hoi4-agent-tools 0.1.3 → 0.1.4

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. package/CHANGELOG.md +8 -0
  2. package/README.md +4 -4
  3. package/dist/hoi4_agent_tools/mcp/registry/metadata.d.ts +1 -1
  4. package/dist/hoi4_agent_tools/version.d.ts +1 -1
  5. package/dist/hoi4_agent_tools/version.js +1 -1
  6. package/docs/completion-report.md +18 -10
  7. package/docs/release.md +11 -4
  8. package/docs/self-hosting.md +2 -2
  9. package/package.json +1 -1
  10. package/schemas/configuration.schema.json +1 -1
  11. package/schemas/continuous-focus-palette.schema.json +1 -1
  12. package/schemas/focus-plan.schema.json +1 -1
  13. package/schemas/focus-planning-sidecar.schema.json +1 -1
  14. package/schemas/gui-animation-source.schema.json +1 -1
  15. package/schemas/gui-helper.schema.json +1 -1
  16. package/schemas/gui-scenario.schema.json +1 -1
  17. package/schemas/map-operation.schema.json +1 -1
  18. package/schemas/operation-result.schema.json +1 -1
  19. package/schemas/transaction-manifest.schema.json +1 -1
  20. package/server.json +2 -2
package/CHANGELOG.md CHANGED
@@ -2,6 +2,14 @@
2
2
 
3
3
  All notable changes are documented here. The project follows Semantic Versioning.
4
4
 
5
+ ## [0.1.4] - 2026-07-11
6
+
7
+ ### Fixed
8
+
9
+ - Verified BuildKit's commit-resolved Git context URI and digest while independently requiring the exact release tag, repository, release workflow ref, workflow SHA, push event, and `publish_image` job recorded in container provenance.
10
+ - Added refusal coverage for altered container source URIs, digests, Dockerfile entry points, event/job identities, tag refs, repository identities, workflow refs, and workflow SHAs.
11
+ - Preserved the immutable `v0.1.3` npm package and GHCR image whose post-push provenance verifier stopped before GitHub Release or MCP Registry publication, then advanced every synchronized release surface for the fix-forward release.
12
+
5
13
  ## [0.1.3] - 2026-07-11
6
14
 
7
15
  ### Fixed
package/README.md CHANGED
@@ -15,7 +15,7 @@ The MCP server is the product interface. There is no focus editor, GUI editor, m
15
15
  Requires Node.js 22 or 24.
16
16
 
17
17
  ```bash
18
- npm install --global hoi4-agent-tools@0.1.3
18
+ npm install --global hoi4-agent-tools@0.1.4
19
19
  hoi4-agent-tools-setup --init-config /path/to/config.json --workspace /path/to/mod --game /path/to/game
20
20
  hoi4-agent-tools-setup --diagnose --config /path/to/config.json
21
21
  hoi4-agent-tools-setup --print-client-config --config /path/to/config.json
@@ -26,7 +26,7 @@ The generated configuration is read-only. Add `--enable-writes --server-state /s
26
26
  For one-shot stdio installation, clients can launch:
27
27
 
28
28
  ```text
29
- npx -y hoi4-agent-tools@0.1.3
29
+ npx -y hoi4-agent-tools@0.1.4
30
30
  ```
31
31
 
32
32
  with `HOI4_AGENT_CONFIG` set to the reviewed config path.
@@ -66,7 +66,7 @@ Generic JSON-based clients:
66
66
  "mcpServers": {
67
67
  "hoi4_agent_tools": {
68
68
  "command": "npx",
69
- "args": ["-y", "hoi4-agent-tools@0.1.3"],
69
+ "args": ["-y", "hoi4-agent-tools@0.1.4"],
70
70
  "env": { "HOI4_AGENT_CONFIG": "/absolute/path/to/config.json" }
71
71
  }
72
72
  }
@@ -78,7 +78,7 @@ Codex `config.toml`:
78
78
  ```toml
79
79
  [mcp_servers.hoi4_agent_tools]
80
80
  command = "npx"
81
- args = ["-y", "hoi4-agent-tools@0.1.3"]
81
+ args = ["-y", "hoi4-agent-tools@0.1.4"]
82
82
  env = { HOI4_AGENT_CONFIG = "/absolute/path/to/config.json" }
83
83
  ```
84
84
 
package/dist/hoi4_agent_tools/mcp/registry/metadata.d.ts CHANGED
@@ -4,6 +4,6 @@ export declare const MCP_REGISTRY_SERVER_NAME = "io.github.klimPaskov/hoi4-agent
4
4
  export declare const MCP_REGISTRY_IDENTITY: {
5
5
  readonly name: "io.github.klimPaskov/hoi4-agent-tools";
6
6
  readonly packageName: "hoi4-agent-tools";
7
- readonly version: "0.1.3";
7
+ readonly version: "0.1.4";
8
8
  };
9
9
  //# sourceMappingURL=metadata.d.ts.map
package/dist/hoi4_agent_tools/version.d.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  export declare const PACKAGE_NAME = "hoi4-agent-tools";
2
- export declare const PACKAGE_VERSION = "0.1.3";
2
+ export declare const PACKAGE_VERSION = "0.1.4";
3
3
  export declare const MCP_PROTOCOL_VERSION = "2025-11-25";
4
4
  export declare const CONFIG_VERSION = 1;
5
5
  export declare const TRANSACTION_VERSION = 1;
package/dist/hoi4_agent_tools/version.js CHANGED
@@ -1,6 +1,6 @@
1
1
  import { LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js';
2
2
  export const PACKAGE_NAME = 'hoi4-agent-tools';
3
- export const PACKAGE_VERSION = '0.1.3';
3
+ export const PACKAGE_VERSION = '0.1.4';
4
4
  export const MCP_PROTOCOL_VERSION = LATEST_PROTOCOL_VERSION;
5
5
  export const CONFIG_VERSION = 1;
6
6
  export const TRANSACTION_VERSION = 1;
package/docs/completion-report.md CHANGED
@@ -1,6 +1,6 @@
1
- # Completion report: 0.1.3 release candidate
1
+ # Completion report: 0.1.4 release candidate
2
2
 
3
- - Candidate version: `0.1.3`
3
+ - Candidate version: `0.1.4`
4
4
  - Report date: 2026-07-11
5
5
  - Status: fix-forward implementation in qualification; public delivery incomplete
6
6
 
@@ -43,16 +43,24 @@ slash-terminated spelling. npm's signature audit itself verified 448 registry si
43
43
  attestations. The workflow correctly skipped GHCR, GitHub Release, MCP Registry, and final public
44
44
  verification. The public npm `0.1.2` bytes and tag are retained as immutable audit evidence.
45
45
 
46
+ The immutable `v0.1.3` release attempt published and independently verified npm, then published
47
+ the exact two-platform GHCR image with SPDX SBOM and SLSA v0.2 provenance attached to each runtime
48
+ manifest. BuildKit correctly resolved its Git context URI to the immutable commit while recording
49
+ the exact release tag and workflow identity in the provenance environment; the verifier had
50
+ incorrectly required the URI itself to retain the tag. GitHub Release, MCP Registry, and final
51
+ public verification were skipped. The npm `0.1.3` bytes, GHCR `0.1.3` digest, and tag are retained
52
+ as immutable audit evidence.
53
+
46
54
  No complete multi-surface public release is claimed in this report. The following evidence remains
47
- pending until the `0.1.3` fix-forward workflow finishes:
55
+ pending until the `0.1.4` fix-forward workflow finishes:
48
56
 
49
57
  | Surface | Required completion evidence | Status |
50
58
  | -------------- | --------------------------------------------------------------------------------------------------------- | ------------ |
51
- | GitHub source | Public canonical repository containing the tested commit and immutable `v0.1.3` tag | Pending |
52
- | npm | Public `hoi4-agent-tools@0.1.3` with exact tarball integrity and SLSA provenance | `0.1.2` only |
53
- | GitHub release | Immutable `v0.1.3` release containing the exact npm and container digest manifests | Pending |
54
- | GHCR | Public anonymous `0.1.3` digest with two runtime platforms and source-bound SBOM/provenance subjects | Pending |
55
- | MCP Registry | Exact `io.github.klimPaskov/hoi4-agent-tools@0.1.3` metadata with official `active` and `isLatest` status | Pending |
59
+ | GitHub source | Public canonical repository containing the tested commit and immutable `v0.1.4` tag | Pending |
60
+ | npm | Public `hoi4-agent-tools@0.1.4` with exact tarball integrity and SLSA provenance | `0.1.3` only |
61
+ | GitHub release | Immutable `v0.1.4` release containing the exact npm and container digest manifests | Pending |
62
+ | GHCR | Public anonymous `0.1.4` digest with two runtime platforms and source-bound SBOM/provenance subjects | `0.1.3` only |
63
+ | MCP Registry | Exact `io.github.klimPaskov/hoi4-agent-tools@0.1.4` metadata with official `active` and `isLatest` status | Pending |
56
64
  | Public install | Clean registry installation, signature audit, MCP initialization, and tool discovery | Pending |
57
65
 
58
66
  ## First-release completion sequence
@@ -61,8 +69,8 @@ pending until the `0.1.3` fix-forward workflow finishes:
61
69
  2. Run the manual GHCR bootstrap workflow, make the new package public in GitHub, and verify the bootstrap index without saved credentials.
62
70
  3. Create `npm-bootstrap-v0.0.0-bootstrap.1`, store a shortest-lived npm granular token only as `NPM_BOOTSTRAP_TOKEN`, and run the manual non-OIDC npm bootstrap workflow from that tag. The earlier immutable `.0` attempt stopped before publication; it is retained as audit evidence rather than rewritten.
63
71
  4. Revoke and delete `NPM_BOOTSTRAP_TOKEN`, then configure npm trusted publishing for `klimPaskov/hoi4-agent-tools`, `release.yml`, and the explicit `npm publish` allowed action.
64
- 5. Preserve `v0.1.0` and `v0.1.1`, plus the immutable `v0.1.2` tag and public npm package whose independent verification stopped before any downstream writer. Do not create `NPM_TOKEN`; the OIDC workflow rejects it.
65
- 6. Qualify the synchronized `0.1.3` fix-forward commit, including the shared canonical npm Registry constant and strict refusal coverage, then create `v0.1.3` only from an exact green commit.
72
+ 5. Preserve `v0.1.0` and `v0.1.1`, the immutable `v0.1.2` npm-only state, and the immutable `v0.1.3` npm-plus-GHCR state. Do not create `NPM_TOKEN`; the OIDC workflow rejects it.
73
+ 6. Qualify the synchronized `0.1.4` fix-forward commit, including strict commit-resolved BuildKit provenance plus independent tag/workflow bindings, then create `v0.1.4` only from an exact green commit.
66
74
  7. Allow the release workflow to publish and verify npm, digest-immutable GHCR, the immutable GitHub release, and MCP Registry in its enforced order.
67
75
  8. Update this report with the commit, workflow run, public URLs, npm and image digests, and Registry status. Only then is public delivery complete.
68
76
 
package/docs/release.md CHANGED
@@ -59,7 +59,7 @@ stable package is published, the normal strict stable-version monotonic and exac
59
59
  ## Immutable fix-forward history
60
60
 
61
61
  Stable tags and public package versions are never moved, deleted, or overwritten after a failed
62
- release attempt. The retained history before `0.1.3` is:
62
+ release attempt. The retained history before `0.1.4` is:
63
63
 
64
64
  - `v0.1.0` stopped during prepublication validation, before any public writer ran;
65
65
  - `v0.1.1` stopped before npm accepted bytes because npm interpreted a slash-containing relative
@@ -69,9 +69,16 @@ release attempt. The retained history before `0.1.3` is:
69
69
  Registry URL without its trailing slash while the strict verifier required the canonical
70
70
  slash-terminated spelling. npm signatures and attestations themselves verified successfully;
71
71
  GHCR, GitHub Release, and MCP Registry writers were skipped.
72
-
73
- `0.1.3` centralizes the exact canonical Registry URL used by the subprocess and verifier. The
74
- normal stable-version monotonic gate treats the public `0.1.2` package as immutable history and
72
+ - `v0.1.3` published and independently verified npm, then published the exact two-platform GHCR
73
+ image with SPDX SBOM and SLSA v0.2 provenance for both runtime manifests. Its post-push verifier
74
+ incorrectly required BuildKit's `configSource.uri` to retain the Git tag even though the action
75
+ resolves the default Git context to the immutable commit. The provenance digest and URI were
76
+ commit-bound, and its environment separately carried the exact tag, repository, release workflow,
77
+ workflow SHA, event, and job. GitHub Release and MCP Registry writers were skipped.
78
+
79
+ `0.1.4` accepts only the exact tag- or commit-resolved repository URI while requiring the source
80
+ commit digest and the independent tag/workflow environment bindings. The normal stable-version
81
+ monotonic gate treats the public `0.1.3` package as immutable history and
75
82
  permits only a strictly newer version. Rerunning or fixing a release never authorizes rewriting a
76
83
  tag, package version, image tag, release asset, or Registry version.
77
84
 
package/docs/self-hosting.md CHANGED
@@ -128,7 +128,7 @@ place it beneath any source, capability, artifact, cache, fixture, or `storageRo
128
128
  ## Container
129
129
 
130
130
  ```bash
131
- docker build -t hoi4-agent-tools:0.1.3 .
131
+ docker build -t hoi4-agent-tools:0.1.4 .
132
132
  docker run --read-only --rm -p 127.0.0.1:3210:3210 \
133
133
  -e HOI4_AGENT_CONFIG=/config/config.json \
134
134
  -v /srv/hoi4/config:/config:ro \
@@ -136,7 +136,7 @@ docker run --read-only --rm -p 127.0.0.1:3210:3210 \
136
136
  -v /srv/hoi4/workspaces:/srv/hoi4/workspaces \
137
137
  -v /var/lib/hoi4-agent-tools:/var/lib/hoi4-agent-tools \
138
138
  -v /var/lib/hoi4-agent-tools-state:/var/lib/hoi4-agent-tools-state \
139
- hoi4-agent-tools:0.1.3
139
+ hoi4-agent-tools:0.1.4
140
140
  ```
141
141
 
142
142
  Port publishing reaches the container through a non-loopback interface. The mounted configuration
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "hoi4-agent-tools",
3
3
  "mcpName": "io.github.klimPaskov/hoi4-agent-tools",
4
- "version": "0.1.3",
4
+ "version": "0.1.4",
5
5
  "description": "Source-preserving HOI4 workbench exposed as a safe Model Context Protocol server for coding agents",
6
6
  "type": "module",
7
7
  "license": "Apache-2.0",
package/schemas/configuration.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/configuration.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/configuration.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/continuous-focus-palette.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/continuous-focus-palette.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/continuous-focus-palette.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/focus-plan.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/focus-plan.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/focus-plan.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/focus-planning-sidecar.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/focus-planning-sidecar.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/focus-planning-sidecar.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/gui-animation-source.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/gui-animation-source.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/gui-animation-source.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/gui-helper.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/gui-helper.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/gui-helper.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/gui-scenario.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/gui-scenario.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/gui-scenario.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/map-operation.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/map-operation.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/map-operation.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "oneOf": [
5
5
  {
package/schemas/operation-result.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/operation-result.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/operation-result.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/transaction-manifest.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/transaction-manifest.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.4/schemas/transaction-manifest.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/server.json CHANGED
@@ -3,7 +3,7 @@
3
3
  "name": "io.github.klimPaskov/hoi4-agent-tools",
4
4
  "title": "HOI4 Agent Tools",
5
5
  "description": "Source-preserving HOI4 focus, scripted GUI, and map tools with safe transactions.",
6
- "version": "0.1.3",
6
+ "version": "0.1.4",
7
7
  "repository": {
8
8
  "url": "https://github.com/klimPaskov/hoi4-agent-tools",
9
9
  "source": "github"
@@ -13,7 +13,7 @@
13
13
  {
14
14
  "registryType": "npm",
15
15
  "identifier": "hoi4-agent-tools",
16
- "version": "0.1.3",
16
+ "version": "0.1.4",
17
17
  "environmentVariables": [
18
18
  {
19
19
  "name": "HOI4_AGENT_CONFIG",