hoi4-agent-tools 2.8.6 → 2.8.7

package/CHANGELOG.md

@@ -4,6 +4,11 @@
 
 No unreleased changes.
 
+## 2.8.7 - 2026-08-28
+
+- Isolate stale, foreign, oversized, malformed, and address-mismatched artifact manifests so one bad generated record cannot block unrelated probability, event, GUI, or other MCP evidence routes.
+- Repair corrupted deterministic manifests from recomputed expected bytes, validate cached probability resources before reuse, and keep direct foreign-artifact access unavailable without exposing cross-workspace content.
+
 ## 2.8.6 - 2026-08-28
 
 - Generate source-aware scripted-GUI scenarios from complete parent/child surfaces, real scripted-localisation candidates, simple threshold conditions, coherent tab states, scoped values, meter ranges, and dynamic-list rows while keeping explicit scenario values authoritative.

package/dist/hoi4_agent_tools/core/artifacts.js

@@ -132,11 +132,14 @@ export function boundedSourceHashEvidence(sourceHashes) {
 }
 function assertManifestIntegrity(manifest, expected, workspace) {
     assertManifestAddressIntegrity(manifest, expected);
-    if (manifest.workspaceIdentity !== workspace.workspaceIdentity ||
-        manifest.ownerIdentity !== workspace.ownerIdentity) {
-        throw new ServiceError('ARTIFACT_MANIFEST_INTEGRITY_FAILED', 'Artifact provenance manifest does not match its immutable address');
+    if (!manifestBelongsToWorkspace(manifest, workspace)) {
+        throw new ServiceError('ARTIFACT_NOT_FOUND', 'Artifact provenance manifest is unavailable');
     }
 }
+function manifestBelongsToWorkspace(manifest, workspace) {
+    return (manifest.workspaceIdentity === workspace.workspaceIdentity &&
+        manifest.ownerIdentity === workspace.ownerIdentity);
+}
 function assertManifestAddressIntegrity(manifest, expected) {
     if (manifest.sha256 !== expected.sha256 ||
         manifest.provenanceHash !== expected.provenanceHash ||
@@ -145,6 +148,33 @@ function assertManifestAddressIntegrity(manifest, expected) {
         throw new ServiceError('ARTIFACT_MANIFEST_INTEGRITY_FAILED', 'Artifact provenance manifest does not match its immutable address');
     }
 }
+function recoverableManifestError(error) {
+    return (error instanceof ServiceError &&
+        [
+            'ARTIFACT_NOT_FOUND',
+            'ARTIFACT_MANIFEST_INVALID',
+            'ARTIFACT_MANIFEST_LIMIT',
+            'ARTIFACT_MANIFEST_INTEGRITY_FAILED',
+        ].includes(error.code));
+}
+async function enumerableArtifactManifest(workspace, directory, entryName, signal) {
+    try {
+        const manifest = await readArtifactManifest(path.join(directory, entryName), signal);
+        if (entryName !== `${manifest.name}.${manifest.provenanceHash}.manifest.json`)
+            return undefined;
+        assertManifestAddressIntegrity(manifest, {
+            sha256: path.basename(directory),
+            provenanceHash: manifest.provenanceHash,
+            name: manifest.name,
+        });
+        return manifestBelongsToWorkspace(manifest, workspace) ? manifest : undefined;
+    }
+    catch (error) {
+        if (recoverableManifestError(error))
+            return undefined;
+        throw error;
+    }
+}
 /** Return the only artifact fields that may cross the MCP trust boundary. */
 export function publicArtifactLink(artifact) {
     return {
@@ -501,6 +531,23 @@ async function existingManifestMatches(filePath, expectedBytes, signal) {
     try {
         const manifest = await readArtifactManifest(filePath, signal);
         if (`${canonicalJson(manifest)}\n` !== expectedBytes) {
+            const expected = artifactManifestSchema.parse(JSON.parse(expectedBytes));
+            try {
+                assertManifestAddressIntegrity(manifest, {
+                    sha256: expected.sha256,
+                    provenanceHash: expected.provenanceHash,
+                    name: expected.name,
+                });
+            }
+            catch (error) {
+                if (!recoverableManifestError(error))
+                    throw error;
+                await unlink(filePath).catch((unlinkError) => {
+                    if (unlinkError.code !== 'ENOENT')
+                        throw unlinkError;
+                });
+                return false;
+            }
             throw new ServiceError('ARTIFACT_MANIFEST_INTEGRITY_FAILED', 'Immutable artifact provenance manifest contains different bytes');
         }
         return true;
@@ -508,11 +555,17 @@ async function existingManifestMatches(filePath, expectedBytes, signal) {
     catch (error) {
         if (error instanceof ServiceError && error.code === 'ARTIFACT_NOT_FOUND')
             return false;
-        if (!(error instanceof ServiceError) || error.code !== 'ARTIFACT_MANIFEST_INVALID')
+        if (!(error instanceof ServiceError) ||
+            !['ARTIFACT_MANIFEST_INVALID', 'ARTIFACT_MANIFEST_LIMIT'].includes(error.code))
             throw error;
         const state = await interruptedManifestState(filePath, expectedBytes, signal);
-        if (!state.interrupted)
-            throw error;
+        if (!state.interrupted) {
+            await unlink(filePath).catch((unlinkError) => {
+                if (unlinkError.code !== 'ENOENT')
+                    throw unlinkError;
+            });
+            return false;
+        }
         try {
             await unlink(filePath);
         }
@@ -689,19 +742,31 @@ export class ArtifactStore {
                 catch (error) {
                     if (error instanceof ServiceError && error.code === 'ARTIFACT_NOT_FOUND')
                         continue;
-                    if (!(error instanceof ServiceError) || error.code !== 'ARTIFACT_MANIFEST_INVALID')
+                    if (!recoverableManifestError(error))
                         throw error;
-                    let interrupted;
                     try {
-                        interrupted = await interruptedManifestState(candidate, undefined, signal);
+                        await unlink(candidate);
                     }
-                    catch (interruptedError) {
-                        if (interruptedError instanceof ServiceError &&
-                            interruptedError.code === 'ARTIFACT_NOT_FOUND')
-                            continue;
-                        throw interruptedError;
+                    catch (unlinkError) {
+                        if (unlinkError.code !== 'ENOENT')
+                            throw unlinkError;
                     }
-                    if (!interrupted.interrupted)
+                    usage.entries = Math.max(0, usage.entries - 1);
+                    usage.bytes = Math.max(0, usage.bytes - metadata.size);
+                    continue;
+                }
+                try {
+                    if (child.name !== `${manifest.name}.${manifest.provenanceHash}.manifest.json`) {
+                        throw new ServiceError('ARTIFACT_MANIFEST_INTEGRITY_FAILED', 'Artifact provenance manifest filename does not match its contents');
+                    }
+                    assertManifestAddressIntegrity(manifest, {
+                        sha256: path.basename(directory),
+                        provenanceHash: manifest.provenanceHash,
+                        name: manifest.name,
+                    });
+                }
+                catch (error) {
+                    if (!recoverableManifestError(error))
                         throw error;
                     try {
                         await unlink(candidate);
@@ -711,17 +776,9 @@ export class ArtifactStore {
                             throw unlinkError;
                     }
                     usage.entries = Math.max(0, usage.entries - 1);
-                    usage.bytes = Math.max(0, usage.bytes - interrupted.size);
+                    usage.bytes = Math.max(0, usage.bytes - metadata.size);
                     continue;
                 }
-                if (child.name !== `${manifest.name}.${manifest.provenanceHash}.manifest.json`) {
-                    throw new ServiceError('ARTIFACT_MANIFEST_INTEGRITY_FAILED', 'Artifact provenance manifest filename does not match its contents');
-                }
-                assertManifestAddressIntegrity(manifest, {
-                    sha256: path.basename(directory),
-                    provenanceHash: manifest.provenanceHash,
-                    name: manifest.name,
-                });
                 const targetPath = await containedGeneratedPath(workspace.artifactRoot, path.relative(workspace.artifactRoot, path.join(directory, manifest.name)));
                 let targetBytes = 0;
                 try {
@@ -867,15 +924,10 @@ export class ArtifactStore {
                     await walk(await containedGeneratedPath(workspace.artifactRoot, path.relative(workspace.artifactRoot, candidate)));
                 }
                 else if (entry.isFile() && entry.name.endsWith('.manifest.json')) {
-                    const manifest = await readArtifactManifest(await containedGeneratedPath(workspace.artifactRoot, path.relative(workspace.artifactRoot, candidate)), signal);
-                    if (entry.name !== `${manifest.name}.${manifest.provenanceHash}.manifest.json`) {
-                        throw new ServiceError('ARTIFACT_MANIFEST_INTEGRITY_FAILED', 'Artifact provenance manifest filename does not match its contents');
-                    }
-                    assertManifestIntegrity(manifest, {
-                        sha256: path.basename(directory),
-                        provenanceHash: manifest.provenanceHash,
-                        name: manifest.name,
-                    }, workspace);
+                    await containedGeneratedPath(workspace.artifactRoot, path.relative(workspace.artifactRoot, candidate));
+                    const manifest = await enumerableArtifactManifest(workspace, directory, entry.name, signal);
+                    if (manifest === undefined)
+                        continue;
                     results.push({
                         uri: this.uri(workspace.id, manifest.sha256, manifest.provenanceHash, manifest.name),
                         name: manifest.name,
@@ -908,15 +960,10 @@ export class ArtifactStore {
         let hasMore = false;
         const visitManifest = async (directory, entryName) => {
             signal?.throwIfAborted();
-            const manifest = await readArtifactManifest(await containedGeneratedPath(workspace.artifactRoot, path.relative(workspace.artifactRoot, path.join(directory, entryName))), signal);
-            if (entryName !== `${manifest.name}.${manifest.provenanceHash}.manifest.json`) {
-                throw new ServiceError('ARTIFACT_MANIFEST_INTEGRITY_FAILED', 'Artifact provenance manifest filename does not match its contents');
-            }
-            assertManifestIntegrity(manifest, {
-                sha256: path.basename(directory),
-                provenanceHash: manifest.provenanceHash,
-                name: manifest.name,
-            }, workspace);
+            await containedGeneratedPath(workspace.artifactRoot, path.relative(workspace.artifactRoot, path.join(directory, entryName)));
+            const manifest = await enumerableArtifactManifest(workspace, directory, entryName, signal);
+            if (manifest === undefined)
+                return;
             const uri = this.uri(workspace.id, manifest.sha256, manifest.provenanceHash, manifest.name);
             revision.update(`${Buffer.byteLength(uri, 'utf8')}:${uri}`);
             total += 1;
@@ -989,6 +1036,20 @@ export class ArtifactStore {
             path: await containedGeneratedPath(workspace.artifactRoot, parsed.sha256.slice(0, 2), parsed.sha256, parsed.name),
         };
     }
+    async available(workspace, artifacts, signal) {
+        for (const artifact of artifacts) {
+            signal?.throwIfAborted();
+            try {
+                await this.describe(workspace, artifact.uri, signal);
+            }
+            catch (error) {
+                if (recoverableManifestError(error))
+                    return false;
+                throw error;
+            }
+        }
+        return true;
+    }
     async put(workspace, name, mimeType, content, provenance, description, signal) {
         return this.withAtomicWrites(workspace, [
             {

package/dist/hoi4_agent_tools/probability/service.js

@@ -735,11 +735,12 @@ export class ProbabilityAnalyzer {
     }
     async store(result, outputs, includeHtml = false, signal, principal) {
         const cached = this.state.byCacheKey.get(result.metadata.cacheKey);
+        const workspace = this.engine.resolver.get(result.metadata.workspaceId, principal);
         if (cached?.operation === result.operation &&
             cached.status === result.status &&
-            visualOutputs(outputs).length === 0)
+            visualOutputs(outputs).length === 0 &&
+            (await this.engine.artifacts.available(workspace, cached.resources, signal)))
             return cached;
-        const workspace = this.engine.resolver.get(result.metadata.workspaceId, principal);
         const provenance = {
             kind: 'probability-analysis',
             toolVersion: PACKAGE_VERSION,

package/dist/hoi4_agent_tools/version.js

@@ -1,6 +1,6 @@
 import { LATEST_PROTOCOL_VERSION } from '@modelcontextprotocol/sdk/types.js';
 export const PACKAGE_NAME = 'hoi4-agent-tools';
-export const PACKAGE_VERSION = '2.8.6';
+export const PACKAGE_VERSION = '2.8.7';
 export const MCP_PROTOCOL_VERSION = LATEST_PROTOCOL_VERSION;
 export const CONFIG_VERSION = 1;
 export const TRANSACTION_VERSION = 1;

package/package.json

@@ -1,7 +1,7 @@
 {
   "name": "hoi4-agent-tools",
   "mcpName": "io.github.klimPaskov/hoi4-agent-tools",
-  "version": "2.8.6",
+  "version": "2.8.7",
   "description": "Analyze HOI4 events, tech trees, AI weights, and MTTH; build focus trees, GUIs, and maps.",
   "type": "module",
   "license": "Apache-2.0",

package/schemas/configuration.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/configuration.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/configuration.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/continuous-focus-palette.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/continuous-focus-palette.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/continuous-focus-palette.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/custom-weighted-pool.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/custom-weighted-pool.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/custom-weighted-pool.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/event-feature-manifest.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/event-feature-manifest.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/event-feature-manifest.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/focus-plan.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/focus-plan.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/focus-plan.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/focus-planning-sidecar.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/focus-planning-sidecar.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/focus-planning-sidecar.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/gui-animation-source.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/gui-animation-source.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/gui-animation-source.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/gui-helper.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/gui-helper.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/gui-helper.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/gui-scenario.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/gui-scenario.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/gui-scenario.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/map-operation.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/map-operation.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/map-operation.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "oneOf": [
     {

package/schemas/operation-result.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/operation-result.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/operation-result.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/probability-analysis-result.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/probability-analysis-result.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/probability-analysis-result.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/probability-compare-input.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/probability-compare-input.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/probability-compare-input.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/probability-evaluate-input.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/probability-evaluate-input.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/probability-evaluate-input.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/probability-inspect-input.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/probability-inspect-input.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/probability-inspect-input.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/probability-render-input.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/probability-render-input.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/probability-render-input.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/probability-scenario-set.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/probability-scenario-set.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/probability-scenario-set.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/probability-sequence-input.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/probability-sequence-input.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/probability-sequence-input.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/probability-simulate-input.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/probability-simulate-input.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/probability-simulate-input.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/schemas/probability-sweep-input.schema.json

@@ -1,5 +1,5 @@
 {
-  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.6/schemas/probability-sweep-input.schema.json",
+  "$id": "https://github.com/klimPaskov/hoi4-agent-tools/blob/v2.8.7/schemas/probability-sweep-input.schema.json",
   "$schema": "https://json-schema.org/draft/2020-12/schema",
   "type": "object",
   "properties": {

package/server.json

@@ -3,7 +3,7 @@
   "name": "io.github.klimPaskov/hoi4-agent-tools",
   "title": "HOI4 Agent Tools",
   "description": "Analyze HOI4 events, tech trees, AI weights, and MTTH; build focus trees, GUIs, and maps.",
-  "version": "2.8.6",
+  "version": "2.8.7",
   "repository": {
     "url": "https://github.com/klimPaskov/hoi4-agent-tools",
     "source": "github"
@@ -13,7 +13,7 @@
     {
       "registryType": "npm",
       "identifier": "hoi4-agent-tools",
-      "version": "2.8.6",
+      "version": "2.8.7",
       "transport": {
         "type": "stdio"
       }