hoi4-agent-tools 0.1.3 → 0.1.5

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (20) hide show
  1. package/CHANGELOG.md +16 -0
  2. package/README.md +4 -4
  3. package/dist/hoi4_agent_tools/mcp/registry/metadata.d.ts +1 -1
  4. package/dist/hoi4_agent_tools/version.d.ts +1 -1
  5. package/dist/hoi4_agent_tools/version.js +1 -1
  6. package/docs/completion-report.md +26 -10
  7. package/docs/release.md +18 -6
  8. package/docs/self-hosting.md +2 -2
  9. package/package.json +1 -1
  10. package/schemas/configuration.schema.json +1 -1
  11. package/schemas/continuous-focus-palette.schema.json +1 -1
  12. package/schemas/focus-plan.schema.json +1 -1
  13. package/schemas/focus-planning-sidecar.schema.json +1 -1
  14. package/schemas/gui-animation-source.schema.json +1 -1
  15. package/schemas/gui-helper.schema.json +1 -1
  16. package/schemas/gui-scenario.schema.json +1 -1
  17. package/schemas/map-operation.schema.json +1 -1
  18. package/schemas/operation-result.schema.json +1 -1
  19. package/schemas/transaction-manifest.schema.json +1 -1
  20. package/server.json +2 -2
package/CHANGELOG.md CHANGED
@@ -2,6 +2,22 @@
2
2
 
3
3
  All notable changes are documented here. The project follows Semantic Versioning.
4
4
 
5
+ ## [0.1.5] - 2026-07-11
6
+
7
+ ### Fixed
8
+
9
+ - Accepted the live GitHub Releases API's empty-string representation for an omitted optional asset label while continuing to reject every non-empty alternate label.
10
+ - Added coverage for both canonical no-label representations and retained strict name, count, uploader, upload state, size, digest, API URL, and downloaded-byte verification for every release asset.
11
+ - Preserved the immutable `v0.1.4` npm package and GHCR image plus its exact unpublished GitHub draft after the draft verifier stopped before Release publication or MCP Registry publication, then advanced every synchronized release surface for the fix-forward release.
12
+
13
+ ## [0.1.4] - 2026-07-11
14
+
15
+ ### Fixed
16
+
17
+ - Verified BuildKit's commit-resolved Git context URI and digest while independently requiring the exact release tag, repository, release workflow ref, workflow SHA, push event, and `publish_image` job recorded in container provenance.
18
+ - Added refusal coverage for altered container source URIs, digests, Dockerfile entry points, event/job identities, tag refs, repository identities, workflow refs, and workflow SHAs.
19
+ - Preserved the immutable `v0.1.3` npm package and GHCR image whose post-push provenance verifier stopped before GitHub Release or MCP Registry publication, then advanced every synchronized release surface for the fix-forward release.
20
+
5
21
  ## [0.1.3] - 2026-07-11
6
22
 
7
23
  ### Fixed
package/README.md CHANGED
@@ -15,7 +15,7 @@ The MCP server is the product interface. There is no focus editor, GUI editor, m
15
15
  Requires Node.js 22 or 24.
16
16
 
17
17
  ```bash
18
- npm install --global hoi4-agent-tools@0.1.3
18
+ npm install --global hoi4-agent-tools@0.1.5
19
19
  hoi4-agent-tools-setup --init-config /path/to/config.json --workspace /path/to/mod --game /path/to/game
20
20
  hoi4-agent-tools-setup --diagnose --config /path/to/config.json
21
21
  hoi4-agent-tools-setup --print-client-config --config /path/to/config.json
@@ -26,7 +26,7 @@ The generated configuration is read-only. Add `--enable-writes --server-state /s
26
26
  For one-shot stdio installation, clients can launch:
27
27
 
28
28
  ```text
29
- npx -y hoi4-agent-tools@0.1.3
29
+ npx -y hoi4-agent-tools@0.1.5
30
30
  ```
31
31
 
32
32
  with `HOI4_AGENT_CONFIG` set to the reviewed config path.
@@ -66,7 +66,7 @@ Generic JSON-based clients:
66
66
  "mcpServers": {
67
67
  "hoi4_agent_tools": {
68
68
  "command": "npx",
69
- "args": ["-y", "hoi4-agent-tools@0.1.3"],
69
+ "args": ["-y", "hoi4-agent-tools@0.1.5"],
70
70
  "env": { "HOI4_AGENT_CONFIG": "/absolute/path/to/config.json" }
71
71
  }
72
72
  }
@@ -78,7 +78,7 @@ Codex `config.toml`:
78
78
  ```toml
79
79
  [mcp_servers.hoi4_agent_tools]
80
80
  command = "npx"
81
- args = ["-y", "hoi4-agent-tools@0.1.3"]
81
+ args = ["-y", "hoi4-agent-tools@0.1.5"]
82
82
  env = { HOI4_AGENT_CONFIG = "/absolute/path/to/config.json" }
83
83
  ```
84
84
 
package/dist/hoi4_agent_tools/mcp/registry/metadata.d.ts CHANGED
@@ -4,6 +4,6 @@ export declare const MCP_REGISTRY_SERVER_NAME = "io.github.klimPaskov/hoi4-agent
4
4
  export declare const MCP_REGISTRY_IDENTITY: {
5
5
  readonly name: "io.github.klimPaskov/hoi4-agent-tools";
6
6
  readonly packageName: "hoi4-agent-tools";
7
- readonly version: "0.1.3";
7
+ readonly version: "0.1.5";
8
8
  };
9
9
  //# sourceMappingURL=metadata.d.ts.map
package/dist/hoi4_agent_tools/version.d.ts CHANGED
@@ -1,5 +1,5 @@
1
1
  export declare const PACKAGE_NAME = "hoi4-agent-tools";
2
- export declare const PACKAGE_VERSION = "0.1.3";
2
+ export declare const PACKAGE_VERSION = "0.1.5";
3
3
  export declare const MCP_PROTOCOL_VERSION = "2025-11-25";
4
4
  export declare const CONFIG_VERSION = 1;
5
5
  export declare const TRANSACTION_VERSION = 1;
package/dist/hoi4_agent_tools/version.js CHANGED
@@ -1,6 +1,6 @@
1
1
  import { LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js';
2
2
  export const PACKAGE_NAME = 'hoi4-agent-tools';
3
- export const PACKAGE_VERSION = '0.1.3';
3
+ export const PACKAGE_VERSION = '0.1.5';
4
4
  export const MCP_PROTOCOL_VERSION = LATEST_PROTOCOL_VERSION;
5
5
  export const CONFIG_VERSION = 1;
6
6
  export const TRANSACTION_VERSION = 1;
package/docs/completion-report.md CHANGED
@@ -1,6 +1,6 @@
1
- # Completion report: 0.1.3 release candidate
1
+ # Completion report: 0.1.5 release candidate
2
2
 
3
- - Candidate version: `0.1.3`
3
+ - Candidate version: `0.1.5`
4
4
  - Report date: 2026-07-11
5
5
  - Status: fix-forward implementation in qualification; public delivery incomplete
6
6
 
@@ -43,16 +43,32 @@ slash-terminated spelling. npm's signature audit itself verified 448 registry si
43
43
  attestations. The workflow correctly skipped GHCR, GitHub Release, MCP Registry, and final public
44
44
  verification. The public npm `0.1.2` bytes and tag are retained as immutable audit evidence.
45
45
 
46
+ The immutable `v0.1.3` release attempt published and independently verified npm, then published
47
+ the exact two-platform GHCR image with SPDX SBOM and SLSA v0.2 provenance attached to each runtime
48
+ manifest. BuildKit correctly resolved its Git context URI to the immutable commit while recording
49
+ the exact release tag and workflow identity in the provenance environment; the verifier had
50
+ incorrectly required the URI itself to retain the tag. GitHub Release, MCP Registry, and final
51
+ public verification were skipped. The npm `0.1.3` bytes, GHCR `0.1.3` digest, and tag are retained
52
+ as immutable audit evidence.
53
+
54
+ The immutable `v0.1.4` release attempt published and independently verified npm and the exact
55
+ two-platform GHCR image, then staged a four-asset GitHub draft with the expected names, sizes,
56
+ SHA-256 digests, upload states, and GitHub Actions bot ownership. The live Releases API represented
57
+ the omitted optional asset label as an empty string while the verifier accepted only `null`, so the
58
+ draft remained unpublished. MCP Registry and final public verification were skipped. The npm
59
+ `0.1.4` bytes, GHCR `0.1.4` digest, tag, draft, and draft assets are retained as immutable or
60
+ unchanged audit evidence.
61
+
46
62
  No complete multi-surface public release is claimed in this report. The following evidence remains
47
- pending until the `0.1.3` fix-forward workflow finishes:
63
+ pending until the `0.1.5` fix-forward workflow finishes:
48
64
 
49
65
  | Surface | Required completion evidence | Status |
50
66
  | -------------- | --------------------------------------------------------------------------------------------------------- | ------------ |
51
- | GitHub source | Public canonical repository containing the tested commit and immutable `v0.1.3` tag | Pending |
52
- | npm | Public `hoi4-agent-tools@0.1.3` with exact tarball integrity and SLSA provenance | `0.1.2` only |
53
- | GitHub release | Immutable `v0.1.3` release containing the exact npm and container digest manifests | Pending |
54
- | GHCR | Public anonymous `0.1.3` digest with two runtime platforms and source-bound SBOM/provenance subjects | Pending |
55
- | MCP Registry | Exact `io.github.klimPaskov/hoi4-agent-tools@0.1.3` metadata with official `active` and `isLatest` status | Pending |
67
+ | GitHub source | Public canonical repository containing the tested commit and immutable `v0.1.5` tag | Pending |
68
+ | npm | Public `hoi4-agent-tools@0.1.5` with exact tarball integrity and SLSA provenance | `0.1.4` only |
69
+ | GitHub release | Immutable `v0.1.5` release containing the exact npm and container digest manifests | Pending |
70
+ | GHCR | Public anonymous `0.1.5` digest with two runtime platforms and source-bound SBOM/provenance subjects | `0.1.4` only |
71
+ | MCP Registry | Exact `io.github.klimPaskov/hoi4-agent-tools@0.1.5` metadata with official `active` and `isLatest` status | Pending |
56
72
  | Public install | Clean registry installation, signature audit, MCP initialization, and tool discovery | Pending |
57
73
 
58
74
  ## First-release completion sequence
@@ -61,8 +77,8 @@ pending until the `0.1.3` fix-forward workflow finishes:
61
77
  2. Run the manual GHCR bootstrap workflow, make the new package public in GitHub, and verify the bootstrap index without saved credentials.
62
78
  3. Create `npm-bootstrap-v0.0.0-bootstrap.1`, store a shortest-lived npm granular token only as `NPM_BOOTSTRAP_TOKEN`, and run the manual non-OIDC npm bootstrap workflow from that tag. The earlier immutable `.0` attempt stopped before publication; it is retained as audit evidence rather than rewritten.
63
79
  4. Revoke and delete `NPM_BOOTSTRAP_TOKEN`, then configure npm trusted publishing for `klimPaskov/hoi4-agent-tools`, `release.yml`, and the explicit `npm publish` allowed action.
64
- 5. Preserve `v0.1.0` and `v0.1.1`, plus the immutable `v0.1.2` tag and public npm package whose independent verification stopped before any downstream writer. Do not create `NPM_TOKEN`; the OIDC workflow rejects it.
65
- 6. Qualify the synchronized `0.1.3` fix-forward commit, including the shared canonical npm Registry constant and strict refusal coverage, then create `v0.1.3` only from an exact green commit.
80
+ 5. Preserve `v0.1.0` and `v0.1.1`, the immutable `v0.1.2` npm-only state, the immutable `v0.1.3` npm-plus-GHCR state, and the immutable `v0.1.4` npm-plus-GHCR state with its unchanged exact draft. Do not create `NPM_TOKEN`; the OIDC workflow rejects it.
81
+ 6. Qualify the synchronized `0.1.5` fix-forward commit, including strict acceptance of only the API's `null` or empty no-label representations, then create `v0.1.5` only from an exact green commit.
66
82
  7. Allow the release workflow to publish and verify npm, digest-immutable GHCR, the immutable GitHub release, and MCP Registry in its enforced order.
67
83
  8. Update this report with the commit, workflow run, public URLs, npm and image digests, and Registry status. Only then is public delivery complete.
68
84
 
package/docs/release.md CHANGED
@@ -59,7 +59,7 @@ stable package is published, the normal strict stable-version monotonic and exac
59
59
  ## Immutable fix-forward history
60
60
 
61
61
  Stable tags and public package versions are never moved, deleted, or overwritten after a failed
62
- release attempt. The retained history before `0.1.3` is:
62
+ release attempt. The retained history before `0.1.5` is:
63
63
 
64
64
  - `v0.1.0` stopped during prepublication validation, before any public writer ran;
65
65
  - `v0.1.1` stopped before npm accepted bytes because npm interpreted a slash-containing relative
@@ -69,11 +69,23 @@ release attempt. The retained history before `0.1.3` is:
69
69
  Registry URL without its trailing slash while the strict verifier required the canonical
70
70
  slash-terminated spelling. npm signatures and attestations themselves verified successfully;
71
71
  GHCR, GitHub Release, and MCP Registry writers were skipped.
72
-
73
- `0.1.3` centralizes the exact canonical Registry URL used by the subprocess and verifier. The
74
- normal stable-version monotonic gate treats the public `0.1.2` package as immutable history and
75
- permits only a strictly newer version. Rerunning or fixing a release never authorizes rewriting a
76
- tag, package version, image tag, release asset, or Registry version.
72
+ - `v0.1.3` published and independently verified npm, then published the exact two-platform GHCR
73
+ image with SPDX SBOM and SLSA v0.2 provenance for both runtime manifests. Its post-push verifier
74
+ incorrectly required BuildKit's `configSource.uri` to retain the Git tag even though the action
75
+ resolves the default Git context to the immutable commit. The provenance digest and URI were
76
+ commit-bound, and its environment separately carried the exact tag, repository, release workflow,
77
+ workflow SHA, event, and job. GitHub Release and MCP Registry writers were skipped.
78
+ - `v0.1.4` published and independently verified npm and the exact two-platform GHCR image, then
79
+ staged an exact four-asset GitHub draft. The live Releases API represented an omitted optional
80
+ asset label as an empty string while the verifier accepted only `null`, so the draft remained
81
+ unpublished and MCP Registry publication was skipped. The tag, npm package, image, draft, and
82
+ draft assets remain unchanged as audit evidence.
83
+
84
+ `0.1.5` accepts only `null` or the empty string as the API's no-label representation and continues
85
+ to reject every non-empty alternate asset label. The normal stable-version monotonic gate treats
86
+ the public `0.1.4` package as immutable history and permits only a strictly newer version. Rerunning
87
+ or fixing a release never authorizes rewriting a tag, package version, image tag, release asset, or
88
+ Registry version.
77
89
 
78
90
  ## Required pre-tag immutability check
79
91
 
package/docs/self-hosting.md CHANGED
@@ -128,7 +128,7 @@ place it beneath any source, capability, artifact, cache, fixture, or `storageRo
128
128
  ## Container
129
129
 
130
130
  ```bash
131
- docker build -t hoi4-agent-tools:0.1.3 .
131
+ docker build -t hoi4-agent-tools:0.1.5 .
132
132
  docker run --read-only --rm -p 127.0.0.1:3210:3210 \
133
133
  -e HOI4_AGENT_CONFIG=/config/config.json \
134
134
  -v /srv/hoi4/config:/config:ro \
@@ -136,7 +136,7 @@ docker run --read-only --rm -p 127.0.0.1:3210:3210 \
136
136
  -v /srv/hoi4/workspaces:/srv/hoi4/workspaces \
137
137
  -v /var/lib/hoi4-agent-tools:/var/lib/hoi4-agent-tools \
138
138
  -v /var/lib/hoi4-agent-tools-state:/var/lib/hoi4-agent-tools-state \
139
- hoi4-agent-tools:0.1.3
139
+ hoi4-agent-tools:0.1.5
140
140
  ```
141
141
 
142
142
  Port publishing reaches the container through a non-loopback interface. The mounted configuration
package/package.json CHANGED
@@ -1,7 +1,7 @@
1
1
  {
2
2
  "name": "hoi4-agent-tools",
3
3
  "mcpName": "io.github.klimPaskov/hoi4-agent-tools",
4
- "version": "0.1.3",
4
+ "version": "0.1.5",
5
5
  "description": "Source-preserving HOI4 workbench exposed as a safe Model Context Protocol server for coding agents",
6
6
  "type": "module",
7
7
  "license": "Apache-2.0",
package/schemas/configuration.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/configuration.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.5/schemas/configuration.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/continuous-focus-palette.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/continuous-focus-palette.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.5/schemas/continuous-focus-palette.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/focus-plan.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/focus-plan.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.5/schemas/focus-plan.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/focus-planning-sidecar.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/focus-planning-sidecar.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.5/schemas/focus-planning-sidecar.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/gui-animation-source.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/gui-animation-source.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.5/schemas/gui-animation-source.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/gui-helper.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/gui-helper.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.5/schemas/gui-helper.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/gui-scenario.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/gui-scenario.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.5/schemas/gui-scenario.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/map-operation.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/map-operation.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.5/schemas/map-operation.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "oneOf": [
5
5
  {
package/schemas/operation-result.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/operation-result.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.5/schemas/operation-result.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/schemas/transaction-manifest.schema.json CHANGED
@@ -1,5 +1,5 @@
1
1
  {
2
- "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.3/schemas/transaction-manifest.schema.json",
2
+ "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v0.1.5/schemas/transaction-manifest.schema.json",
3
3
  "$schema": "https://json-schema.org/draft/2020-12/schema",
4
4
  "type": "object",
5
5
  "properties": {
package/server.json CHANGED
@@ -3,7 +3,7 @@
3
3
  "name": "io.github.klimPaskov/hoi4-agent-tools",
4
4
  "title": "HOI4 Agent Tools",
5
5
  "description": "Source-preserving HOI4 focus, scripted GUI, and map tools with safe transactions.",
6
- "version": "0.1.3",
6
+ "version": "0.1.5",
7
7
  "repository": {
8
8
  "url": "https://github.com/klimPaskov/hoi4-agent-tools",
9
9
  "source": "github"
@@ -13,7 +13,7 @@
13
13
  {
14
14
  "registryType": "npm",
15
15
  "identifier": "hoi4-agent-tools",
16
- "version": "0.1.3",
16
+ "version": "0.1.5",
17
17
  "environmentVariables": [
18
18
  {
19
19
  "name": "HOI4_AGENT_CONFIG",