@chrrxs/robloxstudio-mcp-inspector 2.19.1 → 2.21.0

package/dist/index.js

@@ -196,6 +196,9 @@ var init_bridge_service = __esm({
         }
         return removed;
       }
+      async unregisterInstanceIdEverywhere(instanceId) {
+        return this.unregisterInstanceId(instanceId);
+      }
       getInstances() {
         return Array.from(this.instances.values());
       }
@@ -451,29 +454,256 @@ var init_bridge_service = __esm({
   }
 });
 
+// ../core/dist/roblox-docs.js
+function isDocCategory(value) {
+  return DOC_CATEGORIES.includes(value);
+}
+function cacheGet(key) {
+  const entry = cache.get(key);
+  if (!entry)
+    return void 0;
+  const ttl = entry.notFound ? NEGATIVE_CACHE_TTL_MS : CACHE_TTL_MS;
+  if (Date.now() - entry.fetchedAt > ttl) {
+    cache.delete(key);
+    return void 0;
+  }
+  return entry;
+}
+function cacheSet(key, entry) {
+  if (cache.size >= MAX_CACHE_ENTRIES) {
+    const oldest = cache.keys().next().value;
+    if (oldest !== void 0)
+      cache.delete(oldest);
+  }
+  cache.set(key, entry);
+}
+function docUrl(category, name) {
+  return `${DOCS_BASE_URL}/${category}/${encodeURIComponent(name)}.md`;
+}
+async function fetchRobloxDoc(category, name) {
+  const key = `${category}/${name}`;
+  const cached = cacheGet(key);
+  if (cached) {
+    if (cached.notFound)
+      throw new DocNotFoundError(category, name);
+    return cached.content;
+  }
+  const controller = new AbortController();
+  const timer = setTimeout(() => controller.abort(), FETCH_TIMEOUT_MS);
+  let response;
+  try {
+    response = await fetch(docUrl(category, name), {
+      signal: controller.signal,
+      headers: { Accept: "text/markdown, text/plain" }
+    });
+  } catch (error) {
+    throw new Error(`Failed to fetch Roblox docs for ${key}: ${error instanceof Error ? error.message : String(error)}`);
+  } finally {
+    clearTimeout(timer);
+  }
+  if (response.status === 404) {
+    cacheSet(key, { fetchedAt: Date.now(), notFound: true });
+    throw new DocNotFoundError(category, name);
+  }
+  if (!response.ok) {
+    throw new Error(`Failed to fetch Roblox docs for ${key}: HTTP ${response.status}`);
+  }
+  const content = await response.text();
+  cacheSet(key, { fetchedAt: Date.now(), content });
+  return content;
+}
+function listSections(markdown) {
+  const sections = [];
+  for (const line of markdown.split("\n")) {
+    const match = line.match(/^##\s+(.+?)\s*$/);
+    if (match)
+      sections.push(match[1]);
+  }
+  return sections;
+}
+function extractSection(markdown, section) {
+  const lines = markdown.split("\n");
+  const wanted = section.trim().toLowerCase();
+  let start = -1;
+  for (let i = 0; i < lines.length; i++) {
+    const match = lines[i].match(/^##\s+(.+?)\s*$/);
+    if (match && match[1].toLowerCase() === wanted) {
+      start = i;
+      break;
+    }
+  }
+  if (start === -1)
+    return void 0;
+  let end = lines.length;
+  for (let i = start + 1; i < lines.length; i++) {
+    if (/^##?\s+/.test(lines[i])) {
+      end = i;
+      break;
+    }
+  }
+  return lines.slice(start, end).join("\n").trimEnd();
+}
+async function getRobloxDoc(category, name, section) {
+  const markdown = await fetchRobloxDoc(category, name);
+  const sections = listSections(markdown);
+  if (section) {
+    const extracted = extractSection(markdown, section);
+    if (extracted === void 0) {
+      throw new Error(`Section "${section}" not found in ${category}/${name}. Available sections: ${sections.join(", ") || "(none)"}`);
+    }
+    return { content: extracted, truncated: false, sections };
+  }
+  if (markdown.length > MAX_DOC_CHARS) {
+    const head = markdown.slice(0, MAX_DOC_CHARS);
+    const note = `
+
+---
+[Truncated at ${MAX_DOC_CHARS} of ${markdown.length} characters. Re-request with the "section" parameter to read one section in full. Available sections: ${sections.join(", ")}]`;
+    return { content: head + note, truncated: true, sections };
+  }
+  return { content: markdown, truncated: false, sections };
+}
+var DOC_CATEGORIES, DOCS_BASE_URL, FETCH_TIMEOUT_MS, CACHE_TTL_MS, NEGATIVE_CACHE_TTL_MS, MAX_CACHE_ENTRIES, MAX_DOC_CHARS, cache, DocNotFoundError;
+var init_roblox_docs = __esm({
+  "../core/dist/roblox-docs.js"() {
+    "use strict";
+    DOC_CATEGORIES = ["classes", "enums", "datatypes", "libraries", "globals"];
+    DOCS_BASE_URL = "https://create.roblox.com/docs/reference/engine";
+    FETCH_TIMEOUT_MS = 15e3;
+    CACHE_TTL_MS = 24 * 60 * 60 * 1e3;
+    NEGATIVE_CACHE_TTL_MS = 5 * 60 * 1e3;
+    MAX_CACHE_ENTRIES = 200;
+    MAX_DOC_CHARS = 5e4;
+    cache = /* @__PURE__ */ new Map();
+    DocNotFoundError = class extends Error {
+      constructor(category, name) {
+        super(`No Roblox documentation found for ${category}/${name}. Names are case-sensitive PascalCase (e.g. "ProximityPrompt", "TweenService"). Valid categories: ${DOC_CATEGORIES.join(", ")}.`);
+        this.name = "DocNotFoundError";
+      }
+    };
+  }
+});
+
 // ../core/dist/mcp-compat.js
 import { ErrorCode, ListResourceTemplatesRequestSchema, ListResourcesRequestSchema, McpError, ReadResourceRequestSchema } from "@modelcontextprotocol/sdk/types.js";
-function registerEmptyResourceShim(server) {
+function registerResourceHandlers(server) {
   server.registerCapabilities({ resources: {} });
   server.setRequestHandler(ListResourcesRequestSchema, async () => ({
     resources: []
   }));
   server.setRequestHandler(ListResourceTemplatesRequestSchema, async () => ({
-    resourceTemplates: []
+    resourceTemplates: [
+      {
+        uriTemplate: "robloxdocs://classes/{className}",
+        name: "Roblox class documentation",
+        description: "Official engine reference for a class (e.g. robloxdocs://classes/ProximityPrompt) \u2014 properties, methods, events, and usage guidance as markdown.",
+        mimeType: "text/markdown"
+      },
+      {
+        uriTemplate: "robloxdocs://enums/{enumName}",
+        name: "Roblox enum documentation",
+        description: "Official engine reference for an enum (e.g. robloxdocs://enums/KeyCode).",
+        mimeType: "text/markdown"
+      },
+      {
+        uriTemplate: "robloxdocs://datatypes/{dataTypeName}",
+        name: "Roblox datatype documentation",
+        description: "Official engine reference for a datatype (e.g. robloxdocs://datatypes/CFrame).",
+        mimeType: "text/markdown"
+      },
+      {
+        uriTemplate: "robloxdocs://libraries/{libraryName}",
+        name: "Roblox library documentation",
+        description: "Official engine reference for a Luau library (e.g. robloxdocs://libraries/table).",
+        mimeType: "text/markdown"
+      },
+      {
+        uriTemplate: "robloxdocs://globals/{globalsPage}",
+        name: "Roblox globals documentation",
+        description: "Official engine reference for global functions and variables (e.g. robloxdocs://globals/LuaGlobals, robloxdocs://globals/RobloxGlobals).",
+        mimeType: "text/markdown"
+      }
+    ]
   }));
   server.setRequestHandler(ReadResourceRequestSchema, async (request) => {
-    throw new McpError(ErrorCode.InvalidParams, `Resource ${request.params.uri} not found`);
+    const uri = request.params.uri;
+    const match = uri.match(/^robloxdocs:\/\/([^/]+)\/([^/]+)$/);
+    if (!match || !isDocCategory(match[1])) {
+      throw new McpError(ErrorCode.InvalidParams, `Resource ${uri} not found`);
+    }
+    const [, category, rawName] = match;
+    const name = decodeURIComponent(rawName);
+    try {
+      const content = await fetchRobloxDoc(category, name);
+      return {
+        contents: [{ uri, mimeType: "text/markdown", text: content }]
+      };
+    } catch (error) {
+      if (error instanceof DocNotFoundError) {
+        throw new McpError(ErrorCode.InvalidParams, `Resource ${uri} not found. Names are case-sensitive PascalCase; valid categories: ${DOC_CATEGORIES.join(", ")}.`);
+      }
+      throw new McpError(ErrorCode.InternalError, `Failed to read ${uri}: ${error instanceof Error ? error.message : String(error)}`);
+    }
   });
 }
 var init_mcp_compat = __esm({
   "../core/dist/mcp-compat.js"() {
     "use strict";
+    init_roblox_docs();
+  }
+});
+
+// ../core/dist/auth.js
+import { randomBytes, createHash, timingSafeEqual } from "crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";
+import { join, dirname } from "path";
+import { homedir } from "os";
+function authTokenFilePath() {
+  return join(homedir(), ".robloxstudio-mcp", "auth-token");
+}
+function resolveAuthToken() {
+  const noAuth = (process.env.ROBLOX_STUDIO_NO_AUTH || "").toLowerCase();
+  if (noAuth === "1" || noAuth === "true") {
+    return { source: "disabled" };
+  }
+  const envToken = process.env.ROBLOX_STUDIO_AUTH_TOKEN?.trim();
+  if (envToken) {
+    return { token: envToken, source: "env" };
+  }
+  const filePath = authTokenFilePath();
+  try {
+    if (existsSync(filePath)) {
+      const existing = readFileSync(filePath, "utf8").trim();
+      if (existing) {
+        return { token: existing, source: "file", filePath };
+      }
+    }
+    const fresh = randomBytes(32).toString("hex");
+    mkdirSync(dirname(filePath), { recursive: true, mode: 448 });
+    writeFileSync(filePath, fresh + "\n", { encoding: "utf8", mode: 384 });
+    try {
+      chmodSync(filePath, 384);
+    } catch {
+    }
+    return { token: fresh, source: "file", filePath };
+  } catch (err) {
+    console.error(`[auth] Could not read/create ${filePath} (${err instanceof Error ? err.message : err}). Using an in-memory token for this process; set ROBLOX_STUDIO_AUTH_TOKEN to share one across sessions.`);
+    return { token: randomBytes(32).toString("hex"), source: "file" };
+  }
+}
+function tokensMatch(provided, expected) {
+  const a = createHash("sha256").update(provided).digest();
+  const b = createHash("sha256").update(expected).digest();
+  return timingSafeEqual(a, b);
+}
+var init_auth = __esm({
+  "../core/dist/auth.js"() {
+    "use strict";
   }
 });
 
 // ../core/dist/http-server.js
 import express from "express";
-import cors from "cors";
 import http from "http";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -526,7 +756,7 @@ function requiredClosedLineRange(body, toolName) {
   }
   return { startLine: parsed.startLine, endLine: parsed.endLine };
 }
-function createHttpServer(tools, bridge, allowedTools, serverConfig) {
+function createHttpServer(tools, bridge, allowedTools, serverConfig, security) {
   const app = express();
   let mcpServerActive = false;
   let lastMCPActivity = 0;
@@ -556,7 +786,49 @@ function createHttpServer(tools, bridge, allowedTools, serverConfig) {
   const isPluginConnected = () => {
     return bridge.getInstances().length > 0;
   };
-  app.use(cors());
+  const allowedOrigins = new Set(security?.allowedOrigins ?? []);
+  app.use((req, res, next) => {
+    const origin = req.headers.origin;
+    if (typeof origin !== "string" || origin === "") {
+      next();
+      return;
+    }
+    if (!allowedOrigins.has(origin)) {
+      res.status(403).json({
+        error: "forbidden_origin",
+        message: `Cross-origin requests are not allowed from ${origin}. Set ROBLOX_STUDIO_ALLOWED_ORIGINS to allowlist specific origins.`
+      });
+      return;
+    }
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-MCP-Auth, Mcp-Protocol-Version");
+    if (req.method === "OPTIONS") {
+      res.status(204).end();
+      return;
+    }
+    next();
+  });
+  const authToken = security?.authToken;
+  const authRequired = (path5) => path5 === "/mcp" || path5.startsWith("/mcp/") || path5 === "/proxy" || path5 === "/instances" || path5 === "/unregister-instance-id";
+  app.use((req, res, next) => {
+    if (!authToken || !authRequired(req.path)) {
+      next();
+      return;
+    }
+    const headerToken = req.headers["x-mcp-auth"];
+    const bearer = typeof req.headers.authorization === "string" && req.headers.authorization.startsWith("Bearer ") ? req.headers.authorization.slice("Bearer ".length) : void 0;
+    const provided = typeof headerToken === "string" && headerToken !== "" ? headerToken : bearer;
+    if (provided !== void 0 && tokensMatch(provided, authToken)) {
+      next();
+      return;
+    }
+    res.status(401).json({
+      error: "unauthorized",
+      message: 'Missing or invalid auth token. Send it as "X-MCP-Auth: <token>" or "Authorization: Bearer <token>". ' + (security?.authTokenHint ?? "The token is in ~/.robloxstudio-mcp/auth-token (or ROBLOX_STUDIO_AUTH_TOKEN).")
+    });
+  });
   app.use(express.json({ limit: "50mb" }));
   app.use(express.urlencoded({ limit: "50mb", extended: true }));
   app.get("/health", (req, res) => {
@@ -658,6 +930,15 @@ function createHttpServer(tools, bridge, allowedTools, serverConfig) {
     }
     res.json({ success: true });
   });
+  app.post("/unregister-instance-id", (req, res) => {
+    const { instanceId } = req.body;
+    if (typeof instanceId !== "string" || instanceId.length === 0) {
+      res.status(400).json({ error: "instanceId is required" });
+      return;
+    }
+    const removed = bridge.unregisterInstanceId(instanceId);
+    res.json({ success: true, removed });
+  });
   app.get("/status", (req, res) => {
     const instances = bridge.getInstances();
     const publicInstances = instances.map(toPublic);
@@ -775,7 +1056,7 @@ function createHttpServer(tools, bridge, allowedTools, serverConfig) {
       try {
         trackMCPActivity();
         const server = new Server({ name: serverConfig.name, version: serverConfig.version }, { capabilities: { tools: {} } });
-        registerEmptyResourceShim(server);
+        registerResourceHandlers(server);
         server.setRequestHandler(ListToolsRequestSchema, async () => ({
           tools: filteredTools.map((t) => ({
             name: t.name,
@@ -917,7 +1198,9 @@ var init_http_server = __esm({
     "use strict";
     init_bridge_service();
     init_mcp_compat();
+    init_auth();
     TOOL_HANDLERS = {
+      get_roblox_docs: (tools, body) => tools.getRobloxDocs(body.name, body.doc_type, body.section),
       get_file_tree: (tools, body) => tools.getFileTree(body.path, body.instance_id),
       search_files: (tools, body) => tools.searchFiles(body.query, body.searchType, body.instance_id),
       get_place_info: (tools, body) => tools.getPlaceInfo(body.instance_id),
@@ -1083,8 +1366,844 @@ var init_studio_client = __esm({
   }
 });
 
+// ../core/dist/tools/build-interpreter.js
+import * as acorn from "acorn";
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object")
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function runRestrictedScript(code, globals, options) {
+  const timeoutMs = options?.timeoutMs ?? 1e4;
+  const maxOps = options?.maxOps ?? 2e7;
+  const deadline = Date.now() + timeoutMs;
+  let ops = 0;
+  let ast;
+  try {
+    ast = acorn.parse(code, { ecmaVersion: 2022, sourceType: "script" });
+  } catch (err) {
+    throw new Error(`Syntax error: ${err.message}`);
+  }
+  const globalScope = new Scope(void 0, true);
+  for (const [name, value] of Object.entries(globals)) {
+    globalScope.declare(name, value, "const");
+  }
+  function tick() {
+    ops++;
+    if (ops > maxOps) {
+      throw new ScriptTimeoutError(`Operation budget exceeded (${maxOps} ops)`);
+    }
+    if ((ops & 8191) === 0 && Date.now() > deadline) {
+      throw new ScriptTimeoutError(`Execution timed out after ${timeoutMs}ms`);
+    }
+  }
+  function assertPropAllowed(prop) {
+    const name = typeof prop === "symbol" ? String(prop) : String(prop);
+    if (FORBIDDEN_PROPS.has(name)) {
+      throw new Error(`Access to property "${name}" is not allowed`);
+    }
+    return name;
+  }
+  function getMember(obj, prop) {
+    if (obj === null || obj === void 0) {
+      throw new Error(`Cannot read property "${String(prop)}" of ${obj}`);
+    }
+    const name = assertPropAllowed(prop);
+    if (Array.isArray(obj)) {
+      if (name === "length")
+        return obj.length;
+      const idx = Number(name);
+      if (Number.isInteger(idx) && idx >= 0)
+        return obj[idx];
+      if (ARRAY_MEMBERS.has(name))
+        return obj[name];
+      throw new Error(`Array method "${name}" is not allowed`);
+    }
+    if (typeof obj === "string") {
+      if (name === "length")
+        return obj.length;
+      const idx = Number(name);
+      if (Number.isInteger(idx) && idx >= 0)
+        return obj[idx];
+      if (STRING_MEMBERS.has(name))
+        return obj[name];
+      throw new Error(`String method "${name}" is not allowed`);
+    }
+    if (typeof obj === "number") {
+      if (NUMBER_MEMBERS.has(name))
+        return obj[name];
+      throw new Error(`Number method "${name}" is not allowed`);
+    }
+    if (isPlainObject(obj)) {
+      if (Object.prototype.hasOwnProperty.call(obj, name))
+        return obj[name];
+      return void 0;
+    }
+    throw new Error(`Property access on this value type is not allowed`);
+  }
+  function setMember(obj, prop, value) {
+    if (obj === null || obj === void 0) {
+      throw new Error(`Cannot set property "${String(prop)}" of ${obj}`);
+    }
+    const name = assertPropAllowed(prop);
+    if (Object.isFrozen(obj)) {
+      throw new Error(`Cannot assign to property "${name}" of a frozen object`);
+    }
+    if (Array.isArray(obj)) {
+      const idx = Number(name);
+      if (Number.isInteger(idx) && idx >= 0 || name === "length") {
+        obj[name] = value;
+        return;
+      }
+      throw new Error(`Cannot set property "${name}" on an array`);
+    }
+    if (isPlainObject(obj)) {
+      obj[name] = value;
+      return;
+    }
+    throw new Error(`Property assignment on this value type is not allowed`);
+  }
+  function callFunction(fn, thisArg, args, desc) {
+    if (typeof fn !== "function") {
+      throw new Error(`${desc} is not a function`);
+    }
+    return fn.apply(thisArg, args);
+  }
+  function bindPattern(pattern, value, scope, kind) {
+    switch (pattern.type) {
+      case "Identifier":
+        scope.declare(pattern.name, value, kind);
+        return;
+      case "AssignmentPattern":
+        bindPattern(pattern.left, value === void 0 ? evaluate(pattern.right, scope) : value, scope, kind);
+        return;
+      case "ArrayPattern": {
+        if (value === null || value === void 0)
+          throw new Error("Cannot destructure null/undefined");
+        let i = 0;
+        for (const el of pattern.elements) {
+          if (el === null) {
+            i++;
+            continue;
+          }
+          if (el.type === "RestElement") {
+            bindPattern(el.argument, Array.isArray(value) ? value.slice(i) : [], scope, kind);
+            break;
+          }
+          bindPattern(el, getMember(value, i), scope, kind);
+          i++;
+        }
+        return;
+      }
+      case "ObjectPattern": {
+        if (value === null || value === void 0)
+          throw new Error("Cannot destructure null/undefined");
+        const used = /* @__PURE__ */ new Set();
+        for (const propNode of pattern.properties) {
+          if (propNode.type === "RestElement") {
+            const rest = {};
+            if (isPlainObject(value)) {
+              for (const k of Object.keys(value)) {
+                if (!used.has(k) && !FORBIDDEN_PROPS.has(k))
+                  rest[k] = value[k];
+              }
+            }
+            bindPattern(propNode.argument, rest, scope, kind);
+            continue;
+          }
+          const key = propNode.computed ? String(evaluate(propNode.key, scope)) : propNode.key.type === "Identifier" ? propNode.key.name : String(propNode.key.value);
+          used.add(key);
+          bindPattern(propNode.value, getMember(value, key), scope, kind);
+        }
+        return;
+      }
+      default:
+        throw new Error(`Unsupported binding pattern: ${pattern.type}`);
+    }
+  }
+  function makeFunction(node, closureScope) {
+    return (...args) => {
+      tick();
+      const fnScope = new Scope(closureScope, true);
+      node.params.forEach((param, i) => {
+        if (param.type === "RestElement") {
+          bindPattern(param.argument, args.slice(i), fnScope, "let");
+        } else {
+          bindPattern(param, args[i], fnScope, "let");
+        }
+      });
+      try {
+        if (node.body.type === "BlockStatement") {
+          executeBlock(node.body.body, new Scope(fnScope));
+          return void 0;
+        }
+        return evaluate(node.body, fnScope);
+      } catch (signal) {
+        if (signal instanceof ReturnSignal)
+          return signal.value;
+        throw signal;
+      }
+    };
+  }
+  function hoistFunctions(statements, scope) {
+    for (const stmt of statements) {
+      if (stmt.type === "FunctionDeclaration" && stmt.id) {
+        if (stmt.async || stmt.generator)
+          throw new Error("async/generator functions are not supported");
+        scope.declare(stmt.id.name, makeFunction(stmt, scope), "let");
+      }
+    }
+  }
+  function executeBlock(statements, scope) {
+    hoistFunctions(statements, scope);
+    for (const stmt of statements) {
+      execute(stmt, scope);
+    }
+  }
+  function execute(node, scope) {
+    tick();
+    switch (node.type) {
+      case "ExpressionStatement":
+        evaluate(node.expression, scope);
+        return;
+      case "VariableDeclaration":
+        for (const decl of node.declarations) {
+          const value = decl.init ? evaluate(decl.init, scope) : void 0;
+          bindPattern(decl.id, value, scope, node.kind);
+        }
+        return;
+      case "FunctionDeclaration":
+        return;
+      // hoisted by executeBlock
+      case "BlockStatement":
+        executeBlock(node.body, new Scope(scope));
+        return;
+      case "EmptyStatement":
+        return;
+      case "IfStatement":
+        if (evaluate(node.test, scope)) {
+          execute(node.consequent, scope);
+        } else if (node.alternate) {
+          execute(node.alternate, scope);
+        }
+        return;
+      case "ForStatement": {
+        const forScope = new Scope(scope);
+        if (node.init) {
+          if (node.init.type === "VariableDeclaration")
+            execute(node.init, forScope);
+          else
+            evaluate(node.init, forScope);
+        }
+        while (node.test === null || evaluate(node.test, forScope)) {
+          tick();
+          try {
+            execute(node.body, new Scope(forScope));
+          } catch (signal) {
+            if (signal instanceof BreakSignal)
+              break;
+            if (!(signal instanceof ContinueSignal))
+              throw signal;
+          }
+          if (node.update)
+            evaluate(node.update, forScope);
+        }
+        return;
+      }
+      case "ForOfStatement": {
+        const iterable = evaluate(node.right, scope);
+        if (!Array.isArray(iterable) && typeof iterable !== "string") {
+          throw new Error("for...of only supports arrays and strings");
+        }
+        for (const item of iterable) {
+          tick();
+          const iterScope = new Scope(scope);
+          if (node.left.type === "VariableDeclaration") {
+            bindPattern(node.left.declarations[0].id, item, iterScope, node.left.kind);
+          } else {
+            assignTo(node.left, item, iterScope);
+          }
+          try {
+            execute(node.body, iterScope);
+          } catch (signal) {
+            if (signal instanceof BreakSignal)
+              break;
+            if (!(signal instanceof ContinueSignal))
+              throw signal;
+          }
+        }
+        return;
+      }
+      case "ForInStatement": {
+        const obj = evaluate(node.right, scope);
+        const keys = isPlainObject(obj) ? Object.keys(obj) : Array.isArray(obj) ? obj.map((_, i) => String(i)) : [];
+        for (const key of keys) {
+          tick();
+          const iterScope = new Scope(scope);
+          if (node.left.type === "VariableDeclaration") {
+            bindPattern(node.left.declarations[0].id, key, iterScope, node.left.kind);
+          } else {
+            assignTo(node.left, key, iterScope);
+          }
+          try {
+            execute(node.body, iterScope);
+          } catch (signal) {
+            if (signal instanceof BreakSignal)
+              break;
+            if (!(signal instanceof ContinueSignal))
+              throw signal;
+          }
+        }
+        return;
+      }
+      case "WhileStatement":
+        while (evaluate(node.test, scope)) {
+          tick();
+          try {
+            execute(node.body, new Scope(scope));
+          } catch (signal) {
+            if (signal instanceof BreakSignal)
+              break;
+            if (!(signal instanceof ContinueSignal))
+              throw signal;
+          }
+        }
+        return;
+      case "DoWhileStatement":
+        do {
+          tick();
+          try {
+            execute(node.body, new Scope(scope));
+          } catch (signal) {
+            if (signal instanceof BreakSignal)
+              break;
+            if (!(signal instanceof ContinueSignal))
+              throw signal;
+          }
+        } while (evaluate(node.test, scope));
+        return;
+      case "BreakStatement":
+        throw new BreakSignal(node.label?.name);
+      case "ContinueStatement":
+        throw new ContinueSignal(node.label?.name);
+      case "ReturnStatement":
+        throw new ReturnSignal(node.argument ? evaluate(node.argument, scope) : void 0);
+      case "ThrowStatement":
+        throw evaluate(node.argument, scope);
+      case "TryStatement": {
+        try {
+          execute(node.block, scope);
+        } catch (err) {
+          if (err instanceof BreakSignal || err instanceof ContinueSignal || err instanceof ReturnSignal)
+            throw err;
+          if (err instanceof ScriptTimeoutError)
+            throw err;
+          if (node.handler) {
+            const catchScope = new Scope(scope);
+            if (node.handler.param) {
+              const message = err instanceof Error ? { message: err.message } : err;
+              bindPattern(node.handler.param, message, catchScope, "let");
+            }
+            execute(node.handler.body, catchScope);
+          }
+        } finally {
+          if (node.finalizer)
+            execute(node.finalizer, scope);
+        }
+        return;
+      }
+      case "SwitchStatement": {
+        const disc = evaluate(node.discriminant, scope);
+        const switchScope = new Scope(scope);
+        let matched = false;
+        try {
+          for (const caseNode of node.cases) {
+            if (!matched) {
+              if (caseNode.test === null)
+                matched = true;
+              else if (evaluate(caseNode.test, switchScope) === disc)
+                matched = true;
+            }
+            if (matched) {
+              for (const stmt of caseNode.consequent)
+                execute(stmt, switchScope);
+            }
+          }
+        } catch (signal) {
+          if (!(signal instanceof BreakSignal))
+            throw signal;
+        }
+        return;
+      }
+      case "LabeledStatement":
+        try {
+          execute(node.body, scope);
+        } catch (signal) {
+          if (signal instanceof BreakSignal && signal.label === node.label.name)
+            return;
+          throw signal;
+        }
+        return;
+      default:
+        throw new Error(`Unsupported statement: ${node.type}`);
+    }
+  }
+  function assignTo(target, value, scope) {
+    if (target.type === "Identifier") {
+      scope.set(target.name, value);
+    } else if (target.type === "MemberExpression") {
+      const obj = evaluate(target.object, scope);
+      const prop = target.computed ? evaluate(target.property, scope) : target.property.name;
+      setMember(obj, prop, value);
+    } else {
+      throw new Error(`Unsupported assignment target: ${target.type}`);
+    }
+  }
+  function evaluate(node, scope) {
+    tick();
+    switch (node.type) {
+      case "Literal":
+        if (node.regex)
+          throw new Error("Regular expression literals are not supported");
+        return node.value;
+      case "TemplateLiteral": {
+        let out = "";
+        node.quasis.forEach((quasi, i) => {
+          out += quasi.value.cooked ?? "";
+          if (i < node.expressions.length)
+            out += String(evaluate(node.expressions[i], scope));
+        });
+        return out;
+      }
+      case "Identifier":
+        return scope.get(node.name);
+      case "ArrayExpression": {
+        const arr = [];
+        for (const el of node.elements) {
+          if (el === null) {
+            arr.length++;
+            continue;
+          }
+          if (el.type === "SpreadElement") {
+            const spread = evaluate(el.argument, scope);
+            if (!Array.isArray(spread) && typeof spread !== "string") {
+              throw new Error("Spread only supports arrays and strings");
+            }
+            for (const item of spread)
+              arr.push(item);
+          } else {
+            arr.push(evaluate(el, scope));
+          }
+        }
+        return arr;
+      }
+      case "ObjectExpression": {
+        const obj = {};
+        for (const prop of node.properties) {
+          if (prop.type === "SpreadElement") {
+            const spread = evaluate(prop.argument, scope);
+            if (isPlainObject(spread)) {
+              for (const k of Object.keys(spread)) {
+                if (!FORBIDDEN_PROPS.has(k))
+                  obj[k] = spread[k];
+              }
+            }
+            continue;
+          }
+          if (prop.kind !== "init")
+            throw new Error("Getters/setters are not supported");
+          const key = prop.computed ? String(evaluate(prop.key, scope)) : prop.key.type === "Identifier" ? prop.key.name : String(prop.key.value);
+          assertPropAllowed(key);
+          obj[key] = evaluate(prop.value, scope);
+        }
+        return obj;
+      }
+      case "ArrowFunctionExpression":
+      case "FunctionExpression":
+        if (node.async || node.generator)
+          throw new Error("async/generator functions are not supported");
+        return makeFunction(node, scope);
+      case "UnaryExpression": {
+        if (node.operator === "typeof" && node.argument.type === "Identifier" && !scope.has(node.argument.name)) {
+          return "undefined";
+        }
+        if (node.operator === "delete") {
+          if (node.argument.type !== "MemberExpression")
+            return true;
+          const obj = evaluate(node.argument.object, scope);
+          const prop = node.argument.computed ? evaluate(node.argument.property, scope) : node.argument.property.name;
+          const name = assertPropAllowed(prop);
+          if (isPlainObject(obj) && !Object.isFrozen(obj)) {
+            delete obj[name];
+            return true;
+          }
+          throw new Error("delete is only allowed on plain objects");
+        }
+        const arg = evaluate(node.argument, scope);
+        switch (node.operator) {
+          case "-":
+            return -arg;
+          case "+":
+            return +arg;
+          case "!":
+            return !arg;
+          case "~":
+            return ~arg;
+          case "typeof":
+            return typeof arg;
+          case "void":
+            return void 0;
+          default:
+            throw new Error(`Unsupported unary operator: ${node.operator}`);
+        }
+      }
+      case "UpdateExpression": {
+        const old = node.argument.type === "Identifier" ? scope.get(node.argument.name) : getMember(evaluate(node.argument.object, scope), node.argument.computed ? evaluate(node.argument.property, scope) : node.argument.property.name);
+        const next = node.operator === "++" ? old + 1 : old - 1;
+        assignTo(node.argument, next, scope);
+        return node.prefix ? next : old;
+      }
+      case "BinaryExpression": {
+        if (node.operator === "in") {
+          const key = assertPropAllowed(evaluate(node.left, scope));
+          const obj = evaluate(node.right, scope);
+          if (isPlainObject(obj))
+            return Object.prototype.hasOwnProperty.call(obj, key);
+          if (Array.isArray(obj))
+            return Number(key) >= 0 && Number(key) < obj.length;
+          throw new Error('"in" is only supported on plain objects and arrays');
+        }
+        if (node.operator === "instanceof")
+          throw new Error("instanceof is not supported");
+        const l = evaluate(node.left, scope);
+        const r = evaluate(node.right, scope);
+        switch (node.operator) {
+          case "+":
+            return l + r;
+          case "-":
+            return l - r;
+          case "*":
+            return l * r;
+          case "/":
+            return l / r;
+          case "%":
+            return l % r;
+          case "**":
+            return l ** r;
+          case "==":
+            return l == r;
+          // eslint-disable-line eqeqeq
+          case "!=":
+            return l != r;
+          // eslint-disable-line eqeqeq
+          case "===":
+            return l === r;
+          case "!==":
+            return l !== r;
+          case "<":
+            return l < r;
+          case "<=":
+            return l <= r;
+          case ">":
+            return l > r;
+          case ">=":
+            return l >= r;
+          case "&":
+            return l & r;
+          case "|":
+            return l | r;
+          case "^":
+            return l ^ r;
+          case "<<":
+            return l << r;
+          case ">>":
+            return l >> r;
+          case ">>>":
+            return l >>> r;
+          default:
+            throw new Error(`Unsupported binary operator: ${node.operator}`);
+        }
+      }
+      case "LogicalExpression": {
+        const l = evaluate(node.left, scope);
+        if (node.operator === "&&")
+          return l ? evaluate(node.right, scope) : l;
+        if (node.operator === "||")
+          return l ? l : evaluate(node.right, scope);
+        if (node.operator === "??")
+          return l ?? evaluate(node.right, scope);
+        throw new Error(`Unsupported logical operator: ${node.operator}`);
+      }
+      case "AssignmentExpression": {
+        let value;
+        if (node.operator === "=") {
+          value = evaluate(node.right, scope);
+        } else {
+          const current = node.left.type === "Identifier" ? scope.get(node.left.name) : getMember(evaluate(node.left.object, scope), node.left.computed ? evaluate(node.left.property, scope) : node.left.property.name);
+          const rhs = () => evaluate(node.right, scope);
+          switch (node.operator) {
+            case "+=":
+              value = current + rhs();
+              break;
+            case "-=":
+              value = current - rhs();
+              break;
+            case "*=":
+              value = current * rhs();
+              break;
+            case "/=":
+              value = current / rhs();
+              break;
+            case "%=":
+              value = current % rhs();
+              break;
+            case "**=":
+              value = current ** rhs();
+              break;
+            case "&=":
+              value = current & rhs();
+              break;
+            case "|=":
+              value = current | rhs();
+              break;
+            case "^=":
+              value = current ^ rhs();
+              break;
+            case "<<=":
+              value = current << rhs();
+              break;
+            case ">>=":
+              value = current >> rhs();
+              break;
+            case ">>>=":
+              value = current >>> rhs();
+              break;
+            case "&&=":
+              value = current ? rhs() : current;
+              break;
+            case "||=":
+              value = current ? current : rhs();
+              break;
+            case "??=":
+              value = current ?? rhs();
+              break;
+            default:
+              throw new Error(`Unsupported assignment operator: ${node.operator}`);
+          }
+        }
+        assignTo(node.left, value, scope);
+        return value;
+      }
+      case "ConditionalExpression":
+        return evaluate(node.test, scope) ? evaluate(node.consequent, scope) : evaluate(node.alternate, scope);
+      case "CallExpression": {
+        const args = [];
+        for (const argNode of node.arguments) {
+          if (argNode.type === "SpreadElement") {
+            const spread = evaluate(argNode.argument, scope);
+            if (!Array.isArray(spread) && typeof spread !== "string") {
+              throw new Error("Spread only supports arrays and strings");
+            }
+            for (const item of spread)
+              args.push(item);
+          } else {
+            args.push(evaluate(argNode, scope));
+          }
+        }
+        if (node.callee.type === "MemberExpression") {
+          const obj = evaluate(node.callee.object, scope);
+          if (node.optional && (obj === null || obj === void 0))
+            return void 0;
+          const prop = node.callee.computed ? evaluate(node.callee.property, scope) : node.callee.property.name;
+          const method = getMember(obj, prop);
+          if (node.callee.optional && (method === null || method === void 0))
+            return void 0;
+          return callFunction(method, obj, args, `${String(prop)}`);
+        }
+        const fn = evaluate(node.callee, scope);
+        if (node.optional && (fn === null || fn === void 0))
+          return void 0;
+        const desc = node.callee.type === "Identifier" ? node.callee.name : "expression";
+        return callFunction(fn, void 0, args, desc);
+      }
+      case "MemberExpression": {
+        const obj = evaluate(node.object, scope);
+        if (node.optional && (obj === null || obj === void 0))
+          return void 0;
+        const prop = node.computed ? evaluate(node.property, scope) : node.property.name;
+        return getMember(obj, prop);
+      }
+      case "ChainExpression":
+        return evaluate(node.expression, scope);
+      case "SequenceExpression": {
+        let result;
+        for (const expr of node.expressions)
+          result = evaluate(expr, scope);
+        return result;
+      }
+      case "NewExpression":
+        throw new Error('"new" is not supported in build code');
+      case "ThisExpression":
+        throw new Error('"this" is not supported in build code');
+      case "AwaitExpression":
+        throw new Error("await is not supported in build code");
+      case "TaggedTemplateExpression":
+        throw new Error("Tagged templates are not supported in build code");
+      default:
+        throw new Error(`Unsupported expression: ${node.type}`);
+    }
+  }
+  executeBlock(ast.body, globalScope);
+}
+var ScriptTimeoutError, BreakSignal, ContinueSignal, ReturnSignal, FORBIDDEN_PROPS, ARRAY_MEMBERS, STRING_MEMBERS, NUMBER_MEMBERS, Scope;
+var init_build_interpreter = __esm({
+  "../core/dist/tools/build-interpreter.js"() {
+    "use strict";
+    ScriptTimeoutError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "ScriptTimeoutError";
+      }
+    };
+    BreakSignal = class {
+      label;
+      constructor(label) {
+        this.label = label;
+      }
+    };
+    ContinueSignal = class {
+      label;
+      constructor(label) {
+        this.label = label;
+      }
+    };
+    ReturnSignal = class {
+      value;
+      constructor(value) {
+        this.value = value;
+      }
+    };
+    FORBIDDEN_PROPS = /* @__PURE__ */ new Set([
+      "__proto__",
+      "constructor",
+      "prototype",
+      "__defineGetter__",
+      "__defineSetter__",
+      "__lookupGetter__",
+      "__lookupSetter__",
+      "caller",
+      "callee",
+      "arguments",
+      "bind",
+      "call",
+      "apply"
+    ]);
+    ARRAY_MEMBERS = /* @__PURE__ */ new Set([
+      "length",
+      "push",
+      "pop",
+      "shift",
+      "unshift",
+      "slice",
+      "splice",
+      "indexOf",
+      "lastIndexOf",
+      "includes",
+      "join",
+      "map",
+      "filter",
+      "forEach",
+      "reduce",
+      "reduceRight",
+      "concat",
+      "reverse",
+      "sort",
+      "find",
+      "findIndex",
+      "some",
+      "every",
+      "flat",
+      "flatMap",
+      "fill"
+    ]);
+    STRING_MEMBERS = /* @__PURE__ */ new Set([
+      "length",
+      "charAt",
+      "charCodeAt",
+      "codePointAt",
+      "indexOf",
+      "lastIndexOf",
+      "includes",
+      "startsWith",
+      "endsWith",
+      "slice",
+      "substring",
+      "toUpperCase",
+      "toLowerCase",
+      "trim",
+      "trimStart",
+      "trimEnd",
+      "split",
+      "repeat",
+      "padStart",
+      "padEnd",
+      "concat",
+      "at",
+      "replace",
+      "replaceAll"
+    ]);
+    NUMBER_MEMBERS = /* @__PURE__ */ new Set(["toFixed", "toPrecision", "toString"]);
+    Scope = class {
+      parent;
+      isFunctionScope;
+      vars = /* @__PURE__ */ new Map();
+      consts = /* @__PURE__ */ new Set();
+      constructor(parent, isFunctionScope = false) {
+        this.parent = parent;
+        this.isFunctionScope = isFunctionScope;
+      }
+      declare(name, value, kind) {
+        if (kind === "var" && !this.isFunctionScope && this.parent) {
+          this.parent.declare(name, value, kind);
+          return;
+        }
+        this.vars.set(name, value);
+        if (kind === "const")
+          this.consts.add(name);
+      }
+      resolve(name) {
+        if (this.vars.has(name))
+          return this;
+        return this.parent?.resolve(name);
+      }
+      globalScope() {
+        return this.parent ? this.parent.globalScope() : this;
+      }
+      has(name) {
+        return this.resolve(name) !== void 0;
+      }
+      get(name) {
+        const s = this.resolve(name);
+        if (!s)
+          throw new Error(`${name} is not defined`);
+        return s.vars.get(name);
+      }
+      set(name, value) {
+        const s = this.resolve(name);
+        if (!s) {
+          this.globalScope().vars.set(name, value);
+          return;
+        }
+        if (s.consts.has(name))
+          throw new Error(`Assignment to constant variable "${name}"`);
+        s.vars.set(name, value);
+      }
+    };
+  }
+});
+
 // ../core/dist/tools/build-executor.js
-import * as vm from "vm";
 function createSeededRng(seed) {
   let s = seed;
   return () => {
@@ -1434,6 +2553,7 @@ function runBuildExecutor(code, palette, seed, options) {
     ]);
   }
   const rng = createSeededRng(seed ?? 42);
+  const safeMath = Object.freeze(Object.create(null, Object.getOwnPropertyDescriptors(Math)));
   const sandbox = {
     part: partFn,
     rpart: rpartFn,
@@ -1450,25 +2570,21 @@ function runBuildExecutor(code, palette, seed, options) {
     column: columnFn,
     pew: pewFn,
     fence: fenceFn,
-    Math,
+    Math: safeMath,
     GRID_SIZE: 1,
     rng,
-    console: { log: () => {
+    console: Object.freeze({ log: () => {
     }, warn: () => {
     }, error: () => {
-    } }
+    } })
   };
-  const context = vm.createContext(sandbox, {
-    codeGeneration: { strings: false, wasm: false }
-  });
-  const script = new vm.Script(code, { filename: "build-generator.js" });
   try {
-    script.runInContext(context, { timeout });
+    runRestrictedScript(code, sandbox, { timeoutMs: timeout });
   } catch (err) {
-    if (err.code === "ERR_SCRIPT_EXECUTION_TIMEOUT") {
+    if (err instanceof ScriptTimeoutError) {
       throw new Error(`Build code execution timed out after ${timeout}ms`);
     }
-    throw new Error(`Build code execution error: ${err.message}`);
+    throw new Error(`Build code execution error: ${err?.message ?? String(err)}`);
   }
   if (parts.length === 0) {
     throw new Error("Build code produced no parts. Make sure to call part(), wall(), floor(), etc.");
@@ -1480,6 +2596,7 @@ var DEFAULT_TIMEOUT, DEFAULT_MAX_PARTS, VALID_SHAPES;
 var init_build_executor = __esm({
   "../core/dist/tools/build-executor.js"() {
     "use strict";
+    init_build_interpreter();
     DEFAULT_TIMEOUT = 1e4;
     DEFAULT_MAX_PARTS = 1e4;
     VALID_SHAPES = /* @__PURE__ */ new Set(["Block", "Wedge", "Cylinder", "Ball", "CornerWedge"]);
@@ -2105,7 +3222,7 @@ var init_managed_instance_registry = __esm({
 
 // ../core/dist/studio-instance-manager.js
 import { execFileSync, spawn } from "child_process";
-import { copyFileSync, existsSync, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, realpathSync, rmSync as rmSync2, statSync as statSync2 } from "fs";
+import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, realpathSync, rmSync as rmSync2, statSync as statSync2 } from "fs";
 import { randomUUID } from "crypto";
 import * as os2 from "os";
 import * as path2 from "path";
@@ -2120,14 +3237,14 @@ function isWsl() {
   if (process.platform !== "linux")
     return false;
   try {
-    return /microsoft|wsl/i.test(readFileSync2("/proc/version", "utf8"));
+    return /microsoft|wsl/i.test(readFileSync3("/proc/version", "utf8"));
   } catch {
     return false;
   }
 }
 function powershell(script) {
   return run("powershell.exe", ["-NoProfile", "-Command", script], {
-    cwd: isWsl() && existsSync("/mnt/c/Windows") ? "/mnt/c/Windows" : process.cwd()
+    cwd: isWsl() && existsSync2("/mnt/c/Windows") ? "/mnt/c/Windows" : process.cwd()
   });
 }
 function windowsLocalAppData() {
@@ -2137,7 +3254,7 @@ function windowsLocalAppData() {
     return void 0;
   try {
     return run("cmd.exe", ["/c", "echo %LOCALAPPDATA%"], {
-      cwd: existsSync("/mnt/c/Windows") ? "/mnt/c/Windows" : process.cwd()
+      cwd: existsSync2("/mnt/c/Windows") ? "/mnt/c/Windows" : process.cwd()
     });
   } catch {
     return void 0;
@@ -2149,7 +3266,7 @@ function toWslPath(windowsPath) {
   return run("wslpath", ["-u", windowsPath]);
 }
 function toStudioLaunchArg(arg) {
-  if (!isWsl() || !path2.isAbsolute(arg) || !existsSync(arg))
+  if (!isWsl() || !path2.isAbsolute(arg) || !existsSync2(arg))
     return arg;
   return run("wslpath", ["-w", arg]);
 }
@@ -2175,13 +3292,44 @@ function resolveBaseplateTemplatePath() {
     path2.join(process.cwd(), "assets", BASEPLATE_TEMPLATE_NAME)
   ];
   for (const candidate of candidates) {
-    if (existsSync(candidate))
+    if (existsSync2(candidate))
       return candidate;
   }
   throw new Error(`Baseplate template not found. Expected ${BASEPLATE_TEMPLATE_NAME} in one of: ${candidates.join(", ")}`);
 }
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function sweepStaleBaseplateFiles() {
+  let entries;
+  try {
+    entries = readdirSync2(BASEPLATE_TEMP_DIR);
+  } catch {
+    return;
+  }
+  const cutoff = Date.now() - STALE_BASEPLATE_MAX_AGE_MS;
+  for (const entry of entries) {
+    const match = BASEPLATE_TEMP_SWEEP_NAME.exec(entry);
+    if (!match)
+      continue;
+    if (Number(match[1]) !== process.pid && isProcessAlive(Number(match[1])))
+      continue;
+    const file = path2.join(BASEPLATE_TEMP_DIR, entry);
+    try {
+      if (statSync2(file).mtimeMs < cutoff)
+        rmSync2(file, { force: true });
+    } catch {
+    }
+  }
+}
 function createBaseplatePlaceFile() {
-  mkdirSync2(BASEPLATE_TEMP_DIR, { recursive: true });
+  mkdirSync3(BASEPLATE_TEMP_DIR, { recursive: true });
+  sweepStaleBaseplateFiles();
   const file = path2.join(BASEPLATE_TEMP_DIR, `Baseplate-${process.pid}-${Date.now()}.rbxl`);
   copyFileSync(resolveBaseplateTemplatePath(), file);
   return file;
@@ -2195,8 +3343,12 @@ function cleanupManagedBaseplateFiles(record) {
     return;
   if (!isGeneratedBaseplatePlaceFile(record.localPlaceFile))
     return;
-  rmSync2(record.localPlaceFile, { force: true });
-  rmSync2(`${record.localPlaceFile}.lock`, { force: true });
+  for (const file of [record.localPlaceFile, `${record.localPlaceFile}.lock`]) {
+    try {
+      rmSync2(file, { force: true });
+    } catch {
+    }
+  }
 }
 function prepareStudioLaunchOptions(options) {
   if (options.source !== "baseplate" || options.localPlaceFile)
@@ -2217,10 +3369,10 @@ function resolveStudioExe() {
   }
   const localAppData = windowsLocalAppData();
   const root = localAppData ? path2.join(toWslPath(localAppData), "Roblox", "Versions") : path2.join(os2.homedir(), "AppData", "Local", "Roblox", "Versions");
-  if (!existsSync(root)) {
+  if (!existsSync2(root)) {
     throw new Error(`Roblox Studio Versions folder not found: ${root}. Set ROBLOX_STUDIO_EXE.`);
   }
-  const candidates = readdirSync2(root).filter((name) => name.startsWith("version-")).map((name) => path2.join(root, name, "RobloxStudioBeta.exe")).filter((candidate) => existsSync(candidate)).sort((a, b) => statSync2(b).mtimeMs - statSync2(a).mtimeMs);
+  const candidates = readdirSync2(root).filter((name) => name.startsWith("version-")).map((name) => path2.join(root, name, "RobloxStudioBeta.exe")).filter((candidate) => existsSync2(candidate)).sort((a, b) => statSync2(b).mtimeMs - statSync2(a).mtimeMs);
   if (candidates.length === 0) {
     throw new Error(`RobloxStudioBeta.exe not found under ${root}. Set ROBLOX_STUDIO_EXE.`);
   }
@@ -2255,7 +3407,7 @@ function listStudioProcesses() {
 function currentBootId() {
   if (process.platform === "linux") {
     try {
-      return readFileSync2("/proc/sys/kernel/random/boot_id", "utf8").trim();
+      return readFileSync3("/proc/sys/kernel/random/boot_id", "utf8").trim();
     } catch {
     }
   }
@@ -2312,7 +3464,7 @@ function delay(ms) {
 function basenameAny(filePath) {
   return path2.basename(filePath.replace(/\\/g, "/"));
 }
-var BASEPLATE_TEMP_DIR, BASEPLATE_TEMP_NAME, BASEPLATE_TEMPLATE_NAME, StudioInstanceManager;
+var BASEPLATE_TEMP_DIR, BASEPLATE_TEMP_NAME, BASEPLATE_TEMPLATE_NAME, STALE_BASEPLATE_MAX_AGE_MS, BASEPLATE_TEMP_SWEEP_NAME, StudioInstanceManager;
 var init_studio_instance_manager = __esm({
   "../core/dist/studio-instance-manager.js"() {
     "use strict";
@@ -2320,6 +3472,8 @@ var init_studio_instance_manager = __esm({
     BASEPLATE_TEMP_DIR = path2.join(os2.tmpdir(), "robloxstudio-mcp-baseplates");
     BASEPLATE_TEMP_NAME = /^Baseplate-\d+-\d+\.rbxl$/;
     BASEPLATE_TEMPLATE_NAME = "Baseplate.rbxl";
+    STALE_BASEPLATE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+    BASEPLATE_TEMP_SWEEP_NAME = /^Baseplate-(\d+)-\d+\.rbxl(\.lock)?$/;
     StudioInstanceManager = class {
       managedByInstanceId = /* @__PURE__ */ new Map();
       pending = /* @__PURE__ */ new Set();
@@ -2364,7 +3518,7 @@ var init_studio_instance_manager = __esm({
         const exe = this.processAdapter.resolveStudioExe?.() ?? resolveStudioExe();
         const args = buildStudioLaunchArgs(preparedOptions).map(toStudioLaunchArg);
         const spawnOptions = {
-          cwd: isWsl() && existsSync("/mnt/c/Windows") ? "/mnt/c/Windows" : process.cwd(),
+          cwd: isWsl() && existsSync2("/mnt/c/Windows") ? "/mnt/c/Windows" : process.cwd(),
           detached: true,
           stdio: "ignore"
         };
@@ -4388,6 +5542,7 @@ var init_tools = __esm({
     init_roblox_cookie_client();
     init_studio_instance_manager();
     init_image_decode();
+    init_roblox_docs();
     init_jpeg_encoder();
     init_png_encoder();
     MAX_INLINE_IMAGE_BYTES = 6e6;
@@ -4459,6 +5614,17 @@ var init_tools = __esm({
       _textResult(body) {
         return { content: [{ type: "text", text: JSON.stringify(body) }] };
       }
+      async getRobloxDocs(name, docType, section) {
+        if (!name || typeof name !== "string") {
+          throw new Error('get_roblox_docs requires a name (e.g. "ProximityPrompt")');
+        }
+        const category = docType ?? "classes";
+        if (!isDocCategory(category)) {
+          throw new Error(`Invalid doc_type "${category}". Valid categories: ${DOC_CATEGORIES.join(", ")}`);
+        }
+        const result = await getRobloxDoc(category, name.trim(), section);
+        return { content: [{ type: "text", text: result.content }] };
+      }
       _parseTextResult(result) {
         const text = result?.content?.[0]?.text;
         if (typeof text !== "string")
@@ -6094,9 +7260,9 @@ ${code}`
           if (instance_id) {
             const managedClose = this.instanceManager.closeByInstanceId(instance_id);
             if (managedClose.status !== "not_found") {
-              this.bridge.unregisterInstanceId(instance_id);
+              await this.bridge.unregisterInstanceIdEverywhere(instance_id);
               await sleep(500);
-              this.bridge.unregisterInstanceId(instance_id);
+              await this.bridge.unregisterInstanceIdEverywhere(instance_id);
               return this._textResult({
                 instance_id,
                 message: managedClose.status === "already_closed" ? "Studio instance was already closed." : "Studio instance closed."
@@ -6119,7 +7285,7 @@ ${code}`
                 instance_id
               });
             }
-            this.bridge.unregisterInstanceId(instance_id);
+            await this.bridge.unregisterInstanceIdEverywhere(instance_id);
             return this._textResult({
               instance_id,
               message: "Studio instance closed."
@@ -6138,11 +7304,11 @@ ${code}`
             record2 = active[0];
           }
           if (record2.instanceId)
-            this.bridge.unregisterInstanceId(record2.instanceId);
+            await this.bridge.unregisterInstanceIdEverywhere(record2.instanceId);
           const closeResult = this.instanceManager.close(record2);
           if (record2.instanceId) {
             await sleep(500);
-            this.bridge.unregisterInstanceId(record2.instanceId);
+            await this.bridge.unregisterInstanceIdEverywhere(record2.instanceId);
           }
           return this._textResult({
             instance_id: record2.instanceId,
@@ -7903,21 +9069,31 @@ var init_proxy_bridge_service = __esm({
     init_bridge_service();
     ProxyBridgeService = class _ProxyBridgeService extends BridgeService {
       primaryBaseUrl;
+      authToken;
       proxyInstanceId;
       proxyRequestTimeout = 3e4;
       cachedInstances = [];
       refreshTimer;
       static REFRESH_INTERVAL_MS = 1e3;
-      constructor(primaryBaseUrl) {
+      constructor(primaryBaseUrl, authToken) {
         super();
         this.primaryBaseUrl = primaryBaseUrl;
+        this.authToken = authToken;
         this.proxyInstanceId = uuidv42();
         this.refreshInstances();
         this.refreshTimer = setInterval(() => this.refreshInstances(), _ProxyBridgeService.REFRESH_INTERVAL_MS);
       }
+      authHeaders(extra) {
+        const headers = { ...extra };
+        if (this.authToken)
+          headers["X-MCP-Auth"] = this.authToken;
+        return headers;
+      }
       async refreshInstances() {
         try {
-          const res = await fetch(`${this.primaryBaseUrl}/instances`);
+          const res = await fetch(`${this.primaryBaseUrl}/instances`, {
+            headers: this.authHeaders()
+          });
           if (!res.ok)
             return;
           const body = await res.json();
@@ -7930,6 +9106,24 @@ var init_proxy_bridge_service = __esm({
       getInstances() {
         return this.cachedInstances;
       }
+      async unregisterInstanceIdEverywhere(instanceId) {
+        const response = await fetch(`${this.primaryBaseUrl}/unregister-instance-id`, {
+          method: "POST",
+          headers: this.authHeaders({ "Content-Type": "application/json" }),
+          body: JSON.stringify({ instanceId })
+        });
+        if (!response.ok) {
+          const body = await response.text().catch(() => "");
+          throw new Error(`Proxy unregister failed (${response.status}): ${body || response.statusText}`);
+        }
+        const result = await response.json();
+        const removed = Array.isArray(result.removed) ? result.removed : [];
+        const removedKeys = new Set(removed.map((inst) => `${inst.instanceId}\0${inst.role}`));
+        if (removedKeys.size > 0) {
+          this.cachedInstances = this.cachedInstances.filter((inst) => !removedKeys.has(`${inst.instanceId}\0${inst.role}`));
+        }
+        return removed;
+      }
       /** Called when this proxy is being discarded (e.g. promotion to primary
           replaced it). Stops the background refresh so it doesn't leak. */
       stop() {
@@ -7944,7 +9138,7 @@ var init_proxy_bridge_service = __esm({
         try {
           const response = await fetch(`${this.primaryBaseUrl}/proxy`, {
             method: "POST",
-            headers: { "Content-Type": "application/json" },
+            headers: this.authHeaders({ "Content-Type": "application/json" }),
             body: JSON.stringify({
               endpoint,
               data,
@@ -7989,6 +9183,7 @@ var init_server = __esm({
   "../core/dist/server.js"() {
     "use strict";
     init_http_server();
+    init_auth();
     init_tools();
     init_bridge_service();
     init_proxy_bridge_service();
@@ -8012,7 +9207,7 @@ var init_server = __esm({
         });
         this.bridge = new BridgeService();
         this.tools = new RobloxStudioTools(this.bridge);
-        registerEmptyResourceShim(this.server);
+        registerResourceHandlers(this.server);
         this.setupToolHandlers();
       }
       setupToolHandlers() {
@@ -8058,14 +9253,28 @@ var init_server = __esm({
       }
       async run() {
         const basePort = process.env.ROBLOX_STUDIO_PORT ? parseInt(process.env.ROBLOX_STUDIO_PORT) : 58741;
-        const host = process.env.ROBLOX_STUDIO_HOST || "0.0.0.0";
+        const host = process.env.ROBLOX_STUDIO_HOST?.trim() || "127.0.0.1";
+        if (host !== "127.0.0.1" && host !== "localhost" && host !== "::1") {
+          console.error(`WARNING: ROBLOX_STUDIO_HOST=${host} exposes the MCP bridge beyond this machine. Anyone who can reach the port and knows the auth token can control Roblox Studio.`);
+        }
+        const auth = resolveAuthToken();
+        const security = {
+          authToken: auth.token,
+          authTokenHint: auth.source === "env" ? "The token comes from ROBLOX_STUDIO_AUTH_TOKEN." : auth.filePath ? `The token is in ${auth.filePath}.` : void 0,
+          allowedOrigins: (process.env.ROBLOX_STUDIO_ALLOWED_ORIGINS || "").split(",").map((o) => o.trim()).filter((o) => o !== "")
+        };
+        if (auth.source === "disabled") {
+          console.error("WARNING: ROBLOX_STUDIO_NO_AUTH is set - tool endpoints accept unauthenticated requests.");
+        } else if (auth.filePath) {
+          console.error(`Auth token loaded from ${auth.filePath} (HTTP clients must send X-MCP-Auth or Authorization: Bearer)`);
+        }
         let bridgeMode = "primary";
         let httpHandle;
         let primaryApp;
         let boundPort = 0;
         let promotionInterval;
         try {
-          primaryApp = createHttpServer(this.tools, this.bridge, this.allowedToolNames, this.config);
+          primaryApp = createHttpServer(this.tools, this.bridge, this.allowedToolNames, this.config, security);
           const result = await listenWithRetry(primaryApp, host, basePort, 1);
           httpHandle = result.server;
           boundPort = result.port;
@@ -8074,7 +9283,7 @@ var init_server = __esm({
         } catch {
           bridgeMode = "proxy";
           primaryApp = void 0;
-          const proxyBridge = new ProxyBridgeService(`http://localhost:${basePort}`);
+          const proxyBridge = new ProxyBridgeService(`http://localhost:${basePort}`, auth.token);
           this.bridge = proxyBridge;
           this.tools = new RobloxStudioTools(this.bridge);
           console.error(`Port ${basePort} in use - entering proxy mode (forwarding to localhost:${basePort})`);
@@ -8082,7 +9291,7 @@ var init_server = __esm({
           promotionInterval = setInterval(async () => {
             const candidateBridge = new BridgeService();
             const candidateTools = new RobloxStudioTools(candidateBridge);
-            const candidateApp = createHttpServer(candidateTools, candidateBridge, this.allowedToolNames, this.config);
+            const candidateApp = createHttpServer(candidateTools, candidateBridge, this.allowedToolNames, this.config, security);
             try {
               const result = await listenWithRetry(candidateApp, host, basePort, 1);
               const oldBridge = this.bridge;
@@ -8107,7 +9316,7 @@ var init_server = __esm({
         let legacyHandle;
         let legacyApp;
         if (boundPort !== LEGACY_PORT && bridgeMode === "primary") {
-          legacyApp = createHttpServer(this.tools, this.bridge, this.allowedToolNames, this.config);
+          legacyApp = createHttpServer(this.tools, this.bridge, this.allowedToolNames, this.config, security);
           try {
             const result = await listenWithRetry(legacyApp, host, LEGACY_PORT, 1);
             legacyHandle = result.server;
@@ -9964,7 +11173,7 @@ CYLINDER AXIS: Roblox cylinders extend along the X axis. For upright cylinders,
 EXAMPLE - compact cabin (17 lines):
 room(0,0,0,8,4,6,"a","b","a")
 roof(0,4,0,8,6,"gable","c")
-wall(-4,0,-2,4,0,-2,4,1,"a")
+wall(-4,-2,4,-2,4,1,"a")
 part(0,2,3,3,3,0.3,"a","Block",0.4)
 row(-2,0,-1,3,0,2,(i,cx,cy,cz)=>{pew(cx,0,cz,3,2,"d")})
 column(-3,0,-2,4,0.5,"a","b")
@@ -10758,6 +11967,31 @@ part(0,2,0,2,1,1,"b")`,
           },
           required: ["pattern", "replacement"]
         }
+      },
+      // === Documentation ===
+      {
+        name: "get_roblox_docs",
+        category: "read",
+        description: 'Fetch official Roblox engine API documentation as markdown from create.roblox.com. Call this BEFORE writing or editing code that uses an engine class, enum, datatype, or Luau library you are not fully certain about (e.g. ProximityPrompt, Enum.KeyCode, CFrame, TweenService) \u2014 the page includes the description, properties, methods, events, and code samples. Results are cached, so repeat lookups are cheap. Very large pages are truncated with a section index; pass section (e.g. "Properties", "Methods", "Events") to read one section in full.',
+        inputSchema: {
+          type: "object",
+          properties: {
+            name: {
+              type: "string",
+              description: 'Exact PascalCase name of the class, enum, datatype, or library (e.g. "ProximityPrompt", "KeyCode", "CFrame", "table")'
+            },
+            doc_type: {
+              type: "string",
+              enum: ["classes", "enums", "datatypes", "libraries", "globals"],
+              description: "Documentation category (default: classes)"
+            },
+            section: {
+              type: "string",
+              description: 'Optional "##"-level section to return instead of the whole page (e.g. "Description", "Properties", "Methods", "Events", "Code Samples")'
+            }
+          },
+          required: ["name"]
+        }
       }
     ];
     DEPRECATED_TOOL_DEFINITIONS = [
@@ -10917,15 +12151,15 @@ part(0,2,0,2,1,1,"b")`,
 });
 
 // ../core/dist/install-plugin-helpers.js
-import { existsSync as existsSync4, readFileSync as readFileSync5, unlinkSync } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync6, unlinkSync } from "fs";
 import { execSync } from "child_process";
-import { join as join4 } from "path";
-import { homedir as homedir4 } from "os";
+import { join as join5 } from "path";
+import { homedir as homedir5 } from "os";
 function isWSL() {
   if (process.platform !== "linux")
     return false;
   try {
-    const v = readFileSync5("/proc/version", "utf8");
+    const v = readFileSync6("/proc/version", "utf8");
     return /microsoft|wsl/i.test(v);
   } catch {
     return false;
@@ -10943,7 +12177,7 @@ function getWindowsUserPluginsDir() {
     }).toString().trim();
     if (!linuxPath)
       return null;
-    return join4(linuxPath, "Roblox", "Plugins");
+    return join5(linuxPath, "Roblox", "Plugins");
   } catch {
     return null;
   }
@@ -10952,7 +12186,7 @@ function getPluginsFolder() {
   if (process.env.MCP_PLUGINS_DIR)
     return process.env.MCP_PLUGINS_DIR;
   if (process.platform === "win32") {
-    return join4(process.env.LOCALAPPDATA || join4(homedir4(), "AppData", "Local"), "Roblox", "Plugins");
+    return join5(process.env.LOCALAPPDATA || join5(homedir5(), "AppData", "Local"), "Roblox", "Plugins");
   }
   if (isWSL()) {
     const win = getWindowsUserPluginsDir();
@@ -10960,11 +12194,11 @@ function getPluginsFolder() {
       return win;
     console.warn("[install-plugin] WSL detected but could not resolve Windows %LOCALAPPDATA%. Falling back to ~/Documents/Roblox/Plugins/ - you will likely need to copy the rbxmx to /mnt/c/Users/<you>/AppData/Local/Roblox/Plugins/ manually. Set MCP_PLUGINS_DIR to skip detection.");
   }
-  return join4(homedir4(), "Documents", "Roblox", "Plugins");
+  return join5(homedir5(), "Documents", "Roblox", "Plugins");
 }
 function handleVariantConflict({ pluginsFolder, otherAssetName, replace, log = console.log, warn = console.warn }) {
-  const otherDest = join4(pluginsFolder, otherAssetName);
-  if (!existsSync4(otherDest))
+  const otherDest = join5(pluginsFolder, otherAssetName);
+  if (!existsSync5(otherDest))
     return;
   if (replace) {
     try {
@@ -11009,8 +12243,8 @@ __export(install_plugin_exports, {
   installBundledPlugin: () => installBundledPlugin,
   installPlugin: () => installPlugin
 });
-import { copyFileSync as copyFileSync2, createWriteStream, existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync6, unlinkSync as unlinkSync2 } from "fs";
-import { dirname as dirname3, join as join5 } from "path";
+import { copyFileSync as copyFileSync2, createWriteStream, existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync7, unlinkSync as unlinkSync2 } from "fs";
+import { dirname as dirname4, join as join6 } from "path";
 import { fileURLToPath } from "url";
 import { get } from "https";
 function httpsGet(url) {
@@ -11070,8 +12304,8 @@ function prepareInstall({
   warn
 }) {
   const pluginsFolder = getPluginsFolder();
-  if (!existsSync5(pluginsFolder)) {
-    mkdirSync4(pluginsFolder, { recursive: true });
+  if (!existsSync6(pluginsFolder)) {
+    mkdirSync5(pluginsFolder, { recursive: true });
   }
   handleVariantConflict({
     pluginsFolder,
@@ -11083,23 +12317,23 @@ function prepareInstall({
   return pluginsFolder;
 }
 function bundledAssetPath() {
-  const currentDir = dirname3(fileURLToPath(import.meta.url));
+  const currentDir = dirname4(fileURLToPath(import.meta.url));
   const candidates = [
-    join5(currentDir, "..", "studio-plugin", ASSET_NAME),
-    join5(currentDir, "..", "..", "..", "studio-plugin", ASSET_NAME)
+    join6(currentDir, "..", "studio-plugin", ASSET_NAME),
+    join6(currentDir, "..", "..", "..", "studio-plugin", ASSET_NAME)
   ];
-  return candidates.find((candidate) => existsSync5(candidate)) ?? null;
+  return candidates.find((candidate) => existsSync6(candidate)) ?? null;
 }
 function packageVersion() {
-  const currentDir = dirname3(fileURLToPath(import.meta.url));
-  const pkg = JSON.parse(readFileSync6(join5(currentDir, "..", "package.json"), "utf8"));
+  const currentDir = dirname4(fileURLToPath(import.meta.url));
+  const pkg = JSON.parse(readFileSync7(join6(currentDir, "..", "package.json"), "utf8"));
   if (!pkg.version) {
     throw new Error("Package version not found");
   }
   return pkg.version;
 }
 function bundledPluginVersion(source) {
-  const match = readFileSync6(source, "utf8").match(/local CURRENT_VERSION = "([^"]+)"/);
+  const match = readFileSync7(source, "utf8").match(/local CURRENT_VERSION = "([^"]+)"/);
   return match ? match[1] : null;
 }
 function assertBundledPluginVersion(source) {
@@ -11112,9 +12346,9 @@ function assertBundledPluginVersion(source) {
   }
 }
 function filesMatch(a, b) {
-  if (!existsSync5(b)) return false;
-  const aBytes = readFileSync6(a);
-  const bBytes = readFileSync6(b);
+  if (!existsSync6(b)) return false;
+  const aBytes = readFileSync7(a);
+  const bBytes = readFileSync7(b);
   return aBytes.length === bBytes.length && aBytes.equals(bBytes);
 }
 async function installBundledPlugin(options = {}) {
@@ -11127,7 +12361,7 @@ async function installBundledPlugin(options = {}) {
   }
   assertBundledPluginVersion(source);
   const pluginsFolder = prepareInstall({ replaceVariant, log, warn });
-  const dest = join5(pluginsFolder, ASSET_NAME);
+  const dest = join6(pluginsFolder, ASSET_NAME);
   if (filesMatch(source, dest)) return;
   copyFileSync2(source, dest);
   log(`Installed ${ASSET_NAME} to ${dest}`);
@@ -11140,7 +12374,7 @@ async function installPlugin(options = {}) {
   const bundled = bundledAssetPath();
   if (bundled) {
     assertBundledPluginVersion(bundled);
-    const dest2 = join5(pluginsFolder, ASSET_NAME);
+    const dest2 = join6(pluginsFolder, ASSET_NAME);
     if (filesMatch(bundled, dest2)) {
       log(`${ASSET_NAME} already installed.`);
       return;
@@ -11155,7 +12389,7 @@ async function installPlugin(options = {}) {
   if (!asset) {
     throw new Error(`${ASSET_NAME} not found in release ${release.tag_name}`);
   }
-  const dest = join5(pluginsFolder, ASSET_NAME);
+  const dest = join6(pluginsFolder, ASSET_NAME);
   log(`Downloading ${ASSET_NAME} from ${release.tag_name}...`);
   await download(asset.browser_download_url, dest);
   log(`Installed to ${dest}`);