@chrrxs/robloxstudio-mcp-inspector 2.20.0 → 2.21.0

package/dist/index.js

@@ -653,9 +653,57 @@ var init_mcp_compat = __esm({
   }
 });
 
+// ../core/dist/auth.js
+import { randomBytes, createHash, timingSafeEqual } from "crypto";
+import { existsSync, mkdirSync, readFileSync, writeFileSync, chmodSync } from "fs";
+import { join, dirname } from "path";
+import { homedir } from "os";
+function authTokenFilePath() {
+  return join(homedir(), ".robloxstudio-mcp", "auth-token");
+}
+function resolveAuthToken() {
+  const noAuth = (process.env.ROBLOX_STUDIO_NO_AUTH || "").toLowerCase();
+  if (noAuth === "1" || noAuth === "true") {
+    return { source: "disabled" };
+  }
+  const envToken = process.env.ROBLOX_STUDIO_AUTH_TOKEN?.trim();
+  if (envToken) {
+    return { token: envToken, source: "env" };
+  }
+  const filePath = authTokenFilePath();
+  try {
+    if (existsSync(filePath)) {
+      const existing = readFileSync(filePath, "utf8").trim();
+      if (existing) {
+        return { token: existing, source: "file", filePath };
+      }
+    }
+    const fresh = randomBytes(32).toString("hex");
+    mkdirSync(dirname(filePath), { recursive: true, mode: 448 });
+    writeFileSync(filePath, fresh + "\n", { encoding: "utf8", mode: 384 });
+    try {
+      chmodSync(filePath, 384);
+    } catch {
+    }
+    return { token: fresh, source: "file", filePath };
+  } catch (err) {
+    console.error(`[auth] Could not read/create ${filePath} (${err instanceof Error ? err.message : err}). Using an in-memory token for this process; set ROBLOX_STUDIO_AUTH_TOKEN to share one across sessions.`);
+    return { token: randomBytes(32).toString("hex"), source: "file" };
+  }
+}
+function tokensMatch(provided, expected) {
+  const a = createHash("sha256").update(provided).digest();
+  const b = createHash("sha256").update(expected).digest();
+  return timingSafeEqual(a, b);
+}
+var init_auth = __esm({
+  "../core/dist/auth.js"() {
+    "use strict";
+  }
+});
+
 // ../core/dist/http-server.js
 import express from "express";
-import cors from "cors";
 import http from "http";
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
 import { StreamableHTTPServerTransport } from "@modelcontextprotocol/sdk/server/streamableHttp.js";
@@ -708,7 +756,7 @@ function requiredClosedLineRange(body, toolName) {
   }
   return { startLine: parsed.startLine, endLine: parsed.endLine };
 }
-function createHttpServer(tools, bridge, allowedTools, serverConfig) {
+function createHttpServer(tools, bridge, allowedTools, serverConfig, security) {
   const app = express();
   let mcpServerActive = false;
   let lastMCPActivity = 0;
@@ -738,7 +786,49 @@ function createHttpServer(tools, bridge, allowedTools, serverConfig) {
   const isPluginConnected = () => {
     return bridge.getInstances().length > 0;
   };
-  app.use(cors());
+  const allowedOrigins = new Set(security?.allowedOrigins ?? []);
+  app.use((req, res, next) => {
+    const origin = req.headers.origin;
+    if (typeof origin !== "string" || origin === "") {
+      next();
+      return;
+    }
+    if (!allowedOrigins.has(origin)) {
+      res.status(403).json({
+        error: "forbidden_origin",
+        message: `Cross-origin requests are not allowed from ${origin}. Set ROBLOX_STUDIO_ALLOWED_ORIGINS to allowlist specific origins.`
+      });
+      return;
+    }
+    res.setHeader("Access-Control-Allow-Origin", origin);
+    res.setHeader("Vary", "Origin");
+    res.setHeader("Access-Control-Allow-Methods", "GET, POST, DELETE, OPTIONS");
+    res.setHeader("Access-Control-Allow-Headers", "Content-Type, Authorization, X-MCP-Auth, Mcp-Protocol-Version");
+    if (req.method === "OPTIONS") {
+      res.status(204).end();
+      return;
+    }
+    next();
+  });
+  const authToken = security?.authToken;
+  const authRequired = (path5) => path5 === "/mcp" || path5.startsWith("/mcp/") || path5 === "/proxy" || path5 === "/instances" || path5 === "/unregister-instance-id";
+  app.use((req, res, next) => {
+    if (!authToken || !authRequired(req.path)) {
+      next();
+      return;
+    }
+    const headerToken = req.headers["x-mcp-auth"];
+    const bearer = typeof req.headers.authorization === "string" && req.headers.authorization.startsWith("Bearer ") ? req.headers.authorization.slice("Bearer ".length) : void 0;
+    const provided = typeof headerToken === "string" && headerToken !== "" ? headerToken : bearer;
+    if (provided !== void 0 && tokensMatch(provided, authToken)) {
+      next();
+      return;
+    }
+    res.status(401).json({
+      error: "unauthorized",
+      message: 'Missing or invalid auth token. Send it as "X-MCP-Auth: <token>" or "Authorization: Bearer <token>". ' + (security?.authTokenHint ?? "The token is in ~/.robloxstudio-mcp/auth-token (or ROBLOX_STUDIO_AUTH_TOKEN).")
+    });
+  });
   app.use(express.json({ limit: "50mb" }));
   app.use(express.urlencoded({ limit: "50mb", extended: true }));
   app.get("/health", (req, res) => {
@@ -1108,6 +1198,7 @@ var init_http_server = __esm({
     "use strict";
     init_bridge_service();
     init_mcp_compat();
+    init_auth();
     TOOL_HANDLERS = {
       get_roblox_docs: (tools, body) => tools.getRobloxDocs(body.name, body.doc_type, body.section),
       get_file_tree: (tools, body) => tools.getFileTree(body.path, body.instance_id),
@@ -1275,8 +1366,844 @@ var init_studio_client = __esm({
   }
 });
 
+// ../core/dist/tools/build-interpreter.js
+import * as acorn from "acorn";
+function isPlainObject(value) {
+  if (value === null || typeof value !== "object")
+    return false;
+  const proto = Object.getPrototypeOf(value);
+  return proto === Object.prototype || proto === null;
+}
+function runRestrictedScript(code, globals, options) {
+  const timeoutMs = options?.timeoutMs ?? 1e4;
+  const maxOps = options?.maxOps ?? 2e7;
+  const deadline = Date.now() + timeoutMs;
+  let ops = 0;
+  let ast;
+  try {
+    ast = acorn.parse(code, { ecmaVersion: 2022, sourceType: "script" });
+  } catch (err) {
+    throw new Error(`Syntax error: ${err.message}`);
+  }
+  const globalScope = new Scope(void 0, true);
+  for (const [name, value] of Object.entries(globals)) {
+    globalScope.declare(name, value, "const");
+  }
+  function tick() {
+    ops++;
+    if (ops > maxOps) {
+      throw new ScriptTimeoutError(`Operation budget exceeded (${maxOps} ops)`);
+    }
+    if ((ops & 8191) === 0 && Date.now() > deadline) {
+      throw new ScriptTimeoutError(`Execution timed out after ${timeoutMs}ms`);
+    }
+  }
+  function assertPropAllowed(prop) {
+    const name = typeof prop === "symbol" ? String(prop) : String(prop);
+    if (FORBIDDEN_PROPS.has(name)) {
+      throw new Error(`Access to property "${name}" is not allowed`);
+    }
+    return name;
+  }
+  function getMember(obj, prop) {
+    if (obj === null || obj === void 0) {
+      throw new Error(`Cannot read property "${String(prop)}" of ${obj}`);
+    }
+    const name = assertPropAllowed(prop);
+    if (Array.isArray(obj)) {
+      if (name === "length")
+        return obj.length;
+      const idx = Number(name);
+      if (Number.isInteger(idx) && idx >= 0)
+        return obj[idx];
+      if (ARRAY_MEMBERS.has(name))
+        return obj[name];
+      throw new Error(`Array method "${name}" is not allowed`);
+    }
+    if (typeof obj === "string") {
+      if (name === "length")
+        return obj.length;
+      const idx = Number(name);
+      if (Number.isInteger(idx) && idx >= 0)
+        return obj[idx];
+      if (STRING_MEMBERS.has(name))
+        return obj[name];
+      throw new Error(`String method "${name}" is not allowed`);
+    }
+    if (typeof obj === "number") {
+      if (NUMBER_MEMBERS.has(name))
+        return obj[name];
+      throw new Error(`Number method "${name}" is not allowed`);
+    }
+    if (isPlainObject(obj)) {
+      if (Object.prototype.hasOwnProperty.call(obj, name))
+        return obj[name];
+      return void 0;
+    }
+    throw new Error(`Property access on this value type is not allowed`);
+  }
+  function setMember(obj, prop, value) {
+    if (obj === null || obj === void 0) {
+      throw new Error(`Cannot set property "${String(prop)}" of ${obj}`);
+    }
+    const name = assertPropAllowed(prop);
+    if (Object.isFrozen(obj)) {
+      throw new Error(`Cannot assign to property "${name}" of a frozen object`);
+    }
+    if (Array.isArray(obj)) {
+      const idx = Number(name);
+      if (Number.isInteger(idx) && idx >= 0 || name === "length") {
+        obj[name] = value;
+        return;
+      }
+      throw new Error(`Cannot set property "${name}" on an array`);
+    }
+    if (isPlainObject(obj)) {
+      obj[name] = value;
+      return;
+    }
+    throw new Error(`Property assignment on this value type is not allowed`);
+  }
+  function callFunction(fn, thisArg, args, desc) {
+    if (typeof fn !== "function") {
+      throw new Error(`${desc} is not a function`);
+    }
+    return fn.apply(thisArg, args);
+  }
+  function bindPattern(pattern, value, scope, kind) {
+    switch (pattern.type) {
+      case "Identifier":
+        scope.declare(pattern.name, value, kind);
+        return;
+      case "AssignmentPattern":
+        bindPattern(pattern.left, value === void 0 ? evaluate(pattern.right, scope) : value, scope, kind);
+        return;
+      case "ArrayPattern": {
+        if (value === null || value === void 0)
+          throw new Error("Cannot destructure null/undefined");
+        let i = 0;
+        for (const el of pattern.elements) {
+          if (el === null) {
+            i++;
+            continue;
+          }
+          if (el.type === "RestElement") {
+            bindPattern(el.argument, Array.isArray(value) ? value.slice(i) : [], scope, kind);
+            break;
+          }
+          bindPattern(el, getMember(value, i), scope, kind);
+          i++;
+        }
+        return;
+      }
+      case "ObjectPattern": {
+        if (value === null || value === void 0)
+          throw new Error("Cannot destructure null/undefined");
+        const used = /* @__PURE__ */ new Set();
+        for (const propNode of pattern.properties) {
+          if (propNode.type === "RestElement") {
+            const rest = {};
+            if (isPlainObject(value)) {
+              for (const k of Object.keys(value)) {
+                if (!used.has(k) && !FORBIDDEN_PROPS.has(k))
+                  rest[k] = value[k];
+              }
+            }
+            bindPattern(propNode.argument, rest, scope, kind);
+            continue;
+          }
+          const key = propNode.computed ? String(evaluate(propNode.key, scope)) : propNode.key.type === "Identifier" ? propNode.key.name : String(propNode.key.value);
+          used.add(key);
+          bindPattern(propNode.value, getMember(value, key), scope, kind);
+        }
+        return;
+      }
+      default:
+        throw new Error(`Unsupported binding pattern: ${pattern.type}`);
+    }
+  }
+  function makeFunction(node, closureScope) {
+    return (...args) => {
+      tick();
+      const fnScope = new Scope(closureScope, true);
+      node.params.forEach((param, i) => {
+        if (param.type === "RestElement") {
+          bindPattern(param.argument, args.slice(i), fnScope, "let");
+        } else {
+          bindPattern(param, args[i], fnScope, "let");
+        }
+      });
+      try {
+        if (node.body.type === "BlockStatement") {
+          executeBlock(node.body.body, new Scope(fnScope));
+          return void 0;
+        }
+        return evaluate(node.body, fnScope);
+      } catch (signal) {
+        if (signal instanceof ReturnSignal)
+          return signal.value;
+        throw signal;
+      }
+    };
+  }
+  function hoistFunctions(statements, scope) {
+    for (const stmt of statements) {
+      if (stmt.type === "FunctionDeclaration" && stmt.id) {
+        if (stmt.async || stmt.generator)
+          throw new Error("async/generator functions are not supported");
+        scope.declare(stmt.id.name, makeFunction(stmt, scope), "let");
+      }
+    }
+  }
+  function executeBlock(statements, scope) {
+    hoistFunctions(statements, scope);
+    for (const stmt of statements) {
+      execute(stmt, scope);
+    }
+  }
+  function execute(node, scope) {
+    tick();
+    switch (node.type) {
+      case "ExpressionStatement":
+        evaluate(node.expression, scope);
+        return;
+      case "VariableDeclaration":
+        for (const decl of node.declarations) {
+          const value = decl.init ? evaluate(decl.init, scope) : void 0;
+          bindPattern(decl.id, value, scope, node.kind);
+        }
+        return;
+      case "FunctionDeclaration":
+        return;
+      // hoisted by executeBlock
+      case "BlockStatement":
+        executeBlock(node.body, new Scope(scope));
+        return;
+      case "EmptyStatement":
+        return;
+      case "IfStatement":
+        if (evaluate(node.test, scope)) {
+          execute(node.consequent, scope);
+        } else if (node.alternate) {
+          execute(node.alternate, scope);
+        }
+        return;
+      case "ForStatement": {
+        const forScope = new Scope(scope);
+        if (node.init) {
+          if (node.init.type === "VariableDeclaration")
+            execute(node.init, forScope);
+          else
+            evaluate(node.init, forScope);
+        }
+        while (node.test === null || evaluate(node.test, forScope)) {
+          tick();
+          try {
+            execute(node.body, new Scope(forScope));
+          } catch (signal) {
+            if (signal instanceof BreakSignal)
+              break;
+            if (!(signal instanceof ContinueSignal))
+              throw signal;
+          }
+          if (node.update)
+            evaluate(node.update, forScope);
+        }
+        return;
+      }
+      case "ForOfStatement": {
+        const iterable = evaluate(node.right, scope);
+        if (!Array.isArray(iterable) && typeof iterable !== "string") {
+          throw new Error("for...of only supports arrays and strings");
+        }
+        for (const item of iterable) {
+          tick();
+          const iterScope = new Scope(scope);
+          if (node.left.type === "VariableDeclaration") {
+            bindPattern(node.left.declarations[0].id, item, iterScope, node.left.kind);
+          } else {
+            assignTo(node.left, item, iterScope);
+          }
+          try {
+            execute(node.body, iterScope);
+          } catch (signal) {
+            if (signal instanceof BreakSignal)
+              break;
+            if (!(signal instanceof ContinueSignal))
+              throw signal;
+          }
+        }
+        return;
+      }
+      case "ForInStatement": {
+        const obj = evaluate(node.right, scope);
+        const keys = isPlainObject(obj) ? Object.keys(obj) : Array.isArray(obj) ? obj.map((_, i) => String(i)) : [];
+        for (const key of keys) {
+          tick();
+          const iterScope = new Scope(scope);
+          if (node.left.type === "VariableDeclaration") {
+            bindPattern(node.left.declarations[0].id, key, iterScope, node.left.kind);
+          } else {
+            assignTo(node.left, key, iterScope);
+          }
+          try {
+            execute(node.body, iterScope);
+          } catch (signal) {
+            if (signal instanceof BreakSignal)
+              break;
+            if (!(signal instanceof ContinueSignal))
+              throw signal;
+          }
+        }
+        return;
+      }
+      case "WhileStatement":
+        while (evaluate(node.test, scope)) {
+          tick();
+          try {
+            execute(node.body, new Scope(scope));
+          } catch (signal) {
+            if (signal instanceof BreakSignal)
+              break;
+            if (!(signal instanceof ContinueSignal))
+              throw signal;
+          }
+        }
+        return;
+      case "DoWhileStatement":
+        do {
+          tick();
+          try {
+            execute(node.body, new Scope(scope));
+          } catch (signal) {
+            if (signal instanceof BreakSignal)
+              break;
+            if (!(signal instanceof ContinueSignal))
+              throw signal;
+          }
+        } while (evaluate(node.test, scope));
+        return;
+      case "BreakStatement":
+        throw new BreakSignal(node.label?.name);
+      case "ContinueStatement":
+        throw new ContinueSignal(node.label?.name);
+      case "ReturnStatement":
+        throw new ReturnSignal(node.argument ? evaluate(node.argument, scope) : void 0);
+      case "ThrowStatement":
+        throw evaluate(node.argument, scope);
+      case "TryStatement": {
+        try {
+          execute(node.block, scope);
+        } catch (err) {
+          if (err instanceof BreakSignal || err instanceof ContinueSignal || err instanceof ReturnSignal)
+            throw err;
+          if (err instanceof ScriptTimeoutError)
+            throw err;
+          if (node.handler) {
+            const catchScope = new Scope(scope);
+            if (node.handler.param) {
+              const message = err instanceof Error ? { message: err.message } : err;
+              bindPattern(node.handler.param, message, catchScope, "let");
+            }
+            execute(node.handler.body, catchScope);
+          }
+        } finally {
+          if (node.finalizer)
+            execute(node.finalizer, scope);
+        }
+        return;
+      }
+      case "SwitchStatement": {
+        const disc = evaluate(node.discriminant, scope);
+        const switchScope = new Scope(scope);
+        let matched = false;
+        try {
+          for (const caseNode of node.cases) {
+            if (!matched) {
+              if (caseNode.test === null)
+                matched = true;
+              else if (evaluate(caseNode.test, switchScope) === disc)
+                matched = true;
+            }
+            if (matched) {
+              for (const stmt of caseNode.consequent)
+                execute(stmt, switchScope);
+            }
+          }
+        } catch (signal) {
+          if (!(signal instanceof BreakSignal))
+            throw signal;
+        }
+        return;
+      }
+      case "LabeledStatement":
+        try {
+          execute(node.body, scope);
+        } catch (signal) {
+          if (signal instanceof BreakSignal && signal.label === node.label.name)
+            return;
+          throw signal;
+        }
+        return;
+      default:
+        throw new Error(`Unsupported statement: ${node.type}`);
+    }
+  }
+  function assignTo(target, value, scope) {
+    if (target.type === "Identifier") {
+      scope.set(target.name, value);
+    } else if (target.type === "MemberExpression") {
+      const obj = evaluate(target.object, scope);
+      const prop = target.computed ? evaluate(target.property, scope) : target.property.name;
+      setMember(obj, prop, value);
+    } else {
+      throw new Error(`Unsupported assignment target: ${target.type}`);
+    }
+  }
+  function evaluate(node, scope) {
+    tick();
+    switch (node.type) {
+      case "Literal":
+        if (node.regex)
+          throw new Error("Regular expression literals are not supported");
+        return node.value;
+      case "TemplateLiteral": {
+        let out = "";
+        node.quasis.forEach((quasi, i) => {
+          out += quasi.value.cooked ?? "";
+          if (i < node.expressions.length)
+            out += String(evaluate(node.expressions[i], scope));
+        });
+        return out;
+      }
+      case "Identifier":
+        return scope.get(node.name);
+      case "ArrayExpression": {
+        const arr = [];
+        for (const el of node.elements) {
+          if (el === null) {
+            arr.length++;
+            continue;
+          }
+          if (el.type === "SpreadElement") {
+            const spread = evaluate(el.argument, scope);
+            if (!Array.isArray(spread) && typeof spread !== "string") {
+              throw new Error("Spread only supports arrays and strings");
+            }
+            for (const item of spread)
+              arr.push(item);
+          } else {
+            arr.push(evaluate(el, scope));
+          }
+        }
+        return arr;
+      }
+      case "ObjectExpression": {
+        const obj = {};
+        for (const prop of node.properties) {
+          if (prop.type === "SpreadElement") {
+            const spread = evaluate(prop.argument, scope);
+            if (isPlainObject(spread)) {
+              for (const k of Object.keys(spread)) {
+                if (!FORBIDDEN_PROPS.has(k))
+                  obj[k] = spread[k];
+              }
+            }
+            continue;
+          }
+          if (prop.kind !== "init")
+            throw new Error("Getters/setters are not supported");
+          const key = prop.computed ? String(evaluate(prop.key, scope)) : prop.key.type === "Identifier" ? prop.key.name : String(prop.key.value);
+          assertPropAllowed(key);
+          obj[key] = evaluate(prop.value, scope);
+        }
+        return obj;
+      }
+      case "ArrowFunctionExpression":
+      case "FunctionExpression":
+        if (node.async || node.generator)
+          throw new Error("async/generator functions are not supported");
+        return makeFunction(node, scope);
+      case "UnaryExpression": {
+        if (node.operator === "typeof" && node.argument.type === "Identifier" && !scope.has(node.argument.name)) {
+          return "undefined";
+        }
+        if (node.operator === "delete") {
+          if (node.argument.type !== "MemberExpression")
+            return true;
+          const obj = evaluate(node.argument.object, scope);
+          const prop = node.argument.computed ? evaluate(node.argument.property, scope) : node.argument.property.name;
+          const name = assertPropAllowed(prop);
+          if (isPlainObject(obj) && !Object.isFrozen(obj)) {
+            delete obj[name];
+            return true;
+          }
+          throw new Error("delete is only allowed on plain objects");
+        }
+        const arg = evaluate(node.argument, scope);
+        switch (node.operator) {
+          case "-":
+            return -arg;
+          case "+":
+            return +arg;
+          case "!":
+            return !arg;
+          case "~":
+            return ~arg;
+          case "typeof":
+            return typeof arg;
+          case "void":
+            return void 0;
+          default:
+            throw new Error(`Unsupported unary operator: ${node.operator}`);
+        }
+      }
+      case "UpdateExpression": {
+        const old = node.argument.type === "Identifier" ? scope.get(node.argument.name) : getMember(evaluate(node.argument.object, scope), node.argument.computed ? evaluate(node.argument.property, scope) : node.argument.property.name);
+        const next = node.operator === "++" ? old + 1 : old - 1;
+        assignTo(node.argument, next, scope);
+        return node.prefix ? next : old;
+      }
+      case "BinaryExpression": {
+        if (node.operator === "in") {
+          const key = assertPropAllowed(evaluate(node.left, scope));
+          const obj = evaluate(node.right, scope);
+          if (isPlainObject(obj))
+            return Object.prototype.hasOwnProperty.call(obj, key);
+          if (Array.isArray(obj))
+            return Number(key) >= 0 && Number(key) < obj.length;
+          throw new Error('"in" is only supported on plain objects and arrays');
+        }
+        if (node.operator === "instanceof")
+          throw new Error("instanceof is not supported");
+        const l = evaluate(node.left, scope);
+        const r = evaluate(node.right, scope);
+        switch (node.operator) {
+          case "+":
+            return l + r;
+          case "-":
+            return l - r;
+          case "*":
+            return l * r;
+          case "/":
+            return l / r;
+          case "%":
+            return l % r;
+          case "**":
+            return l ** r;
+          case "==":
+            return l == r;
+          // eslint-disable-line eqeqeq
+          case "!=":
+            return l != r;
+          // eslint-disable-line eqeqeq
+          case "===":
+            return l === r;
+          case "!==":
+            return l !== r;
+          case "<":
+            return l < r;
+          case "<=":
+            return l <= r;
+          case ">":
+            return l > r;
+          case ">=":
+            return l >= r;
+          case "&":
+            return l & r;
+          case "|":
+            return l | r;
+          case "^":
+            return l ^ r;
+          case "<<":
+            return l << r;
+          case ">>":
+            return l >> r;
+          case ">>>":
+            return l >>> r;
+          default:
+            throw new Error(`Unsupported binary operator: ${node.operator}`);
+        }
+      }
+      case "LogicalExpression": {
+        const l = evaluate(node.left, scope);
+        if (node.operator === "&&")
+          return l ? evaluate(node.right, scope) : l;
+        if (node.operator === "||")
+          return l ? l : evaluate(node.right, scope);
+        if (node.operator === "??")
+          return l ?? evaluate(node.right, scope);
+        throw new Error(`Unsupported logical operator: ${node.operator}`);
+      }
+      case "AssignmentExpression": {
+        let value;
+        if (node.operator === "=") {
+          value = evaluate(node.right, scope);
+        } else {
+          const current = node.left.type === "Identifier" ? scope.get(node.left.name) : getMember(evaluate(node.left.object, scope), node.left.computed ? evaluate(node.left.property, scope) : node.left.property.name);
+          const rhs = () => evaluate(node.right, scope);
+          switch (node.operator) {
+            case "+=":
+              value = current + rhs();
+              break;
+            case "-=":
+              value = current - rhs();
+              break;
+            case "*=":
+              value = current * rhs();
+              break;
+            case "/=":
+              value = current / rhs();
+              break;
+            case "%=":
+              value = current % rhs();
+              break;
+            case "**=":
+              value = current ** rhs();
+              break;
+            case "&=":
+              value = current & rhs();
+              break;
+            case "|=":
+              value = current | rhs();
+              break;
+            case "^=":
+              value = current ^ rhs();
+              break;
+            case "<<=":
+              value = current << rhs();
+              break;
+            case ">>=":
+              value = current >> rhs();
+              break;
+            case ">>>=":
+              value = current >>> rhs();
+              break;
+            case "&&=":
+              value = current ? rhs() : current;
+              break;
+            case "||=":
+              value = current ? current : rhs();
+              break;
+            case "??=":
+              value = current ?? rhs();
+              break;
+            default:
+              throw new Error(`Unsupported assignment operator: ${node.operator}`);
+          }
+        }
+        assignTo(node.left, value, scope);
+        return value;
+      }
+      case "ConditionalExpression":
+        return evaluate(node.test, scope) ? evaluate(node.consequent, scope) : evaluate(node.alternate, scope);
+      case "CallExpression": {
+        const args = [];
+        for (const argNode of node.arguments) {
+          if (argNode.type === "SpreadElement") {
+            const spread = evaluate(argNode.argument, scope);
+            if (!Array.isArray(spread) && typeof spread !== "string") {
+              throw new Error("Spread only supports arrays and strings");
+            }
+            for (const item of spread)
+              args.push(item);
+          } else {
+            args.push(evaluate(argNode, scope));
+          }
+        }
+        if (node.callee.type === "MemberExpression") {
+          const obj = evaluate(node.callee.object, scope);
+          if (node.optional && (obj === null || obj === void 0))
+            return void 0;
+          const prop = node.callee.computed ? evaluate(node.callee.property, scope) : node.callee.property.name;
+          const method = getMember(obj, prop);
+          if (node.callee.optional && (method === null || method === void 0))
+            return void 0;
+          return callFunction(method, obj, args, `${String(prop)}`);
+        }
+        const fn = evaluate(node.callee, scope);
+        if (node.optional && (fn === null || fn === void 0))
+          return void 0;
+        const desc = node.callee.type === "Identifier" ? node.callee.name : "expression";
+        return callFunction(fn, void 0, args, desc);
+      }
+      case "MemberExpression": {
+        const obj = evaluate(node.object, scope);
+        if (node.optional && (obj === null || obj === void 0))
+          return void 0;
+        const prop = node.computed ? evaluate(node.property, scope) : node.property.name;
+        return getMember(obj, prop);
+      }
+      case "ChainExpression":
+        return evaluate(node.expression, scope);
+      case "SequenceExpression": {
+        let result;
+        for (const expr of node.expressions)
+          result = evaluate(expr, scope);
+        return result;
+      }
+      case "NewExpression":
+        throw new Error('"new" is not supported in build code');
+      case "ThisExpression":
+        throw new Error('"this" is not supported in build code');
+      case "AwaitExpression":
+        throw new Error("await is not supported in build code");
+      case "TaggedTemplateExpression":
+        throw new Error("Tagged templates are not supported in build code");
+      default:
+        throw new Error(`Unsupported expression: ${node.type}`);
+    }
+  }
+  executeBlock(ast.body, globalScope);
+}
+var ScriptTimeoutError, BreakSignal, ContinueSignal, ReturnSignal, FORBIDDEN_PROPS, ARRAY_MEMBERS, STRING_MEMBERS, NUMBER_MEMBERS, Scope;
+var init_build_interpreter = __esm({
+  "../core/dist/tools/build-interpreter.js"() {
+    "use strict";
+    ScriptTimeoutError = class extends Error {
+      constructor(message) {
+        super(message);
+        this.name = "ScriptTimeoutError";
+      }
+    };
+    BreakSignal = class {
+      label;
+      constructor(label) {
+        this.label = label;
+      }
+    };
+    ContinueSignal = class {
+      label;
+      constructor(label) {
+        this.label = label;
+      }
+    };
+    ReturnSignal = class {
+      value;
+      constructor(value) {
+        this.value = value;
+      }
+    };
+    FORBIDDEN_PROPS = /* @__PURE__ */ new Set([
+      "__proto__",
+      "constructor",
+      "prototype",
+      "__defineGetter__",
+      "__defineSetter__",
+      "__lookupGetter__",
+      "__lookupSetter__",
+      "caller",
+      "callee",
+      "arguments",
+      "bind",
+      "call",
+      "apply"
+    ]);
+    ARRAY_MEMBERS = /* @__PURE__ */ new Set([
+      "length",
+      "push",
+      "pop",
+      "shift",
+      "unshift",
+      "slice",
+      "splice",
+      "indexOf",
+      "lastIndexOf",
+      "includes",
+      "join",
+      "map",
+      "filter",
+      "forEach",
+      "reduce",
+      "reduceRight",
+      "concat",
+      "reverse",
+      "sort",
+      "find",
+      "findIndex",
+      "some",
+      "every",
+      "flat",
+      "flatMap",
+      "fill"
+    ]);
+    STRING_MEMBERS = /* @__PURE__ */ new Set([
+      "length",
+      "charAt",
+      "charCodeAt",
+      "codePointAt",
+      "indexOf",
+      "lastIndexOf",
+      "includes",
+      "startsWith",
+      "endsWith",
+      "slice",
+      "substring",
+      "toUpperCase",
+      "toLowerCase",
+      "trim",
+      "trimStart",
+      "trimEnd",
+      "split",
+      "repeat",
+      "padStart",
+      "padEnd",
+      "concat",
+      "at",
+      "replace",
+      "replaceAll"
+    ]);
+    NUMBER_MEMBERS = /* @__PURE__ */ new Set(["toFixed", "toPrecision", "toString"]);
+    Scope = class {
+      parent;
+      isFunctionScope;
+      vars = /* @__PURE__ */ new Map();
+      consts = /* @__PURE__ */ new Set();
+      constructor(parent, isFunctionScope = false) {
+        this.parent = parent;
+        this.isFunctionScope = isFunctionScope;
+      }
+      declare(name, value, kind) {
+        if (kind === "var" && !this.isFunctionScope && this.parent) {
+          this.parent.declare(name, value, kind);
+          return;
+        }
+        this.vars.set(name, value);
+        if (kind === "const")
+          this.consts.add(name);
+      }
+      resolve(name) {
+        if (this.vars.has(name))
+          return this;
+        return this.parent?.resolve(name);
+      }
+      globalScope() {
+        return this.parent ? this.parent.globalScope() : this;
+      }
+      has(name) {
+        return this.resolve(name) !== void 0;
+      }
+      get(name) {
+        const s = this.resolve(name);
+        if (!s)
+          throw new Error(`${name} is not defined`);
+        return s.vars.get(name);
+      }
+      set(name, value) {
+        const s = this.resolve(name);
+        if (!s) {
+          this.globalScope().vars.set(name, value);
+          return;
+        }
+        if (s.consts.has(name))
+          throw new Error(`Assignment to constant variable "${name}"`);
+        s.vars.set(name, value);
+      }
+    };
+  }
+});
+
 // ../core/dist/tools/build-executor.js
-import * as vm from "vm";
 function createSeededRng(seed) {
   let s = seed;
   return () => {
@@ -1626,6 +2553,7 @@ function runBuildExecutor(code, palette, seed, options) {
     ]);
   }
   const rng = createSeededRng(seed ?? 42);
+  const safeMath = Object.freeze(Object.create(null, Object.getOwnPropertyDescriptors(Math)));
   const sandbox = {
     part: partFn,
     rpart: rpartFn,
@@ -1642,25 +2570,21 @@ function runBuildExecutor(code, palette, seed, options) {
     column: columnFn,
     pew: pewFn,
     fence: fenceFn,
-    Math,
+    Math: safeMath,
     GRID_SIZE: 1,
     rng,
-    console: { log: () => {
+    console: Object.freeze({ log: () => {
     }, warn: () => {
     }, error: () => {
-    } }
+    } })
   };
-  const context = vm.createContext(sandbox, {
-    codeGeneration: { strings: false, wasm: false }
-  });
-  const script = new vm.Script(code, { filename: "build-generator.js" });
   try {
-    script.runInContext(context, { timeout });
+    runRestrictedScript(code, sandbox, { timeoutMs: timeout });
   } catch (err) {
-    if (err.code === "ERR_SCRIPT_EXECUTION_TIMEOUT") {
+    if (err instanceof ScriptTimeoutError) {
       throw new Error(`Build code execution timed out after ${timeout}ms`);
     }
-    throw new Error(`Build code execution error: ${err.message}`);
+    throw new Error(`Build code execution error: ${err?.message ?? String(err)}`);
   }
   if (parts.length === 0) {
     throw new Error("Build code produced no parts. Make sure to call part(), wall(), floor(), etc.");
@@ -1672,6 +2596,7 @@ var DEFAULT_TIMEOUT, DEFAULT_MAX_PARTS, VALID_SHAPES;
 var init_build_executor = __esm({
   "../core/dist/tools/build-executor.js"() {
     "use strict";
+    init_build_interpreter();
     DEFAULT_TIMEOUT = 1e4;
     DEFAULT_MAX_PARTS = 1e4;
     VALID_SHAPES = /* @__PURE__ */ new Set(["Block", "Wedge", "Cylinder", "Ball", "CornerWedge"]);
@@ -2297,7 +3222,7 @@ var init_managed_instance_registry = __esm({
 
 // ../core/dist/studio-instance-manager.js
 import { execFileSync, spawn } from "child_process";
-import { copyFileSync, existsSync, mkdirSync as mkdirSync2, readdirSync as readdirSync2, readFileSync as readFileSync2, realpathSync, rmSync as rmSync2, statSync as statSync2 } from "fs";
+import { copyFileSync, existsSync as existsSync2, mkdirSync as mkdirSync3, readdirSync as readdirSync2, readFileSync as readFileSync3, realpathSync, rmSync as rmSync2, statSync as statSync2 } from "fs";
 import { randomUUID } from "crypto";
 import * as os2 from "os";
 import * as path2 from "path";
@@ -2312,14 +3237,14 @@ function isWsl() {
   if (process.platform !== "linux")
     return false;
   try {
-    return /microsoft|wsl/i.test(readFileSync2("/proc/version", "utf8"));
+    return /microsoft|wsl/i.test(readFileSync3("/proc/version", "utf8"));
   } catch {
     return false;
   }
 }
 function powershell(script) {
   return run("powershell.exe", ["-NoProfile", "-Command", script], {
-    cwd: isWsl() && existsSync("/mnt/c/Windows") ? "/mnt/c/Windows" : process.cwd()
+    cwd: isWsl() && existsSync2("/mnt/c/Windows") ? "/mnt/c/Windows" : process.cwd()
   });
 }
 function windowsLocalAppData() {
@@ -2329,7 +3254,7 @@ function windowsLocalAppData() {
     return void 0;
   try {
     return run("cmd.exe", ["/c", "echo %LOCALAPPDATA%"], {
-      cwd: existsSync("/mnt/c/Windows") ? "/mnt/c/Windows" : process.cwd()
+      cwd: existsSync2("/mnt/c/Windows") ? "/mnt/c/Windows" : process.cwd()
     });
   } catch {
     return void 0;
@@ -2341,7 +3266,7 @@ function toWslPath(windowsPath) {
   return run("wslpath", ["-u", windowsPath]);
 }
 function toStudioLaunchArg(arg) {
-  if (!isWsl() || !path2.isAbsolute(arg) || !existsSync(arg))
+  if (!isWsl() || !path2.isAbsolute(arg) || !existsSync2(arg))
     return arg;
   return run("wslpath", ["-w", arg]);
 }
@@ -2367,13 +3292,44 @@ function resolveBaseplateTemplatePath() {
     path2.join(process.cwd(), "assets", BASEPLATE_TEMPLATE_NAME)
   ];
   for (const candidate of candidates) {
-    if (existsSync(candidate))
+    if (existsSync2(candidate))
       return candidate;
   }
   throw new Error(`Baseplate template not found. Expected ${BASEPLATE_TEMPLATE_NAME} in one of: ${candidates.join(", ")}`);
 }
+function isProcessAlive(pid) {
+  try {
+    process.kill(pid, 0);
+    return true;
+  } catch (err) {
+    return err.code === "EPERM";
+  }
+}
+function sweepStaleBaseplateFiles() {
+  let entries;
+  try {
+    entries = readdirSync2(BASEPLATE_TEMP_DIR);
+  } catch {
+    return;
+  }
+  const cutoff = Date.now() - STALE_BASEPLATE_MAX_AGE_MS;
+  for (const entry of entries) {
+    const match = BASEPLATE_TEMP_SWEEP_NAME.exec(entry);
+    if (!match)
+      continue;
+    if (Number(match[1]) !== process.pid && isProcessAlive(Number(match[1])))
+      continue;
+    const file = path2.join(BASEPLATE_TEMP_DIR, entry);
+    try {
+      if (statSync2(file).mtimeMs < cutoff)
+        rmSync2(file, { force: true });
+    } catch {
+    }
+  }
+}
 function createBaseplatePlaceFile() {
-  mkdirSync2(BASEPLATE_TEMP_DIR, { recursive: true });
+  mkdirSync3(BASEPLATE_TEMP_DIR, { recursive: true });
+  sweepStaleBaseplateFiles();
   const file = path2.join(BASEPLATE_TEMP_DIR, `Baseplate-${process.pid}-${Date.now()}.rbxl`);
   copyFileSync(resolveBaseplateTemplatePath(), file);
   return file;
@@ -2387,8 +3343,12 @@ function cleanupManagedBaseplateFiles(record) {
     return;
   if (!isGeneratedBaseplatePlaceFile(record.localPlaceFile))
     return;
-  rmSync2(record.localPlaceFile, { force: true });
-  rmSync2(`${record.localPlaceFile}.lock`, { force: true });
+  for (const file of [record.localPlaceFile, `${record.localPlaceFile}.lock`]) {
+    try {
+      rmSync2(file, { force: true });
+    } catch {
+    }
+  }
 }
 function prepareStudioLaunchOptions(options) {
   if (options.source !== "baseplate" || options.localPlaceFile)
@@ -2409,10 +3369,10 @@ function resolveStudioExe() {
   }
   const localAppData = windowsLocalAppData();
   const root = localAppData ? path2.join(toWslPath(localAppData), "Roblox", "Versions") : path2.join(os2.homedir(), "AppData", "Local", "Roblox", "Versions");
-  if (!existsSync(root)) {
+  if (!existsSync2(root)) {
     throw new Error(`Roblox Studio Versions folder not found: ${root}. Set ROBLOX_STUDIO_EXE.`);
   }
-  const candidates = readdirSync2(root).filter((name) => name.startsWith("version-")).map((name) => path2.join(root, name, "RobloxStudioBeta.exe")).filter((candidate) => existsSync(candidate)).sort((a, b) => statSync2(b).mtimeMs - statSync2(a).mtimeMs);
+  const candidates = readdirSync2(root).filter((name) => name.startsWith("version-")).map((name) => path2.join(root, name, "RobloxStudioBeta.exe")).filter((candidate) => existsSync2(candidate)).sort((a, b) => statSync2(b).mtimeMs - statSync2(a).mtimeMs);
   if (candidates.length === 0) {
     throw new Error(`RobloxStudioBeta.exe not found under ${root}. Set ROBLOX_STUDIO_EXE.`);
   }
@@ -2447,7 +3407,7 @@ function listStudioProcesses() {
 function currentBootId() {
   if (process.platform === "linux") {
     try {
-      return readFileSync2("/proc/sys/kernel/random/boot_id", "utf8").trim();
+      return readFileSync3("/proc/sys/kernel/random/boot_id", "utf8").trim();
     } catch {
     }
   }
@@ -2504,7 +3464,7 @@ function delay(ms) {
 function basenameAny(filePath) {
   return path2.basename(filePath.replace(/\\/g, "/"));
 }
-var BASEPLATE_TEMP_DIR, BASEPLATE_TEMP_NAME, BASEPLATE_TEMPLATE_NAME, StudioInstanceManager;
+var BASEPLATE_TEMP_DIR, BASEPLATE_TEMP_NAME, BASEPLATE_TEMPLATE_NAME, STALE_BASEPLATE_MAX_AGE_MS, BASEPLATE_TEMP_SWEEP_NAME, StudioInstanceManager;
 var init_studio_instance_manager = __esm({
   "../core/dist/studio-instance-manager.js"() {
     "use strict";
@@ -2512,6 +3472,8 @@ var init_studio_instance_manager = __esm({
     BASEPLATE_TEMP_DIR = path2.join(os2.tmpdir(), "robloxstudio-mcp-baseplates");
     BASEPLATE_TEMP_NAME = /^Baseplate-\d+-\d+\.rbxl$/;
     BASEPLATE_TEMPLATE_NAME = "Baseplate.rbxl";
+    STALE_BASEPLATE_MAX_AGE_MS = 24 * 60 * 60 * 1e3;
+    BASEPLATE_TEMP_SWEEP_NAME = /^Baseplate-(\d+)-\d+\.rbxl(\.lock)?$/;
     StudioInstanceManager = class {
       managedByInstanceId = /* @__PURE__ */ new Map();
       pending = /* @__PURE__ */ new Set();
@@ -2556,7 +3518,7 @@ var init_studio_instance_manager = __esm({
         const exe = this.processAdapter.resolveStudioExe?.() ?? resolveStudioExe();
         const args = buildStudioLaunchArgs(preparedOptions).map(toStudioLaunchArg);
         const spawnOptions = {
-          cwd: isWsl() && existsSync("/mnt/c/Windows") ? "/mnt/c/Windows" : process.cwd(),
+          cwd: isWsl() && existsSync2("/mnt/c/Windows") ? "/mnt/c/Windows" : process.cwd(),
           detached: true,
           stdio: "ignore"
         };
@@ -8107,21 +9069,31 @@ var init_proxy_bridge_service = __esm({
     init_bridge_service();
     ProxyBridgeService = class _ProxyBridgeService extends BridgeService {
       primaryBaseUrl;
+      authToken;
       proxyInstanceId;
       proxyRequestTimeout = 3e4;
       cachedInstances = [];
       refreshTimer;
       static REFRESH_INTERVAL_MS = 1e3;
-      constructor(primaryBaseUrl) {
+      constructor(primaryBaseUrl, authToken) {
         super();
         this.primaryBaseUrl = primaryBaseUrl;
+        this.authToken = authToken;
         this.proxyInstanceId = uuidv42();
         this.refreshInstances();
         this.refreshTimer = setInterval(() => this.refreshInstances(), _ProxyBridgeService.REFRESH_INTERVAL_MS);
       }
+      authHeaders(extra) {
+        const headers = { ...extra };
+        if (this.authToken)
+          headers["X-MCP-Auth"] = this.authToken;
+        return headers;
+      }
       async refreshInstances() {
         try {
-          const res = await fetch(`${this.primaryBaseUrl}/instances`);
+          const res = await fetch(`${this.primaryBaseUrl}/instances`, {
+            headers: this.authHeaders()
+          });
           if (!res.ok)
             return;
           const body = await res.json();
@@ -8137,7 +9109,7 @@ var init_proxy_bridge_service = __esm({
       async unregisterInstanceIdEverywhere(instanceId) {
         const response = await fetch(`${this.primaryBaseUrl}/unregister-instance-id`, {
           method: "POST",
-          headers: { "Content-Type": "application/json" },
+          headers: this.authHeaders({ "Content-Type": "application/json" }),
           body: JSON.stringify({ instanceId })
         });
         if (!response.ok) {
@@ -8166,7 +9138,7 @@ var init_proxy_bridge_service = __esm({
         try {
           const response = await fetch(`${this.primaryBaseUrl}/proxy`, {
             method: "POST",
-            headers: { "Content-Type": "application/json" },
+            headers: this.authHeaders({ "Content-Type": "application/json" }),
             body: JSON.stringify({
               endpoint,
               data,
@@ -8211,6 +9183,7 @@ var init_server = __esm({
   "../core/dist/server.js"() {
     "use strict";
     init_http_server();
+    init_auth();
     init_tools();
     init_bridge_service();
     init_proxy_bridge_service();
@@ -8280,14 +9253,28 @@ var init_server = __esm({
       }
       async run() {
         const basePort = process.env.ROBLOX_STUDIO_PORT ? parseInt(process.env.ROBLOX_STUDIO_PORT) : 58741;
-        const host = process.env.ROBLOX_STUDIO_HOST || "0.0.0.0";
+        const host = process.env.ROBLOX_STUDIO_HOST?.trim() || "127.0.0.1";
+        if (host !== "127.0.0.1" && host !== "localhost" && host !== "::1") {
+          console.error(`WARNING: ROBLOX_STUDIO_HOST=${host} exposes the MCP bridge beyond this machine. Anyone who can reach the port and knows the auth token can control Roblox Studio.`);
+        }
+        const auth = resolveAuthToken();
+        const security = {
+          authToken: auth.token,
+          authTokenHint: auth.source === "env" ? "The token comes from ROBLOX_STUDIO_AUTH_TOKEN." : auth.filePath ? `The token is in ${auth.filePath}.` : void 0,
+          allowedOrigins: (process.env.ROBLOX_STUDIO_ALLOWED_ORIGINS || "").split(",").map((o) => o.trim()).filter((o) => o !== "")
+        };
+        if (auth.source === "disabled") {
+          console.error("WARNING: ROBLOX_STUDIO_NO_AUTH is set - tool endpoints accept unauthenticated requests.");
+        } else if (auth.filePath) {
+          console.error(`Auth token loaded from ${auth.filePath} (HTTP clients must send X-MCP-Auth or Authorization: Bearer)`);
+        }
         let bridgeMode = "primary";
         let httpHandle;
         let primaryApp;
         let boundPort = 0;
         let promotionInterval;
         try {
-          primaryApp = createHttpServer(this.tools, this.bridge, this.allowedToolNames, this.config);
+          primaryApp = createHttpServer(this.tools, this.bridge, this.allowedToolNames, this.config, security);
           const result = await listenWithRetry(primaryApp, host, basePort, 1);
           httpHandle = result.server;
           boundPort = result.port;
@@ -8296,7 +9283,7 @@ var init_server = __esm({
         } catch {
           bridgeMode = "proxy";
           primaryApp = void 0;
-          const proxyBridge = new ProxyBridgeService(`http://localhost:${basePort}`);
+          const proxyBridge = new ProxyBridgeService(`http://localhost:${basePort}`, auth.token);
           this.bridge = proxyBridge;
           this.tools = new RobloxStudioTools(this.bridge);
           console.error(`Port ${basePort} in use - entering proxy mode (forwarding to localhost:${basePort})`);
@@ -8304,7 +9291,7 @@ var init_server = __esm({
           promotionInterval = setInterval(async () => {
             const candidateBridge = new BridgeService();
             const candidateTools = new RobloxStudioTools(candidateBridge);
-            const candidateApp = createHttpServer(candidateTools, candidateBridge, this.allowedToolNames, this.config);
+            const candidateApp = createHttpServer(candidateTools, candidateBridge, this.allowedToolNames, this.config, security);
             try {
               const result = await listenWithRetry(candidateApp, host, basePort, 1);
               const oldBridge = this.bridge;
@@ -8329,7 +9316,7 @@ var init_server = __esm({
         let legacyHandle;
         let legacyApp;
         if (boundPort !== LEGACY_PORT && bridgeMode === "primary") {
-          legacyApp = createHttpServer(this.tools, this.bridge, this.allowedToolNames, this.config);
+          legacyApp = createHttpServer(this.tools, this.bridge, this.allowedToolNames, this.config, security);
           try {
             const result = await listenWithRetry(legacyApp, host, LEGACY_PORT, 1);
             legacyHandle = result.server;
@@ -10186,7 +11173,7 @@ CYLINDER AXIS: Roblox cylinders extend along the X axis. For upright cylinders,
 EXAMPLE - compact cabin (17 lines):
 room(0,0,0,8,4,6,"a","b","a")
 roof(0,4,0,8,6,"gable","c")
-wall(-4,0,-2,4,0,-2,4,1,"a")
+wall(-4,-2,4,-2,4,1,"a")
 part(0,2,3,3,3,0.3,"a","Block",0.4)
 row(-2,0,-1,3,0,2,(i,cx,cy,cz)=>{pew(cx,0,cz,3,2,"d")})
 column(-3,0,-2,4,0.5,"a","b")
@@ -11164,15 +12151,15 @@ part(0,2,0,2,1,1,"b")`,
 });
 
 // ../core/dist/install-plugin-helpers.js
-import { existsSync as existsSync4, readFileSync as readFileSync5, unlinkSync } from "fs";
+import { existsSync as existsSync5, readFileSync as readFileSync6, unlinkSync } from "fs";
 import { execSync } from "child_process";
-import { join as join4 } from "path";
-import { homedir as homedir4 } from "os";
+import { join as join5 } from "path";
+import { homedir as homedir5 } from "os";
 function isWSL() {
   if (process.platform !== "linux")
     return false;
   try {
-    const v = readFileSync5("/proc/version", "utf8");
+    const v = readFileSync6("/proc/version", "utf8");
     return /microsoft|wsl/i.test(v);
   } catch {
     return false;
@@ -11190,7 +12177,7 @@ function getWindowsUserPluginsDir() {
     }).toString().trim();
     if (!linuxPath)
       return null;
-    return join4(linuxPath, "Roblox", "Plugins");
+    return join5(linuxPath, "Roblox", "Plugins");
   } catch {
     return null;
   }
@@ -11199,7 +12186,7 @@ function getPluginsFolder() {
   if (process.env.MCP_PLUGINS_DIR)
     return process.env.MCP_PLUGINS_DIR;
   if (process.platform === "win32") {
-    return join4(process.env.LOCALAPPDATA || join4(homedir4(), "AppData", "Local"), "Roblox", "Plugins");
+    return join5(process.env.LOCALAPPDATA || join5(homedir5(), "AppData", "Local"), "Roblox", "Plugins");
   }
   if (isWSL()) {
     const win = getWindowsUserPluginsDir();
@@ -11207,11 +12194,11 @@ function getPluginsFolder() {
       return win;
     console.warn("[install-plugin] WSL detected but could not resolve Windows %LOCALAPPDATA%. Falling back to ~/Documents/Roblox/Plugins/ - you will likely need to copy the rbxmx to /mnt/c/Users/<you>/AppData/Local/Roblox/Plugins/ manually. Set MCP_PLUGINS_DIR to skip detection.");
   }
-  return join4(homedir4(), "Documents", "Roblox", "Plugins");
+  return join5(homedir5(), "Documents", "Roblox", "Plugins");
 }
 function handleVariantConflict({ pluginsFolder, otherAssetName, replace, log = console.log, warn = console.warn }) {
-  const otherDest = join4(pluginsFolder, otherAssetName);
-  if (!existsSync4(otherDest))
+  const otherDest = join5(pluginsFolder, otherAssetName);
+  if (!existsSync5(otherDest))
     return;
   if (replace) {
     try {
@@ -11256,8 +12243,8 @@ __export(install_plugin_exports, {
   installBundledPlugin: () => installBundledPlugin,
   installPlugin: () => installPlugin
 });
-import { copyFileSync as copyFileSync2, createWriteStream, existsSync as existsSync5, mkdirSync as mkdirSync4, readFileSync as readFileSync6, unlinkSync as unlinkSync2 } from "fs";
-import { dirname as dirname3, join as join5 } from "path";
+import { copyFileSync as copyFileSync2, createWriteStream, existsSync as existsSync6, mkdirSync as mkdirSync5, readFileSync as readFileSync7, unlinkSync as unlinkSync2 } from "fs";
+import { dirname as dirname4, join as join6 } from "path";
 import { fileURLToPath } from "url";
 import { get } from "https";
 function httpsGet(url) {
@@ -11317,8 +12304,8 @@ function prepareInstall({
   warn
 }) {
   const pluginsFolder = getPluginsFolder();
-  if (!existsSync5(pluginsFolder)) {
-    mkdirSync4(pluginsFolder, { recursive: true });
+  if (!existsSync6(pluginsFolder)) {
+    mkdirSync5(pluginsFolder, { recursive: true });
   }
   handleVariantConflict({
     pluginsFolder,
@@ -11330,23 +12317,23 @@ function prepareInstall({
   return pluginsFolder;
 }
 function bundledAssetPath() {
-  const currentDir = dirname3(fileURLToPath(import.meta.url));
+  const currentDir = dirname4(fileURLToPath(import.meta.url));
   const candidates = [
-    join5(currentDir, "..", "studio-plugin", ASSET_NAME),
-    join5(currentDir, "..", "..", "..", "studio-plugin", ASSET_NAME)
+    join6(currentDir, "..", "studio-plugin", ASSET_NAME),
+    join6(currentDir, "..", "..", "..", "studio-plugin", ASSET_NAME)
   ];
-  return candidates.find((candidate) => existsSync5(candidate)) ?? null;
+  return candidates.find((candidate) => existsSync6(candidate)) ?? null;
 }
 function packageVersion() {
-  const currentDir = dirname3(fileURLToPath(import.meta.url));
-  const pkg = JSON.parse(readFileSync6(join5(currentDir, "..", "package.json"), "utf8"));
+  const currentDir = dirname4(fileURLToPath(import.meta.url));
+  const pkg = JSON.parse(readFileSync7(join6(currentDir, "..", "package.json"), "utf8"));
   if (!pkg.version) {
     throw new Error("Package version not found");
   }
   return pkg.version;
 }
 function bundledPluginVersion(source) {
-  const match = readFileSync6(source, "utf8").match(/local CURRENT_VERSION = "([^"]+)"/);
+  const match = readFileSync7(source, "utf8").match(/local CURRENT_VERSION = "([^"]+)"/);
   return match ? match[1] : null;
 }
 function assertBundledPluginVersion(source) {
@@ -11359,9 +12346,9 @@ function assertBundledPluginVersion(source) {
   }
 }
 function filesMatch(a, b) {
-  if (!existsSync5(b)) return false;
-  const aBytes = readFileSync6(a);
-  const bBytes = readFileSync6(b);
+  if (!existsSync6(b)) return false;
+  const aBytes = readFileSync7(a);
+  const bBytes = readFileSync7(b);
   return aBytes.length === bBytes.length && aBytes.equals(bBytes);
 }
 async function installBundledPlugin(options = {}) {
@@ -11374,7 +12361,7 @@ async function installBundledPlugin(options = {}) {
   }
   assertBundledPluginVersion(source);
   const pluginsFolder = prepareInstall({ replaceVariant, log, warn });
-  const dest = join5(pluginsFolder, ASSET_NAME);
+  const dest = join6(pluginsFolder, ASSET_NAME);
   if (filesMatch(source, dest)) return;
   copyFileSync2(source, dest);
   log(`Installed ${ASSET_NAME} to ${dest}`);
@@ -11387,7 +12374,7 @@ async function installPlugin(options = {}) {
   const bundled = bundledAssetPath();
   if (bundled) {
     assertBundledPluginVersion(bundled);
-    const dest2 = join5(pluginsFolder, ASSET_NAME);
+    const dest2 = join6(pluginsFolder, ASSET_NAME);
     if (filesMatch(bundled, dest2)) {
       log(`${ASSET_NAME} already installed.`);
       return;
@@ -11402,7 +12389,7 @@ async function installPlugin(options = {}) {
   if (!asset) {
     throw new Error(`${ASSET_NAME} not found in release ${release.tag_name}`);
   }
-  const dest = join5(pluginsFolder, ASSET_NAME);
+  const dest = join6(pluginsFolder, ASSET_NAME);
   log(`Downloading ${ASSET_NAME} from ${release.tag_name}...`);
   await download(asset.browser_download_url, dest);
   log(`Installed to ${dest}`);