godot-cli 0.11.1 → 0.13.0

package/dist/utils/addon-deps.js

@@ -0,0 +1,27 @@
+// The NuGet PackageReferences a consumer's Godot C# project MUST declare so the
+// `addons/godot_mcp/` sources compile into the project assembly (Godot globs every
+// `*.cs` under the project into one assembly — see the addon README
+// "Consumer-install story"). `install-plugin` writes these into the generated
+// consumer `.csproj` so a from-scratch terminal install actually builds.
+//
+// SINGLE SOURCE OF TRUTH: these values mirror the addon's own reused pins in
+// `Godot-MCP.csproj` (`com.IvanMurzak.ReflectorNet`, `com.IvanMurzak.McpPlugin`).
+// They are NOT a bump of those pins — they are the SAME values, copied so the
+// scaffold installs exactly what the addon was built against. A parity test
+// (`cli/tests/addon-deps-parity.test.ts`) reads `Godot-MCP.csproj` and FAILS the
+// build if these constants ever drift from the addon's pins, so the scaffold can
+// never silently install a mismatched version.
+//
+// No top-level side effects; pure data + pure string transforms only.
+/**
+ * The exact NuGet `PackageReference`s the consumer's project `.csproj` needs,
+ * single-sourced from the addon's `Godot-MCP.csproj` pins. Order matches the
+ * addon csproj (ReflectorNet first, then McpPlugin).
+ */
+export const ADDON_PACKAGE_REFERENCES = [
+    { id: 'com.IvanMurzak.ReflectorNet', version: '5.3.1' },
+    { id: 'com.IvanMurzak.McpPlugin', version: '6.10.0' },
+];
+/** The resource path of the addon manifest a consumer project loads the plugin from. */
+export const ADDON_PLUGIN_CFG_RESOURCE = 'res://addons/godot_mcp/plugin.cfg';
+//# sourceMappingURL=addon-deps.js.map

package/dist/utils/addon-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"addon-deps.js","sourceRoot":"","sources":["../../src/utils/addon-deps.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,mFAAmF;AACnF,oEAAoE;AACpE,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,kFAAkF;AAClF,8EAA8E;AAC9E,4EAA4E;AAC5E,iFAAiF;AACjF,iFAAiF;AACjF,+CAA+C;AAC/C,EAAE;AACF,sEAAsE;AAUtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqC;IACxE,EAAE,EAAE,EAAE,6BAA6B,EAAE,OAAO,EAAE,OAAO,EAAE;IACvD,EAAE,EAAE,EAAE,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE;CAC7C,CAAC;AAEX,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,mCAAmC,CAAC"}

package/dist/utils/addon-source.d.ts

@@ -0,0 +1,36 @@
+/** GitHub-release host the addon zip is downloaded from. NOTHING else is trusted. */
+export declare const TRUSTED_DOWNLOAD_HOST = "github.com";
+/** The `owner/repo` the addon releases live under. */
+export declare const ADDON_RELEASE_REPO = "IvanMurzak/Godot-MCP";
+/**
+ * The release-asset name for an addon version: `godot-mcp-addon-<version>.zip`.
+ * Matches the asset the release workflow attaches (`release.yml` → "Package addon
+ * zip": `zip_name="godot-mcp-addon-${version}.zip"`). The `<version>` is the bare
+ * version WITHOUT a leading `v` (the `v` only appears in the tag). Pure.
+ */
+export declare function addonAssetName(version: string): string;
+/**
+ * The git release TAG for an addon version: the version with a leading `v`
+ * (`0.11.1` → `v0.11.1`). The release workflow tags every release `v<version>`
+ * (`release.yml` → `tag=v${version}`); an already-`v`-prefixed input is passed
+ * through unchanged so a caller cannot double-prefix. Pure.
+ */
+export declare function releaseTag(version: string): string;
+/** Drop a single leading `v`/`V` from a version string. Pure. */
+export declare function stripLeadingV(version: string): string;
+/**
+ * The download URL for an addon version's zip:
+ * `https://github.com/IvanMurzak/Godot-MCP/releases/download/v<version>/godot-mcp-addon-<version>.zip`.
+ * Mirrors `GodotMcpServerView.DownloadUrl`. Pure string build. The host is always
+ * `github.com` by construction; `assertTrustedDownloadUrl` re-checks a
+ * caller-supplied URL before any network call.
+ */
+export declare function addonDownloadUrl(version: string): string;
+/**
+ * Fail-closed host trust check: throw unless `url` is an HTTPS URL whose host is
+ * EXACTLY `github.com` (no subdomains, no `github.com.evil.test`, no http). This
+ * is the security boundary the task requires — reject non-github hosts. Returns
+ * the parsed URL on success. Pure (throws on the unhappy path; the caller turns
+ * it into a structured failure so nothing escapes the public boundary).
+ */
+export declare function assertTrustedDownloadUrl(url: string): URL;

package/dist/utils/addon-source.js

@@ -0,0 +1,68 @@
+// Pure helpers for resolving WHERE the `addons/godot_mcp/` files come from when
+// `install-plugin` materializes them: the trusted GitHub-release download URL and
+// the host-trust check. Mirrors the addon's own trusted-source pattern in
+// `addons/godot_mcp/Runtime/Connection/GodotMcpServerView.cs` (github.com only,
+// `releases/download/v<version>/<asset>`). No side effects; unit-testable.
+/** GitHub-release host the addon zip is downloaded from. NOTHING else is trusted. */
+export const TRUSTED_DOWNLOAD_HOST = 'github.com';
+/** The `owner/repo` the addon releases live under. */
+export const ADDON_RELEASE_REPO = 'IvanMurzak/Godot-MCP';
+/**
+ * The release-asset name for an addon version: `godot-mcp-addon-<version>.zip`.
+ * Matches the asset the release workflow attaches (`release.yml` → "Package addon
+ * zip": `zip_name="godot-mcp-addon-${version}.zip"`). The `<version>` is the bare
+ * version WITHOUT a leading `v` (the `v` only appears in the tag). Pure.
+ */
+export function addonAssetName(version) {
+    return `godot-mcp-addon-${stripLeadingV(version)}.zip`;
+}
+/**
+ * The git release TAG for an addon version: the version with a leading `v`
+ * (`0.11.1` → `v0.11.1`). The release workflow tags every release `v<version>`
+ * (`release.yml` → `tag=v${version}`); an already-`v`-prefixed input is passed
+ * through unchanged so a caller cannot double-prefix. Pure.
+ */
+export function releaseTag(version) {
+    const v = (version ?? '').trim();
+    return v.startsWith('v') ? v : `v${v}`;
+}
+/** Drop a single leading `v`/`V` from a version string. Pure. */
+export function stripLeadingV(version) {
+    const v = (version ?? '').trim();
+    return /^v/i.test(v) ? v.slice(1) : v;
+}
+/**
+ * The download URL for an addon version's zip:
+ * `https://github.com/IvanMurzak/Godot-MCP/releases/download/v<version>/godot-mcp-addon-<version>.zip`.
+ * Mirrors `GodotMcpServerView.DownloadUrl`. Pure string build. The host is always
+ * `github.com` by construction; `assertTrustedDownloadUrl` re-checks a
+ * caller-supplied URL before any network call.
+ */
+export function addonDownloadUrl(version) {
+    const bare = stripLeadingV(version);
+    return `https://${TRUSTED_DOWNLOAD_HOST}/${ADDON_RELEASE_REPO}/releases/download/${releaseTag(version)}/${addonAssetName(bare)}`;
+}
+/**
+ * Fail-closed host trust check: throw unless `url` is an HTTPS URL whose host is
+ * EXACTLY `github.com` (no subdomains, no `github.com.evil.test`, no http). This
+ * is the security boundary the task requires — reject non-github hosts. Returns
+ * the parsed URL on success. Pure (throws on the unhappy path; the caller turns
+ * it into a structured failure so nothing escapes the public boundary).
+ */
+export function assertTrustedDownloadUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`Refusing to download addon: malformed URL "${url}".`);
+    }
+    if (parsed.protocol !== 'https:') {
+        throw new Error(`Refusing to download addon: only https is allowed, got "${parsed.protocol}" (${url}).`);
+    }
+    if (parsed.hostname.toLowerCase() !== TRUSTED_DOWNLOAD_HOST) {
+        throw new Error(`Refusing to download addon from untrusted host "${parsed.hostname}". Only ${TRUSTED_DOWNLOAD_HOST} is trusted.`);
+    }
+    return parsed;
+}
+//# sourceMappingURL=addon-source.js.map

package/dist/utils/addon-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"addon-source.js","sourceRoot":"","sources":["../../src/utils/addon-source.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,kFAAkF;AAClF,0EAA0E;AAC1E,gFAAgF;AAChF,2EAA2E;AAE3E,qFAAqF;AACrF,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAElD,sDAAsD;AACtD,MAAM,CAAC,MAAM,kBAAkB,GAAG,sBAAsB,CAAC;AAEzD;;;;;GAKG;AACH,MAAM,UAAU,cAAc,CAAC,OAAe;IAC5C,OAAO,mBAAmB,aAAa,CAAC,OAAO,CAAC,MAAM,CAAC;AACzD,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,UAAU,CAAC,OAAe;IACxC,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACzC,CAAC;AAED,iEAAiE;AACjE,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,OAAO,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;AACxC,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,IAAI,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACpC,OAAO,WAAW,qBAAqB,IAAI,kBAAkB,sBAAsB,UAAU,CAAC,OAAO,CAAC,IAAI,cAAc,CAAC,IAAI,CAAC,EAAE,CAAC;AACnI,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,wBAAwB,CAAC,GAAW;IAClD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,8CAA8C,GAAG,IAAI,CAAC,CAAC;IACzE,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CACb,2DAA2D,MAAM,CAAC,QAAQ,MAAM,GAAG,IAAI,CACxF,CAAC;IACJ,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,qBAAqB,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,mDAAmD,MAAM,CAAC,QAAQ,WAAW,qBAAqB,cAAc,CACjH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC"}

package/dist/utils/csproj-deps.d.ts

@@ -0,0 +1,40 @@
+import { type AddonPackageReference } from './addon-deps.js';
+/**
+ * Idempotently reconcile a Godot consumer `.csproj`'s `<PackageReference>`s so it
+ * declares exactly the addon's two required NuGet pins (see `addon-deps.ts`).
+ *
+ * Pure: operates on the csproj TEXT and returns the new text + what changed; never
+ * touches the filesystem. Exported for unit tests. Handles, idempotently:
+ *  - a project with NO `<ItemGroup>` at all (appends one before `</Project>`);
+ *  - a project that already declares both pins at the right version (no change);
+ *  - a project that declares one or both at a DIFFERENT version (reconciles in place);
+ *  - a project that declares only one of the two (adds the missing one).
+ *
+ * It deliberately does a minimal, well-scoped text edit rather than a full XML
+ * parse/serialize, to preserve the rest of the consumer's csproj formatting
+ * verbatim. The `<PackageReference Include="..." />` shape it reads/writes is the
+ * single self-closing form the scaffold and the addon README both use.
+ */
+export type CsprojPatchChange = {
+    id: string;
+    action: 'added';
+    version: string;
+} | {
+    id: string;
+    action: 'updated';
+    from: string;
+    version: string;
+} | {
+    id: string;
+    action: 'unchanged';
+    version: string;
+};
+export interface CsprojPatchResult {
+    /** The new csproj text (identical to input when nothing changed). */
+    text: string;
+    /** True when the text was modified. */
+    changed: boolean;
+    /** One entry per required package describing what happened to it. */
+    changes: CsprojPatchChange[];
+}
+export declare function addAddonPackageReferences(csprojText: string, requiredRefs?: readonly AddonPackageReference[]): CsprojPatchResult;

package/dist/utils/csproj-deps.js

@@ -0,0 +1,121 @@
+import { ADDON_PACKAGE_REFERENCES } from './addon-deps.js';
+/** Escape a string for use inside a RegExp source. */
+function escapeRegExp(value) {
+    return value.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+}
+/**
+ * Match an existing `<PackageReference Include="<id>" Version="<ver>" />` element
+ * for a specific package id, capturing the whole element and its version, in
+ * either attribute order (`Include` before or after `Version`). The element may
+ * also be a `<PackageReference ...></PackageReference>` open/close pair.
+ */
+function packageRefRegex(id) {
+    const escId = escapeRegExp(id);
+    // <PackageReference ... Include="id" ... Version="x" ... /> (Include before Version)
+    // or Version before Include. Two alternations cover both orders; either may end
+    // with a self-close `/>` or an explicit `></PackageReference>`.
+    return new RegExp(`<PackageReference\\b[^>]*?\\bInclude\\s*=\\s*"${escId}"[^>]*?\\bVersion\\s*=\\s*"([^"]*)"[^>]*?(?:/>|></PackageReference>)` +
+        `|` +
+        `<PackageReference\\b[^>]*?\\bVersion\\s*=\\s*"([^"]*)"[^>]*?\\bInclude\\s*=\\s*"${escId}"[^>]*?(?:/>|></PackageReference>)`, 'i');
+}
+/** Render the canonical self-closing element for a required reference. */
+function renderRef(ref) {
+    return `<PackageReference Include="${ref.id}" Version="${ref.version}" />`;
+}
+/**
+ * Detect the indentation used by the FIRST existing `<PackageReference>` (or fall
+ * back to 4 spaces) so appended/inserted elements match the consumer's style.
+ */
+function detectIndent(text) {
+    const m = text.match(/\n([ \t]*)<PackageReference\b/);
+    return m ? m[1] : '    ';
+}
+/**
+ * Detect the dominant line ending of the csproj so inserted/appended XML matches
+ * it (a CRLF csproj should not gain bare-LF lines). Returns `\r\n` when CRLF
+ * line endings outnumber bare-LF ones, else `\n`.
+ */
+function detectEol(text) {
+    const crlf = (text.match(/\r\n/g) ?? []).length;
+    const lf = (text.match(/\n/g) ?? []).length - crlf;
+    return crlf > lf ? '\r\n' : '\n';
+}
+export function addAddonPackageReferences(csprojText, requiredRefs = ADDON_PACKAGE_REFERENCES) {
+    const changes = [];
+    let text = csprojText;
+    const indent = detectIndent(text);
+    const eol = detectEol(text);
+    // First pass: reconcile any references that already exist (possibly at a
+    // different version). Collect the ones still missing for the append pass.
+    const missing = [];
+    for (const ref of requiredRefs) {
+        const re = packageRefRegex(ref.id);
+        const match = text.match(re);
+        if (!match) {
+            missing.push(ref);
+            continue;
+        }
+        const existingVersion = match[1] ?? match[2] ?? '';
+        if (existingVersion === ref.version) {
+            changes.push({ id: ref.id, action: 'unchanged', version: ref.version });
+            continue;
+        }
+        // Reconcile in place: replace the whole element with the canonical pin.
+        text = text.replace(re, renderRef(ref));
+        changes.push({ id: ref.id, action: 'updated', from: existingVersion, version: ref.version });
+    }
+    // Second pass: add the missing references. Prefer an existing <ItemGroup> that
+    // already holds a <PackageReference> (group them together); else append a fresh
+    // <ItemGroup> just before </Project>.
+    if (missing.length > 0) {
+        const block = missing.map((ref) => `${indent}${renderRef(ref)}`).join(eol);
+        const pkgItemGroupClose = findPackageReferenceItemGroupClose(text);
+        if (pkgItemGroupClose !== -1) {
+            // Insert the missing refs just before that ItemGroup's closing tag.
+            text = `${text.slice(0, pkgItemGroupClose)}${block}${eol}${text.slice(pkgItemGroupClose)}`;
+        }
+        else {
+            // No PackageReference ItemGroup — append a new one before </Project>.
+            const groupIndent = indent.length >= 2 ? indent.slice(0, Math.floor(indent.length / 2)) : '  ';
+            const newGroup = `${groupIndent}<ItemGroup>${eol}${block}${eol}${groupIndent}</ItemGroup>${eol}`;
+            const closeIdx = text.lastIndexOf('</Project>');
+            if (closeIdx === -1) {
+                // Not a recognizable csproj; append best-effort at EOF.
+                text = `${text}${eol}${newGroup}`;
+            }
+            else {
+                text = `${text.slice(0, closeIdx)}${newGroup}${text.slice(closeIdx)}`;
+            }
+        }
+        for (const ref of missing) {
+            changes.push({ id: ref.id, action: 'added', version: ref.version });
+        }
+    }
+    // Restore the required-order in `changes` to match `requiredRefs` for stable output.
+    const orderedChanges = requiredRefs
+        .map((ref) => changes.find((c) => c.id === ref.id))
+        .filter((c) => c !== undefined);
+    return {
+        text,
+        changed: orderedChanges.some((c) => c.action !== 'unchanged'),
+        changes: orderedChanges,
+    };
+}
+/**
+ * Return the index of the `</ItemGroup>` that closes the FIRST `<ItemGroup>`
+ * containing a `<PackageReference>`, or -1 when none exists. Used to group the
+ * added pins with the consumer's existing package references.
+ */
+function findPackageReferenceItemGroupClose(text) {
+    const itemGroupRe = /<ItemGroup\b[^>]*>([\s\S]*?)<\/ItemGroup>/gi;
+    let m;
+    while ((m = itemGroupRe.exec(text)) !== null) {
+        if (/<PackageReference\b/i.test(m[1])) {
+            // The close tag starts at the end of the match minus its length.
+            const closeTag = '</ItemGroup>';
+            return m.index + m[0].length - closeTag.length;
+        }
+    }
+    return -1;
+}
+//# sourceMappingURL=csproj-deps.js.map

package/dist/utils/csproj-deps.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"csproj-deps.js","sourceRoot":"","sources":["../../src/utils/csproj-deps.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,wBAAwB,EAA8B,MAAM,iBAAiB,CAAC;AAiCvF,sDAAsD;AACtD,SAAS,YAAY,CAAC,KAAa;IACjC,OAAO,KAAK,CAAC,OAAO,CAAC,qBAAqB,EAAE,MAAM,CAAC,CAAC;AACtD,CAAC;AAED;;;;;GAKG;AACH,SAAS,eAAe,CAAC,EAAU;IACjC,MAAM,KAAK,GAAG,YAAY,CAAC,EAAE,CAAC,CAAC;IAC/B,qFAAqF;IACrF,gFAAgF;IAChF,gEAAgE;IAChE,OAAO,IAAI,MAAM,CACf,iDAAiD,KAAK,sEAAsE;QAC1H,GAAG;QACH,mFAAmF,KAAK,oCAAoC,EAC9H,GAAG,CACJ,CAAC;AACJ,CAAC;AAED,0EAA0E;AAC1E,SAAS,SAAS,CAAC,GAA0B;IAC3C,OAAO,8BAA8B,GAAG,CAAC,EAAE,cAAc,GAAG,CAAC,OAAO,MAAM,CAAC;AAC7E,CAAC;AAED;;;GAGG;AACH,SAAS,YAAY,CAAC,IAAY;IAChC,MAAM,CAAC,GAAG,IAAI,CAAC,KAAK,CAAC,+BAA+B,CAAC,CAAC;IACtD,OAAO,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC;AAC3B,CAAC;AAED;;;;GAIG;AACH,SAAS,SAAS,CAAC,IAAY;IAC7B,MAAM,IAAI,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,CAAC;IAChD,MAAM,EAAE,GAAG,CAAC,IAAI,CAAC,KAAK,CAAC,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC,MAAM,GAAG,IAAI,CAAC;IACnD,OAAO,IAAI,GAAG,EAAE,CAAC,CAAC,CAAC,MAAM,CAAC,CAAC,CAAC,IAAI,CAAC;AACnC,CAAC;AAED,MAAM,UAAU,yBAAyB,CACvC,UAAkB,EAClB,eAAiD,wBAAwB;IAEzE,MAAM,OAAO,GAAwB,EAAE,CAAC;IACxC,IAAI,IAAI,GAAG,UAAU,CAAC;IACtB,MAAM,MAAM,GAAG,YAAY,CAAC,IAAI,CAAC,CAAC;IAClC,MAAM,GAAG,GAAG,SAAS,CAAC,IAAI,CAAC,CAAC;IAE5B,yEAAyE;IACzE,0EAA0E;IAC1E,MAAM,OAAO,GAA4B,EAAE,CAAC;IAE5C,KAAK,MAAM,GAAG,IAAI,YAAY,EAAE,CAAC;QAC/B,MAAM,EAAE,GAAG,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC;QACnC,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,EAAE,CAAC,CAAC;QAC7B,IAAI,CAAC,KAAK,EAAE,CAAC;YACX,OAAO,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;YAClB,SAAS;QACX,CAAC;QACD,MAAM,eAAe,GAAG,KAAK,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,CAAC,CAAC,IAAI,EAAE,CAAC;QACnD,IAAI,eAAe,KAAK,GAAG,CAAC,OAAO,EAAE,CAAC;YACpC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,WAAW,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;YACxE,SAAS;QACX,CAAC;QACD,wEAAwE;QACxE,IAAI,GAAG,IAAI,CAAC,OAAO,CAAC,EAAE,EAAE,SAAS,CAAC,GAAG,CAAC,CAAC,CAAC;QACxC,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,SAAS,EAAE,IAAI,EAAE,eAAe,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;IAC/F,CAAC;IAED,+EAA+E;IAC/E,gFAAgF;IAChF,sCAAsC;IACtC,IAAI,OAAO,CAAC,MAAM,GAAG,CAAC,EAAE,CAAC;QACvB,MAAM,KAAK,GAAG,OAAO,CAAC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,GAAG,MAAM,GAAG,SAAS,CAAC,GAAG,CAAC,EAAE,CAAC,CAAC,IAAI,CAAC,GAAG,CAAC,CAAC;QAE3E,MAAM,iBAAiB,GAAG,kCAAkC,CAAC,IAAI,CAAC,CAAC;QACnE,IAAI,iBAAiB,KAAK,CAAC,CAAC,EAAE,CAAC;YAC7B,oEAAoE;YACpE,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,iBAAiB,CAAC,GAAG,KAAK,GAAG,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,iBAAiB,CAAC,EAAE,CAAC;QAC7F,CAAC;aAAM,CAAC;YACN,sEAAsE;YACtE,MAAM,WAAW,GAAG,MAAM,CAAC,MAAM,IAAI,CAAC,CAAC,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,EAAE,IAAI,CAAC,KAAK,CAAC,MAAM,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC;YAC/F,MAAM,QAAQ,GAAG,GAAG,WAAW,cAAc,GAAG,GAAG,KAAK,GAAG,GAAG,GAAG,WAAW,eAAe,GAAG,EAAE,CAAC;YACjG,MAAM,QAAQ,GAAG,IAAI,CAAC,WAAW,CAAC,YAAY,CAAC,CAAC;YAChD,IAAI,QAAQ,KAAK,CAAC,CAAC,EAAE,CAAC;gBACpB,wDAAwD;gBACxD,IAAI,GAAG,GAAG,IAAI,GAAG,GAAG,GAAG,QAAQ,EAAE,CAAC;YACpC,CAAC;iBAAM,CAAC;gBACN,IAAI,GAAG,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,GAAG,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,CAAC,EAAE,CAAC;YACxE,CAAC;QACH,CAAC;QAED,KAAK,MAAM,GAAG,IAAI,OAAO,EAAE,CAAC;YAC1B,OAAO,CAAC,IAAI,CAAC,EAAE,EAAE,EAAE,GAAG,CAAC,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,CAAC,OAAO,EAAE,CAAC,CAAC;QACtE,CAAC;IACH,CAAC;IAED,qFAAqF;IACrF,MAAM,cAAc,GAAG,YAAY;SAChC,GAAG,CAAC,CAAC,GAAG,EAAE,EAAE,CAAC,OAAO,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,EAAE,KAAK,GAAG,CAAC,EAAE,CAAC,CAAC;SAClD,MAAM,CAAC,CAAC,CAAC,EAA0B,EAAE,CAAC,CAAC,KAAK,SAAS,CAAC,CAAC;IAE1D,OAAO;QACL,IAAI;QACJ,OAAO,EAAE,cAAc,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,EAAE,CAAC,CAAC,CAAC,MAAM,KAAK,WAAW,CAAC;QAC7D,OAAO,EAAE,cAAc;KACxB,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,kCAAkC,CAAC,IAAY;IACtD,MAAM,WAAW,GAAG,6CAA6C,CAAC;IAClE,IAAI,CAAyB,CAAC;IAC9B,OAAO,CAAC,CAAC,GAAG,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;QAC7C,IAAI,sBAAsB,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YACtC,iEAAiE;YACjE,MAAM,QAAQ,GAAG,cAAc,CAAC;YAChC,OAAO,CAAC,CAAC,KAAK,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,MAAM,GAAG,QAAQ,CAAC,MAAM,CAAC;QACjD,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC"}

package/dist/utils/unzip.d.ts

@@ -0,0 +1,25 @@
+/**
+ * Minimal, dependency-free ZIP reader for the addon-install path. Parses the ZIP
+ * central directory and inflates each entry (STORED `0` + DEFLATE `8` — the only
+ * two compression methods the GitHub release `zip -r` produces). Pure: takes the
+ * archive bytes, returns `{ path, bytes }` entries; performs NO filesystem writes
+ * (the caller decides where the files land, after path-safety checks).
+ *
+ * This avoids adding a native/3rd-party unzip dependency to the lean `godot-cli`
+ * package while staying cross-platform (no shelling out to a system `unzip`).
+ * Exported for unit tests.
+ */
+export interface ZipEntry {
+    /** The entry's path inside the archive, using forward slashes. */
+    path: string;
+    /** Decompressed bytes. Empty for directory entries. */
+    bytes: Buffer;
+    /** True when the entry is a directory (path ends with `/`). */
+    isDirectory: boolean;
+}
+/**
+ * Parse a ZIP archive buffer into its entries. Throws a descriptive Error on a
+ * malformed archive (the caller wraps this into a structured failure — it never
+ * propagates past the library's public boundary).
+ */
+export declare function parseZip(buffer: Buffer): ZipEntry[];

package/dist/utils/unzip.js

@@ -0,0 +1,79 @@
+import * as zlib from 'zlib';
+// ZIP signatures.
+const EOCD_SIGNATURE = 0x06054b50; // End Of Central Directory
+const CDH_SIGNATURE = 0x02014b50; // Central Directory Header
+const LFH_SIGNATURE = 0x04034b50; // Local File Header
+/**
+ * Parse a ZIP archive buffer into its entries. Throws a descriptive Error on a
+ * malformed archive (the caller wraps this into a structured failure — it never
+ * propagates past the library's public boundary).
+ */
+export function parseZip(buffer) {
+    const eocdOffset = findEndOfCentralDirectory(buffer);
+    if (eocdOffset === -1) {
+        throw new Error('Invalid zip: End Of Central Directory record not found.');
+    }
+    const entryCount = buffer.readUInt16LE(eocdOffset + 10);
+    const centralDirOffset = buffer.readUInt32LE(eocdOffset + 16);
+    const entries = [];
+    let ptr = centralDirOffset;
+    for (let i = 0; i < entryCount; i++) {
+        if (buffer.readUInt32LE(ptr) !== CDH_SIGNATURE) {
+            throw new Error(`Invalid zip: bad central directory header at entry ${i}.`);
+        }
+        const compressionMethod = buffer.readUInt16LE(ptr + 10);
+        const compressedSize = buffer.readUInt32LE(ptr + 20);
+        const fileNameLength = buffer.readUInt16LE(ptr + 28);
+        const extraFieldLength = buffer.readUInt16LE(ptr + 30);
+        const commentLength = buffer.readUInt16LE(ptr + 32);
+        const localHeaderOffset = buffer.readUInt32LE(ptr + 42);
+        const fileName = buffer.toString('utf8', ptr + 46, ptr + 46 + fileNameLength);
+        const bytes = readLocalEntry(buffer, localHeaderOffset, compressionMethod, compressedSize);
+        entries.push({
+            path: fileName.replace(/\\/g, '/'),
+            bytes,
+            isDirectory: fileName.endsWith('/'),
+        });
+        ptr += 46 + fileNameLength + extraFieldLength + commentLength;
+    }
+    return entries;
+}
+/** Read + decompress a single entry given its central-directory metadata. */
+function readLocalEntry(buffer, localHeaderOffset, compressionMethod, compressedSize) {
+    if (buffer.readUInt32LE(localHeaderOffset) !== LFH_SIGNATURE) {
+        throw new Error('Invalid zip: bad local file header.');
+    }
+    // The local header repeats the name/extra lengths; the data starts after them.
+    const lfhNameLength = buffer.readUInt16LE(localHeaderOffset + 26);
+    const lfhExtraLength = buffer.readUInt16LE(localHeaderOffset + 28);
+    const dataStart = localHeaderOffset + 30 + lfhNameLength + lfhExtraLength;
+    const compressed = buffer.subarray(dataStart, dataStart + compressedSize);
+    if (compressionMethod === 0) {
+        // STORED — no compression.
+        return Buffer.from(compressed);
+    }
+    if (compressionMethod === 8) {
+        // DEFLATE (raw, no zlib header).
+        return zlib.inflateRawSync(compressed);
+    }
+    throw new Error(`Unsupported zip compression method ${compressionMethod}.`);
+}
+/**
+ * Locate the End Of Central Directory record by scanning backwards from EOF for
+ * its signature (the trailing comment is almost always empty, so it is usually
+ * the last 22 bytes — but we scan to be safe).
+ */
+function findEndOfCentralDirectory(buffer) {
+    const minEocdSize = 22;
+    if (buffer.length < minEocdSize)
+        return -1;
+    // Max comment length is 0xFFFF; scan that far back at most.
+    const scanStart = Math.max(0, buffer.length - minEocdSize - 0xffff);
+    for (let i = buffer.length - minEocdSize; i >= scanStart; i--) {
+        if (buffer.readUInt32LE(i) === EOCD_SIGNATURE) {
+            return i;
+        }
+    }
+    return -1;
+}
+//# sourceMappingURL=unzip.js.map

package/dist/utils/unzip.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"unzip.js","sourceRoot":"","sources":["../../src/utils/unzip.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAuB7B,kBAAkB;AAClB,MAAM,cAAc,GAAG,UAAU,CAAC,CAAC,2BAA2B;AAC9D,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,2BAA2B;AAC7D,MAAM,aAAa,GAAG,UAAU,CAAC,CAAC,oBAAoB;AAEtD;;;;GAIG;AACH,MAAM,UAAU,QAAQ,CAAC,MAAc;IACrC,MAAM,UAAU,GAAG,yBAAyB,CAAC,MAAM,CAAC,CAAC;IACrD,IAAI,UAAU,KAAK,CAAC,CAAC,EAAE,CAAC;QACtB,MAAM,IAAI,KAAK,CAAC,yDAAyD,CAAC,CAAC;IAC7E,CAAC;IAED,MAAM,UAAU,GAAG,MAAM,CAAC,YAAY,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IACxD,MAAM,gBAAgB,GAAG,MAAM,CAAC,YAAY,CAAC,UAAU,GAAG,EAAE,CAAC,CAAC;IAE9D,MAAM,OAAO,GAAe,EAAE,CAAC;IAC/B,IAAI,GAAG,GAAG,gBAAgB,CAAC;IAE3B,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,UAAU,EAAE,CAAC,EAAE,EAAE,CAAC;QACpC,IAAI,MAAM,CAAC,YAAY,CAAC,GAAG,CAAC,KAAK,aAAa,EAAE,CAAC;YAC/C,MAAM,IAAI,KAAK,CAAC,sDAAsD,CAAC,GAAG,CAAC,CAAC;QAC9E,CAAC;QACD,MAAM,iBAAiB,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;QACxD,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;QACrD,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;QACrD,MAAM,gBAAgB,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;QACvD,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;QACpD,MAAM,iBAAiB,GAAG,MAAM,CAAC,YAAY,CAAC,GAAG,GAAG,EAAE,CAAC,CAAC;QAExD,MAAM,QAAQ,GAAG,MAAM,CAAC,QAAQ,CAAC,MAAM,EAAE,GAAG,GAAG,EAAE,EAAE,GAAG,GAAG,EAAE,GAAG,cAAc,CAAC,CAAC;QAE9E,MAAM,KAAK,GAAG,cAAc,CAAC,MAAM,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,cAAc,CAAC,CAAC;QAC3F,OAAO,CAAC,IAAI,CAAC;YACX,IAAI,EAAE,QAAQ,CAAC,OAAO,CAAC,KAAK,EAAE,GAAG,CAAC;YAClC,KAAK;YACL,WAAW,EAAE,QAAQ,CAAC,QAAQ,CAAC,GAAG,CAAC;SACpC,CAAC,CAAC;QAEH,GAAG,IAAI,EAAE,GAAG,cAAc,GAAG,gBAAgB,GAAG,aAAa,CAAC;IAChE,CAAC;IAED,OAAO,OAAO,CAAC;AACjB,CAAC;AAED,6EAA6E;AAC7E,SAAS,cAAc,CACrB,MAAc,EACd,iBAAyB,EACzB,iBAAyB,EACzB,cAAsB;IAEtB,IAAI,MAAM,CAAC,YAAY,CAAC,iBAAiB,CAAC,KAAK,aAAa,EAAE,CAAC;QAC7D,MAAM,IAAI,KAAK,CAAC,qCAAqC,CAAC,CAAC;IACzD,CAAC;IACD,+EAA+E;IAC/E,MAAM,aAAa,GAAG,MAAM,CAAC,YAAY,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;IAClE,MAAM,cAAc,GAAG,MAAM,CAAC,YAAY,CAAC,iBAAiB,GAAG,EAAE,CAAC,CAAC;IACnE,MAAM,SAAS,GAAG,iBAAiB,GAAG,EAAE,GAAG,aAAa,GAAG,cAAc,CAAC;IAC1E,MAAM,UAAU,GAAG,MAAM,CAAC,QAAQ,CAAC,SAAS,EAAE,SAAS,GAAG,cAAc,CAAC,CAAC;IAE1E,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAC5B,2BAA2B;QAC3B,OAAO,MAAM,CAAC,IAAI,CAAC,UAAU,CAAC,CAAC;IACjC,CAAC;IACD,IAAI,iBAAiB,KAAK,CAAC,EAAE,CAAC;QAC5B,iCAAiC;QACjC,OAAO,IAAI,CAAC,cAAc,CAAC,UAAU,CAAC,CAAC;IACzC,CAAC;IACD,MAAM,IAAI,KAAK,CAAC,sCAAsC,iBAAiB,GAAG,CAAC,CAAC;AAC9E,CAAC;AAED;;;;GAIG;AACH,SAAS,yBAAyB,CAAC,MAAc;IAC/C,MAAM,WAAW,GAAG,EAAE,CAAC;IACvB,IAAI,MAAM,CAAC,MAAM,GAAG,WAAW;QAAE,OAAO,CAAC,CAAC,CAAC;IAC3C,4DAA4D;IAC5D,MAAM,SAAS,GAAG,IAAI,CAAC,GAAG,CAAC,CAAC,EAAE,MAAM,CAAC,MAAM,GAAG,WAAW,GAAG,MAAM,CAAC,CAAC;IACpE,KAAK,IAAI,CAAC,GAAG,MAAM,CAAC,MAAM,GAAG,WAAW,EAAE,CAAC,IAAI,SAAS,EAAE,CAAC,EAAE,EAAE,CAAC;QAC9D,IAAI,MAAM,CAAC,YAAY,CAAC,CAAC,CAAC,KAAK,cAAc,EAAE,CAAC;YAC9C,OAAO,CAAC,CAAC;QACX,CAAC;IACH,CAAC;IACD,OAAO,CAAC,CAAC,CAAC;AACZ,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "godot-cli",
-  "version": "0.11.1",
+  "version": "0.13.0",
   "description": "Cross-platform CLI tool for Godot-MCP (Skills & MCP). Resolves and launches the Godot editor with MCP connection env vars, runs MCP/system tools over HTTP, probes server health, configures AI agents (Claude Code, Cursor, VS Code, …), and enables/disables the godot_mcp addon. Works with Claude Code, Cursor, Copilot, and any MCP client.",
   "type": "module",
   "main": "dist/lib.js",