hoi4-agent-tools 0.1.2 → 0.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. package/CHANGELOG.md +16 -0
  2. package/README.md +4 -4
  3. package/dist/hoi4_agent_tools/mcp/registry/metadata.d.ts +1 -1
  4. package/dist/hoi4_agent_tools/version.d.ts +1 -1
  5. package/dist/hoi4_agent_tools/version.js +1 -1
  6. package/docs/completion-report.md +33 -16
  7. package/docs/release.md +26 -0
  8. package/docs/self-hosting.md +2 -2
  9. package/package.json +1 -1
  10. package/schemas/configuration.schema.json +1 -1
  11. package/schemas/continuous-focus-palette.schema.json +1 -1
  12. package/schemas/focus-plan.schema.json +1 -1
  13. package/schemas/focus-planning-sidecar.schema.json +1 -1
  14. package/schemas/gui-animation-source.schema.json +1 -1
  15. package/schemas/gui-helper.schema.json +1 -1
  16. package/schemas/gui-scenario.schema.json +1 -1
  17. package/schemas/map-operation.schema.json +1 -1
  18. package/schemas/operation-result.schema.json +1 -1
  19. package/schemas/transaction-manifest.schema.json +1 -1
  20. package/server.json +2 -2
package/CHANGELOG.md CHANGED
@@ -2,6 +2,22 @@
2
2
 
3
3
  All notable changes are documented here. The project follows Semantic Versioning.
4
4
 
5
+ ## [0.1.4] - 2026-07-11
6
+
7
+ ### Fixed
8
+
9
+ - Verified BuildKit's commit-resolved Git context URI and digest while independently requiring the exact release tag, repository, release workflow ref, workflow SHA, push event, and `publish_image` job recorded in container provenance.
10
+ - Added refusal coverage for altered container source URIs, digests, Dockerfile entry points, event/job identities, tag refs, repository identities, workflow refs, and workflow SHAs.
11
+ - Preserved the immutable `v0.1.3` npm package and GHCR image whose post-push provenance verifier stopped before GitHub Release or MCP Registry publication, then advanced every synchronized release surface for the fix-forward release.
12
+
13
+ ## [0.1.3] - 2026-07-11
14
+
15
+ ### Fixed
16
+
17
+ - Centralized the canonical slash-terminated npm Registry URL used by both the pinned npm audit subprocess and the strict provenance verifier, preventing equivalent configuration serialization from blocking verified publication.
18
+ - Added refusal coverage for no-slash, insecure, credential-bearing, path-bearing, query-bearing, fragment-bearing, and lookalike npm Registry values.
19
+ - Preserved the immutable `v0.1.2` tag and public npm package whose downstream verification stopped before GHCR, GitHub Release, or MCP Registry publication, then advanced every synchronized release surface for the fix-forward release.
20
+
5
21
  ## [0.1.2] - 2026-07-11
6
22
 
7
23
  ### Fixed
package/README.md CHANGED
@@ -15,7 +15,7 @@ The MCP server is the product interface. There is no focus editor, GUI editor, m
15
15
  Requires Node.js 22 or 24.
16
16
 
17
17
  ```bash
18
- npm install --global hoi4-agent-tools@0.1.2
18
+ npm install --global hoi4-agent-tools@0.1.4
19
19
  hoi4-agent-tools-setup --init-config /path/to/config.json --workspace /path/to/mod --game /path/to/game
20
20
  hoi4-agent-tools-setup --diagnose --config /path/to/config.json
21
21
  hoi4-agent-tools-setup --print-client-config --config /path/to/config.json
@@ -26,7 +26,7 @@ The generated configuration is read-only. Add `--enable-writes --server-state /s
26
26
  For one-shot stdio installation, clients can launch:
27
27
 
28
28
  ```text
29
- npx -y hoi4-agent-tools@0.1.2
29
+ npx -y hoi4-agent-tools@0.1.4
30
30
  ```
31
31
 
32
32
  with `HOI4_AGENT_CONFIG` set to the reviewed config path.
@@ -66,7 +66,7 @@ Generic JSON-based clients:
66
66
  "mcpServers": {
67
67
  "hoi4_agent_tools": {
68
68
  "command": "npx",
69
- "args": ["-y", "hoi4-agent-tools@0.1.2"],
69
+ "args": ["-y", "hoi4-agent-tools@0.1.4"],
70
70
  "env": { "HOI4_AGENT_CONFIG": "/absolute/path/to/config.json" }
71
71
  }
72
72
  }
@@ -78,7 +78,7 @@ Codex `config.toml`:
78
78
  ```toml
79
79
  [mcp_servers.hoi4_agent_tools]
80
80
  command = "npx"
81
- args = ["-y", "hoi4-agent-tools@0.1.2"]
81
+ args = ["-y", "hoi4-agent-tools@0.1.4"]
82
82
  env = { HOI4_AGENT_CONFIG = "/absolute/path/to/config.json" }
83
83
  ```
84
84
 
package/dist/hoi4_agent_tools/mcp/registry/metadata.d.ts CHANGED
@@ -4,6 +4,6 @@ export declare const MCP_REGISTRY_SERVER_NAME = "io.github.klimPaskov/hoi4-agent
4
4
  export declare const MCP_REGISTRY_IDENTITY: {
5
5
  readonly name: "io.github.klimPaskov/hoi4-agent-tools";
6
6
  readonly packageName: "hoi4-agent-tools";
7
- readonly version: "0.1.2";
7
+ readonly version: "0.1.4";
8
8
  };
9
9
  //# sourceMappingURL=metadata.d.ts.map
package/dist/hoi4_agent_tools/version.d.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  export declare const PACKAGE_NAME = "hoi4-agent-tools";
2
- export declare const PACKAGE_VERSION = "0.1.2";
2
+ export declare const PACKAGE_VERSION = "0.1.4";
3
3
  export declare const MCP_PROTOCOL_VERSION = "2025-11-25";
4
4
  export declare const CONFIG_VERSION = 1;
5
5
  export declare const TRANSACTION_VERSION = 1;
package/dist/hoi4_agent_tools/version.js CHANGED
@@ -1,6 +1,6 @@
1
1
  import { LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js';
2
2
  export const PACKAGE_NAME = 'hoi4-agent-tools';
3
- export const PACKAGE_VERSION = '0.1.2';
3
+ export const PACKAGE_VERSION = '0.1.4';
4
4
  export const MCP_PROTOCOL_VERSION = LATEST_PROTOCOL_VERSION;
5
5
  export const CONFIG_VERSION = 1;
6
6
  export const TRANSACTION_VERSION = 1;
package/docs/completion-report.md CHANGED
@@ -1,8 +1,8 @@
1
- # Completion report: 0.1.2 release candidate
1
+ # Completion report: 0.1.4 release candidate
2
2
 
3
- - Candidate version: `0.1.2`
3
+ - Candidate version: `0.1.4`
4
4
  - Report date: 2026-07-11
5
- - Status: implementation and local release qualification complete; public delivery pending
5
+ - Status: fix-forward implementation in qualification; public delivery incomplete
6
6
 
7
7
  ## Implemented scope
8
8
 
@@ -12,7 +12,7 @@ The npm payload is explicitly limited to compiled entry points, documentation, s
12
12
 
13
13
  ## Qualification evidence
14
14
 
15
- The candidate has passed all 46 portable test files: 494 tests passed and one POSIX case was intentionally skipped on Windows. The latest enforced coverage is 88.44% statements, 78.25% branches, 91.28% functions, and 89.90% lines.
15
+ The candidate has passed all 46 portable test files: 495 tests passed and one POSIX case was intentionally skipped on Windows. The latest enforced coverage is 88.44% statements, 78.25% branches, 91.28% functions, and 89.90% lines.
16
16
 
17
17
  Release-specific qualification also covers:
18
18
 
@@ -36,16 +36,32 @@ Known refusal cases and intentional boundaries remain documented in [Known limit
36
36
 
37
37
  ## Public delivery status
38
38
 
39
- No public endpoint is claimed as complete in this report. The following evidence remains pending until the first release workflow finishes:
39
+ The immutable `v0.1.2` release attempt published npm with trusted-publisher provenance and then
40
+ stopped in independent verification because the pinned npm subprocess reported the configured
41
+ official Registry URL without a trailing slash while the strict verifier required the canonical
42
+ slash-terminated spelling. npm's signature audit itself verified 448 registry signatures and 128
43
+ attestations. The workflow correctly skipped GHCR, GitHub Release, MCP Registry, and final public
44
+ verification. The public npm `0.1.2` bytes and tag are retained as immutable audit evidence.
40
45
 
41
- | Surface | Required completion evidence | Status |
42
- | -------------- | --------------------------------------------------------------------------------------------------------- | ------- |
43
- | GitHub source | Public canonical repository containing the tested commit and immutable `v0.1.2` tag | Pending |
44
- | npm | Public `hoi4-agent-tools@0.1.2` with exact tarball integrity and SLSA provenance | Pending |
45
- | GitHub release | Immutable `v0.1.2` release containing the exact npm and container digest manifests | Pending |
46
- | GHCR | Public anonymous `0.1.2` digest with two runtime platforms and source-bound SBOM/provenance subjects | Pending |
47
- | MCP Registry | Exact `io.github.klimPaskov/hoi4-agent-tools@0.1.2` metadata with official `active` and `isLatest` status | Pending |
48
- | Public install | Clean registry installation, signature audit, MCP initialization, and tool discovery | Pending |
46
+ The immutable `v0.1.3` release attempt published and independently verified npm, then published
47
+ the exact two-platform GHCR image with SPDX SBOM and SLSA v0.2 provenance attached to each runtime
48
+ manifest. BuildKit correctly resolved its Git context URI to the immutable commit while recording
49
+ the exact release tag and workflow identity in the provenance environment; the verifier had
50
+ incorrectly required the URI itself to retain the tag. GitHub Release, MCP Registry, and final
51
+ public verification were skipped. The npm `0.1.3` bytes, GHCR `0.1.3` digest, and tag are retained
52
+ as immutable audit evidence.
53
+
54
+ No complete multi-surface public release is claimed in this report. The following evidence remains
55
+ pending until the `0.1.4` fix-forward workflow finishes:
56
+
57
+ | Surface | Required completion evidence | Status |
58
+ | -------------- | --------------------------------------------------------------------------------------------------------- | ------------ |
59
+ | GitHub source | Public canonical repository containing the tested commit and immutable `v0.1.4` tag | Pending |
60
+ | npm | Public `hoi4-agent-tools@0.1.4` with exact tarball integrity and SLSA provenance | `0.1.3` only |
61
+ | GitHub release | Immutable `v0.1.4` release containing the exact npm and container digest manifests | Pending |
62
+ | GHCR | Public anonymous `0.1.4` digest with two runtime platforms and source-bound SBOM/provenance subjects | `0.1.3` only |
63
+ | MCP Registry | Exact `io.github.klimPaskov/hoi4-agent-tools@0.1.4` metadata with official `active` and `isLatest` status | Pending |
64
+ | Public install | Clean registry installation, signature audit, MCP initialization, and tool discovery | Pending |
49
65
 
50
66
  ## First-release completion sequence
51
67
 
@@ -53,8 +69,9 @@ No public endpoint is claimed as complete in this report. The following evidence
53
69
  2. Run the manual GHCR bootstrap workflow, make the new package public in GitHub, and verify the bootstrap index without saved credentials.
54
70
  3. Create `npm-bootstrap-v0.0.0-bootstrap.1`, store a shortest-lived npm granular token only as `NPM_BOOTSTRAP_TOKEN`, and run the manual non-OIDC npm bootstrap workflow from that tag. The earlier immutable `.0` attempt stopped before publication; it is retained as audit evidence rather than rewritten.
55
71
  4. Revoke and delete `NPM_BOOTSTRAP_TOKEN`, then configure npm trusted publishing for `klimPaskov/hoi4-agent-tools`, `release.yml`, and the explicit `npm publish` allowed action.
56
- 5. Preserve the immutable `v0.1.0` tag whose run stopped in prepublication validation and `v0.1.1` whose OIDC job stopped before npm accepted bytes because npm parsed a relative tarball path as a Git shorthand. Qualify the synchronized `0.1.2` fix-forward commit and create `v0.1.2`. Do not create `NPM_TOKEN`; the OIDC workflow rejects it.
57
- 6. Allow the release workflow to publish and verify npm, digest-immutable GHCR, the immutable GitHub release, and MCP Registry in its enforced order.
58
- 7. Update this report with the commit, workflow run, public URLs, npm and image digests, and Registry status. Only then is public delivery complete.
72
+ 5. Preserve `v0.1.0` and `v0.1.1`, the immutable `v0.1.2` npm-only state, and the immutable `v0.1.3` npm-plus-GHCR state. Do not create `NPM_TOKEN`; the OIDC workflow rejects it.
73
+ 6. Qualify the synchronized `0.1.4` fix-forward commit, including strict commit-resolved BuildKit provenance plus independent tag/workflow bindings, then create `v0.1.4` only from an exact green commit.
74
+ 7. Allow the release workflow to publish and verify npm, digest-immutable GHCR, the immutable GitHub release, and MCP Registry in its enforced order.
75
+ 8. Update this report with the commit, workflow run, public URLs, npm and image digests, and Registry status. Only then is public delivery complete.
59
76
 
60
77
  Detailed commands and failure behavior are documented in [Release and MCP Registry publication](release.md).
package/docs/release.md CHANGED
@@ -56,6 +56,32 @@ the only dist-tags are `bootstrap` and `latest`, both naming that version. Any e
56
56
  different prerelease, missing bootstrap tag, or malformed state stops publication. Once the first
57
57
  stable package is published, the normal strict stable-version monotonic and exact-rerun rules apply.
58
58
 
59
+ ## Immutable fix-forward history
60
+
61
+ Stable tags and public package versions are never moved, deleted, or overwritten after a failed
62
+ release attempt. The retained history before `0.1.4` is:
63
+
64
+ - `v0.1.0` stopped during prepublication validation, before any public writer ran;
65
+ - `v0.1.1` stopped before npm accepted bytes because npm interpreted a slash-containing relative
66
+ tarball operand as GitHub repository shorthand;
67
+ - `v0.1.2` published the exact npm package with trusted-publisher provenance, then stopped in the
68
+ independent verifier because the pinned npm subprocess had been configured with the official
69
+ Registry URL without its trailing slash while the strict verifier required the canonical
70
+ slash-terminated spelling. npm signatures and attestations themselves verified successfully;
71
+ GHCR, GitHub Release, and MCP Registry writers were skipped.
72
+ - `v0.1.3` published and independently verified npm, then published the exact two-platform GHCR
73
+ image with SPDX SBOM and SLSA v0.2 provenance for both runtime manifests. Its post-push verifier
74
+ incorrectly required BuildKit's `configSource.uri` to retain the Git tag even though the action
75
+ resolves the default Git context to the immutable commit. The provenance digest and URI were
76
+ commit-bound, and its environment separately carried the exact tag, repository, release workflow,
77
+ workflow SHA, event, and job. GitHub Release and MCP Registry writers were skipped.
78
+
79
+ `0.1.4` accepts only the exact tag- or commit-resolved repository URI while requiring the source
80
+ commit digest and the independent tag/workflow environment bindings. The normal stable-version
81
+ monotonic gate treats the public `0.1.3` package as immutable history and
82
+ permits only a strictly newer version. Rerunning or fixing a release never authorizes rewriting a
83
+ tag, package version, image tag, release asset, or Registry version.
84
+
59
85
  ## Required pre-tag immutability check
60
86
 
61
87
  GitHub's immutable-release settings endpoint requires repository `Administration:read`, which
package/docs/self-hosting.md CHANGED
@@ -128,7 +128,7 @@ place it beneath any source, capability, artifact, cache, fixture, or `storageRo
128
128
  ## Container
129
129
 
130
130
  ```bash
131
- docker build -t hoi4-agent-tools:0.1.2 .
131
+ docker build -t hoi4-agent-tools:0.1.4 .
132
132
  docker run --read-only --rm -p 127.0.0.1:3210:3210 \
133
133
  -e HOI4_AGENT_CONFIG=/config/config.json \
134
134
  -v /srv/hoi4/config:/config:ro \
@@ -136,7 +136,7 @@ docker run --read-only --rm -p 127.0.0.1:3210:3210 \
136
136
  -v /srv/hoi4/workspaces:/srv/hoi4/workspaces \
137
137
  -v /var/lib/hoi4-agent-tools:/var/lib/hoi4-agent-tools \
138
138
  -v /var/lib/hoi4-agent-tools-state:/var/lib/hoi4-agent-tools-state \
139
- hoi4-agent-tools:0.1.2
139
+ hoi4-agent-tools:0.1.4
140
140
  ```
141
141
 
142
142
  Port publishing reaches the container through a non-loopback interface. The mounted configuration
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "hoi4-agent-tools",
3
3
  "mcpName": "io.github.klimPaskov/hoi4-agent-tools",
4
- "version": "0.1.2",
4
+ "version": "0.1.4",
5
5
  "description": "Source-preserving HOI4 workbench exposed as a safe Model Context Protocol server for coding agents",
6
6
  "type": "module",
7
7
  "license": "Apache-2.0",
package/schemas/configuration.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.2/schemas/configuration.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/configuration.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/continuous-focus-palette.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.2/schemas/continuous-focus-palette.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/continuous-focus-palette.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/focus-plan.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.2/schemas/focus-plan.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/focus-plan.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/focus-planning-sidecar.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.2/schemas/focus-planning-sidecar.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/focus-planning-sidecar.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/gui-animation-source.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.2/schemas/gui-animation-source.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/gui-animation-source.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/gui-helper.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.2/schemas/gui-helper.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/gui-helper.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/gui-scenario.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.2/schemas/gui-scenario.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/gui-scenario.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/map-operation.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.2/schemas/map-operation.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/map-operation.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "oneOf": [
5
5
  {
package/schemas/operation-result.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.2/schemas/operation-result.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/operation-result.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/transaction-manifest.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.2/schemas/transaction-manifest.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/transaction-manifest.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/server.json CHANGED
@@ -3,7 +3,7 @@
3
3
  "name": "io.github.klimPaskov/hoi4-agent-tools",
4
4
  "title": "HOI4 Agent Tools",
5
5
  "description": "Source-preserving HOI4 focus, scripted GUI, and map tools with safe transactions.",
6
- "version": "0.1.2",
6
+ "version": "0.1.4",
7
7
  "repository": {
8
8
  "url": "https://github.com/klimPaskov/hoi4-agent-tools",
9
9
  "source": "github"
@@ -13,7 +13,7 @@
13
13
  {
14
14
  "registryType": "npm",
15
15
  "identifier": "hoi4-agent-tools",
16
- "version": "0.1.2",
16
+ "version": "0.1.4",
17
17
  "environmentVariables": [
18
18
  {
19
19
  "name": "HOI4_AGENT_CONFIG",