dominus-cli 2.1.0 → 2.1.1

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 2.1.1 (2026-07-13)
+
+### Studio connection reliability
+
+- Made pending WebStream connection attempts cancellable so overlapping retries
+  cannot strand a waiting coroutine or deadlock future reconnects.
+- Serialized reconnect attempts and reset failed open transports explicitly.
+- Changed the Dominus 2 toolbar button to always force an immediate reconnect
+  instead of toggling automatic reconnection off.
+
+### Typed mutations and packaging
+
+- Fixed valid Enum values such as `Slate`, `Wood`, `Glass`, and `Ball` being
+  rejected by resolving names against the live Enum type's items.
+- Removed the stale binary `.rbxm` build artifact. The package and installer now
+  use the single canonical `.rbxmx` plugin build.
+- Corrected documentation to describe the 16-tool MCP catalog and optional Studio
+  restart behavior.
+
 ## 2.1.0 (2026-07-12)
 
 Dominus has been rewritten as an MCP-first Roblox Studio engineering server.
@@ -8,7 +27,7 @@ Dominus has been rewritten as an MCP-first Roblox Studio engineering server.
 
 - Removed the Ink/TUI command from the published binaries. Dominus now relies on
   the MCP host's model, context, consent UI, and agent runtime.
-- Replaced the monolithic legacy catalog with 17 focused tools for connection
+- Replaced the monolithic legacy catalog with 16 focused tools for connection
   management, inspection, transactional changes, UI, scripts, tests, and docs.
 - Added strict input schemas, output schemas, `structuredContent`, text fallbacks,
   `isError`, and accurate read-only/destructive/idempotent/open-world annotations.
@@ -20,7 +39,8 @@ Dominus has been rewritten as an MCP-first Roblox Studio engineering server.
 ### Secure Studio bridge
 
 - Bound the WebSocket bridge to `127.0.0.1` instead of every network interface.
-- Added a persistent 256-bit bridge token and six-digit first-use pairing flow.
+- Added a persistent 256-bit bridge token that is provisioned directly into the
+  local plugin by `dominus-install-plugin`; users do not complete a pairing flow.
 - Authenticated relay/controller processes as well as Studio plugin connections.
 - Added one MiB payload limits, socket rate limits, handshake timeouts, bounded
   request timeouts, and strict message-envelope validation.
@@ -36,7 +56,7 @@ Dominus has been rewritten as an MCP-first Roblox Studio engineering server.
   same place ID are now safe and independently selectable.
 - Relay clients carry their selected connection on each request, so separate MCP
   processes cannot overwrite each other's active target.
-- Added `dominus_status`, `dominus_pair_studio`, and `dominus_select_studio`.
+- Added `dominus_status` and `dominus_select_studio`.
 
 ### Studio plugin harness
 
@@ -66,7 +86,7 @@ Dominus has been rewritten as an MCP-first Roblox Studio engineering server.
   installer implementation.
 - The published runtime dependency set is MCP-only; old CLI dependencies are
   development-only and excluded from the MCP bundle.
-- Added transport tests for auth, pairing, relays, duplicate places, wrong-target
+- Added transport tests for auth, credential rejection, relays, duplicate places, wrong-target
   responses, and disconnect isolation.
 - Added in-memory MCP conformance tests for the tool catalog, structured outputs,
   resources, prompts, routing, and error results.

package/README.md

@@ -8,12 +8,12 @@ Luau execution.
 ## What changed
 
 - MCP-only product: the old Ink chat CLI is no longer published.
-- 17 focused tools with input/output schemas, structured results, and risk hints.
+- 16 focused tools with input/output schemas, structured results, and risk hints.
 - Stable instance refs survive dots in names, renames, reparenting, and duplicate
   sibling names for the life of the Studio session.
 - Script writes require a revision from `studio_read_script`.
 - Mutation batches and UI replacement are undoable and roll back on failure.
-- The loopback Studio bridge requires a persistent token and first-use pairing.
+- The installer provisions a private bridge token into the local Studio plugin.
 - Multiple Studio windows are selected by unique connection ID, not place ID.
 - Roblox Creator Docs API lookup is built in.
 
@@ -39,7 +39,8 @@ Install or update the Studio plugin:
 dominus-install-plugin
 ```
 
-Restart Roblox Studio after installing the plugin.
+Roblox Studio normally reloads the local plugin automatically. Restart Studio
+only if the Dominus 2 toolbar button does not appear or reconnect.
 
 ## MCP configuration
 
@@ -62,7 +63,7 @@ For a version-pinned configuration that does not require a global install:
   "mcpServers": {
     "dominus": {
       "command": "npx",
-      "args": ["-y", "-p", "dominus-cli@2.1.0", "dominus-mcp"]
+      "args": ["-y", "-p", "dominus-cli@2.1.1", "dominus-mcp"]
     }
   }
 }
@@ -72,12 +73,9 @@ Restart the MCP client after changing its configuration.
 
 ## First connection
 
-1. Start the MCP client so `dominus-mcp` is running.
-2. Open Roblox Studio. The Dominus 2 plugin connects to `127.0.0.1:18088`.
-3. On first use, Studio Output prints a connection ID and six-digit pairing code.
-4. Ask the MCP agent to call `dominus_status`, then `dominus_pair_studio` with
-   that connection ID and code.
-5. Pairing is saved. Future Studio sessions authenticate automatically.
+1. Run `dominus-install-plugin`; restart Roblox Studio only if it does not reload.
+2. Start the MCP client so `dominus-mcp` is running.
+3. Open Roblox Studio. The plugin connects and authenticates automatically.
 
 If several Studio windows are open, call `dominus_select_studio` with the exact
 connection ID before editing. Two windows on the same place ID remain distinct.
@@ -101,7 +99,6 @@ successful write response alone.
 Connection tools:
 
 - `dominus_status`
-- `dominus_pair_studio`
 - `dominus_select_studio`
 
 Studio inspection:
@@ -131,9 +128,10 @@ Roblox documentation:
 
 The MCP transport is stdio. The separate Studio WebSocket bridge binds only to
 `127.0.0.1`, limits messages to one MiB, rate-limits sockets, times out incomplete
-handshakes, and authenticates both Studio plugins and relay controllers. First-use
-pairing requires a code visible in Studio. The plugin only accepts an explicit
-command allowlist and contains no `loadstring` executor.
+handshakes, and authenticates both Studio plugins and relay controllers. The local
+installer injects a user-specific token into the plugin, so no manual pairing flow
+is needed. The plugin only accepts an explicit command allowlist and contains no
+`loadstring` executor.
 
 The bridge token protects against accidental or opportunistic access by unrelated
 local processes. Like other user-level credentials, it cannot protect against a

package/dist/install-plugin.js

@@ -1,30 +1,75 @@
 #!/usr/bin/env node
-import fs from 'fs';
-import os from 'os';
-import path from 'path';
+import fs3 from 'fs';
+import os2 from 'os';
+import path3 from 'path';
 import { fileURLToPath } from 'url';
+import * as crypto from 'crypto';
 
+var DOMINUS_DIR = path3.join(os2.homedir(), ".dominus");
+path3.join(DOMINUS_DIR, "config.json");
+path3.join(DOMINUS_DIR, "dominus.db");
+path3.join(DOMINUS_DIR, "rules.json");
+function ensureDir() {
+  if (!fs3.existsSync(DOMINUS_DIR)) {
+    fs3.mkdirSync(DOMINUS_DIR, { recursive: true });
+  }
+}
+function getDominusDir() {
+  ensureDir();
+  return DOMINUS_DIR;
+}
+
+// src/transport/auth.ts
+var TOKEN_FILE = "bridge-token";
+function loadOrCreateBridgeToken() {
+  const tokenPath = path3.join(getDominusDir(), TOKEN_FILE);
+  try {
+    const existing = fs3.readFileSync(tokenPath, "utf8").trim();
+    if (existing.length >= 32) return existing;
+  } catch {
+  }
+  const token = crypto.randomBytes(32).toString("base64url");
+  fs3.writeFileSync(tokenPath, `${token}
+`, { encoding: "utf8", mode: 384 });
+  try {
+    fs3.chmodSync(tokenPath, 384);
+  } catch {
+  }
+  return token;
+}
+
+// src/install-plugin.ts
+var TOKEN_PLACEHOLDER = "__DOMINUS_BRIDGE_TOKEN__";
 function getPluginDirectory() {
   if (process.platform === "win32") {
     const localAppData = process.env.LOCALAPPDATA;
     if (!localAppData) throw new Error("LOCALAPPDATA is not set");
-    return path.join(localAppData, "Roblox", "Plugins");
+    return path3.join(localAppData, "Roblox", "Plugins");
   }
   if (process.platform === "darwin") {
-    return path.join(os.homedir(), "Documents", "Roblox", "Plugins");
+    return path3.join(os2.homedir(), "Documents", "Roblox", "Plugins");
   }
-  return path.join(os.homedir(), ".local", "share", "Roblox", "Plugins");
+  return path3.join(os2.homedir(), ".local", "share", "Roblox", "Plugins");
 }
-var distDirectory = path.dirname(fileURLToPath(import.meta.url));
-var source = path.resolve(distDirectory, "..", "plugin", "Dominus.rbxm");
+var distDirectory = path3.dirname(fileURLToPath(import.meta.url));
+var source = path3.resolve(distDirectory, "..", "plugin", "Dominus.rbxmx");
 var destinationDirectory = getPluginDirectory();
-var destination = path.join(destinationDirectory, "Dominus2.rbxm");
-if (!fs.existsSync(source)) {
+var destination = path3.join(destinationDirectory, "Dominus2.rbxmx");
+if (!fs3.existsSync(source)) {
   throw new Error(`Packaged plugin not found at ${source}. Run pnpm build:plugin first.`);
 }
-fs.mkdirSync(destinationDirectory, { recursive: true });
-fs.copyFileSync(source, destination);
+var template = fs3.readFileSync(source, "utf8");
+if (!template.includes(TOKEN_PLACEHOLDER)) {
+  throw new Error("Packaged plugin template is missing its bridge token placeholder");
+}
+var personalizedPlugin = template.replaceAll(TOKEN_PLACEHOLDER, loadOrCreateBridgeToken());
+fs3.mkdirSync(destinationDirectory, { recursive: true });
+fs3.writeFileSync(destination, personalizedPlugin, "utf8");
+for (const obsoleteName of ["Dominus2.rbxm", "Dominus.rbxm", "Dominus.rbxmx"]) {
+  const obsoletePath = path3.join(destinationDirectory, obsoleteName);
+  if (obsoletePath !== destination) fs3.rmSync(obsoletePath, { force: true });
+}
 console.log(`Installed Dominus 2 Studio plugin to ${destination}`);
-console.log("Restart Roblox Studio, start dominus-mcp, then approve the pairing code shown in Studio Output.");
+console.log("Restart Roblox Studio. Dominus 2 will authenticate automatically when dominus-mcp starts.");
 //# sourceMappingURL=install-plugin.js.map
 //# sourceMappingURL=install-plugin.js.map

package/dist/install-plugin.js.map

@@ -1 +1 @@
-{"version":3,"sources":["../src/install-plugin.ts"],"names":[],"mappings":";;;;;;AAKA,SAAS,kBAAA,GAA6B;AACpC,EAAA,IAAI,OAAA,CAAQ,aAAa,OAAA,EAAS;AAChC,IAAA,MAAM,YAAA,GAAe,QAAQ,GAAA,CAAI,YAAA;AACjC,IAAA,IAAI,CAAC,YAAA,EAAc,MAAM,IAAI,MAAM,yBAAyB,CAAA;AAC5D,IAAA,OAAO,IAAA,CAAK,IAAA,CAAK,YAAA,EAAc,QAAA,EAAU,SAAS,CAAA;AAAA,EACpD;AACA,EAAA,IAAI,OAAA,CAAQ,aAAa,QAAA,EAAU;AACjC,IAAA,OAAO,KAAK,IAAA,CAAK,EAAA,CAAG,SAAQ,EAAG,WAAA,EAAa,UAAU,SAAS,CAAA;AAAA,EACjE;AACA,EAAA,OAAO,IAAA,CAAK,KAAK,EAAA,CAAG,OAAA,IAAW,QAAA,EAAU,OAAA,EAAS,UAAU,SAAS,CAAA;AACvE;AAEA,IAAM,gBAAgB,IAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAM,SAAS,IAAA,CAAK,OAAA,CAAQ,aAAA,EAAe,IAAA,EAAM,UAAU,cAAc,CAAA;AACzE,IAAM,uBAAuB,kBAAA,EAAmB;AAChD,IAAM,WAAA,GAAc,IAAA,CAAK,IAAA,CAAK,oBAAA,EAAsB,eAAe,CAAA;AAEnE,IAAI,CAAC,EAAA,CAAG,UAAA,CAAW,MAAM,CAAA,EAAG;AAC1B,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,MAAM,CAAA,8BAAA,CAAgC,CAAA;AACxF;AAEA,EAAA,CAAG,SAAA,CAAU,oBAAA,EAAsB,EAAE,SAAA,EAAW,MAAM,CAAA;AACtD,EAAA,CAAG,YAAA,CAAa,QAAQ,WAAW,CAAA;AACnC,OAAA,CAAQ,GAAA,CAAI,CAAA,qCAAA,EAAwC,WAAW,CAAA,CAAE,CAAA;AACjE,OAAA,CAAQ,IAAI,iGAAiG,CAAA","file":"install-plugin.js","sourcesContent":["import fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\n\nfunction getPluginDirectory(): string {\n  if (process.platform === 'win32') {\n    const localAppData = process.env.LOCALAPPDATA;\n    if (!localAppData) throw new Error('LOCALAPPDATA is not set');\n    return path.join(localAppData, 'Roblox', 'Plugins');\n  }\n  if (process.platform === 'darwin') {\n    return path.join(os.homedir(), 'Documents', 'Roblox', 'Plugins');\n  }\n  return path.join(os.homedir(), '.local', 'share', 'Roblox', 'Plugins');\n}\n\nconst distDirectory = path.dirname(fileURLToPath(import.meta.url));\nconst source = path.resolve(distDirectory, '..', 'plugin', 'Dominus.rbxm');\nconst destinationDirectory = getPluginDirectory();\nconst destination = path.join(destinationDirectory, 'Dominus2.rbxm');\n\nif (!fs.existsSync(source)) {\n  throw new Error(`Packaged plugin not found at ${source}. Run pnpm build:plugin first.`);\n}\n\nfs.mkdirSync(destinationDirectory, { recursive: true });\nfs.copyFileSync(source, destination);\nconsole.log(`Installed Dominus 2 Studio plugin to ${destination}`);\nconsole.log('Restart Roblox Studio, start dominus-mcp, then approve the pairing code shown in Studio Output.');\n"]}
+{"version":3,"sources":["../src/config/config.ts","../src/transport/auth.ts","../src/install-plugin.ts"],"names":["path","os","fs"],"mappings":";;;;;;;AAKA,IAAM,cAAcA,KAAA,CAAK,IAAA,CAAKC,GAAA,CAAG,OAAA,IAAW,UAAU,CAAA;AAClCD,KAAA,CAAK,IAAA,CAAK,WAAA,EAAa,aAAa;AACxCA,KAAA,CAAK,IAAA,CAAK,WAAA,EAAa,YAAY;AAChCA,KAAA,CAAK,IAAA,CAAK,WAAA,EAAa,YAAY;AA6HtD,SAAS,SAAA,GAAkB;AACzB,EAAA,IAAI,CAACE,GAAA,CAAG,UAAA,CAAW,WAAW,CAAA,EAAG;AAC/B,IAAAA,GAAA,CAAG,SAAA,CAAU,WAAA,EAAa,EAAE,SAAA,EAAW,MAAM,CAAA;AAAA,EAC/C;AACF;AAoDO,SAAS,aAAA,GAAwB;AACtC,EAAA,SAAA,EAAU;AACV,EAAA,OAAO,WAAA;AACT;;;AC3LA,IAAM,UAAA,GAAa,cAAA;AAEZ,SAAS,uBAAA,GAAkC;AAChD,EAAA,MAAM,SAAA,GAAYF,KAAAA,CAAK,IAAA,CAAK,aAAA,IAAiB,UAAU,CAAA;AACvD,EAAA,IAAI;AACF,IAAA,MAAM,WAAWE,GAAAA,CAAG,YAAA,CAAa,SAAA,EAAW,MAAM,EAAE,IAAA,EAAK;AACzD,IAAA,IAAI,QAAA,CAAS,MAAA,IAAU,EAAA,EAAI,OAAO,QAAA;AAAA,EACpC,CAAA,CAAA,MAAQ;AAAA,EAER;AAEA,EAAA,MAAM,KAAA,GAAe,MAAA,CAAA,WAAA,CAAY,EAAE,CAAA,CAAE,SAAS,WAAW,CAAA;AACzD,EAAAA,GAAAA,CAAG,aAAA,CAAc,SAAA,EAAW,CAAA,EAAG,KAAK;AAAA,CAAA,EAAM,EAAE,QAAA,EAAU,MAAA,EAAQ,IAAA,EAAM,KAAO,CAAA;AAC3E,EAAA,IAAI;AACF,IAAAA,GAAAA,CAAG,SAAA,CAAU,SAAA,EAAW,GAAK,CAAA;AAAA,EAC/B,CAAA,CAAA,MAAQ;AAAA,EAER;AACA,EAAA,OAAO,KAAA;AACT;;;AClBA,IAAM,iBAAA,GAAoB,0BAAA;AAE1B,SAAS,kBAAA,GAA6B;AACpC,EAAA,IAAI,OAAA,CAAQ,aAAa,OAAA,EAAS;AAChC,IAAA,MAAM,YAAA,GAAe,QAAQ,GAAA,CAAI,YAAA;AACjC,IAAA,IAAI,CAAC,YAAA,EAAc,MAAM,IAAI,MAAM,yBAAyB,CAAA;AAC5D,IAAA,OAAOF,KAAAA,CAAK,IAAA,CAAK,YAAA,EAAc,QAAA,EAAU,SAAS,CAAA;AAAA,EACpD;AACA,EAAA,IAAI,OAAA,CAAQ,aAAa,QAAA,EAAU;AACjC,IAAA,OAAOA,MAAK,IAAA,CAAKC,GAAAA,CAAG,SAAQ,EAAG,WAAA,EAAa,UAAU,SAAS,CAAA;AAAA,EACjE;AACA,EAAA,OAAOD,KAAAA,CAAK,KAAKC,GAAAA,CAAG,OAAA,IAAW,QAAA,EAAU,OAAA,EAAS,UAAU,SAAS,CAAA;AACvE;AAEA,IAAM,gBAAgBD,KAAAA,CAAK,OAAA,CAAQ,aAAA,CAAc,MAAA,CAAA,IAAA,CAAY,GAAG,CAAC,CAAA;AACjE,IAAM,SAASA,KAAAA,CAAK,OAAA,CAAQ,aAAA,EAAe,IAAA,EAAM,UAAU,eAAe,CAAA;AAC1E,IAAM,uBAAuB,kBAAA,EAAmB;AAChD,IAAM,WAAA,GAAcA,KAAAA,CAAK,IAAA,CAAK,oBAAA,EAAsB,gBAAgB,CAAA;AAEpE,IAAI,CAACE,GAAAA,CAAG,UAAA,CAAW,MAAM,CAAA,EAAG;AAC1B,EAAA,MAAM,IAAI,KAAA,CAAM,CAAA,6BAAA,EAAgC,MAAM,CAAA,8BAAA,CAAgC,CAAA;AACxF;AAEA,IAAM,QAAA,GAAWA,GAAAA,CAAG,YAAA,CAAa,MAAA,EAAQ,MAAM,CAAA;AAC/C,IAAI,CAAC,QAAA,CAAS,QAAA,CAAS,iBAAiB,CAAA,EAAG;AACzC,EAAA,MAAM,IAAI,MAAM,kEAAkE,CAAA;AACpF;AACA,IAAM,kBAAA,GAAqB,QAAA,CAAS,UAAA,CAAW,iBAAA,EAAmB,yBAAyB,CAAA;AAE3FA,GAAAA,CAAG,SAAA,CAAU,oBAAA,EAAsB,EAAE,SAAA,EAAW,MAAM,CAAA;AACtDA,GAAAA,CAAG,aAAA,CAAc,WAAA,EAAa,kBAAA,EAAoB,MAAM,CAAA;AACxD,KAAA,MAAW,YAAA,IAAgB,CAAC,eAAA,EAAiB,cAAA,EAAgB,eAAe,CAAA,EAAG;AAC7E,EAAA,MAAM,YAAA,GAAeF,KAAAA,CAAK,IAAA,CAAK,oBAAA,EAAsB,YAAY,CAAA;AACjE,EAAA,IAAI,YAAA,KAAiB,aAAaE,GAAAA,CAAG,OAAO,YAAA,EAAc,EAAE,KAAA,EAAO,IAAA,EAAM,CAAA;AAC3E;AACA,OAAA,CAAQ,GAAA,CAAI,CAAA,qCAAA,EAAwC,WAAW,CAAA,CAAE,CAAA;AACjE,OAAA,CAAQ,IAAI,2FAA2F,CAAA","file":"install-plugin.js","sourcesContent":["import fs from 'node:fs';\nimport path from 'node:path';\nimport os from 'node:os';\nimport type { ConfigAccess } from '../tools/types.js';\n\nconst DOMINUS_DIR = path.join(os.homedir(), '.dominus');\nconst CONFIG_PATH = path.join(DOMINUS_DIR, 'config.json');\nconst DB_PATH = path.join(DOMINUS_DIR, 'dominus.db');\nconst RULES_PATH = path.join(DOMINUS_DIR, 'rules.json');\n\nexport type AIProviderType =\n  | 'openai'\n  | 'anthropic'\n  | 'gemini'\n  | 'xai'\n  | 'openrouter'\n  | 'custom';\n\nexport interface ProviderConfig {\n  name: string;\n  baseUrl: string;\n  envVar: string;\n  defaultModel: string;\n}\n\nexport const PROVIDERS: Record<AIProviderType, ProviderConfig> = {\n  openai: {\n    name: 'OpenAI',\n    baseUrl: 'https://api.openai.com/v1',\n    envVar: 'OPENAI_API_KEY',\n    defaultModel: 'gpt-5.3-codex',\n  },\n  anthropic: {\n    name: 'Anthropic',\n    baseUrl: 'https://api.anthropic.com/v1/',\n    envVar: 'ANTHROPIC_API_KEY',\n    defaultModel: 'claude-sonnet-4-6',\n  },\n  gemini: {\n    name: 'Google Gemini',\n    baseUrl: 'https://generativelanguage.googleapis.com/v1beta/openai',\n    envVar: 'GEMINI_API_KEY',\n    defaultModel: 'gemini-3.1-pro',\n  },\n  xai: {\n    name: 'xAI (Grok)',\n    baseUrl: 'https://api.x.ai/v1',\n    envVar: 'XAI_API_KEY',\n    defaultModel: 'grok-4.2',\n  },\n  openrouter: {\n    name: 'OpenRouter',\n    baseUrl: 'https://openrouter.ai/api/v1',\n    envVar: 'OPENROUTER_API_KEY',\n    defaultModel: 'anthropic/claude-sonnet-4-6',\n  },\n  custom: {\n    name: 'Custom',\n    baseUrl: '',\n    envVar: '',\n    defaultModel: '',\n  },\n};\n\nexport interface DominusConfig {\n  provider: AIProviderType;\n  apiKey?: string;\n  apiBaseUrl: string;\n  model: string;\n  port: number;\n  maxToolIterations: number;\n  maxVerifyRetries: number;\n  tokenBudget: number;\n  autoIndex: boolean;\n  autoLearn: boolean;\n  userName: string;\n  openCloudApiKey?: string;\n}\n\nconst DEFAULTS: DominusConfig = {\n  provider: 'openai',\n  apiBaseUrl: '',\n  model: '',\n  port: 18088,\n  maxToolIterations: 25,\n  maxVerifyRetries: 3,\n  tokenBudget: 128000,\n  autoIndex: true,\n  autoLearn: true,\n  userName: 'Developer',\n};\n\n/**\n * Auto-detect provider from environment variables.\n * Returns the first provider whose env var is set, or null.\n */\nexport function detectProviderFromEnv(): { provider: AIProviderType; apiKey: string } | null {\n  const priority: AIProviderType[] = ['openai', 'anthropic', 'gemini', 'xai', 'openrouter'];\n  for (const p of priority) {\n    const key = process.env[PROVIDERS[p].envVar];\n    if (key) return { provider: p, apiKey: key };\n  }\n  return null;\n}\n\n/**\n * Resolve the effective base URL and model for a provider config.\n */\nexport function resolveProviderSettings(config: DominusConfig): {\n  baseUrl: string;\n  model: string;\n} {\n  const providerInfo = PROVIDERS[config.provider];\n  return {\n    baseUrl: config.apiBaseUrl || providerInfo?.baseUrl || PROVIDERS.openrouter.baseUrl,\n    model: config.model || providerInfo?.defaultModel || 'gpt-4o',\n  };\n}\n\nexport interface DominusRules {\n  do: string[];\n  dont: string[];\n  conventions: string[];\n  context: string;\n}\n\nconst DEFAULT_RULES: DominusRules = {\n  do: [],\n  dont: [],\n  conventions: [],\n  context: '',\n};\n\nfunction ensureDir(): void {\n  if (!fs.existsSync(DOMINUS_DIR)) {\n    fs.mkdirSync(DOMINUS_DIR, { recursive: true });\n  }\n}\n\nfunction readJson<T>(filePath: string, defaults: T): T {\n  try {\n    if (fs.existsSync(filePath)) {\n      const raw = fs.readFileSync(filePath, 'utf-8');\n      return { ...defaults, ...JSON.parse(raw) };\n    }\n  } catch {\n    // Corrupted file; reset to defaults\n  }\n  return { ...defaults };\n}\n\nfunction writeJson(filePath: string, data: unknown): void {\n  ensureDir();\n  fs.writeFileSync(filePath, JSON.stringify(data, null, 2), 'utf-8');\n}\n\nexport function loadConfig(): DominusConfig {\n  ensureDir();\n  return readJson(CONFIG_PATH, DEFAULTS);\n}\n\nexport function saveConfig(config: DominusConfig): void {\n  writeJson(CONFIG_PATH, config);\n}\n\nexport function getConfigValue<K extends keyof DominusConfig>(key: K): DominusConfig[K] {\n  const config = loadConfig();\n  return config[key];\n}\n\nexport function setConfigValue<K extends keyof DominusConfig>(\n  key: K,\n  value: DominusConfig[K],\n): void {\n  const config = loadConfig();\n  // eslint-disable-next-line @typescript-eslint/no-explicit-any\n  (config as any)[key] = value;\n  saveConfig(config);\n}\n\nexport function loadRules(): DominusRules {\n  ensureDir();\n  return readJson(RULES_PATH, DEFAULT_RULES);\n}\n\nexport function saveRules(rules: DominusRules): void {\n  writeJson(RULES_PATH, rules);\n}\n\nexport function getDominusDir(): string {\n  ensureDir();\n  return DOMINUS_DIR;\n}\n\nexport function getDbPath(): string {\n  ensureDir();\n  return DB_PATH;\n}\n\nexport function createConfigAccess(): ConfigAccess {\n  return {\n    get<T>(key: string): T | undefined {\n      const config = loadConfig() as unknown as Record<string, unknown>;\n      return config[key] as T | undefined;\n    },\n    set(key: string, value: unknown): void {\n      const config = loadConfig() as unknown as Record<string, unknown>;\n      config[key] = value;\n      saveConfig(config as unknown as DominusConfig);\n    },\n    getAll(): Record<string, unknown> {\n      return loadConfig() as unknown as Record<string, unknown>;\n    },\n  };\n}\n","import fs from 'node:fs';\nimport path from 'node:path';\nimport * as crypto from 'node:crypto';\nimport { getDominusDir } from '../config/config.js';\n\nconst TOKEN_FILE = 'bridge-token';\n\nexport function loadOrCreateBridgeToken(): string {\n  const tokenPath = path.join(getDominusDir(), TOKEN_FILE);\n  try {\n    const existing = fs.readFileSync(tokenPath, 'utf8').trim();\n    if (existing.length >= 32) return existing;\n  } catch {\n    // First run or an unreadable token is repaired below.\n  }\n\n  const token = crypto.randomBytes(32).toString('base64url');\n  fs.writeFileSync(tokenPath, `${token}\\n`, { encoding: 'utf8', mode: 0o600 });\n  try {\n    fs.chmodSync(tokenPath, 0o600);\n  } catch {\n    // Windows ACLs do not map directly to POSIX modes.\n  }\n  return token;\n}\n\nexport function tokensEqual(actual: unknown, expected: string): boolean {\n  if (typeof actual !== 'string') return false;\n  const actualBuffer = Buffer.from(actual);\n  const expectedBuffer = Buffer.from(expected);\n  return actualBuffer.length === expectedBuffer.length\n    && crypto.timingSafeEqual(actualBuffer, expectedBuffer);\n}\n","import fs from 'node:fs';\nimport os from 'node:os';\nimport path from 'node:path';\nimport { fileURLToPath } from 'node:url';\nimport { loadOrCreateBridgeToken } from './transport/auth.js';\n\nconst TOKEN_PLACEHOLDER = '__DOMINUS_BRIDGE_TOKEN__';\n\nfunction getPluginDirectory(): string {\n  if (process.platform === 'win32') {\n    const localAppData = process.env.LOCALAPPDATA;\n    if (!localAppData) throw new Error('LOCALAPPDATA is not set');\n    return path.join(localAppData, 'Roblox', 'Plugins');\n  }\n  if (process.platform === 'darwin') {\n    return path.join(os.homedir(), 'Documents', 'Roblox', 'Plugins');\n  }\n  return path.join(os.homedir(), '.local', 'share', 'Roblox', 'Plugins');\n}\n\nconst distDirectory = path.dirname(fileURLToPath(import.meta.url));\nconst source = path.resolve(distDirectory, '..', 'plugin', 'Dominus.rbxmx');\nconst destinationDirectory = getPluginDirectory();\nconst destination = path.join(destinationDirectory, 'Dominus2.rbxmx');\n\nif (!fs.existsSync(source)) {\n  throw new Error(`Packaged plugin not found at ${source}. Run pnpm build:plugin first.`);\n}\n\nconst template = fs.readFileSync(source, 'utf8');\nif (!template.includes(TOKEN_PLACEHOLDER)) {\n  throw new Error('Packaged plugin template is missing its bridge token placeholder');\n}\nconst personalizedPlugin = template.replaceAll(TOKEN_PLACEHOLDER, loadOrCreateBridgeToken());\n\nfs.mkdirSync(destinationDirectory, { recursive: true });\nfs.writeFileSync(destination, personalizedPlugin, 'utf8');\nfor (const obsoleteName of ['Dominus2.rbxm', 'Dominus.rbxm', 'Dominus.rbxmx']) {\n  const obsoletePath = path.join(destinationDirectory, obsoleteName);\n  if (obsoletePath !== destination) fs.rmSync(obsoletePath, { force: true });\n}\nconsole.log(`Installed Dominus 2 Studio plugin to ${destination}`);\nconsole.log('Restart Roblox Studio. Dominus 2 will authenticate automatically when dominus-mcp starts.');\n"]}

package/dist/mcp.js

@@ -8,7 +8,8 @@ import { EventEmitter } from 'events';
 import { WebSocket, WebSocketServer } from 'ws';
 import { nanoid } from 'nanoid';
 import { z } from 'zod';
-import { randomUUID, randomBytes, timingSafeEqual, randomInt } from 'crypto';
+import * as crypto from 'crypto';
+import { randomUUID } from 'crypto';
 
 var DOMINUS_DIR = path3.join(os.homedir(), ".dominus");
 var CONFIG_PATH = path3.join(DOMINUS_DIR, "config.json");
@@ -64,7 +65,6 @@ var StudioMsg = {
   RESPONSE: "studio:response",
   REFLECTION: "studio:reflection",
   TEST_RESULTS: "studio:test:results",
-  PAIRING_REQUIRED: "server:pairing_required",
   AUTHENTICATED: "server:authenticated",
   AUTH_REJECTED: "server:auth_rejected"
 };
@@ -73,9 +73,7 @@ var ControllerMsg = {
   WELCOME: "controller:welcome",
   RELAY: "controller:relay",
   TARGET_STATE: "controller:target_state",
-  SET_ACTIVE_CONNECTION: "controller:set_active_connection",
-  LIST_PENDING: "controller:list_pending",
-  APPROVE_CONNECTION: "controller:approve_connection"
+  SET_ACTIVE_CONNECTION: "controller:set_active_connection"
 };
 var CliMsg = {
   V2_GET_TREE: "studio:v2:get_tree",
@@ -126,7 +124,7 @@ function loadOrCreateBridgeToken() {
     if (existing.length >= 32) return existing;
   } catch {
   }
-  const token = randomBytes(32).toString("base64url");
+  const token = crypto.randomBytes(32).toString("base64url");
   fs3.writeFileSync(tokenPath, `${token}
 `, { encoding: "utf8", mode: 384 });
   try {
@@ -139,10 +137,7 @@ function tokensEqual(actual, expected) {
   if (typeof actual !== "string") return false;
   const actualBuffer = Buffer.from(actual);
   const expectedBuffer = Buffer.from(expected);
-  return actualBuffer.length === expectedBuffer.length && timingSafeEqual(actualBuffer, expectedBuffer);
-}
-function createPairingCode() {
-  return randomInt(1e5, 1e6).toString();
+  return actualBuffer.length === expectedBuffer.length && crypto.timingSafeEqual(actualBuffer, expectedBuffer);
 }
 
 // src/transport/ws-client.ts
@@ -373,20 +368,6 @@ var DominusClient = class extends EventEmitter {
       active: connection.connectionId === this.activeConnectionId
     }));
   }
-  async listPendingConnections() {
-    const result = await this.sendControlRequest(
-      ControllerMsg.LIST_PENDING,
-      {}
-    );
-    return result.pending;
-  }
-  async approveConnection(connectionId, pairingCode) {
-    const result = await this.sendControlRequest(
-      ControllerMsg.APPROVE_CONNECTION,
-      { connectionId, pairingCode }
-    );
-    return result.connection;
-  }
   getActiveConnectionId() {
     return this.activeConnectionId;
   }
@@ -469,14 +450,12 @@ async function isPortInUse(port) {
   });
 }
 var HANDSHAKE_TIMEOUT_MS = 8e3;
-var PAIRING_TTL_MS = 5 * 6e4;
 var RATE_WINDOW_MS = 1e4;
 var RATE_LIMIT = 250;
 var DominusServer = class extends EventEmitter {
   wss = null;
   studioClients = /* @__PURE__ */ new Map();
   wsToConnectionId = /* @__PURE__ */ new Map();
-  pendingConnections = /* @__PURE__ */ new Map();
   controllers = /* @__PURE__ */ new Set();
   socketRoles = /* @__PURE__ */ new Map();
   pendingRequests = /* @__PURE__ */ new Map();
@@ -579,7 +558,10 @@ var DominusServer = class extends EventEmitter {
       if (tokensEqual(hello.token, this.token)) {
         this.authorizeStudio(ws, hello, randomUUID());
       } else {
-        this.createPendingStudio(ws, hello);
+        this.sendSafe(ws, createMessage(StudioMsg.AUTH_REJECTED, {
+          error: "Studio plugin credentials are missing or stale. Run dominus-install-plugin and restart Studio."
+        }));
+        ws.close(1008, "Unauthorized Studio plugin");
       }
       return;
     }
@@ -605,32 +587,6 @@ var DominusServer = class extends EventEmitter {
     }));
     ws.close(1008, "Invalid Dominus handshake");
   }
-  createPendingStudio(ws, hello) {
-    const connectionId = randomUUID();
-    const requestedAt = Date.now();
-    const pending = {
-      ws,
-      pairingCode: createPairingCode(),
-      hello,
-      info: {
-        connectionId,
-        clientId: hello.clientId,
-        placeId: hello.placeId ?? 0,
-        placeName: hello.placeName,
-        studioVersion: hello.studioVersion,
-        requestedAt,
-        expiresAt: requestedAt + PAIRING_TTL_MS
-      }
-    };
-    this.pendingConnections.set(connectionId, pending);
-    this.socketRoles.set(ws, "pending");
-    this.sendSafe(ws, createMessage(StudioMsg.PAIRING_REQUIRED, {
-      connectionId,
-      pairingCode: pending.pairingCode,
-      expiresAt: pending.info.expiresAt
-    }));
-    this.emit("studio:pairing_required", pending.info);
-  }
   authorizeStudio(ws, hello, connectionId) {
     const connection = {
       ws,
@@ -641,7 +597,6 @@ var DominusServer = class extends EventEmitter {
       placeId: hello.placeId ?? 0,
       placeName: hello.placeName
     };
-    this.pendingConnections.delete(connectionId);
     this.studioClients.set(connectionId, connection);
     this.wsToConnectionId.set(ws, connectionId);
     this.socketRoles.set(ws, "studio");
@@ -682,18 +637,6 @@ var DominusServer = class extends EventEmitter {
       this.sendResponse(controllerWs, msg.id, { success: true, connectionId });
       return;
     }
-    if (msg.type === ControllerMsg.LIST_PENDING) {
-      this.sendResponse(controllerWs, msg.id, { success: true, pending: this.getPendingInfos() });
-      return;
-    }
-    if (msg.type === ControllerMsg.APPROVE_CONNECTION) {
-      const payload = msg.payload;
-      this.approveConnection(String(payload.connectionId ?? ""), String(payload.pairingCode ?? "")).then((connection) => this.sendResponse(controllerWs, msg.id, { success: true, connection })).catch((err) => this.sendResponse(controllerWs, msg.id, {
-        success: false,
-        error: err instanceof Error ? err.message : String(err)
-      }));
-      return;
-    }
     this.sendResponse(controllerWs, msg.id, { error: `Unsupported controller message: ${msg.type}` });
   }
   handleStudioMessage(ws, msg) {
@@ -734,12 +677,6 @@ var DominusServer = class extends EventEmitter {
       }
       return;
     }
-    if (role === "pending") {
-      for (const [id, pending] of this.pendingConnections) {
-        if (pending.ws === ws) this.pendingConnections.delete(id);
-      }
-      return;
-    }
     const connectionId = this.wsToConnectionId.get(ws);
     if (!connectionId) return;
     const connection = this.studioClients.get(connectionId);
@@ -782,16 +719,6 @@ var DominusServer = class extends EventEmitter {
     if (this.activeConnectionId) return `Studio connection ${this.activeConnectionId} is unavailable`;
     return "Multiple Studio sessions are connected. Call dominus_select_studio with a connectionId.";
   }
-  getPendingInfos() {
-    const now = Date.now();
-    for (const [id, pending] of this.pendingConnections) {
-      if (pending.info.expiresAt <= now || pending.ws.readyState !== WebSocket.OPEN) {
-        this.pendingConnections.delete(id);
-        pending.ws.close(1008, "Pairing expired");
-      }
-    }
-    return [...this.pendingConnections.values()].map(({ info }) => ({ ...info }));
-  }
   toPlaceInfo(connection) {
     return {
       placeId: connection.placeId ?? 0,
@@ -858,20 +785,6 @@ var DominusServer = class extends EventEmitter {
   listConnections() {
     return [...this.studioClients.values()].filter(({ ws }) => ws.readyState === WebSocket.OPEN).map((connection) => this.toPlaceInfo(connection));
   }
-  async listPendingConnections() {
-    return this.getPendingInfos();
-  }
-  async approveConnection(connectionId, pairingCode) {
-    const pending = this.pendingConnections.get(connectionId);
-    if (!pending || pending.info.expiresAt <= Date.now()) {
-      throw new Error("Pairing request not found or expired");
-    }
-    if (pending.pairingCode !== pairingCode) {
-      throw new Error("Pairing code is incorrect");
-    }
-    const connection = this.authorizeStudio(pending.ws, pending.hello, connectionId);
-    return this.toPlaceInfo(connection);
-  }
   getActiveConnectionId() {
     return this.activeConnectionId;
   }
@@ -909,7 +822,6 @@ var DominusServer = class extends EventEmitter {
       this.relayRequests.clear();
       for (const ws of this.socketRoles.keys()) ws.close(1001, "Dominus bridge shutdown");
       this.studioClients.clear();
-      this.pendingConnections.clear();
       this.controllers.clear();
       this.socketRoles.clear();
       this.wsToConnectionId.clear();
@@ -972,8 +884,7 @@ function registerDominusResources(server, bridge) {
       text: JSON.stringify({
         protocolVersion: 2,
         activeConnectionId: bridge.getActiveConnectionId(),
-        connections: bridge.listConnections(),
-        pendingConnections: await bridge.listPendingConnections()
+        connections: bridge.listConnections()
       }, null, 2)
     }]
   }));
@@ -1038,41 +949,22 @@ function ref(value) {
 function registerConnectionTools(server, bridge) {
   server.registerTool("dominus_status", {
     title: "Dominus Studio Status",
-    description: "List authenticated and pending Roblox Studio sessions, the active target, and bridge health. Call this before Studio work.",
+    description: "List authenticated Roblox Studio sessions, the active target, and bridge health. Call this before Studio work.",
     inputSchema: {},
     outputSchema: toolOutputSchema,
     annotations: { readOnlyHint: true, destructiveHint: false, idempotentHint: true, openWorldHint: false }
   }, async () => {
     try {
-      const pending = await bridge.listPendingConnections();
       return success({
         protocolVersion: 2,
         port: bridge.getPort(),
         activeConnectionId: bridge.getActiveConnectionId(),
-        connections: bridge.listConnections(),
-        pendingConnections: pending
+        connections: bridge.listConnections()
       });
     } catch (err) {
       return failure(err);
     }
   });
-  server.registerTool("dominus_pair_studio", {
-    title: "Pair Roblox Studio",
-    description: "Approve a first-time Studio plugin connection using the connection ID and six-digit code printed in Roblox Studio Output.",
-    inputSchema: {
-      connectionId: z.string().uuid(),
-      pairingCode: z.string().regex(/^\d{6}$/)
-    },
-    outputSchema: toolOutputSchema,
-    annotations: { readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: false }
-  }, async ({ connectionId, pairingCode }) => {
-    try {
-      const connection = await bridge.approveConnection(connectionId, pairingCode);
-      return success({ connection });
-    } catch (err) {
-      return failure(err);
-    }
-  });
   server.registerTool("dominus_select_studio", {
     title: "Select Studio Session",
     description: "Choose the exact Studio connection targeted by subsequent tools. Uses connectionId, not placeId, so duplicate windows are safe.",
@@ -1715,7 +1607,7 @@ function registerStudioTools(server, bridge) {
 }
 
 // src/mcp/server.ts
-var VERSION = "2.1.0";
+var VERSION = "2.1.1";
 function createDominusMcpServer(bridge) {
   const server = new McpServer({
     name: "dominus-2",