godot-cli 0.16.2 → 0.17.1

package/dist/utils/server-source.d.ts

@@ -0,0 +1,84 @@
+/**
+ * The DEFAULT shared-server version `--with-server` downloads. Single-sourced
+ * from the addon's `GodotMcpServerView.ServerVersion` constant (parity-tested).
+ * `--server-version <v>` overrides it; `--server-source <path>` skips the
+ * download entirely (offline / CI). Bumping the addon's server pin requires
+ * bumping this in the same PR or the parity test goes red.
+ */
+export declare const DEFAULT_SERVER_VERSION = "9.0.0";
+/** GitHub-release host the server zip + manifest are downloaded from. NOTHING else is trusted. */
+export declare const TRUSTED_DOWNLOAD_HOST = "github.com";
+/** The `owner/repo` the shared server releases live under. */
+export declare const SERVER_RELEASE_REPO = "IvanMurzak/GameDev-MCP-Server";
+/** The server-binary base name (matches the addon's `GodotMcpServerView.ExecutableName`). */
+export declare const SERVER_EXECUTABLE_NAME = "gamedev-mcp-server";
+/** The release-asset / RID prefix (matches the addon's `AssetPrefix`). */
+export declare const SERVER_ASSET_PREFIX = "gamedev-mcp-server";
+/** The integrity-manifest asset attached to every GameDev-MCP-Server release. */
+export declare const SHA256SUMS_ASSET_NAME = "SHA256SUMS";
+/** Map a Node `process.platform` token to the .NET RID os segment (`win`/`osx`/`linux`). */
+export declare function osToken(platform?: NodeJS.Platform): string;
+/** Map a Node `process.arch` token to the .NET RID arch segment (`x86`/`x64`/`arm`/`arm64`). */
+export declare function archToken(arch?: string): string;
+/**
+ * The RID-style platform name `<os>-<arch>` (e.g. `win-x64`) for the given (or
+ * current) host. Matches the addon's `GodotMcpServerView.PlatformName` and the
+ * GameDev-MCP-Server release asset RIDs (linux-arm64/linux-x64/osx-arm64/osx-x64/
+ * win-arm64/win-x64/win-x86). Pure.
+ */
+export declare function detectHostRid(platform?: NodeJS.Platform, arch?: string): string;
+/** The on-disk executable file name for an os: `gamedev-mcp-server.exe` on Windows, else `gamedev-mcp-server`. */
+export declare function serverExecutableFileName(platform?: NodeJS.Platform): string;
+/** The GitHub release-zip asset name for a RID: `gamedev-mcp-server-<rid>.zip`. Pure. */
+export declare function serverAssetName(rid: string): string;
+/** The git release TAG for a server version: the version with a leading `v` (`9.0.0` → `v9.0.0`). Pure. */
+export declare function serverReleaseTag(version: string): string;
+/**
+ * The download URL for a server version's per-RID zip:
+ * `https://github.com/IvanMurzak/GameDev-MCP-Server/releases/download/v<version>/gamedev-mcp-server-<rid>.zip`.
+ * Mirrors `GodotMcpServerView.DownloadUrl`. The host is always `github.com` by
+ * construction; `assertTrustedServerUrl` re-checks a URL before any network call. Pure.
+ */
+export declare function serverDownloadUrl(version: string, rid: string): string;
+/**
+ * The `SHA256SUMS` manifest URL — the sibling of the per-RID zip under the SAME
+ * `v<version>` release tag. Mirrors `GodotMcpServerView.Sha256SumsUrl`. Pure.
+ */
+export declare function sha256SumsUrl(version: string): string;
+/**
+ * Fail-closed host trust check: throw unless `url` is an HTTPS URL whose host is
+ * EXACTLY `github.com` (no subdomains, no `github.com.evil.test`, no http). The
+ * security boundary the task requires for the server download. Returns the parsed
+ * URL on success. Pure (throws on the unhappy path; callers turn it into a
+ * structured failure so nothing escapes the public boundary).
+ */
+export declare function assertTrustedServerUrl(url: string): URL;
+/**
+ * Parse a coreutils `sha256sum` manifest into a `{filename → lowercase-hex-digest}`
+ * map. One line per file: a 64-char hex digest, whitespace, then the file name.
+ * Tolerances (matching the C# reference): CRLF + bare-LF; blank lines skipped;
+ * leading/trailing whitespace trimmed; the binary-mode `*` marker before the
+ * filename stripped; a line whose first token is not 64-hex, or which has no
+ * filename, is skipped (never a spurious entry — fail-closed at lookup). On a
+ * duplicate filename the LAST entry wins. Never throws. Pure.
+ */
+export declare function parseSha256Sums(sha256SumsText: string | null | undefined): Map<string, string>;
+/** Look up the expected digest for an asset zip name in a parsed manifest, or null when absent. Pure. */
+export declare function lookupDigest(parsed: Map<string, string>, assetZipName: string): string | null;
+/** Case-insensitive hex-digest equality (both trimmed). A null/empty side is NEVER a match (fail-closed). Pure. */
+export declare function digestMatches(expectedHexDigest: string | null | undefined, actualHexDigest: string | null | undefined): boolean;
+/** The verdict of verifying a downloaded zip against a release `SHA256SUMS` manifest. */
+export type ChecksumVerdict = 'verified' | 'manifest-unparsable' | 'missing-entry' | 'digest-mismatch';
+/**
+ * The single fail-closed integrity decision the installer calls BEFORE extract:
+ * parse the release `SHA256SUMS`, find the entry for `assetZipName`, and compare
+ * it (case-insensitive hex) against the locally-computed SHA256 of the downloaded
+ * zip. Returns `'verified'` ONLY when the manifest parsed, contained the asset,
+ * and the digest matched; every other outcome is a distinct fail-closed verdict
+ * the caller MUST treat as "do NOT extract". Never throws. Pure.
+ */
+export declare function verifyZipChecksum(sha256SumsText: string | null | undefined, assetZipName: string, actualZipHexDigest: string | null | undefined): ChecksumVerdict;
+/** A short, actionable reason for a non-`verified` verdict, for the installer's fail-closed error. Pure. */
+export declare function checksumFailureReason(verdict: ChecksumVerdict, assetZipName: string): string;
+/** The lowercase hex SHA256 of a byte buffer (the downloaded zip). Pure. */
+export declare function sha256Hex(bytes: Buffer): string;

package/dist/utils/server-source.js

@@ -0,0 +1,217 @@
+// Pure helpers for resolving WHERE the shared `gamedev-mcp-server` binary comes
+// from when `install-plugin --with-server` materializes it: RID detection, the
+// trusted GitHub-release download URL, the `SHA256SUMS` integrity manifest, and
+// the fail-closed verify verdict. These MIRROR the addon's own server logic in
+// `addons/godot_mcp/Runtime/Connection/GodotMcpServerView.cs` (github.com only,
+// `releases/download/v<version>/gamedev-mcp-server-<rid>.zip`, verify-before-
+// extract against `SHA256SUMS`). No side effects; unit-testable with no network.
+//
+// The DEFAULT server version is single-sourced from the addon's pinned
+// `ServerVersion` constant (a parity test — `cli/tests/server-source-parity.test.ts`
+// — reads `GodotMcpServerView.cs` and FAILS the build if this drifts), so the CLI
+// and the addon can never download two different server versions.
+import { createHash } from 'crypto';
+/**
+ * The DEFAULT shared-server version `--with-server` downloads. Single-sourced
+ * from the addon's `GodotMcpServerView.ServerVersion` constant (parity-tested).
+ * `--server-version <v>` overrides it; `--server-source <path>` skips the
+ * download entirely (offline / CI). Bumping the addon's server pin requires
+ * bumping this in the same PR or the parity test goes red.
+ */
+export const DEFAULT_SERVER_VERSION = '9.0.0';
+/** GitHub-release host the server zip + manifest are downloaded from. NOTHING else is trusted. */
+export const TRUSTED_DOWNLOAD_HOST = 'github.com';
+/** The `owner/repo` the shared server releases live under. */
+export const SERVER_RELEASE_REPO = 'IvanMurzak/GameDev-MCP-Server';
+/** The server-binary base name (matches the addon's `GodotMcpServerView.ExecutableName`). */
+export const SERVER_EXECUTABLE_NAME = 'gamedev-mcp-server';
+/** The release-asset / RID prefix (matches the addon's `AssetPrefix`). */
+export const SERVER_ASSET_PREFIX = SERVER_EXECUTABLE_NAME;
+/** The integrity-manifest asset attached to every GameDev-MCP-Server release. */
+export const SHA256SUMS_ASSET_NAME = 'SHA256SUMS';
+/** Map a Node `process.platform` token to the .NET RID os segment (`win`/`osx`/`linux`). */
+export function osToken(platform = process.platform) {
+    switch (platform) {
+        case 'win32':
+            return 'win';
+        case 'darwin':
+            return 'osx';
+        case 'linux':
+            return 'linux';
+        default:
+            return 'unknown';
+    }
+}
+/** Map a Node `process.arch` token to the .NET RID arch segment (`x86`/`x64`/`arm`/`arm64`). */
+export function archToken(arch = process.arch) {
+    switch (arch) {
+        case 'x64':
+            return 'x64';
+        case 'arm64':
+            return 'arm64';
+        case 'ia32':
+            return 'x86';
+        case 'arm':
+            return 'arm';
+        default:
+            return 'unknown';
+    }
+}
+/**
+ * The RID-style platform name `<os>-<arch>` (e.g. `win-x64`) for the given (or
+ * current) host. Matches the addon's `GodotMcpServerView.PlatformName` and the
+ * GameDev-MCP-Server release asset RIDs (linux-arm64/linux-x64/osx-arm64/osx-x64/
+ * win-arm64/win-x64/win-x86). Pure.
+ */
+export function detectHostRid(platform = process.platform, arch = process.arch) {
+    return `${osToken(platform)}-${archToken(arch)}`;
+}
+/** The on-disk executable file name for an os: `gamedev-mcp-server.exe` on Windows, else `gamedev-mcp-server`. */
+export function serverExecutableFileName(platform = process.platform) {
+    return platform === 'win32' ? `${SERVER_EXECUTABLE_NAME}.exe` : SERVER_EXECUTABLE_NAME;
+}
+/** The GitHub release-zip asset name for a RID: `gamedev-mcp-server-<rid>.zip`. Pure. */
+export function serverAssetName(rid) {
+    return `${SERVER_ASSET_PREFIX}-${rid}.zip`;
+}
+/** The git release TAG for a server version: the version with a leading `v` (`9.0.0` → `v9.0.0`). Pure. */
+export function serverReleaseTag(version) {
+    const v = (version ?? '').trim();
+    return v.startsWith('v') ? v : `v${v}`;
+}
+/**
+ * The download URL for a server version's per-RID zip:
+ * `https://github.com/IvanMurzak/GameDev-MCP-Server/releases/download/v<version>/gamedev-mcp-server-<rid>.zip`.
+ * Mirrors `GodotMcpServerView.DownloadUrl`. The host is always `github.com` by
+ * construction; `assertTrustedServerUrl` re-checks a URL before any network call. Pure.
+ */
+export function serverDownloadUrl(version, rid) {
+    return `https://${TRUSTED_DOWNLOAD_HOST}/${SERVER_RELEASE_REPO}/releases/download/${serverReleaseTag(version)}/${serverAssetName(rid)}`;
+}
+/**
+ * The `SHA256SUMS` manifest URL — the sibling of the per-RID zip under the SAME
+ * `v<version>` release tag. Mirrors `GodotMcpServerView.Sha256SumsUrl`. Pure.
+ */
+export function sha256SumsUrl(version) {
+    return `https://${TRUSTED_DOWNLOAD_HOST}/${SERVER_RELEASE_REPO}/releases/download/${serverReleaseTag(version)}/${SHA256SUMS_ASSET_NAME}`;
+}
+/**
+ * Fail-closed host trust check: throw unless `url` is an HTTPS URL whose host is
+ * EXACTLY `github.com` (no subdomains, no `github.com.evil.test`, no http). The
+ * security boundary the task requires for the server download. Returns the parsed
+ * URL on success. Pure (throws on the unhappy path; callers turn it into a
+ * structured failure so nothing escapes the public boundary).
+ */
+export function assertTrustedServerUrl(url) {
+    let parsed;
+    try {
+        parsed = new URL(url);
+    }
+    catch {
+        throw new Error(`Refusing to download server: malformed URL "${url}".`);
+    }
+    if (parsed.protocol !== 'https:') {
+        throw new Error(`Refusing to download server: only https is allowed, got "${parsed.protocol}" (${url}).`);
+    }
+    if (parsed.hostname.toLowerCase() !== TRUSTED_DOWNLOAD_HOST) {
+        throw new Error(`Refusing to download server from untrusted host "${parsed.hostname}". Only ${TRUSTED_DOWNLOAD_HOST} is trusted.`);
+    }
+    return parsed;
+}
+// --- SHA256SUMS integrity manifest (download-verify-before-extract, fail-closed) ---
+// Ported from GodotMcpServerView.{ParseSha256Sums,LookupDigest,DigestMatches,VerifyZipChecksum}
+// so the CLI and the addon apply byte-identical integrity rules.
+/** True when `value` is exactly 64 ASCII hex characters (a SHA256 hex digest). */
+function isHex64(value) {
+    if (value.length !== 64)
+        return false;
+    return /^[0-9a-fA-F]{64}$/.test(value);
+}
+/**
+ * Parse a coreutils `sha256sum` manifest into a `{filename → lowercase-hex-digest}`
+ * map. One line per file: a 64-char hex digest, whitespace, then the file name.
+ * Tolerances (matching the C# reference): CRLF + bare-LF; blank lines skipped;
+ * leading/trailing whitespace trimmed; the binary-mode `*` marker before the
+ * filename stripped; a line whose first token is not 64-hex, or which has no
+ * filename, is skipped (never a spurious entry — fail-closed at lookup). On a
+ * duplicate filename the LAST entry wins. Never throws. Pure.
+ */
+export function parseSha256Sums(sha256SumsText) {
+    const map = new Map();
+    if (!sha256SumsText)
+        return map;
+    for (const rawLine of sha256SumsText.replace(/\r\n/g, '\n').split('\n')) {
+        const line = rawLine.trim();
+        if (line.length === 0)
+            continue;
+        // Split into the digest token and the remainder (the filename) on the FIRST
+        // run of whitespace, so single-space/tab variants still parse.
+        let sepIndex = -1;
+        for (let i = 0; i < line.length; i++) {
+            if (line[i] === ' ' || line[i] === '\t') {
+                sepIndex = i;
+                break;
+            }
+        }
+        if (sepIndex <= 0 || sepIndex >= line.length - 1)
+            continue;
+        const digestToken = line.slice(0, sepIndex);
+        if (!isHex64(digestToken))
+            continue;
+        let fileName = line.slice(sepIndex + 1).replace(/^[ \t]+/, '');
+        if (fileName.startsWith('*'))
+            fileName = fileName.slice(1);
+        fileName = fileName.trim();
+        if (fileName.length === 0)
+            continue;
+        map.set(fileName, digestToken.toLowerCase());
+    }
+    return map;
+}
+/** Look up the expected digest for an asset zip name in a parsed manifest, or null when absent. Pure. */
+export function lookupDigest(parsed, assetZipName) {
+    if (!parsed || !assetZipName)
+        return null;
+    return parsed.get(assetZipName) ?? null;
+}
+/** Case-insensitive hex-digest equality (both trimmed). A null/empty side is NEVER a match (fail-closed). Pure. */
+export function digestMatches(expectedHexDigest, actualHexDigest) {
+    if (!expectedHexDigest || !expectedHexDigest.trim() || !actualHexDigest || !actualHexDigest.trim())
+        return false;
+    return expectedHexDigest.trim().toLowerCase() === actualHexDigest.trim().toLowerCase();
+}
+/**
+ * The single fail-closed integrity decision the installer calls BEFORE extract:
+ * parse the release `SHA256SUMS`, find the entry for `assetZipName`, and compare
+ * it (case-insensitive hex) against the locally-computed SHA256 of the downloaded
+ * zip. Returns `'verified'` ONLY when the manifest parsed, contained the asset,
+ * and the digest matched; every other outcome is a distinct fail-closed verdict
+ * the caller MUST treat as "do NOT extract". Never throws. Pure.
+ */
+export function verifyZipChecksum(sha256SumsText, assetZipName, actualZipHexDigest) {
+    const parsed = parseSha256Sums(sha256SumsText);
+    if (parsed.size === 0)
+        return 'manifest-unparsable';
+    const expected = lookupDigest(parsed, assetZipName);
+    if (expected === null)
+        return 'missing-entry';
+    return digestMatches(expected, actualZipHexDigest) ? 'verified' : 'digest-mismatch';
+}
+/** A short, actionable reason for a non-`verified` verdict, for the installer's fail-closed error. Pure. */
+export function checksumFailureReason(verdict, assetZipName) {
+    switch (verdict) {
+        case 'manifest-unparsable':
+            return `the downloaded ${SHA256SUMS_ASSET_NAME} manifest was empty or unparsable`;
+        case 'missing-entry':
+            return `the ${SHA256SUMS_ASSET_NAME} manifest has no entry for '${assetZipName}'`;
+        case 'digest-mismatch':
+            return `the downloaded '${assetZipName}' SHA256 did not match the ${SHA256SUMS_ASSET_NAME} manifest entry`;
+        default:
+            return 'the checksum was verified';
+    }
+}
+/** The lowercase hex SHA256 of a byte buffer (the downloaded zip). Pure. */
+export function sha256Hex(bytes) {
+    return createHash('sha256').update(bytes).digest('hex');
+}
+//# sourceMappingURL=server-source.js.map

package/dist/utils/server-source.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-source.js","sourceRoot":"","sources":["../../src/utils/server-source.ts"],"names":[],"mappings":"AAAA,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,+EAA+E;AAC/E,gFAAgF;AAChF,8EAA8E;AAC9E,iFAAiF;AACjF,EAAE;AACF,uEAAuE;AACvE,qFAAqF;AACrF,kFAAkF;AAClF,kEAAkE;AAElE,OAAO,EAAE,UAAU,EAAE,MAAM,QAAQ,CAAC;AAEpC;;;;;;GAMG;AACH,MAAM,CAAC,MAAM,sBAAsB,GAAG,OAAO,CAAC;AAE9C,kGAAkG;AAClG,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAElD,8DAA8D;AAC9D,MAAM,CAAC,MAAM,mBAAmB,GAAG,+BAA+B,CAAC;AAEnE,6FAA6F;AAC7F,MAAM,CAAC,MAAM,sBAAsB,GAAG,oBAAoB,CAAC;AAE3D,0EAA0E;AAC1E,MAAM,CAAC,MAAM,mBAAmB,GAAG,sBAAsB,CAAC;AAE1D,iFAAiF;AACjF,MAAM,CAAC,MAAM,qBAAqB,GAAG,YAAY,CAAC;AAElD,4FAA4F;AAC5F,MAAM,UAAU,OAAO,CAAC,WAA4B,OAAO,CAAC,QAAQ;IAClE,QAAQ,QAAQ,EAAE,CAAC;QACjB,KAAK,OAAO;YACV,OAAO,KAAK,CAAC;QACf,KAAK,QAAQ;YACX,OAAO,KAAK,CAAC;QACf,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED,gGAAgG;AAChG,MAAM,UAAU,SAAS,CAAC,OAAe,OAAO,CAAC,IAAI;IACnD,QAAQ,IAAI,EAAE,CAAC;QACb,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf,KAAK,OAAO;YACV,OAAO,OAAO,CAAC;QACjB,KAAK,MAAM;YACT,OAAO,KAAK,CAAC;QACf,KAAK,KAAK;YACR,OAAO,KAAK,CAAC;QACf;YACE,OAAO,SAAS,CAAC;IACrB,CAAC;AACH,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,aAAa,CAAC,WAA4B,OAAO,CAAC,QAAQ,EAAE,OAAe,OAAO,CAAC,IAAI;IACrG,OAAO,GAAG,OAAO,CAAC,QAAQ,CAAC,IAAI,SAAS,CAAC,IAAI,CAAC,EAAE,CAAC;AACnD,CAAC;AAED,kHAAkH;AAClH,MAAM,UAAU,wBAAwB,CAAC,WAA4B,OAAO,CAAC,QAAQ;IACnF,OAAO,QAAQ,KAAK,OAAO,CAAC,CAAC,CAAC,GAAG,sBAAsB,MAAM,CAAC,CAAC,CAAC,sBAAsB,CAAC;AACzF,CAAC;AAED,yFAAyF;AACzF,MAAM,UAAU,eAAe,CAAC,GAAW;IACzC,OAAO,GAAG,mBAAmB,IAAI,GAAG,MAAM,CAAC;AAC7C,CAAC;AAED,2GAA2G;AAC3G,MAAM,UAAU,gBAAgB,CAAC,OAAe;IAC9C,MAAM,CAAC,GAAG,CAAC,OAAO,IAAI,EAAE,CAAC,CAAC,IAAI,EAAE,CAAC;IACjC,OAAO,CAAC,CAAC,UAAU,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,IAAI,CAAC,EAAE,CAAC;AACzC,CAAC;AAED;;;;;GAKG;AACH,MAAM,UAAU,iBAAiB,CAAC,OAAe,EAAE,GAAW;IAC5D,OAAO,WAAW,qBAAqB,IAAI,mBAAmB,sBAAsB,gBAAgB,CAAC,OAAO,CAAC,IAAI,eAAe,CAAC,GAAG,CAAC,EAAE,CAAC;AAC1I,CAAC;AAED;;;GAGG;AACH,MAAM,UAAU,aAAa,CAAC,OAAe;IAC3C,OAAO,WAAW,qBAAqB,IAAI,mBAAmB,sBAAsB,gBAAgB,CAAC,OAAO,CAAC,IAAI,qBAAqB,EAAE,CAAC;AAC3I,CAAC;AAED;;;;;;GAMG;AACH,MAAM,UAAU,sBAAsB,CAAC,GAAW;IAChD,IAAI,MAAW,CAAC;IAChB,IAAI,CAAC;QACH,MAAM,GAAG,IAAI,GAAG,CAAC,GAAG,CAAC,CAAC;IACxB,CAAC;IAAC,MAAM,CAAC;QACP,MAAM,IAAI,KAAK,CAAC,+CAA+C,GAAG,IAAI,CAAC,CAAC;IAC1E,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,KAAK,QAAQ,EAAE,CAAC;QACjC,MAAM,IAAI,KAAK,CAAC,4DAA4D,MAAM,CAAC,QAAQ,MAAM,GAAG,IAAI,CAAC,CAAC;IAC5G,CAAC;IACD,IAAI,MAAM,CAAC,QAAQ,CAAC,WAAW,EAAE,KAAK,qBAAqB,EAAE,CAAC;QAC5D,MAAM,IAAI,KAAK,CACb,oDAAoD,MAAM,CAAC,QAAQ,WAAW,qBAAqB,cAAc,CAClH,CAAC;IACJ,CAAC;IACD,OAAO,MAAM,CAAC;AAChB,CAAC;AAED,sFAAsF;AACtF,gGAAgG;AAChG,iEAAiE;AAEjE,kFAAkF;AAClF,SAAS,OAAO,CAAC,KAAa;IAC5B,IAAI,KAAK,CAAC,MAAM,KAAK,EAAE;QAAE,OAAO,KAAK,CAAC;IACtC,OAAO,mBAAmB,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC;AACzC,CAAC;AAED;;;;;;;;GAQG;AACH,MAAM,UAAU,eAAe,CAAC,cAAyC;IACvE,MAAM,GAAG,GAAG,IAAI,GAAG,EAAkB,CAAC;IACtC,IAAI,CAAC,cAAc;QAAE,OAAO,GAAG,CAAC;IAEhC,KAAK,MAAM,OAAO,IAAI,cAAc,CAAC,OAAO,CAAC,OAAO,EAAE,IAAI,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,EAAE,CAAC;QACxE,MAAM,IAAI,GAAG,OAAO,CAAC,IAAI,EAAE,CAAC;QAC5B,IAAI,IAAI,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEhC,4EAA4E;QAC5E,+DAA+D;QAC/D,IAAI,QAAQ,GAAG,CAAC,CAAC,CAAC;QAClB,KAAK,IAAI,CAAC,GAAG,CAAC,EAAE,CAAC,GAAG,IAAI,CAAC,MAAM,EAAE,CAAC,EAAE,EAAE,CAAC;YACrC,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,GAAG,IAAI,IAAI,CAAC,CAAC,CAAC,KAAK,IAAI,EAAE,CAAC;gBACxC,QAAQ,GAAG,CAAC,CAAC;gBACb,MAAM;YACR,CAAC;QACH,CAAC;QACD,IAAI,QAAQ,IAAI,CAAC,IAAI,QAAQ,IAAI,IAAI,CAAC,MAAM,GAAG,CAAC;YAAE,SAAS;QAE3D,MAAM,WAAW,GAAG,IAAI,CAAC,KAAK,CAAC,CAAC,EAAE,QAAQ,CAAC,CAAC;QAC5C,IAAI,CAAC,OAAO,CAAC,WAAW,CAAC;YAAE,SAAS;QAEpC,IAAI,QAAQ,GAAG,IAAI,CAAC,KAAK,CAAC,QAAQ,GAAG,CAAC,CAAC,CAAC,OAAO,CAAC,SAAS,EAAE,EAAE,CAAC,CAAC;QAC/D,IAAI,QAAQ,CAAC,UAAU,CAAC,GAAG,CAAC;YAAE,QAAQ,GAAG,QAAQ,CAAC,KAAK,CAAC,CAAC,CAAC,CAAC;QAC3D,QAAQ,GAAG,QAAQ,CAAC,IAAI,EAAE,CAAC;QAC3B,IAAI,QAAQ,CAAC,MAAM,KAAK,CAAC;YAAE,SAAS;QAEpC,GAAG,CAAC,GAAG,CAAC,QAAQ,EAAE,WAAW,CAAC,WAAW,EAAE,CAAC,CAAC;IAC/C,CAAC;IAED,OAAO,GAAG,CAAC;AACb,CAAC;AAED,yGAAyG;AACzG,MAAM,UAAU,YAAY,CAAC,MAA2B,EAAE,YAAoB;IAC5E,IAAI,CAAC,MAAM,IAAI,CAAC,YAAY;QAAE,OAAO,IAAI,CAAC;IAC1C,OAAO,MAAM,CAAC,GAAG,CAAC,YAAY,CAAC,IAAI,IAAI,CAAC;AAC1C,CAAC;AAED,mHAAmH;AACnH,MAAM,UAAU,aAAa,CAAC,iBAA4C,EAAE,eAA0C;IACpH,IAAI,CAAC,iBAAiB,IAAI,CAAC,iBAAiB,CAAC,IAAI,EAAE,IAAI,CAAC,eAAe,IAAI,CAAC,eAAe,CAAC,IAAI,EAAE;QAAE,OAAO,KAAK,CAAC;IACjH,OAAO,iBAAiB,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,KAAK,eAAe,CAAC,IAAI,EAAE,CAAC,WAAW,EAAE,CAAC;AACzF,CAAC;AAKD;;;;;;;GAOG;AACH,MAAM,UAAU,iBAAiB,CAC/B,cAAyC,EACzC,YAAoB,EACpB,kBAA6C;IAE7C,MAAM,MAAM,GAAG,eAAe,CAAC,cAAc,CAAC,CAAC;IAC/C,IAAI,MAAM,CAAC,IAAI,KAAK,CAAC;QAAE,OAAO,qBAAqB,CAAC;IAEpD,MAAM,QAAQ,GAAG,YAAY,CAAC,MAAM,EAAE,YAAY,CAAC,CAAC;IACpD,IAAI,QAAQ,KAAK,IAAI;QAAE,OAAO,eAAe,CAAC;IAE9C,OAAO,aAAa,CAAC,QAAQ,EAAE,kBAAkB,CAAC,CAAC,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC,iBAAiB,CAAC;AACtF,CAAC;AAED,4GAA4G;AAC5G,MAAM,UAAU,qBAAqB,CAAC,OAAwB,EAAE,YAAoB;IAClF,QAAQ,OAAO,EAAE,CAAC;QAChB,KAAK,qBAAqB;YACxB,OAAO,kBAAkB,qBAAqB,mCAAmC,CAAC;QACpF,KAAK,eAAe;YAClB,OAAO,OAAO,qBAAqB,+BAA+B,YAAY,GAAG,CAAC;QACpF,KAAK,iBAAiB;YACpB,OAAO,mBAAmB,YAAY,8BAA8B,qBAAqB,iBAAiB,CAAC;QAC7G;YACE,OAAO,2BAA2B,CAAC;IACvC,CAAC;AACH,CAAC;AAED,4EAA4E;AAC5E,MAAM,UAAU,SAAS,CAAC,KAAa;IACrC,OAAO,UAAU,CAAC,QAAQ,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC,MAAM,CAAC,KAAK,CAAC,CAAC;AAC1D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "godot-cli",
-  "version": "0.16.2",
+  "version": "0.17.1",
   "description": "Cross-platform CLI tool for Godot-MCP (Skills & MCP). Resolves and launches the Godot editor with MCP connection env vars, runs MCP/system tools over HTTP, probes server health, configures AI agents (Claude Code, Cursor, VS Code, …), and enables/disables the godot_mcp addon. Works with Claude Code, Cursor, Copilot, and any MCP client.",
   "type": "module",
   "main": "dist/lib.js",