godot-cli 0.16.2 → 0.17.0

package/dist/lib/install-server.d.ts

@@ -0,0 +1,25 @@
+import type { InstallServerOptions, InstallServerResult } from './types.js';
+/** Relative path of the CLI-managed server dir inside a project (design 06: "the CLI's managed directory"). */
+export declare const MANAGED_SERVER_REL_DIR: string;
+/** Absolute path of the CLI-managed server directory for a project. */
+export declare function getManagedServerDir(projectPath: string): string;
+/** Absolute path of the managed server executable for a project (the file the `configure` proxy spawns). */
+export declare function getManagedServerExecutablePath(projectPath: string, platform?: NodeJS.Platform): string;
+/**
+ * Install the shared `gamedev-mcp-server` binary into the CLI-managed directory
+ * `<project>/.ai-game-dev/server/` — the `install-plugin --with-server` flow (D12).
+ *
+ *  1. Download path (default): resolve the host RID, download the RID-matched
+ *     `gamedev-mcp-server-<rid>.zip` from github.com only (fail-closed host
+ *     trust), download the release `SHA256SUMS`, and VERIFY the zip's SHA256
+ *     against the manifest BEFORE extraction (fail-closed — any non-`verified`
+ *     verdict aborts and leaves the project untouched). Then extract + swap.
+ *  2. Local path (`--server-source`): copy a trusted local server dir / `.zip`
+ *     into the managed dir with no network + no checksum (the local artifact is
+ *     trusted). Offline / dev / CI.
+ *
+ * Library-safe: no stdout noise, no `process.exit`, no throws past the boundary;
+ * returns a `{ kind }` union. Materializes into a temp sibling and swaps only on
+ * full success, so a partial download/extract is rolled back.
+ */
+export declare function installServer(opts: InstallServerOptions): Promise<InstallServerResult>;

package/dist/lib/install-server.js

@@ -0,0 +1,234 @@
+import * as fs from 'fs';
+import * as path from 'path';
+import { DEFAULT_SERVER_VERSION, detectHostRid, serverDownloadUrl, serverAssetName, serverExecutableFileName, sha256SumsUrl, assertTrustedServerUrl, verifyZipChecksum, checksumFailureReason, sha256Hex, } from '../utils/server-source.js';
+import { parseZip } from '../utils/unzip.js';
+import { emitProgress } from './progress.js';
+/** Relative path of the CLI-managed server dir inside a project (design 06: "the CLI's managed directory"). */
+export const MANAGED_SERVER_REL_DIR = path.join('.ai-game-dev', 'server');
+/** Absolute path of the CLI-managed server directory for a project. */
+export function getManagedServerDir(projectPath) {
+    return path.join(projectPath, MANAGED_SERVER_REL_DIR);
+}
+/** Absolute path of the managed server executable for a project (the file the `configure` proxy spawns). */
+export function getManagedServerExecutablePath(projectPath, platform = process.platform) {
+    return path.join(getManagedServerDir(projectPath), serverExecutableFileName(platform));
+}
+/**
+ * Install the shared `gamedev-mcp-server` binary into the CLI-managed directory
+ * `<project>/.ai-game-dev/server/` — the `install-plugin --with-server` flow (D12).
+ *
+ *  1. Download path (default): resolve the host RID, download the RID-matched
+ *     `gamedev-mcp-server-<rid>.zip` from github.com only (fail-closed host
+ *     trust), download the release `SHA256SUMS`, and VERIFY the zip's SHA256
+ *     against the manifest BEFORE extraction (fail-closed — any non-`verified`
+ *     verdict aborts and leaves the project untouched). Then extract + swap.
+ *  2. Local path (`--server-source`): copy a trusted local server dir / `.zip`
+ *     into the managed dir with no network + no checksum (the local artifact is
+ *     trusted). Offline / dev / CI.
+ *
+ * Library-safe: no stdout noise, no `process.exit`, no throws past the boundary;
+ * returns a `{ kind }` union. Materializes into a temp sibling and swaps only on
+ * full success, so a partial download/extract is rolled back.
+ */
+export async function installServer(opts) {
+    const warnings = [];
+    const platform = process.platform;
+    try {
+        const projectPath = path.resolve(opts.godotProjectPath);
+        if (!fs.existsSync(projectPath)) {
+            throw new Error(`Project path does not exist: ${projectPath}`);
+        }
+        const serverDir = getManagedServerDir(projectPath);
+        if (opts.source !== undefined && opts.source !== '') {
+            return installFromLocal(projectPath, serverDir, opts.source, platform, warnings, opts.onProgress);
+        }
+        return await installFromDownload(projectPath, serverDir, platform, warnings, opts);
+    }
+    catch (err) {
+        return {
+            kind: 'failure',
+            success: false,
+            warnings,
+            error: err instanceof Error ? err : new Error(String(err)),
+        };
+    }
+}
+async function installFromDownload(projectPath, serverDir, platform, warnings, opts) {
+    const rid = (opts.rid ?? detectHostRid()).trim();
+    if (rid.includes('unknown')) {
+        throw new Error(`Cannot detect a supported host RID (got "${rid}"). Use --server-source <path> to install a server binary manually.`);
+    }
+    const version = (opts.version ?? DEFAULT_SERVER_VERSION).trim();
+    if (version === '') {
+        throw new Error('No server version to download. Pass --server-version <x.y.z> or --server-source <path>.');
+    }
+    const url = serverDownloadUrl(version, rid);
+    assertTrustedServerUrl(url);
+    const assetName = serverAssetName(rid);
+    const fetchImpl = opts.fetchImpl ?? globalThis.fetch;
+    emitProgress(opts.onProgress, {
+        phase: 'server-downloading',
+        message: `Downloading ${assetName} (${version}) from ${url}`,
+        url,
+    });
+    const zipResponse = await fetchImpl(url);
+    if (!zipResponse.ok) {
+        throw new Error(`Failed to download server ${version} for ${rid}: HTTP ${zipResponse.status} ${zipResponse.statusText} from ${url}. ` +
+            `Verify the release v${version} exists with a ${assetName} asset, or use --server-source <path>.`);
+    }
+    const archive = Buffer.from(await zipResponse.arrayBuffer());
+    // Fail-closed integrity: download SHA256SUMS + verify BEFORE extraction.
+    const sumsUrl = sha256SumsUrl(version);
+    assertTrustedServerUrl(sumsUrl);
+    emitProgress(opts.onProgress, { phase: 'server-verifying', message: `Verifying against ${sumsUrl}` });
+    const sumsResponse = await fetchImpl(sumsUrl);
+    if (!sumsResponse.ok) {
+        throw new Error(`Refusing to install an unverified server: could not download ${sumsUrl} (HTTP ${sumsResponse.status}). ` +
+            `The release must publish a SHA256SUMS manifest.`);
+    }
+    const sumsText = await sumsResponse.text();
+    const actualDigest = sha256Hex(archive);
+    const verdict = verifyZipChecksum(sumsText, assetName, actualDigest);
+    if (verdict !== 'verified') {
+        throw new Error(`Refusing to install server ${version} for ${rid}: ${checksumFailureReason(verdict, assetName)} (fail-closed).`);
+    }
+    emitProgress(opts.onProgress, { phase: 'server-extracting', message: 'Extracting verified server zip' });
+    const entries = parseZip(archive);
+    stageThenSwap(projectPath, serverDir, (staging) => extractServerEntries(entries, staging));
+    const executablePath = resolveExecutable(serverDir, platform);
+    if (executablePath === null) {
+        throw new Error(`Server zip extracted but no ${serverExecutableFileName(platform)} was found under ${serverDir} — the archive is not a valid server release.`);
+    }
+    makeExecutable(executablePath, platform);
+    emitProgress(opts.onProgress, {
+        phase: 'server-materialized',
+        message: `Downloaded + verified server to ${serverDir}`,
+        serverDir,
+        source: 'download',
+    });
+    return {
+        kind: 'success',
+        success: true,
+        source: 'download',
+        rid,
+        version,
+        serverDir,
+        executablePath,
+        downloadUrl: url,
+        warnings,
+    };
+}
+function installFromLocal(projectPath, serverDir, source, platform, warnings, onProgress) {
+    const resolved = path.resolve(source);
+    if (!fs.existsSync(resolved)) {
+        throw new Error(`--server-source ${resolved} does not exist.`);
+    }
+    emitProgress(onProgress, { phase: 'server-extracting', message: `Installing server from ${resolved}` });
+    const stat = fs.statSync(resolved);
+    if (stat.isFile() && resolved.toLowerCase().endsWith('.zip')) {
+        const entries = parseZip(fs.readFileSync(resolved));
+        stageThenSwap(projectPath, serverDir, (staging) => extractServerEntries(entries, staging));
+    }
+    else if (stat.isDirectory()) {
+        stageThenSwap(projectPath, serverDir, (staging) => {
+            fs.cpSync(resolved, staging, { recursive: true });
+        });
+    }
+    else {
+        throw new Error(`--server-source ${resolved} must be a directory or a .zip archive.`);
+    }
+    const executablePath = resolveExecutable(serverDir, platform);
+    if (executablePath === null) {
+        throw new Error(`--server-source ${resolved} did not yield a ${serverExecutableFileName(platform)} under ${serverDir}.`);
+    }
+    makeExecutable(executablePath, platform);
+    emitProgress(onProgress, {
+        phase: 'server-materialized',
+        message: `Copied server from ${resolved}`,
+        serverDir,
+        source: 'local',
+    });
+    return {
+        kind: 'success',
+        success: true,
+        source: 'local',
+        rid: detectHostRid(),
+        version: '',
+        serverDir,
+        executablePath,
+        warnings,
+    };
+}
+/**
+ * Write every zip entry into `staging` (no `addons/` prefix stripping — the
+ * server zip expands to the binary + deps at the archive root). Path-safety:
+ * reject zip-slip `../` traversal escaping the staging dir.
+ */
+function extractServerEntries(entries, staging) {
+    for (const entry of entries) {
+        if (entry.path === '')
+            continue;
+        const target = path.resolve(staging, entry.path);
+        if (target !== staging && !target.startsWith(staging + path.sep)) {
+            throw new Error(`Refusing to extract entry escaping the server dir: ${entry.path}`);
+        }
+        if (entry.isDirectory) {
+            fs.mkdirSync(target, { recursive: true });
+            continue;
+        }
+        fs.mkdirSync(path.dirname(target), { recursive: true });
+        fs.writeFileSync(target, entry.bytes);
+    }
+}
+/** Locate the server executable at the managed-dir root, else one level down. Null when absent. */
+function resolveExecutable(serverDir, platform) {
+    const exeName = serverExecutableFileName(platform);
+    const atRoot = path.join(serverDir, exeName);
+    if (fs.existsSync(atRoot))
+        return atRoot;
+    // Self-contained builds sometimes nest under a single top dir; search one level.
+    let children;
+    try {
+        children = fs.readdirSync(serverDir);
+    }
+    catch {
+        return null;
+    }
+    for (const child of children) {
+        const candidate = path.join(serverDir, child, exeName);
+        if (fs.existsSync(candidate))
+            return candidate;
+    }
+    return null;
+}
+/** Mark the executable runnable on POSIX (no-op on Windows). Best-effort. */
+function makeExecutable(executablePath, platform) {
+    if (platform === 'win32')
+        return;
+    try {
+        fs.chmodSync(executablePath, 0o755);
+    }
+    catch {
+        // Best-effort; never fail the install over a chmod.
+    }
+}
+/**
+ * Fill a fresh staging sibling, then atomically swap it into `serverDir`. A mid-
+ * fill failure discards staging and leaves any existing managed server untouched.
+ */
+function stageThenSwap(projectPath, serverDir, fill) {
+    const serverReal = path.resolve(serverDir);
+    const staging = path.resolve(projectPath, `.gamedev-server-staging-${process.pid}-${Date.now()}`);
+    fs.rmSync(staging, { recursive: true, force: true });
+    fs.mkdirSync(staging, { recursive: true });
+    try {
+        fill(staging);
+        fs.rmSync(serverReal, { recursive: true, force: true });
+        fs.mkdirSync(path.dirname(serverReal), { recursive: true });
+        fs.renameSync(staging, serverReal);
+    }
+    finally {
+        fs.rmSync(staging, { recursive: true, force: true });
+    }
+}
+//# sourceMappingURL=install-server.js.map

package/dist/lib/install-server.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"install-server.js","sourceRoot":"","sources":["../../src/lib/install-server.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,IAAI,CAAC;AACzB,OAAO,KAAK,IAAI,MAAM,MAAM,CAAC;AAC7B,OAAO,EACL,sBAAsB,EACtB,aAAa,EACb,iBAAiB,EACjB,eAAe,EACf,wBAAwB,EACxB,aAAa,EACb,sBAAsB,EACtB,iBAAiB,EACjB,qBAAqB,EACrB,SAAS,GACV,MAAM,2BAA2B,CAAC;AACnC,OAAO,EAAE,QAAQ,EAAiB,MAAM,mBAAmB,CAAC;AAC5D,OAAO,EAAE,YAAY,EAAE,MAAM,eAAe,CAAC;AAG7C,+GAA+G;AAC/G,MAAM,CAAC,MAAM,sBAAsB,GAAG,IAAI,CAAC,IAAI,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;AAE1E,uEAAuE;AACvE,MAAM,UAAU,mBAAmB,CAAC,WAAmB;IACrD,OAAO,IAAI,CAAC,IAAI,CAAC,WAAW,EAAE,sBAAsB,CAAC,CAAC;AACxD,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,8BAA8B,CAC5C,WAAmB,EACnB,WAA4B,OAAO,CAAC,QAAQ;IAE5C,OAAO,IAAI,CAAC,IAAI,CAAC,mBAAmB,CAAC,WAAW,CAAC,EAAE,wBAAwB,CAAC,QAAQ,CAAC,CAAC,CAAC;AACzF,CAAC;AAED;;;;;;;;;;;;;;;;GAgBG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,IAA0B;IAC5D,MAAM,QAAQ,GAAa,EAAE,CAAC;IAC9B,MAAM,QAAQ,GAAG,OAAO,CAAC,QAAQ,CAAC;IAElC,IAAI,CAAC;QACH,MAAM,WAAW,GAAG,IAAI,CAAC,OAAO,CAAC,IAAI,CAAC,gBAAgB,CAAC,CAAC;QACxD,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,WAAW,CAAC,EAAE,CAAC;YAChC,MAAM,IAAI,KAAK,CAAC,gCAAgC,WAAW,EAAE,CAAC,CAAC;QACjE,CAAC;QACD,MAAM,SAAS,GAAG,mBAAmB,CAAC,WAAW,CAAC,CAAC;QAEnD,IAAI,IAAI,CAAC,MAAM,KAAK,SAAS,IAAI,IAAI,CAAC,MAAM,KAAK,EAAE,EAAE,CAAC;YACpD,OAAO,gBAAgB,CAAC,WAAW,EAAE,SAAS,EAAE,IAAI,CAAC,MAAM,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,UAAU,CAAC,CAAC;QACpG,CAAC;QAED,OAAO,MAAM,mBAAmB,CAAC,WAAW,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,IAAI,CAAC,CAAC;IACrF,CAAC;IAAC,OAAO,GAAY,EAAE,CAAC;QACtB,OAAO;YACL,IAAI,EAAE,SAAS;YACf,OAAO,EAAE,KAAK;YACd,QAAQ;YACR,KAAK,EAAE,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,KAAK,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;SAC3D,CAAC;IACJ,CAAC;AACH,CAAC;AAED,KAAK,UAAU,mBAAmB,CAChC,WAAmB,EACnB,SAAiB,EACjB,QAAyB,EACzB,QAAkB,EAClB,IAA0B;IAE1B,MAAM,GAAG,GAAG,CAAC,IAAI,CAAC,GAAG,IAAI,aAAa,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjD,IAAI,GAAG,CAAC,QAAQ,CAAC,SAAS,CAAC,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,4CAA4C,GAAG,qEAAqE,CACrH,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,CAAC,IAAI,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAC,IAAI,EAAE,CAAC;IAChE,IAAI,OAAO,KAAK,EAAE,EAAE,CAAC;QACnB,MAAM,IAAI,KAAK,CAAC,yFAAyF,CAAC,CAAC;IAC7G,CAAC;IAED,MAAM,GAAG,GAAG,iBAAiB,CAAC,OAAO,EAAE,GAAG,CAAC,CAAC;IAC5C,sBAAsB,CAAC,GAAG,CAAC,CAAC;IAC5B,MAAM,SAAS,GAAG,eAAe,CAAC,GAAG,CAAC,CAAC;IAEvC,MAAM,SAAS,GAAG,IAAI,CAAC,SAAS,IAAI,UAAU,CAAC,KAAK,CAAC;IAErD,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE;QAC5B,KAAK,EAAE,oBAAoB;QAC3B,OAAO,EAAE,eAAe,SAAS,KAAK,OAAO,UAAU,GAAG,EAAE;QAC5D,GAAG;KACJ,CAAC,CAAC;IACH,MAAM,WAAW,GAAG,MAAM,SAAS,CAAC,GAAG,CAAC,CAAC;IACzC,IAAI,CAAC,WAAW,CAAC,EAAE,EAAE,CAAC;QACpB,MAAM,IAAI,KAAK,CACb,6BAA6B,OAAO,QAAQ,GAAG,UAAU,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,UAAU,SAAS,GAAG,IAAI;YACnH,uBAAuB,OAAO,kBAAkB,SAAS,wCAAwC,CACpG,CAAC;IACJ,CAAC;IACD,MAAM,OAAO,GAAG,MAAM,CAAC,IAAI,CAAC,MAAM,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;IAE7D,yEAAyE;IACzE,MAAM,OAAO,GAAG,aAAa,CAAC,OAAO,CAAC,CAAC;IACvC,sBAAsB,CAAC,OAAO,CAAC,CAAC;IAChC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,kBAAkB,EAAE,OAAO,EAAE,qBAAqB,OAAO,EAAE,EAAE,CAAC,CAAC;IACtG,MAAM,YAAY,GAAG,MAAM,SAAS,CAAC,OAAO,CAAC,CAAC;IAC9C,IAAI,CAAC,YAAY,CAAC,EAAE,EAAE,CAAC;QACrB,MAAM,IAAI,KAAK,CACb,gEAAgE,OAAO,UAAU,YAAY,CAAC,MAAM,KAAK;YACvG,iDAAiD,CACpD,CAAC;IACJ,CAAC;IACD,MAAM,QAAQ,GAAG,MAAM,YAAY,CAAC,IAAI,EAAE,CAAC;IAC3C,MAAM,YAAY,GAAG,SAAS,CAAC,OAAO,CAAC,CAAC;IACxC,MAAM,OAAO,GAAG,iBAAiB,CAAC,QAAQ,EAAE,SAAS,EAAE,YAAY,CAAC,CAAC;IACrE,IAAI,OAAO,KAAK,UAAU,EAAE,CAAC;QAC3B,MAAM,IAAI,KAAK,CACb,8BAA8B,OAAO,QAAQ,GAAG,KAAK,qBAAqB,CAAC,OAAO,EAAE,SAAS,CAAC,iBAAiB,CAChH,CAAC;IACJ,CAAC;IAED,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,gCAAgC,EAAE,CAAC,CAAC;IACzG,MAAM,OAAO,GAAG,QAAQ,CAAC,OAAO,CAAC,CAAC;IAClC,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAE3F,MAAM,cAAc,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9D,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,+BAA+B,wBAAwB,CAAC,QAAQ,CAAC,oBAAoB,SAAS,+CAA+C,CAC9I,CAAC;IACJ,CAAC;IACD,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAEzC,YAAY,CAAC,IAAI,CAAC,UAAU,EAAE;QAC5B,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,mCAAmC,SAAS,EAAE;QACvD,SAAS;QACT,MAAM,EAAE,UAAU;KACnB,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,UAAU;QAClB,GAAG;QACH,OAAO;QACP,SAAS;QACT,cAAc;QACd,WAAW,EAAE,GAAG;QAChB,QAAQ;KACT,CAAC;AACJ,CAAC;AAED,SAAS,gBAAgB,CACvB,WAAmB,EACnB,SAAiB,EACjB,MAAc,EACd,QAAyB,EACzB,QAAkB,EAClB,UAA6B;IAE7B,MAAM,QAAQ,GAAG,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,CAAC;IACtC,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,QAAQ,CAAC,EAAE,CAAC;QAC7B,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,kBAAkB,CAAC,CAAC;IACjE,CAAC;IAED,YAAY,CAAC,UAAU,EAAE,EAAE,KAAK,EAAE,mBAAmB,EAAE,OAAO,EAAE,0BAA0B,QAAQ,EAAE,EAAE,CAAC,CAAC;IAExG,MAAM,IAAI,GAAG,EAAE,CAAC,QAAQ,CAAC,QAAQ,CAAC,CAAC;IACnC,IAAI,IAAI,CAAC,MAAM,EAAE,IAAI,QAAQ,CAAC,WAAW,EAAE,CAAC,QAAQ,CAAC,MAAM,CAAC,EAAE,CAAC;QAC7D,MAAM,OAAO,GAAG,QAAQ,CAAC,EAAE,CAAC,YAAY,CAAC,QAAQ,CAAC,CAAC,CAAC;QACpD,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE,CAAC,oBAAoB,CAAC,OAAO,EAAE,OAAO,CAAC,CAAC,CAAC;IAC7F,CAAC;SAAM,IAAI,IAAI,CAAC,WAAW,EAAE,EAAE,CAAC;QAC9B,aAAa,CAAC,WAAW,EAAE,SAAS,EAAE,CAAC,OAAO,EAAE,EAAE;YAChD,EAAE,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACpD,CAAC,CAAC,CAAC;IACL,CAAC;SAAM,CAAC;QACN,MAAM,IAAI,KAAK,CAAC,mBAAmB,QAAQ,yCAAyC,CAAC,CAAC;IACxF,CAAC;IAED,MAAM,cAAc,GAAG,iBAAiB,CAAC,SAAS,EAAE,QAAQ,CAAC,CAAC;IAC9D,IAAI,cAAc,KAAK,IAAI,EAAE,CAAC;QAC5B,MAAM,IAAI,KAAK,CACb,mBAAmB,QAAQ,oBAAoB,wBAAwB,CAAC,QAAQ,CAAC,UAAU,SAAS,GAAG,CACxG,CAAC;IACJ,CAAC;IACD,cAAc,CAAC,cAAc,EAAE,QAAQ,CAAC,CAAC;IAEzC,YAAY,CAAC,UAAU,EAAE;QACvB,KAAK,EAAE,qBAAqB;QAC5B,OAAO,EAAE,sBAAsB,QAAQ,EAAE;QACzC,SAAS;QACT,MAAM,EAAE,OAAO;KAChB,CAAC,CAAC;IAEH,OAAO;QACL,IAAI,EAAE,SAAS;QACf,OAAO,EAAE,IAAI;QACb,MAAM,EAAE,OAAO;QACf,GAAG,EAAE,aAAa,EAAE;QACpB,OAAO,EAAE,EAAE;QACX,SAAS;QACT,cAAc;QACd,QAAQ;KACT,CAAC;AACJ,CAAC;AAED;;;;GAIG;AACH,SAAS,oBAAoB,CAAC,OAAmB,EAAE,OAAe;IAChE,KAAK,MAAM,KAAK,IAAI,OAAO,EAAE,CAAC;QAC5B,IAAI,KAAK,CAAC,IAAI,KAAK,EAAE;YAAE,SAAS;QAChC,MAAM,MAAM,GAAG,IAAI,CAAC,OAAO,CAAC,OAAO,EAAE,KAAK,CAAC,IAAI,CAAC,CAAC;QACjD,IAAI,MAAM,KAAK,OAAO,IAAI,CAAC,MAAM,CAAC,UAAU,CAAC,OAAO,GAAG,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC;YACjE,MAAM,IAAI,KAAK,CAAC,sDAAsD,KAAK,CAAC,IAAI,EAAE,CAAC,CAAC;QACtF,CAAC;QACD,IAAI,KAAK,CAAC,WAAW,EAAE,CAAC;YACtB,EAAE,CAAC,SAAS,CAAC,MAAM,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;YAC1C,SAAS;QACX,CAAC;QACD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,EAAE,CAAC,aAAa,CAAC,MAAM,EAAE,KAAK,CAAC,KAAK,CAAC,CAAC;IACxC,CAAC;AACH,CAAC;AAED,mGAAmG;AACnG,SAAS,iBAAiB,CAAC,SAAiB,EAAE,QAAyB;IACrE,MAAM,OAAO,GAAG,wBAAwB,CAAC,QAAQ,CAAC,CAAC;IACnD,MAAM,MAAM,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,OAAO,CAAC,CAAC;IAC7C,IAAI,EAAE,CAAC,UAAU,CAAC,MAAM,CAAC;QAAE,OAAO,MAAM,CAAC;IACzC,iFAAiF;IACjF,IAAI,QAAkB,CAAC;IACvB,IAAI,CAAC;QACH,QAAQ,GAAG,EAAE,CAAC,WAAW,CAAC,SAAS,CAAC,CAAC;IACvC,CAAC;IAAC,MAAM,CAAC;QACP,OAAO,IAAI,CAAC;IACd,CAAC;IACD,KAAK,MAAM,KAAK,IAAI,QAAQ,EAAE,CAAC;QAC7B,MAAM,SAAS,GAAG,IAAI,CAAC,IAAI,CAAC,SAAS,EAAE,KAAK,EAAE,OAAO,CAAC,CAAC;QACvD,IAAI,EAAE,CAAC,UAAU,CAAC,SAAS,CAAC;YAAE,OAAO,SAAS,CAAC;IACjD,CAAC;IACD,OAAO,IAAI,CAAC;AACd,CAAC;AAED,6EAA6E;AAC7E,SAAS,cAAc,CAAC,cAAsB,EAAE,QAAyB;IACvE,IAAI,QAAQ,KAAK,OAAO;QAAE,OAAO;IACjC,IAAI,CAAC;QACH,EAAE,CAAC,SAAS,CAAC,cAAc,EAAE,KAAK,CAAC,CAAC;IACtC,CAAC;IAAC,MAAM,CAAC;QACP,oDAAoD;IACtD,CAAC;AACH,CAAC;AAED;;;GAGG;AACH,SAAS,aAAa,CAAC,WAAmB,EAAE,SAAiB,EAAE,IAA+B;IAC5F,MAAM,UAAU,GAAG,IAAI,CAAC,OAAO,CAAC,SAAS,CAAC,CAAC;IAC3C,MAAM,OAAO,GAAG,IAAI,CAAC,OAAO,CAAC,WAAW,EAAE,2BAA2B,OAAO,CAAC,GAAG,IAAI,IAAI,CAAC,GAAG,EAAE,EAAE,CAAC,CAAC;IAClG,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACrD,EAAE,CAAC,SAAS,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;IAC3C,IAAI,CAAC;QACH,IAAI,CAAC,OAAO,CAAC,CAAC;QACd,EAAE,CAAC,MAAM,CAAC,UAAU,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;QACxD,EAAE,CAAC,SAAS,CAAC,IAAI,CAAC,OAAO,CAAC,UAAU,CAAC,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,CAAC,CAAC;QAC5D,EAAE,CAAC,UAAU,CAAC,OAAO,EAAE,UAAU,CAAC,CAAC;IACrC,CAAC;YAAS,CAAC;QACT,EAAE,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,EAAE,IAAI,EAAE,KAAK,EAAE,IAAI,EAAE,CAAC,CAAC;IACvD,CAAC;AACH,CAAC"}

package/dist/lib/types.d.ts

@@ -26,6 +26,28 @@ export type ProgressEvent = {
     phase: 'csproj-patched';
     message: string;
     csprojPath: string;
+} | {
+    phase: 'server-downloading';
+    message: string;
+    url: string;
+} | {
+    phase: 'server-verifying';
+    message: string;
+} | {
+    phase: 'server-extracting';
+    message: string;
+} | {
+    phase: 'server-materialized';
+    message: string;
+    serverDir: string;
+    source: 'download' | 'local';
+} | {
+    phase: 'enroll-redeeming';
+    message: string;
+} | {
+    phase: 'enroll-redeemed';
+    message: string;
+    serverTarget: string;
 } | {
     phase: 'project-scaffolded';
     message: string;
@@ -476,3 +498,119 @@ export interface InstallExtensionFailure {
     error: Error;
 }
 export type InstallExtensionResult = InstallExtensionSuccess | InstallExtensionFailure;
+export interface InstallServerOptions {
+    /** Absolute or relative path to the Godot project root (holds the managed server dir). */
+    godotProjectPath: string;
+    /**
+     * Local path to install the server from instead of downloading it (offline /
+     * dev / CI — the `--server-source` flag). May be a directory containing the
+     * server binary, or a `.zip` archive of one. When set, no network call is made
+     * and no checksum is verified (the local artifact is trusted).
+     */
+    source?: string;
+    /**
+     * Shared-server version to download (`v<version>` release on GameDev-MCP-Server).
+     * Defaults to the addon's pinned `ServerVersion`. Ignored when `source` is set.
+     */
+    version?: string;
+    /** Host RID override (`<os>-<arch>`). Defaults to the detected host RID. */
+    rid?: string;
+    /** Injectable fetch for tests (mock the GitHub download). Used only on the download path. */
+    fetchImpl?: typeof fetch;
+    onProgress?: ProgressCallback;
+}
+export interface InstallServerSuccess {
+    kind: 'success';
+    success: true;
+    /** Where the server binary came from. */
+    source: 'download' | 'local';
+    /** The host RID the binary was resolved for. */
+    rid: string;
+    /** The downloaded server version (empty on the local path). */
+    version: string;
+    /** Absolute path to the CLI-managed server directory the binary was extracted into. */
+    serverDir: string;
+    /** Absolute path to the resolved server executable. */
+    executablePath: string;
+    /** The download URL used (download path only). */
+    downloadUrl?: string;
+    warnings: string[];
+}
+export interface InstallServerFailure {
+    kind: 'failure';
+    success: false;
+    warnings: string[];
+    error: Error;
+}
+export type InstallServerResult = InstallServerSuccess | InstallServerFailure;
+export interface EnrollPluginOptions {
+    /** Absolute or relative path to the Godot project root (holds the project marker). */
+    godotProjectPath: string;
+    /** The D13 enrollment code to redeem. */
+    code: string;
+    /** Cloud AS base URL to redeem against (default https://ai-game.dev). */
+    baseUrl?: string;
+    /** Override the machine credential store directory (tests only). */
+    storeBaseDir?: string;
+    /** Injectable fetch for the redeem round-trip (tests). */
+    fetchImpl?: typeof fetch;
+    onProgress?: ProgressCallback;
+}
+export interface EnrollPluginSuccess {
+    kind: 'success';
+    success: true;
+    /** The server target the enrollment code was minted for (recorded in the marker). */
+    serverTarget: string;
+    /** The D14 routing pin recorded in the marker. */
+    pin: string;
+    /** The deterministic local port recorded for a localhost target (undefined for a hosted target). */
+    port?: number;
+    /** Absolute path to the machine credential store the plugin credential was written to. */
+    credentialsPath: string;
+    /** Absolute path to the project marker written. */
+    markerPath: string;
+    /** Absolute paths of any existing project-local agent configs whose URL was pin-upserted. */
+    pinnedConfigs: string[];
+    warnings: string[];
+}
+export interface EnrollPluginFailure {
+    kind: 'failure';
+    success: false;
+    warnings: string[];
+    error: Error;
+}
+export type EnrollPluginResult = EnrollPluginSuccess | EnrollPluginFailure;
+export interface ConfigureAgentOptions {
+    /** Absolute or relative path to the Godot project root (locates the managed server binary + is the config target). */
+    godotProjectPath: string;
+    /** The agent id to configure (forwarded verbatim to the server binary's `configure --agent`). */
+    agentId: string;
+    /** Explicit MCP server URL override (forwarded as `--url`). */
+    url?: string;
+    /** Injectable `child_process.spawn` for tests (mock the server binary). */
+    spawnImpl?: typeof import('child_process').spawn;
+    onProgress?: ProgressCallback;
+}
+export interface ConfigureAgentSuccess {
+    kind: 'success';
+    success: true;
+    agentId: string;
+    /** Absolute path to the managed server binary that was proxied to. */
+    serverBinaryPath: string;
+    /** The argv passed to the server binary (after the executable), for diagnostics. */
+    args: string[];
+    /** The server binary's exit code (0 on success). */
+    exitCode: number;
+    /** The server binary's captured stdout+stderr (surfaced to the user by the command). */
+    output: string;
+    warnings: string[];
+}
+export interface ConfigureAgentFailure {
+    kind: 'failure';
+    success: false;
+    /** The server binary's exit code when it ran and failed; undefined when it could not be launched. */
+    exitCode?: number;
+    warnings: string[];
+    error: Error;
+}
+export type ConfigureAgentResult = ConfigureAgentSuccess | ConfigureAgentFailure;

package/dist/lib.d.ts

@@ -6,6 +6,9 @@ export { setupMcp, listAgentIds } from './lib/setup-mcp.js';
 export { setupSkills } from './lib/setup-skills.js';
 export { installPlugin, removePlugin } from './lib/install-plugin.js';
 export { installExtension } from './lib/install-extension.js';
+export { installServer } from './lib/install-server.js';
+export { enrollPlugin } from './lib/enroll.js';
+export { configureAgentViaServer } from './lib/configure-agent.js';
 export { EXTENSIONS_CATALOG, findExtension, hasVersion } from './utils/extensions-catalog.js';
 export type { ExtensionDescriptor, ExtensionTool } from './utils/extensions-catalog.js';
-export type { ProgressEvent, ProgressCallback, ResultKind, OpenProjectOptions, OpenProjectResult, OpenProjectSuccess, OpenProjectFailure, OpenProjectAuthOption, OpenProjectConnectionMode, BuildProjectOptions, BuildProjectResult, BuildProjectSuccess, BuildProjectFailure, BuildSkipReason, CreateProjectOptions, CreateProjectResult, CreateProjectSuccess, CreateProjectFailure, RunToolOptions, RunToolResult, RunToolSuccess, RunToolFailure, RunToolFailureReason, RunSystemToolOptions, RunSystemToolResult, RunSystemToolSuccess, RunSystemToolFailure, SetupMcpOptions, SetupMcpResult, SetupMcpSuccess, SetupMcpFailure, SetupSkillsOptions, SetupSkillsResult, SetupSkillsSuccess, SetupSkillsFailure, InstallPluginOptions, InstallPluginResult, InstallPluginSuccess, InstallPluginFailure, AddonMaterializeOutcome, CsprojPatchOutcome, RemovePluginOptions, RemovePluginResult, RemovePluginSuccess, RemovePluginFailure, InstallExtensionOptions, InstallExtensionResult, InstallExtensionSuccess, InstallExtensionFailure, ExtensionInstallOutcome, } from './lib/types.js';
+export type { ProgressEvent, ProgressCallback, ResultKind, OpenProjectOptions, OpenProjectResult, OpenProjectSuccess, OpenProjectFailure, OpenProjectAuthOption, OpenProjectConnectionMode, BuildProjectOptions, BuildProjectResult, BuildProjectSuccess, BuildProjectFailure, BuildSkipReason, CreateProjectOptions, CreateProjectResult, CreateProjectSuccess, CreateProjectFailure, RunToolOptions, RunToolResult, RunToolSuccess, RunToolFailure, RunToolFailureReason, RunSystemToolOptions, RunSystemToolResult, RunSystemToolSuccess, RunSystemToolFailure, SetupMcpOptions, SetupMcpResult, SetupMcpSuccess, SetupMcpFailure, SetupSkillsOptions, SetupSkillsResult, SetupSkillsSuccess, SetupSkillsFailure, InstallPluginOptions, InstallPluginResult, InstallPluginSuccess, InstallPluginFailure, AddonMaterializeOutcome, CsprojPatchOutcome, RemovePluginOptions, RemovePluginResult, RemovePluginSuccess, RemovePluginFailure, InstallExtensionOptions, InstallExtensionResult, InstallExtensionSuccess, InstallExtensionFailure, ExtensionInstallOutcome, InstallServerOptions, InstallServerResult, InstallServerSuccess, InstallServerFailure, EnrollPluginOptions, EnrollPluginResult, EnrollPluginSuccess, EnrollPluginFailure, ConfigureAgentOptions, ConfigureAgentResult, ConfigureAgentSuccess, ConfigureAgentFailure, } from './lib/types.js';

package/dist/lib.js

@@ -20,6 +20,9 @@ export { setupMcp, listAgentIds } from './lib/setup-mcp.js';
 export { setupSkills } from './lib/setup-skills.js';
 export { installPlugin, removePlugin } from './lib/install-plugin.js';
 export { installExtension } from './lib/install-extension.js';
+export { installServer } from './lib/install-server.js';
+export { enrollPlugin } from './lib/enroll.js';
+export { configureAgentViaServer } from './lib/configure-agent.js';
 // Shared extension catalog (single-sourced from addons/godot_mcp/extensions.catalog.json)
 // + its lookup helpers, so the app can render the same list the dock + CLI install from.
 export { EXTENSIONS_CATALOG, findExtension, hasVersion } from './utils/extensions-catalog.js';

package/dist/lib.js.map

@@ -1 +1 @@
-{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,eAAe;AACf,+EAA+E;AAC/E,wDAAwD;AACxD,oDAAoD;AACpD,yEAAyE;AACzE,4DAA4D;AAC5D,+EAA+E;AAC/E,gEAAgE;AAChE,6EAA6E;AAC7E,EAAE;AACF,0EAA0E;AAC1E,4CAA4C;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAE9D,0FAA0F;AAC1F,yFAAyF;AACzF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC"}
+{"version":3,"file":"lib.js","sourceRoot":"","sources":["../src/lib.ts"],"names":[],"mappings":"AAAA,uCAAuC;AACvC,EAAE;AACF,eAAe;AACf,+EAA+E;AAC/E,wDAAwD;AACxD,oDAAoD;AACpD,yEAAyE;AACzE,4DAA4D;AAC5D,+EAA+E;AAC/E,gEAAgE;AAChE,6EAA6E;AAC7E,EAAE;AACF,0EAA0E;AAC1E,4CAA4C;AAE5C,OAAO,EAAE,WAAW,EAAE,MAAM,eAAe,CAAC;AAC5C,OAAO,EAAE,YAAY,EAAE,MAAM,gBAAgB,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,OAAO,EAAE,aAAa,EAAE,MAAM,mBAAmB,CAAC;AAC3D,OAAO,EAAE,QAAQ,EAAE,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAC5D,OAAO,EAAE,WAAW,EAAE,MAAM,uBAAuB,CAAC;AACpD,OAAO,EAAE,aAAa,EAAE,YAAY,EAAE,MAAM,yBAAyB,CAAC;AACtE,OAAO,EAAE,gBAAgB,EAAE,MAAM,4BAA4B,CAAC;AAC9D,OAAO,EAAE,aAAa,EAAE,MAAM,yBAAyB,CAAC;AACxD,OAAO,EAAE,YAAY,EAAE,MAAM,iBAAiB,CAAC;AAC/C,OAAO,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAEnE,0FAA0F;AAC1F,yFAAyF;AACzF,OAAO,EAAE,kBAAkB,EAAE,aAAa,EAAE,UAAU,EAAE,MAAM,+BAA+B,CAAC"}

package/dist/utils/addon-deps.js

@@ -19,8 +19,8 @@
  * addon csproj (ReflectorNet first, then McpPlugin).
  */
 export const ADDON_PACKAGE_REFERENCES = [
-    { id: 'com.IvanMurzak.ReflectorNet', version: '5.3.1' },
-    { id: 'com.IvanMurzak.McpPlugin', version: '6.11.0' },
+    { id: 'com.IvanMurzak.ReflectorNet', version: '5.3.2' },
+    { id: 'com.IvanMurzak.McpPlugin', version: '7.0.0' },
 ];
 /**
  * The exact `<EmbeddedResource>`s the consumer's project `.csproj` needs, single-sourced

package/dist/utils/addon-deps.js.map

@@ -1 +1 @@
-{"version":3,"file":"addon-deps.js","sourceRoot":"","sources":["../../src/utils/addon-deps.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,mFAAmF;AACnF,oEAAoE;AACpE,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,kFAAkF;AAClF,8EAA8E;AAC9E,4EAA4E;AAC5E,iFAAiF;AACjF,iFAAiF;AACjF,+CAA+C;AAC/C,EAAE;AACF,sEAAsE;AAwBtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqC;IACxE,EAAE,EAAE,EAAE,6BAA6B,EAAE,OAAO,EAAE,OAAO,EAAE;IACvD,EAAE,EAAE,EAAE,0BAA0B,EAAE,OAAO,EAAE,QAAQ,EAAE;CAC7C,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqC;IACxE;QACE,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,mCAAmC;KACjD;CACO,CAAC;AAEX,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,mCAAmC,CAAC"}
+{"version":3,"file":"addon-deps.js","sourceRoot":"","sources":["../../src/utils/addon-deps.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,mFAAmF;AACnF,oEAAoE;AACpE,8EAA8E;AAC9E,yEAAyE;AACzE,EAAE;AACF,6EAA6E;AAC7E,kFAAkF;AAClF,8EAA8E;AAC9E,4EAA4E;AAC5E,iFAAiF;AACjF,iFAAiF;AACjF,+CAA+C;AAC/C,EAAE;AACF,sEAAsE;AAwBtE;;;;GAIG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqC;IACxE,EAAE,EAAE,EAAE,6BAA6B,EAAE,OAAO,EAAE,OAAO,EAAE;IACvD,EAAE,EAAE,EAAE,0BAA0B,EAAE,OAAO,EAAE,OAAO,EAAE;CAC5C,CAAC;AAEX;;;;;;;;GAQG;AACH,MAAM,CAAC,MAAM,wBAAwB,GAAqC;IACxE;QACE,OAAO,EAAE,0CAA0C;QACnD,WAAW,EAAE,mCAAmC;KACjD;CACO,CAAC;AAEX,wFAAwF;AACxF,MAAM,CAAC,MAAM,yBAAyB,GAAG,mCAAmC,CAAC"}

package/dist/utils/cloud-login.d.ts

@@ -1,4 +1,20 @@
 import { type DeviceAuthDeps } from './auth.js';
+/**
+ * Where a successful `login` persists the credential.
+ *
+ * - `machine` (the default) → the shared per-machine store `~/.ai-game-dev/credentials.json`
+ *   (0600 on POSIX / DPAPI on Windows), so the engine plugin auto-adopts it — sign in once per
+ *   machine (design 06 · D12). `storeBaseDir` overrides the store directory (tests only).
+ * - `project` → the legacy project-local override `<projectPath>/.godot-mcp/credentials.json`
+ *   (gitignored), kept for per-project accounts (the `--project` flag).
+ */
+export type CredentialSink = {
+    kind: 'machine';
+    storeBaseDir?: string;
+} | {
+    kind: 'project';
+    projectPath: string;
+};
 export interface CloudLoginOptions {
     /** Cloud base URL to authenticate against (default https://ai-game.dev). */
     baseUrl?: string;
@@ -8,12 +24,14 @@ export interface CloudLoginOptions {
     openBrowserImpl?: (url: string) => void;
     /** Device-flow dependency injection (fetch/sleep/clock) for tests. */
     authDeps?: DeviceAuthDeps;
+    /** Where to persist the credential. Defaults to the shared machine store. */
+    sink?: CredentialSink;
 }
 /**
- * Run the cloud device-auth flow: initiate, display the user code, open the
- * browser, poll to completion, and persist the token to the project's
- * `.godot-mcp/credentials.json`.
+ * Run the cloud device-auth flow: initiate, display the user code, open the browser, poll to
+ * completion, and persist the token to the resolved {@link CredentialSink} (the shared machine store
+ * by default; the project-local override when `--project` is used).
  *
  * Returns the access token on success, or null on failure (errors are printed).
  */
-export declare function runCloudLogin(projectPath: string, options?: CloudLoginOptions): Promise<string | null>;
+export declare function runCloudLogin(options?: CloudLoginOptions): Promise<string | null>;

package/dist/utils/cloud-login.js

@@ -1,19 +1,21 @@
 import * as ui from './ui.js';
 import { DEFAULT_CLOUD_BASE_URL } from './connection.js';
 import { readCredentials, writeCredentials } from './credentials.js';
+import { readMachineCredentials, writeMachineCredentials } from './machine-credentials.js';
 import { deviceAuthFlow } from './auth.js';
 import { openBrowser } from './browser.js';
 /**
- * Run the cloud device-auth flow: initiate, display the user code, open the
- * browser, poll to completion, and persist the token to the project's
- * `.godot-mcp/credentials.json`.
+ * Run the cloud device-auth flow: initiate, display the user code, open the browser, poll to
+ * completion, and persist the token to the resolved {@link CredentialSink} (the shared machine store
+ * by default; the project-local override when `--project` is used).
  *
  * Returns the access token on success, or null on failure (errors are printed).
  */
-export async function runCloudLogin(projectPath, options = {}) {
+export async function runCloudLogin(options = {}) {
     const baseUrl = (options.baseUrl ?? DEFAULT_CLOUD_BASE_URL).replace(/\/$/, '');
     const clientLabel = options.clientLabel ?? 'Godot-MCP CLI';
     const openBrowserImpl = options.openBrowserImpl ?? openBrowser;
+    const sink = options.sink ?? { kind: 'machine' };
     let spinner;
     try {
         const result = await deviceAuthFlow(baseUrl, clientLabel, {
@@ -31,19 +33,7 @@ export async function runCloudLogin(projectPath, options = {}) {
         }, options.authDeps);
         if (result.success) {
             spinner?.success('Authorized');
-            // A corrupt existing credentials file must not block a fresh login.
-            let existing = {};
-            try {
-                existing = readCredentials(projectPath) ?? {};
-            }
-            catch {
-                existing = {};
-            }
-            writeCredentials(projectPath, {
-                ...existing,
-                cloudToken: result.accessToken,
-                cloudBaseUrl: baseUrl,
-            });
+            persistCredential(sink, result.accessToken, baseUrl);
             return result.accessToken;
         }
         spinner?.stop();
@@ -62,4 +52,37 @@ export async function runCloudLogin(projectPath, options = {}) {
         return null;
     }
 }
+function persistCredential(sink, accessToken, baseUrl) {
+    if (sink.kind === 'project') {
+        // A corrupt existing credentials file must not block a fresh login.
+        let existing = {};
+        try {
+            existing = readCredentials(sink.projectPath) ?? {};
+        }
+        catch {
+            existing = {};
+        }
+        writeCredentials(sink.projectPath, {
+            ...existing,
+            cloudToken: accessToken,
+            cloudBaseUrl: baseUrl,
+        });
+        return;
+    }
+    // Machine store: preserve any stored identity/refresh fields, replacing the token material and
+    // recording the server target the credential was issued for.
+    let existing = {};
+    try {
+        existing = readMachineCredentials(sink.storeBaseDir) ?? {};
+    }
+    catch {
+        existing = {};
+    }
+    writeMachineCredentials({
+        ...existing,
+        version: 1,
+        accessToken,
+        serverTarget: baseUrl,
+    }, sink.storeBaseDir);
+}
 //# sourceMappingURL=cloud-login.js.map

package/dist/utils/cloud-login.js.map

@@ -1 +1 @@
-{"version":3,"file":"cloud-login.js","sourceRoot":"","sources":["../../src/utils/cloud-login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AAa3C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CACjC,WAAmB,EACnB,UAA6B,EAAE;IAE/B,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,WAAW,CAAC;IAE/D,IAAI,OAAuD,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,OAAO,EACP,WAAW,EACX;YACE,UAAU,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE;gBACxC,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;gBACvC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,KAAK,eAAe,EAAE,CAAC,CAAC;gBACpC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC3B,eAAe,CAAC,eAAe,CAAC,CAAC;YACnC,CAAC;YACD,SAAS,EAAE,GAAG,EAAE;gBACd,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;YAC5D,CAAC;SACF,EACD,OAAO,CAAC,QAAQ,CACjB,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YAE/B,oEAAoE;YACpE,IAAI,QAAQ,GAAG,EAAE,CAAC;YAClB,IAAI,CAAC;gBACH,QAAQ,GAAG,eAAe,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;YAChD,CAAC;YAAC,MAAM,CAAC;gBACP,QAAQ,GAAG,EAAE,CAAC;YAChB,CAAC;YACD,gBAAgB,CAAC,WAAW,EAAE;gBAC5B,GAAG,QAAQ;gBACX,UAAU,EAAE,MAAM,CAAC,WAAW;gBAC9B,YAAY,EAAE,OAAO;aACtB,CAAC,CAAC;YAEH,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACzE,EAAE,CAAC,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC"}
+{"version":3,"file":"cloud-login.js","sourceRoot":"","sources":["../../src/utils/cloud-login.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,sBAAsB,EAAE,MAAM,iBAAiB,CAAC;AACzD,OAAO,EAAE,eAAe,EAAE,gBAAgB,EAAE,MAAM,kBAAkB,CAAC;AACrE,OAAO,EAAE,sBAAsB,EAAE,uBAAuB,EAAE,MAAM,0BAA0B,CAAC;AAC3F,OAAO,EAAE,cAAc,EAAuB,MAAM,WAAW,CAAC;AAChE,OAAO,EAAE,WAAW,EAAE,MAAM,cAAc,CAAC;AA4B3C;;;;;;GAMG;AACH,MAAM,CAAC,KAAK,UAAU,aAAa,CAAC,UAA6B,EAAE;IACjE,MAAM,OAAO,GAAG,CAAC,OAAO,CAAC,OAAO,IAAI,sBAAsB,CAAC,CAAC,OAAO,CAAC,KAAK,EAAE,EAAE,CAAC,CAAC;IAC/E,MAAM,WAAW,GAAG,OAAO,CAAC,WAAW,IAAI,eAAe,CAAC;IAC3D,MAAM,eAAe,GAAG,OAAO,CAAC,eAAe,IAAI,WAAW,CAAC;IAC/D,MAAM,IAAI,GAAmB,OAAO,CAAC,IAAI,IAAI,EAAE,IAAI,EAAE,SAAS,EAAE,CAAC;IAEjE,IAAI,OAAuD,CAAC;IAE5D,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,MAAM,cAAc,CACjC,OAAO,EACP,WAAW,EACX;YACE,UAAU,EAAE,CAAC,QAAQ,EAAE,eAAe,EAAE,EAAE;gBACxC,EAAE,CAAC,IAAI,CAAC,6BAA6B,CAAC,CAAC;gBACvC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,OAAO,CAAC,GAAG,CAAC,KAAK,eAAe,EAAE,CAAC,CAAC;gBACpC,OAAO,CAAC,GAAG,EAAE,CAAC;gBACd,EAAE,CAAC,KAAK,CAAC,MAAM,EAAE,QAAQ,CAAC,CAAC;gBAC3B,eAAe,CAAC,eAAe,CAAC,CAAC;YACnC,CAAC;YACD,SAAS,EAAE,GAAG,EAAE;gBACd,OAAO,GAAG,EAAE,CAAC,YAAY,CAAC,8BAA8B,CAAC,CAAC;YAC5D,CAAC;SACF,EACD,OAAO,CAAC,QAAQ,CACjB,CAAC;QAEF,IAAI,MAAM,CAAC,OAAO,EAAE,CAAC;YACnB,OAAO,EAAE,OAAO,CAAC,YAAY,CAAC,CAAC;YAC/B,iBAAiB,CAAC,IAAI,EAAE,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC,CAAC;YACrD,OAAO,MAAM,CAAC,WAAW,CAAC;QAC5B,CAAC;QAED,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,EAAE,CAAC,KAAK,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;QACzB,OAAO,IAAI,CAAC;IACd,CAAC;IAAC,OAAO,GAAG,EAAE,CAAC;QACb,OAAO,EAAE,IAAI,EAAE,CAAC;QAChB,MAAM,OAAO,GAAG,GAAG,YAAY,KAAK,CAAC,CAAC,CAAC,GAAG,CAAC,OAAO,CAAC,CAAC,CAAC,MAAM,CAAC,GAAG,CAAC,CAAC;QACjE,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,IAAI,OAAO,CAAC,QAAQ,CAAC,cAAc,CAAC,EAAE,CAAC;YACzE,EAAE,CAAC,KAAK,CAAC,gCAAgC,OAAO,EAAE,CAAC,CAAC;QACtD,CAAC;aAAM,CAAC;YACN,EAAE,CAAC,KAAK,CAAC,0BAA0B,OAAO,EAAE,CAAC,CAAC;QAChD,CAAC;QACD,OAAO,IAAI,CAAC;IACd,CAAC;AACH,CAAC;AAED,SAAS,iBAAiB,CAAC,IAAoB,EAAE,WAAmB,EAAE,OAAe;IACnF,IAAI,IAAI,CAAC,IAAI,KAAK,SAAS,EAAE,CAAC;QAC5B,oEAAoE;QACpE,IAAI,QAAQ,GAAG,EAAE,CAAC;QAClB,IAAI,CAAC;YACH,QAAQ,GAAG,eAAe,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,EAAE,CAAC;QACrD,CAAC;QAAC,MAAM,CAAC;YACP,QAAQ,GAAG,EAAE,CAAC;QAChB,CAAC;QACD,gBAAgB,CAAC,IAAI,CAAC,WAAW,EAAE;YACjC,GAAG,QAAQ;YACX,UAAU,EAAE,WAAW;YACvB,YAAY,EAAE,OAAO;SACtB,CAAC,CAAC;QACH,OAAO;IACT,CAAC;IAED,+FAA+F;IAC/F,6DAA6D;IAC7D,IAAI,QAAQ,GAAG,EAAE,CAAC;IAClB,IAAI,CAAC;QACH,QAAQ,GAAG,sBAAsB,CAAC,IAAI,CAAC,YAAY,CAAC,IAAI,EAAE,CAAC;IAC7D,CAAC;IAAC,MAAM,CAAC;QACP,QAAQ,GAAG,EAAE,CAAC;IAChB,CAAC;IACD,uBAAuB,CACrB;QACE,GAAG,QAAQ;QACX,OAAO,EAAE,CAAC;QACV,WAAW;QACX,YAAY,EAAE,OAAO;KACtB,EACD,IAAI,CAAC,YAAY,CAClB,CAAC;AACJ,CAAC"}

package/dist/utils/connection.d.ts

@@ -44,13 +44,10 @@ export declare function resolveAndValidateProjectPath(positionalPath: string | u
  * Token priority:
  *   1. --token flag (explicit override)
  *   2. GODOT_MCP_TOKEN env
- *   3. persisted cloud token from `.godot-mcp/credentials.json` (Cloud mode only,
- *      written by `godot-cli login`)
- *
- * Unlike the Unity CLI, there is NO deterministic project-path→port hash:
- * the Godot plugin is a server-less client whose live config lives in `user://`
- * (outside the project tree). The one project-local surface the CLI DOES own is
- * the `login`-written credentials file, consulted last so `--token`/env still win.
+ *   3. persisted cloud token (Cloud mode only) — the project-local
+ *      `.godot-mcp/credentials.json` (a `--project` login) first, then the shared machine
+ *      store `~/.ai-game-dev/credentials.json` (a default `godot-cli login`), so a
+ *      sign-once-per-machine credential is picked up here too.
  */
 export declare function resolveConnection(projectPath: string, options: ConnectionOptions): {
     url: string;