASE_PASSWORD environment variable is not set to a sufficiently strong value." >&2
	echo "Refusing to run backup with an empty, too-short, or commonly used database password." >&2
	echo "Please set DATABASE_PASSWORD to a stronger password (at least 8 characters, not a common or trivial value) and rerun this script." >&2

[Copilot]

Default password 'roamdev' is weak and should not be used in production. The file comment on lines 4-6 mentions requiring POSTGRES_PASSWORD, but the default undermines this. Consider removing the default or making it intentionally invalid (e.g., 'CHANGE_ME_OR_FAIL') to force explicit configuration.

Suggested change

	POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:-roamdev}
	POSTGRES_PASSWORD: ${POSTGRES_PASSWORD:?POSTGRES_PASSWORD environment variable must be set}

[dmccoystephenson]

@copilot address comments

[Copilot]

@dmccoystephenson I've opened a new pull request, #303, to work on those changes. Once the pull request is ready, I'll request review from you.

[dmccoystephenson]

@copilot I am no longer able to move. My player switches directions visibly but there is no movement. I have full energy. Also, the server tick is stuck at 0

[Copilot]

@dmccoystephenson I've opened a new pull request, #304, to work on those changes. Once the pull request is ready, I'll request review from you.

[dmccoystephenson]

@copilot After placing bear meat I ran into the following:

2026-02-01 16:12:59,233 - screen.serverBackedWorldScreen - WARNING - Unknown entity type encountered: 'BearMeat' (name: 'Bear Meat'). Using colored square fallback. Consider adding sprite mapping.

Resolve and check for other issues related to entity rendering

[Copilot]

@dmccoystephenson I've opened a new pull request, #305, to work on those changes. Once the pull request is ready, I'll request review from you.

[dmccoystephenson]

@copilot grass should be an entity that the player can pick up, not a tile type

[Copilot]

@dmccoystephenson I've opened a new pull request, #306, to work on those changes. Once the pull request is ready, I'll request review from you.