breakpoint-mcp 1.28.0 → 1.72.7

package/dist/schemas.js

@@ -102,6 +102,8 @@ export const outputSchemas = {
         child_count: z.number(),
         children: z.array(sceneNode).optional(),
     },
+    main_screen_get: { active: z.string().nullable(), available: z.array(z.string()) },
+    main_screen_set: { active: z.string().nullable(), available: z.array(z.string()), requested: z.string() },
     scene_open: { opened: z.string() },
     scene_save: { saved: z.string() },
     scene_new: { created: z.string(), root_type: z.string() },
@@ -109,7 +111,16 @@ export const outputSchemas = {
     scene_reload: { reloaded: z.string() },
     scene_close: { closed: z.string() },
     scene_pack: { packed: z.string(), branch: z.string() },
-    scene_get_dependencies: { path: z.string(), dependencies: z.array(z.string()) },
+    // `dependencies` are LOADABLE res:// paths as of 1.48.0; `dependencies_raw` keeps the
+    // engine's own `uid://X::::res://Y` encoding, which is what the field used to carry and
+    // which resource_load answers `not_found` for (169 §5). `dependency_uids` is
+    // index-aligned with both, "" where the dependency has no UID.
+    scene_get_dependencies: {
+        path: z.string(),
+        dependencies: z.array(z.string()),
+        dependencies_raw: z.array(z.string()),
+        dependency_uids: z.array(z.string()),
+    },
     scene_save_as: { saved_as: z.string() },
     node_add: { path: z.string(), name: z.string(), type: z.string() },
     node_delete: { deleted: z.string() },
@@ -169,11 +180,19 @@ export const outputSchemas = {
     resource_get_property: { path: z.string(), property: z.string(), value: encodedValue },
     resource_set_property: { path: z.string(), property: z.string(), value: encodedValue },
     resource_get_import_settings: { path: z.string(), imported: z.boolean(), importer: z.string(), settings: z.record(encodedValue) },
-    resource_set_import_settings: { path: z.string(), reimported: z.boolean(), settings: z.array(z.string()) },
+    // `changed` (1.46.0) is narrower than `settings`: `settings` lists every key the call
+    // SET, `changed` only those whose stored value actually moved. Setting a key to the
+    // value it already held reported `reimported: true` with the sidecar's bytes unmoved
+    // until 1.46.0 — see the note in operations.gd's _resource_set_import_settings.
+    resource_set_import_settings: { path: z.string(), reimported: z.boolean(), settings: z.array(z.string()), changed: z.array(z.string()) },
     // ---- Group B: filesystem (tools/editor.ts -> operations.gd _filesystem_*) ----
     filesystem_list: { path: z.string(), dirs: z.array(z.string()), files: z.array(z.string()) },
     filesystem_scan: { scanning: z.boolean() },
-    filesystem_move: { moved: z.string(), from: z.string(), moved_import: z.boolean() },
+    // `import_stranded` (173): the .import sidecar EXISTED and would not move. Separate
+    // from `moved_import: false`, which also means "there was no sidecar" — one boolean
+    // cannot carry both, and the difference is a moved asset that has lost its import
+    // settings versus one that never had any.
+    filesystem_move: { moved: z.string(), from: z.string(), moved_import: z.boolean(), import_stranded: z.boolean() },
     filesystem_create_dir: { created: z.string(), existed: z.boolean() },
     // ---- Group C: animation (tools/editor.ts -> operations.gd _anim_*) ----
     anim_player_create: { path: z.string(), name: z.string(), type: z.string() },
@@ -368,13 +387,33 @@ export const outputSchemas = {
         actions: z.array(z.object({ title: z.string(), kind: z.string(), has_edit: z.boolean(), command: z.string().nullable() })),
     },
     // ---- Plane D: debugging / DAP (tools/dap.ts) ----
-    dbg_launch: { session_id: z.string(), state: z.string(), scene: z.string() },
-    dbg_attach: { session_id: z.string(), state: z.string() },
+    dbg_launch: {
+        session_id: z.string(), state: z.string(), scene: z.string(),
+        // Present only when stop_on_entry was requested: whether an entry stop actually
+        // landed. The Godot adapter does not implement stopOnEntry, so it reports false.
+        // NOTE: keep single quotes out of comments in this file (155 §7). An unpaired
+        // one inside a shape makes contract_check.py swallow every later entry into
+        // this one, and the drift error then names every field in the file.
+        stop_on_entry_honored: z.boolean().optional(),
+        // Modifiers dropped when the handshake applied the BUFFERED breakpoints. Buffered
+        // modifiers cannot be feature-detected at set time, so this is where their fate is
+        // reported; dbg_set_breakpoints said only that detection was deferred.
+        unsupported_modifiers: z.array(z.string()).optional(),
+        warning: z.string().optional(),
+    },
+    dbg_attach: {
+        session_id: z.string(), state: z.string(),
+        unsupported_modifiers: z.array(z.string()).optional(),
+        warning: z.string().optional(),
+    },
     dbg_set_breakpoints: {
         path: z.string(), buffered: z.boolean(),
         breakpoints: z.array(z.object({ line: z.number(), verified: z.boolean() })),
         // Present only when the adapter advertised a requested modifier unsupported (see tools/dap.ts).
         unsupported_modifiers: z.array(z.string()).optional(),
+        // Present when modifiers were buffered before any session existed: the adapter had
+        // advertised nothing yet, so nothing could be detected. Value: deferred.
+        modifier_detection: z.string().optional(),
         warning: z.string().optional(),
     },
     dbg_continue: { state: z.string(), stopped_reason: z.string().nullable() },
@@ -609,6 +648,7 @@ export const outputSchemas = {
             name: z.string(), short_sha: z.string(), current: z.boolean(), remote: z.boolean(),
         })),
         count: z.number(),
+        detached: z.boolean(),
     },
     vcs_blame: {
         path: z.string(),
@@ -631,8 +671,12 @@ export const outputSchemas = {
         summary: z.string(),
     },
     vcs_restore: {
+        // 🔴 `restored` IS MEASURED, NOT ECHOED (D5, 155 §2). It used to be the requested
+        // paths handed straight back, so a clean path reported as discarded work.
         restored: z.array(z.string()),
         count: z.number(),
+        requested: z.array(z.string()),
+        stranded: z.array(z.string()),
     },
     vcs_stash: {
         op: z.string(),

package/dist/tools/assetgen.js

@@ -2,7 +2,8 @@ import { spawn } from "node:child_process";
 import fs from "node:fs";
 import { z } from "zod";
 import { gate } from "../confirm.js";
-import { toFsPath } from "../paths.js";
+import { toFsPath, resolveInsideProject } from "../paths.js";
+import { failPath } from "./lsp-common.js";
 /**
  * Group J — AI asset generation.
  *
@@ -179,6 +180,21 @@ export function registerAssetGenTools(server, bridge, config) {
     // The shared generation flow for the 5 typed generators + the always-on placeholder.
     async function generate(kind, args) {
         const { prompt, to_path, width, height, duration_ms, shape, placeholder, confirm, forcePlaceholder } = args;
+        // 🔴 BEFORE THE BACKEND CHECK, NOT AFTER — 163 §3's shape. All six generators
+        // funnel through here, and MEASURED against a live editor every one of them wrote
+        // outside the root through `res://../`. Refusing first means the refusal costs no
+        // bridge call and no backend, so a unit test reaches it with `backend: "none"`.
+        //
+        // 🔴 THIS IS THE ONE BEHAVIOUR CHANGE. With no backend configured, an escaping
+        // `to_path` used to come back `no_backend` carrying a `request` spec — which was
+        // an instruction to the CALLER to write outside the project. It now refuses. That
+        // is the honest answer, and it is pinned by a test rather than left to chance.
+        try {
+            resolveInsideProject(to_path, config.projectPath, "to_path");
+        }
+        catch (err) {
+            return failPath(err);
+        }
         const spec = KIND_FORMAT[kind];
         const usePlaceholder = forcePlaceholder === true || placeholder === true || state.backend === "placeholder";
         const effectiveBackend = usePlaceholder ? "placeholder" : state.backend;

package/dist/tools/backend.js

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import { gate } from "../confirm.js";
+import { resolveInsideProject } from "../paths.js";
 /**
  * Group M (second half) — Backend-SDK integration scaffolding (`backend_*`,
  * `*_scaffold`).
@@ -334,7 +335,7 @@ export function buildCloudSaveScript(sdk) {
     }
 }
 // ------------------------------------------------------------- registration ----
-export function registerBackendTools(server, bridge, _config) {
+export function registerBackendTools(server, bridge, config) {
     const call = async (method, params = {}) => bridge.request(method, params);
     async function detect() {
         const r = (await call("backend.detect"));
@@ -354,6 +355,22 @@ export function registerBackendTools(server, bridge, _config) {
         if (!opts.toPath.startsWith("res://") || !opts.toPath.endsWith(".gd")) {
             return fail({ code: "bad_params", message: "'to_path' must be a res:// .gd path" });
         }
+        // 🔴 `res://../` SATISFIES THE PREFIX CHECK ABOVE and, measured against a live
+        // editor, wrote all four scaffolds outside the project root. The same defect
+        // netcode.ts fixed at its three call sites in 161 — and this file calls the SAME
+        // addon method, `mp.write_script`. One helper guarded, its twin not: the fourth
+        // consecutive session where the second call site was the interesting one.
+        //
+        // 🔴 IT GOES BEFORE THE CAPABILITY AND INSTALLED CHECKS, not after. The first run
+        // of this session's probe put sixteen backend rows through an uninstalled SDK and
+        // measured `sdk_missing` — the DETECTOR, not the path. A guard that sits behind a
+        // feature gate is a guard nobody can measure.
+        try {
+            resolveInsideProject(opts.toPath, config.projectPath, "to_path");
+        }
+        catch (err) {
+            return fail(err);
+        }
         // (1) capability — intrinsic to the SDK, no bridge needed.
         if (!hasCapability(opts.sdk, opts.feature)) {
             return ok({

package/dist/tools/cli.js

@@ -3,7 +3,8 @@ import { promisify } from "node:util";
 import { z } from "zod";
 import { log } from "../logger.js";
 import { registerTaskTool } from "../tasks.js";
-import { ok } from "./lsp-common.js";
+import { ok, failPath } from "./lsp-common.js";
+import { resolveInsideProject } from "../paths.js";
 import { portFree, portConflictMessage } from "../ports.js";
 const execFileAsync = promisify(execFile);
 /** Run the Godot binary to completion, capturing stdout/stderr. */
@@ -76,7 +77,19 @@ export function registerCliTools(server, cfg) {
                 "bridge will NOT be reachable — use only when you want the process for its side effects and will not " +
                 "call any runtime_* tool against it."),
         },
-    }, async ({ scene, allow_port_conflict }) => {
+    }, 
+    // 🔴 MEASURED by the LAUNCHED PROCESS'S OWN ARGV: `res://../example_evil/x.tscn`
+    // produced `godot --path …/example res://../example_evil/x.tscn` and the game
+    // ran it. The port check comes second — a scene that can never legally run
+    // should not first claim the runtime port.
+    async ({ scene, allow_port_conflict }) => {
+        try {
+            if (scene !== undefined)
+                resolveInsideProject(scene, cfg.projectPath, "scene");
+        }
+        catch (err) {
+            return failPath(err);
+        }
         if (!allow_port_conflict && !(await portFree(cfg.runtimeHost, cfg.runtimePort))) {
             return { isError: true, content: [{ type: "text", text: portConflictMessage(cfg.runtimeHost, cfg.runtimePort) }] };
         }
@@ -96,7 +109,20 @@ export function registerCliTools(server, cfg) {
             debug: z.boolean().optional().describe("Export a debug build instead of release (default false)"),
             timeout_ms: z.number().int().positive().optional().describe("Max run time (default 600000)"),
         },
-    }, async ({ preset, output_path, debug, timeout_ms }, signal) => {
+    }, 
+    // 🔴 A WRITER THE `to_path` SWEEP MISSED ON A NAMING ACCIDENT. `output_path` goes
+    // to the Godot CLI verbatim, and the CLI honours an escaping one: measured with
+    // the equivalent `--export-pack "Linux/X11" ../example_evil/g165_pack.pck`, which
+    // put a 306KB .pck outside the root. (The tool's own `--export-release` could not
+    // be run to completion on the measuring Mac — no export templates installed — so
+    // this row is CLI-measured plus source-verified passthrough, not tool-measured.)
+    async ({ preset, output_path, debug, timeout_ms }, signal) => {
+        try {
+            resolveInsideProject(output_path, cfg.projectPath, "output_path");
+        }
+        catch (err) {
+            return failPath(err);
+        }
         const flag = debug ? "--export-debug" : "--export-release";
         const r = await runCaptured(cfg, ["--headless", "--path", cfg.projectPath, flag, preset, output_path], timeout_ms ?? 600000, signal);
         return ok({
@@ -129,7 +155,18 @@ export function registerCliTools(server, cfg) {
             args: z.array(z.string()).optional().describe("Extra CLI args passed after the script"),
             timeout_ms: z.number().int().positive().optional().describe("Max run time (default 600000)"),
         },
-    }, async ({ script_path, args, timeout_ms }, signal) => {
+    }, 
+    // 🔴🔴 THE SHARPEST ROW OF THE SESSION. `-s <script_path>` EXECUTES the file. A
+    // script at `res://../example_evil/g165_run.gd` RAN — proven by the marker file it
+    // wrote, not by the reply, which answered `exit_code: 0` for the real script AND
+    // for one that did not exist. The reply channel carried zero information.
+    async ({ script_path, args, timeout_ms }, signal) => {
+        try {
+            resolveInsideProject(script_path, cfg.projectPath, "script_path");
+        }
+        catch (err) {
+            return failPath(err);
+        }
         const r = await runCaptured(cfg, ["--headless", "--path", cfg.projectPath, "-s", script_path, ...(args ?? [])], timeout_ms ?? 600000, signal);
         return ok({
             script_path,

package/dist/tools/csdap.js

@@ -1,6 +1,6 @@
 import { z } from "zod";
 import { DapError } from "../dap.js";
-import { toFsPath } from "../paths.js";
+import { resolveSourceFile } from "../paths.js";
 import { gate } from "../confirm.js";
 import { ok } from "./lsp-common.js";
 import { portFree, portConflictMessage } from "../ports.js";
@@ -10,11 +10,41 @@ import { portFree, portConflictMessage } from "../ports.js";
 const RESUME_WAIT_MS = 15000;
 function fail(err) {
     const e = err;
+    // A REFUSAL is the host declining the call, not the debug adapter failing one —
+    // the same distinction `lsp-common.fail()` draws. Rendering it as
+    // "C# DAP error [...]" sends the caller to debug an adapter that was never asked.
+    if (e?.refusal) {
+        return {
+            isError: true,
+            content: [{ type: "text", text: e.message ?? String(err) }],
+        };
+    }
+    // 🔴 An adapter failure can carry NO message at all. Measured: netcoredbg
+    // advertises `supportsSetVariable: true` and answered a setVariable failure with an
+    // empty `message`, so this rendered as the bare, meaningless
+    // `C# DAP error [setVariable]: ` — an error whose text says nothing about what went
+    // wrong or who reported it. Say that the adapter reported a failure without one.
+    const message = (e?.message ?? "").trim();
+    const command = e?.command ?? "error";
+    if (message === "") {
+        return {
+            isError: true,
+            content: [{
+                    type: "text",
+                    text: `C# DAP error [${command}]: the debug adapter reported a failure with no message. ` +
+                        `The request was rejected; nothing was changed by it.`,
+                }],
+        };
+    }
     return {
         isError: true,
-        content: [{ type: "text", text: `C# DAP error [${e.command ?? "error"}]: ${e.message ?? String(err)}` }],
+        content: [{ type: "text", text: `C# DAP error [${command}]: ${message}` }],
     };
 }
+/** Throw a host refusal — rendered verbatim by `fail()`, never as an adapter error. */
+function refuse(message, code) {
+    throw Object.assign(new Error(message), { refusal: true, code });
+}
 /**
  * True when `err` is a DAP request that hit its own request deadline (not an
  * adapter-reported failure or a dropped connection). Used to turn a
@@ -43,13 +73,74 @@ function isDapTimeout(err) {
  * `supportsGotoTargetsRequest` nor `supportsDataBreakpoints`, so those tools
  * would only ever return "unsupported" here.
  */
+/**
+ * 🔴 THE PLANE WHOSE GUARD IS DELIBERATELY DIFFERENT, and the one 161 §8 item 5 said
+ * to find before folding anything together. `anchoredOnly` is the whole difference:
+ *
+ *   - `res://…` and relative paths are PROJECT-ANCHORED by definition; one that
+ *     resolves outside the root (`res://../../../etc/passwd` landed in
+ *     `~/Downloads/etc/passwd`) is meaningless and is refused.
+ *   - an ABSOLUTE path is the caller explicitly naming a file elsewhere, which is
+ *     exactly how you debug another program — `cs_dbg_launch` documents overriding
+ *     `program` for precisely that. It stays legal.
+ *
+ * Measured, session 162, and this is not a reading of the code: `<csroot>_evil/…` and
+ * a plain `elsewhere/…` both answered ok through the real stdio server, while every
+ * project-anchored escape was refused. The cs-dap gate DEPENDS on this — its own
+ * throwaway fixture source is an absolute path outside the project, and §4 of that
+ * probe is built on breakpoints in it. Flattening this plane onto the other three
+ * would have broken the documented mainline of the tool AND its gate.
+ *
+ * Existence is checked for BOTH forms: that guard asks whether a breakpoint can bind
+ * at all, and it is location-independent.
+ */
+const CS_DAP_PATHS = {
+    root: "the C# project root",
+    escapeHint: "A res:// or relative path is project-anchored; pass an absolute path to set a " +
+        "breakpoint in a program outside the project.",
+    missingHint: "A breakpoint there can never bind, but it was previously answered exactly like " +
+        "one on a real file.",
+    emptyNote: " (an empty path resolves to the project root)",
+    anchoredOnly: true,
+};
 export function registerCsDapTools(server, dap, cfg) {
+    const root = cfg.csDapProjectPath;
+    /**
+     * Resolve a breakpoint source path and REFUSE one that cannot carry a breakpoint.
+     *
+     * Measured against a real netcoredbg: `res://NoSuchFile.cs`, `res://demo` (a
+     * DIRECTORY) and `""` (which `path.join`s down to the PROJECT ROOT DIRECTORY) each
+     * answered `{buffered:true, breakpoints:[]}` with `isError:false` — byte-identical
+     * to `res://Player.cs`. The caller could not tell an armed breakpoint from one that
+     * can never bind.
+     *
+     * 🔴 The escape check is deliberately NARROWER than the `cs_*` LSP plane's, and the
+     * difference is not an oversight. `cs_dbg_launch` documents overriding `program` to
+     * "debug a different .NET program", whose sources legitimately live outside the
+     * Godot C# project — refusing every absolute path outside the root would break the
+     * documented mainline of this tool. So:
+     *
+     *   - `res://…` and relative paths are PROJECT-ANCHORED by definition; one that
+     *     resolves outside the root (`res://../../../etc/passwd` landed in
+     *     `~/Downloads/etc/passwd`) is meaningless and is refused.
+     *   - an ABSOLUTE path is the caller explicitly naming a file elsewhere, which is
+     *     exactly how you debug another program. It stays legal.
+     *
+     * Existence is checked for BOTH forms — that guard is about whether a breakpoint
+     * can bind at all, and it is location-independent. The comparison is against
+     * `root + path.sep`, never a bare `startsWith(root)`: the latter accepts a sibling
+     * directory that merely shares the root's name prefix.
+     */
+    const guardSource = (p) => resolveSourceFile(p, root, CS_DAP_PATHS);
     server.registerTool("cs_dbg_launch", {
         title: "Launch C# debug session",
         description: "Start a C# Godot game under netcoredbg. `program` defaults to the configured Mono/.NET Godot binary " +
             "(GODOT_CSHARP_BIN) and `args` to ['--path', <C# project>]; override either to debug a different .NET program. " +
             "Any breakpoints set beforehand are applied during the handshake. Requires netcoredbg (GODOT_CSDAP_CMD) — " +
-            "absent, the lazy spawn fails with an actionable hint rather than hanging.",
+            "absent, the lazy spawn fails with an actionable hint rather than hanging. A launch the adapter rejects " +
+            "(a program that does not exist, or is not a .NET assembly) is reported as an error: it previously answered " +
+            "state 'running' for a session that never started. With `stop_on_entry` the call waits for the entry stop, " +
+            "so it returns state 'stopped' with a usable thread — not 'running'.",
         inputSchema: {
             program: z.string().optional().describe("Path to the program to launch (default: the Mono/.NET Godot binary)"),
             args: z.array(z.string()).optional().describe("Program arguments (default: ['--path', <C# project>])"),
@@ -105,12 +196,29 @@ export function registerCsDapTools(server, dap, cfg) {
     server.registerTool("cs_dbg_attach", {
         title: "Attach C# debug session",
         description: "Attach netcoredbg to an already-running .NET process (e.g. a C# Godot game launched separately) by its OS process id. " +
-            "Any breakpoints set beforehand are applied during the handshake.",
+            "Any breakpoints set beforehand are applied during the handshake. A process id nothing is running under is refused " +
+            "rather than reported as an attached session; a process owned by another user is a legitimate target and is not refused.",
         inputSchema: {
-            process_id: z.number().int().describe("OS process id of the running .NET process to attach to"),
+            // .positive(): a pid is 1 or greater. `-1` and `0` are not process ids, and
+            // both were measured answering `isError:false state:"running"` — a phantom
+            // session against a process that cannot exist.
+            process_id: z.number().int().positive().describe("OS process id of the running .NET process to attach to"),
         },
     }, async ({ process_id }) => {
         try {
+            // Refuse a pid nothing is running under, BEFORE the handshake. `kill(pid, 0)`
+            // signals nothing; it only asks the kernel about the process. ESRCH means no
+            // such process. EPERM means it EXISTS and is owned by someone else — that is a
+            // legitimate attach target, so it must NOT be refused here.
+            try {
+                process.kill(process_id, 0);
+            }
+            catch (err) {
+                if (err?.code === "ESRCH") {
+                    refuse(`Refusing to attach to process ${process_id}: no such process. The debug session ` +
+                        `was previously reported as "running" against a process that does not exist.`, "no_such_process");
+                }
+            }
             await dap.start("attach", { processId: process_id });
             return ok({ session_id: "csharp", state: dap.state });
         }
@@ -123,7 +231,10 @@ export function registerCsDapTools(server, dap, cfg) {
         description: "Set (replace) the breakpoints for a C# source file. Applied immediately if a session is running, else buffered until launch/attach. " +
             "Feature-detected: the per-line `conditions` modifier is only sent when the connected adapter advertises supportsConditionalBreakpoints " +
             "(netcoredbg does); on an adapter that advertises it unsupported the modifier is dropped and the result carries `unsupported_modifiers` " +
-            "plus a `warning`. Detection needs a live session, so set conditions after cs_dbg_launch/cs_dbg_attach.",
+            "plus a `warning`. Detection needs a live session, so set conditions after cs_dbg_launch/cs_dbg_attach. " +
+            "A path that names nothing, or names a directory, is refused: it previously answered exactly like a real file. " +
+            "A res:// or relative path that resolves outside the C# project root is refused too; an absolute path elsewhere " +
+            "is legal, because debugging a different .NET program is supported.",
         inputSchema: {
             path: z.string().describe("C# script path (res://..., absolute, or relative to the C# project root)"),
             lines: z.array(z.number().int().positive()).describe("1-based line numbers"),
@@ -131,7 +242,7 @@ export function registerCsDapTools(server, dap, cfg) {
         },
     }, async ({ path, lines, conditions }) => {
         try {
-            const fsPath = toFsPath(path, cfg.csDapProjectPath);
+            const fsPath = guardSource(path);
             // Feature-detect the condition modifier against the connected adapter. Only when it does
             // not advertise supportsConditionalBreakpoints do we DROP conditions and warn — otherwise
             // a "conditional" breakpoint could halt unconditionally on an adapter that ignores them.
@@ -346,7 +457,8 @@ export function registerCsDapTools(server, dap, cfg) {
         description: "Enable (replace) the debugger's exception breakpoint filters so execution halts when a matching .NET exception is thrown " +
             "(DAP setExceptionBreakpoints). Pass the filter IDs to enable; call with no filters (or []) to clear them. The result echoes the " +
             "active filters and lists `available_filters` — the exception filters the connected adapter advertises (netcoredbg exposes `all` " +
-            "for every thrown exception and `user-unhandled`). Requires a running debug session. Not gated (it only configures the debugger). " +
+            "for every thrown exception and `user-unhandled`). A filter id the adapter does not advertise is refused by name, listing the real " +
+            "ones, rather than forwarded to the adapter as an opaque failure. Requires a running debug session. Not gated (it only configures the debugger). " +
             "Feature-detected: on an adapter that advertises no exceptionBreakpointFilters it returns a clear \"unsupported\" message WITHOUT sending anything.",
         inputSchema: {
             filters: z.array(z.string()).optional().describe("Exception filter IDs to enable (default none = clear). Choose from available_filters in the result (netcoredbg: 'all', 'user-unhandled')."),
@@ -367,6 +479,18 @@ export function registerCsDapTools(server, dap, cfg) {
                 };
             }
             const active = filters ?? [];
+            // 🔴 The empty case was validated; MEMBERSHIP was not. An id the adapter never
+            // advertised went straight to the wire and came back
+            // `Failed command 'setExceptionBreakpoints' : 0x80070057` — a hex code for a
+            // question the host already had the answer to, since `available_filters` is
+            // right here. Name the bad filter and list the real ones instead.
+            const known = new Set(available_filters.map((f) => f.filter));
+            const unknown = active.filter((f) => !known.has(f));
+            if (unknown.length) {
+                refuse(`Refusing exception filter(s) ${unknown.map((f) => JSON.stringify(f)).join(", ")}: the ` +
+                    `connected C# debug adapter does not advertise them. Available: ` +
+                    `${available_filters.map((f) => f.filter).join(", ")}.`, "unknown_exception_filter");
+            }
             const body = await dap.request("setExceptionBreakpoints", { filters: active });
             const breakpoints = Array.isArray(body["breakpoints"])
                 ? body["breakpoints"].map((b) => ({ verified: Boolean(b.verified) }))

package/dist/tools/cslsp.js

@@ -1,6 +1,6 @@
 import fs from "node:fs";
 import { z } from "zod";
-import { toFileUri, toFsPath, readFileText } from "../paths.js";
+import { toFileUri, toFsPath, readFileText, resolveSourceFile } from "../paths.js";
 import { gate } from "../confirm.js";
 import { COMPLETION_KIND, SYMBOL_KIND, ok, fail, markupToString, isMethodNotFound, normalizeLocations, applyTextEdits, normalizeWorkspaceEdit, } from "./lsp-common.js";
 /**
@@ -32,17 +32,100 @@ function unsupportedCsLsp(tool, method, capability, alt) {
             }],
     };
 }
+/**
+ * A C# identifier: the only thing `cs_rename` may rename a symbol TO.
+ *
+ * This is the spec shape (identifier-start-character then identifier-part-characters),
+ * NOT an ASCII approximation — `Ångström` and `日本語` are legal C# identifiers and a
+ * rename to one produces a file that compiles, so refusing them would be wrong.
+ *
+ * The leading `@` is C#'s verbatim-identifier prefix: `@class` IS a legal identifier
+ * precisely BECAUSE it escapes the keyword, so a `@`-prefixed name skips the reserved
+ * word check below rather than being refused by it.
+ */
+const CS_IDENTIFIER = /^@?[\p{L}\p{Nl}_][\p{L}\p{Nl}\p{Mn}\p{Mc}\p{Nd}\p{Pc}\p{Cf}]*$/u;
+/**
+ * C# **reserved** keywords. A rename to one of these is shaped like an identifier but
+ * produces a file the compiler rejects, so it is refused for the same reason.
+ *
+ * Deliberately excludes CONTEXTUAL keywords (`var`, `value`, `async`, `await`, `yield`,
+ * `nameof`, `record`, `when`, `from`, `select`, …) — those are legal identifiers and a
+ * rename to one compiles. Framework type names (`Console`, `String`, `Task`) are legal
+ * too and are likewise not listed, the same call `gd_rename` makes for engine classes.
+ */
+const CS_KEYWORDS = new Set([
+    "abstract", "as", "base", "bool", "break", "byte", "case", "catch", "char", "checked",
+    "class", "const", "continue", "decimal", "default", "delegate", "do", "double", "else",
+    "enum", "event", "explicit", "extern", "false", "finally", "fixed", "float", "for",
+    "foreach", "goto", "if", "implicit", "in", "int", "interface", "internal", "is", "lock",
+    "long", "namespace", "new", "null", "object", "operator", "out", "override", "params",
+    "private", "protected", "public", "readonly", "ref", "return", "sbyte", "sealed",
+    "short", "sizeof", "stackalloc", "static", "string", "struct", "switch", "this",
+    "throw", "true", "try", "typeof", "uint", "ulong", "unchecked", "unsafe", "ushort",
+    "using", "virtual", "void", "volatile", "while",
+]);
+/**
+ * This plane's shipped refusal wording, kept verbatim while the guard itself moved to
+ * `paths.ts` (161 §8 item 5). `cs-lsp-plane.integration.mjs` pins /outside the C#
+ * project root/ by regex, so the `root` phrase here is a contract, not decoration —
+ * and it is the reason `paths.ts` takes the wording as a parameter instead of
+ * hardcoding "Godot" the way the tabletop helper does.
+ *
+ * Measured against OmniSharp v1.39.15: `res://../../../etc/passwd`, a bare
+ * `/etc/passwd` and `res://../../README.md` each resolved outside the project root and
+ * were answered with `isError: false`. And this plane had the SHARPER existence repro:
+ * `cs_document_symbols` returned byte-identical `{"symbols":[]}` for a MISSING file,
+ * a genuinely EMPTY one, and a DIRECTORY — three states, one answer.
+ */
+const CS_LSP_PATHS = {
+    root: "the C# project root",
+    escapeHint: "Pass a res:// path, or a path inside the project.",
+    missingHint: "It was previously opened as an EMPTY document, so the language server answered " +
+        "about a file that does not exist.",
+};
 export function registerCsLspTools(server, cslsp, cfg) {
     const root = cfg.csLspProjectPath;
+    /**
+     * Resolve a caller-supplied script path and REFUSE one that escapes the C# project
+     * root, names nothing, or names something that is not a regular file. This is the
+     * same guard the `gd_*` plane grew in 1.34.0, ported after measuring the `cs_*`
+     * plane against a real OmniSharp — the defects are the same shape, but two of them
+     * present differently, and the comments record what was measured HERE, not there.
+     *
+     * `toFsPath` joins through `path.join`, which normalizes `..` away silently.
+     * Measured against OmniSharp v1.39.15: `res://../../../etc/passwd`, a bare
+     * `/etc/passwd` and `res://../../README.md` each resolved outside the project root
+     * and were answered with `isError: false`. Nothing leaked — the answer was the same
+     * degenerate one any unloaded path produces — but nothing refused them either.
+     *
+     * The comparison is against `root + path.sep`, never a bare `startsWith(root)`: the
+     * latter accepts a SIBLING directory that merely shares the root's name prefix.
+     */
+    const guardPath = (p) => {
+        resolveSourceFile(p, root, CS_LSP_PATHS);
+    };
     const openAndPos = async (path) => {
+        guardPath(path);
         const uri = toFileUri(path, root);
         await cslsp.ensureOpen(uri, readFileText(toFsPath(path, root)));
         return uri;
     };
     const posSchema = {
         path: z.string().describe("C# script path (res://..., absolute, or relative to the C# project root)"),
-        line: z.number().int().describe("0-based line"),
-        character: z.number().int().describe("0-based character"),
+        // .min(0): a negative line or character is not a position. The symptom here is
+        // NOT the GDScript one — measured against OmniSharp, a negative position does not
+        // come back a silent success, it comes back
+        // `LSP error [-32603]: Internal Error - System.ArgumentOutOfRangeException ...`
+        // with a .NET stack trace leaking into the tool's answer, on cs_hover,
+        // cs_definition, cs_references, cs_completion and cs_signature_help alike.
+        // A schema-legal call that can only ever produce an internal-error trace should
+        // be refused before it reaches the wire.
+        //
+        // NOTE the bound is one-sided and deliberately so: a line number PAST the end of
+        // the file produces the same -32603, and no schema can know the file's length.
+        // That case is out of scope here, not fixed by this.
+        line: z.number().int().min(0).describe("0-based line"),
+        character: z.number().int().min(0).describe("0-based character"),
     };
     server.registerTool("cs_completion", { title: "C# completion", description: "Type-aware C# code completion at a position via OmniSharp.", inputSchema: posSchema }, async ({ path, line, character }) => {
         try {
@@ -98,15 +181,37 @@ export function registerCsLspTools(server, cslsp, cfg) {
     });
     server.registerTool("cs_rename", {
         title: "C# rename symbol",
-        description: "Rename a C# symbol project-wide via OmniSharp. Returns the planned edit; pass apply=true to WRITE the changes to disk (DESTRUCTIVE — confirm with the user).",
+        description: "Rename a C# symbol project-wide via OmniSharp. Returns the planned edit; pass apply=true to WRITE the changes to disk (DESTRUCTIVE — confirm with the user). " +
+            "new_name must be a valid C# identifier and not a reserved keyword: the language server plans a rename to any string, including one that would write a file the C# compiler rejects, so an illegal name is refused here before the rename is planned. Verbatim identifiers (@class) and contextual keywords (var, value, async) are legal and accepted.",
         inputSchema: {
             ...posSchema,
-            new_name: z.string().describe("New symbol name"),
+            new_name: z.string().describe("New symbol name — a valid C# identifier, optionally @-prefixed"),
             apply: z.boolean().optional().describe("Write edits to disk (default false = dry run)"),
             confirm: z.boolean().optional().describe("Auto-approve writing edits (skip the confirmation prompt); only relevant with apply=true"),
         },
     }, async ({ path, line, character, new_name, apply, confirm }) => {
         try {
+            // Refuse BEFORE planning. OmniSharp does not validate the new name.
+            // Measured against a real OmniSharp v1.39.15 on the example-csharp fixture:
+            // a rename to "1bad name!", "class", "int", "  ", "a\nb" or "my-name" each
+            // came back `isError: false` with a five-edit plan across Player.cs — and
+            // with apply:true the host WRITES those edits, producing C# that does not
+            // compile. The one string OmniSharp itself rejects is "", and it rejects it
+            // with an internal assertion failure ("Unexpected true - file Renamer.cs
+            // line 151"), not a usable validation error. So the refusal has to happen
+            // here for all of them, including "".
+            if (!CS_IDENTIFIER.test(new_name)) {
+                throw Object.assign(new Error(`Refusing to rename to ${JSON.stringify(new_name)}: it is not a valid C# ` +
+                    `identifier (a letter or underscore, then letters, digits or underscores; ` +
+                    `optionally @-prefixed). The language server will plan this rename anyway ` +
+                    `and the written file would not compile.`), { refusal: true, code: "invalid_identifier" });
+            }
+            // The @ prefix is what MAKES a keyword legal, so it exempts the name here.
+            if (!new_name.startsWith("@") && CS_KEYWORDS.has(new_name)) {
+                throw Object.assign(new Error(`Refusing to rename to "${new_name}": it is a C# reserved keyword. The ` +
+                    `language server will plan this rename anyway and the written file would ` +
+                    `not compile. Pass "@${new_name}" if you meant the verbatim identifier.`), { refusal: true, code: "reserved_word" });
+            }
             const uri = await openAndPos(path);
             const edit = await cslsp.request("textDocument/rename", {
                 textDocument: { uri }, position: { line, character }, newName: new_name,