modwright 0.1.1 → 0.1.3

package/README.md

@@ -15,8 +15,9 @@ The core is generic. Each game is a **surface**: one module that declares
 where things live and what the rules are, so every tool works for every
 supported game.
 
-**Status:** 0.x. The tools are exercised against real installs and real mod
-projects, but the API is not stable yet.
+**Status:** 0.x, and the API is not stable yet. How far each game is tested
+differs a lot; "Supported games" says which surfaces have been used against
+a real install and which are built from documentation alone.
 
 ## Why
 
@@ -63,18 +64,65 @@ without tcli." Most features need nothing. ModWright can install some
 external tools itself, and any other tool or data folder only has to be
 pointed at once.
 
+## Which mod is doing this?
+
+With hundreds of mods installed, the usual question is not "is something
+broken" but "which mod did it". Three tools answer it from different sides,
+without launching the game:
+
+- **`owner_of`**: which mod a file comes from. Give it a DLL named in a
+  crash log, a path from `triage_logs`, or a bare file name. It answers
+  from the game's own mod folders, Vortex's deployment records and Mod
+  Organizer 2's profiles (Skyrim), and says how it decided. For example,
+  `owner_of game=cyberpunk2077 paths=["TweakXL.dll"]` names the Vortex mod
+  that deployed it.
+- **`who_touches`**: which mods write the same record or entry: Cyberpunk
+  2077 TweakDB records and flats, Baldur's Gate 3 stats entries, Stardew
+  Valley Content Patcher assets and entries. With no `key` it lists the
+  keys mods actually disagree on, for example
+  `who_touches game=cyberpunk2077`. These don't count as a disagreement:
+  - identical writes;
+  - list edits on different items;
+  - a mod the game does not load (a BG3 pak missing from
+    `modsettings.lsx`);
+  - a second copy of the same mod.
+
+  Copies of one mod are reported separately, under `duplicateCopies`.
+  `who_touches key=<record>` shows every writer of one key, and `mod=<name>`
+  shows what one mod writes.
+- **`triage_logs`** with `attributionFor`: what the frameworks' own logs say
+  happened. For example, TweakXL's log gives the order it read tweak files
+  in, and a later file wins the same flat.
+
+Together they catch the quiet problems, for example a tweak file installed
+twice and loaded twice, or a stale copy of a mod that the game binds instead
+of the current one. `who_touches` reads files, not the running game, so
+scripts that change things at runtime are not seen. Which of two
+disagreeing mods wins depends on load order, which these tools report but
+do not decide.
+
 ## Supported games
 
-| Surface | Game | Mod systems modeled |
-|---|---|---|
-| `cyberpunk2077` | Cyberpunk 2077 | legacy archives, REDmod, redscript, TweakXL, ArchiveXL, RED4ext, CET; the TweakDB vanilla index; garment, vehicle, tweak and packaging validators; the CET bridge |
-| `baldursgate3` | Baldur's Gate 3 | `.pak` mods, loose overrides, Script Extender, the native mod loader; the stats, GUID and handle vanilla index; stats, story, progression and visual-bank validators; the Script Extender bridge |
-| `skyrimse` | Skyrim Special Edition | plugins, BSA archives, SKSE plugins, loose files |
-| `eldenring` | Elden Ring | me3 profiles, Mod Engine 2 overlay and DLLs, UXM loose files; paramdef-typed param exports, the `.me3` profile, package-layout and DCX rules |
-| `valheim` | Valheim | BepInEx plugins, patchers, config, MonoMod, the Doorstop loader; Thunderstore packaging, plugin-source and config rules; the vanilla index from Jötunn's dumps |
-| `stardewvalley` | Stardew Valley | SMAPI mods and Content Patcher packs, the load-order override lists, SMAPI's log; the manifest and `content.json` rules; the wiki schema index, built from the wiki's data pages, which `check_toolchain` fetches for you |
-| `subnautica2` | Subnautica 2 | `~mods` paks, LogicMods, UE4SS mods, DLC-style plugins; triplet, mount-point, TOC and UE4SS-shape rules |
-| `nivalisnights` | Nivalis Nights | BepInEx 6 IL2CPP plugins, patchers, config, generated interop, MelonLoader mods; the vanilla index (items, recipes, vendors, venues, NPCs, by GUID) built from your install with Cpp2IL and UnityPy |
+| Surface | Game | Tested | Mod systems modeled |
+|---|---|---|---|
+| `cyberpunk2077` | Cyberpunk 2077 | field-tested | legacy archives, REDmod, redscript, TweakXL, ArchiveXL, RED4ext, CET; the TweakDB vanilla index; garment, vehicle, tweak and packaging validators; the CET bridge |
+| `baldursgate3` | Baldur's Gate 3 | field-tested | `.pak` mods, loose overrides, Script Extender, the native mod loader; the stats, GUID and handle vanilla index; stats, story, progression and visual-bank validators; the Script Extender bridge |
+| `skyrimse` | Skyrim Special Edition | research only | plugins, BSA archives, SKSE plugins, loose files |
+| `eldenring` | Elden Ring | research only | me3 profiles, Mod Engine 2 overlay and DLLs, UXM loose files; paramdef-typed param exports, the `.me3` profile, package-layout and DCX rules |
+| `valheim` | Valheim | research only | BepInEx plugins, patchers, config, MonoMod, the Doorstop loader; Thunderstore packaging, plugin-source and config rules; the vanilla index from Jötunn's dumps |
+| `stardewvalley` | Stardew Valley | research only | SMAPI mods and Content Patcher packs, the load-order override lists, SMAPI's log; the manifest and `content.json` rules; the wiki schema index, built from the wiki's data pages, which `check_toolchain` fetches for you |
+| `subnautica2` | Subnautica 2 | research only | `~mods` paks, LogicMods, UE4SS mods, DLC-style plugins; triplet, mount-point, TOC and UE4SS-shape rules |
+| `nivalisnights` | Nivalis Nights | checked on an install | BepInEx 6 IL2CPP plugins, patchers, config, generated interop, MelonLoader mods; the vanilla index (items, recipes, vendors, venues, NPCs, by GUID) built from your install with Cpp2IL and UnityPy |
+
+- **Field-tested:** used against real installs, real mod projects and the
+  running game, through the in-game bridge, over many field runs.
+- **Checked on an install:** detection, logs, compatibility and the vanilla
+  index were checked against an installed copy of the game. No mod project
+  has been built or deployed through it yet, and it has no bridge.
+- **Research only:** written from the game's modding documentation, its
+  community tools' sources and their published file formats, and tested
+  against fixtures. No install was behind it. Expect gaps, and please report
+  them.
 
 Installs are auto-detected from Steam (every library folder), plus GOG and
 Epic paths where they apply. Override with `installPath` on any tool, or set
@@ -88,13 +136,15 @@ Epic paths where they apply. Override with `installPath` on any tool, or set
 | `detect_install` | Locate one game, and report every mod root and log source, marking which exist. |
 | `list_mods` | Enumerate installed mods across all roots, with sizes, timestamps and parsed manifests. |
 | `inspect_mod` | Full detail on one mod: files owned, manifest, warnings. |
-| `find_conflicts` | Paths claimed by more than one mod, restricted to roots where that is actually possible. |
+| `find_conflicts` | Paths claimed by more than one mod, restricted to roots where that is actually possible. Where Mod Organizer 2 manages the game, it also reports the files one MO2 mod overrides in another. |
+| `owner_of` | Which installed mod a file comes from, and which copy the game sees when several provide it: for a DLL named in a crash log, a path from `triage_logs`, or a bare file name. It reads the game's own mod folders, Mod Organizer 2's profiles (Skyrim) and Vortex's deployment records, and says how each answer was decided. |
+| `who_touches` | Which installed mods write a given record or entry, at the level the game merges on: Cyberpunk 2077 TweakDB records and flats, Baldur's Gate 3 stats entries (read out of paks), Stardew Valley Content Patcher assets and entries. With no key it lists the contested ones. A mod the game does not load is listed but never contests, and copies of one mod count once. Static: it does not decide load order, and runtime scripts are not seen. |
 | `load_order` | Read the game's explicit load order and cross-check it against what is installed. |
 | `load_order_diff` | Snapshot the load order before a launch, then report what the game dropped, added or reordered (BG3 `modsettings.lsx`). |
 | `read_log` | Tail a mod-related log (redscript, RED4ext, CET, SKSE, BG3SE, BepInEx, SMAPI and more). |
-| `triage_logs` | Read every mod log for the current run and classify lines against known failure signatures. It returns one verdict: which systems loaded, what failed first, and the usual fix. |
+| `triage_logs` | Read every mod log for the current run and classify lines against known failure signatures. It returns one verdict: which systems loaded, what failed first, and the usual fix. Where a framework's log names who acted (TweakXL's read order, ArchiveXL's merges), it also says which mod did what; `attributionFor` narrows that to one asset, record or mod. |
 | `check_compat` | Detect the game build, loaders, frameworks and tools, and check them against cited compatibility floors. |
-| `check_toolchain` | Locate the external tools (LSLib divine, WolvenKit CLI, Blender, Cpp2IL and others), report each one's path and version (never guessed), and say what each feature needs. It also remembers a tool or data folder you point it at, and installs the tools ModWright can install. |
+| `check_toolchain` | Locate the external tools (LSLib divine, WolvenKit CLI, Blender, Cpp2IL and others), report each one's path and version (never guessed), and say what each feature needs. It also remembers a tool or data folder you point it at, installs the tools ModWright can install, and trusts a project to run its own build commands. |
 | `project_info` | Load a `modwright.json` mod project: sources, build, deploy targets, dependencies and publish targets, with paths resolved and structural warnings. |
 | `lookup` | Search the knowledge base of game and toolchain facts (each with a status and a source), the validator catalogue, or the game's vanilla index you built locally. |
 | `build_index` | Extract and index the game's own data into a local SQLite file in ModWright's cache. Never redistributed. |
@@ -114,6 +164,23 @@ Epic paths where they apply. Override with `installPath` on any tool, or set
 Every tool that writes is **dry-run by default**: it describes the plan and
 writes nothing until you apply it.
 
+## How much to trust an answer
+
+Every fact `lookup` returns carries a status and a source:
+
+| Status | Means |
+|---|---|
+| `verified` | Someone observed it in the game; the fact says when. |
+| `community` | A wiki, README, issue or forum post states it, cited by URL, and it has not been re-checked here. |
+| `inferred` | Derived from reading code or from other facts. |
+| `unverified` | Written from documentation or reasoning, and never observed. |
+| `contradicted` | Once believed and later shown wrong. It is kept, pointing at what replaced it, so the mistake is not made again. |
+
+A validator that cannot run is reported as **skipped**, with the reason,
+never as passed. That happens when the vanilla index is not built, a tool is
+missing, or the project has nothing of the kind it checks. An in-game test
+whose probe is `unverified` can pass, but its result stays below `verified`.
+
 ## Workflow prompts
 
 Seven workflow prompts walk the authoring loop in any MCP client
@@ -173,6 +240,12 @@ project:
   `check_toolchain action=install tool=cpp2il` shows exactly what it would
   fetch (URL, size, sha256, destination); `mode=apply` installs it. Downloads
   are pinned and checked before anything is written.
+- **Trusted projects** are listed in `trusted-projects.json`, beside that
+  config. A project's `exec` build steps and `toolchain` overrides run only
+  after you trust it once: `check_toolchain action=trust projectPath=<mod>`
+  lists what it would allow, and `mode=apply` records it. Until then an
+  applied build, convert, template extract or index build that would run
+  them is refused. `MODWRIGHT_TRUST_ALL=1` trusts every project, for CI.
 - **Overrides:** `MODWRIGHT_CACHE_DIR` moves the cache; `MODWRIGHT_HOME`
   moves everything.
 - **Project state** stays in the project's own `.modwright/`.
@@ -205,6 +278,41 @@ produce confident nonsense:
 - **Redistributing game data.** Indexes and templates are built from your
   own install, on your machine, and never shipped.
 
+## Security
+
+ModWright runs programs on your machine and writes into your game folders.
+What it runs, and where it writes:
+
+- **Tools it finds.** It runs the external tools it locates (LSLib divine,
+  WolvenKit CLI, Blender and the others `check_toolchain` lists). They come
+  from a `MODWRIGHT_TOOL_*` variable, your per-user config, its own managed
+  installs, PATH or common install locations. Managed installs are pinned
+  and their sha256 is checked before anything is written.
+- **A project's own commands.** A mod project's `exec` build steps and its
+  `toolchain` overrides are programs the project's author chose. They run
+  only after you trust that project on this machine:
+  `check_toolchain action=trust projectPath=<mod>` lists what it would allow,
+  and `mode=apply` records it. Read the project's `modwright.json` first,
+  above all for a mod you cloned from someone else. Trust belongs to the
+  folder, not to the file's content, so a trusted project that later gains
+  a step (after a `git pull`) is not asked again.
+- **Where it writes.** Every writer is dry-run until you apply it, and it
+  backs up what it replaces. A build writes under the project's
+  `build.outDir`, and a deploy writes under the game's mod roots. A project
+  path that is absolute or climbs out with `..` is refused unless that entry
+  sets `"allowOutsideRoot": true`. `rollback` restores only under the
+  project and the game's mod roots, unless you pass `allowOutsideRoots`.
+- **The in-game bridges.** While a verification bridge is deployed and the
+  game runs, anything that can write the bridge's request folder can run Lua
+  in the game. There is no token. Deploy a bridge only while you verify,
+  remove it afterwards, and never ship it (the release validators block a
+  build that contains it). The bridge READMEs under `bridges/` describe each
+  one's trust model.
+
+To report a security problem, use **Report a vulnerability** on
+[modwright-community's Security tab](https://github.com/jtrachtenberg/modwright-community/security),
+not a public issue.
+
 ## Reporting a problem
 
 Bug reports, game and feature requests and questions go to

package/bridges/bg3-se/README.md

@@ -82,6 +82,21 @@ No Lua parser is vendored. Syntax is checked with `luac -p` under Lua 5.1 and
 dispatch-table keys equal the catalogue's probe ids, that the `PROTOCOL_VERSION` literals
 agree, that `bridge.json` lists every shipped file, and that every `.lua` carries the banner.
 
+## Trust model
+
+While this bridge is deployed and the game is running, anything that can write a file into
+its request folder (`%LOCALAPPDATA%\Larian Studios\Baldur's Gate 3\Script Extender`) can run
+Lua inside the game. A request names its own probes and its own grants, and `bg3.lua.eval`
+runs whatever code a request carries once the request grants the `session` tier. There is no
+token. The nonce and the request's `armedUntil` expiry only stop a consumed or stale request
+from running again; they do not say who wrote it. So:
+
+- deploy the bridge only to a machine and a profile you control, and only while you are
+  verifying a mod;
+- remove `Mods/ModWrightBridge` from the profile when you are done, before playing normally
+  or sharing the profile;
+- never ship it. `bg3.history.bridge-never-ships` blocks a release build that contains it.
+
 ## What this bridge never does
 
 - No Osiris **action**, ever, and no forced cast: `Osi.UseSpell` was observed to re-cast,

package/bridges/cp2077-cet/ModWrightBridge/probes.lua

@@ -39,6 +39,9 @@
 --                                                   (verified, 2.31, observed in game 2026-08-16)
 --   TweakDB:GetRecord / TweakDB:GetFlat             observed in the CET console on
 --                                                   2026-09-08 (see the rows below).
+--   obj:GetNPCsAroundObject(radius)                 the game's RTTI dump (rayshader/cp2077-nativedb,
+--   obj:GetEntitiesAroundObject(radius, filter)     gameObject methods); no CET mod or wiki page calls
+--   TSF_Or / TSF_Any / Enum.new                     them — `unverified`; CET's source pins the Lua side
 --
 -- MUTATION. Two rows have effect `mutate`: `cp2077.inventory.add`, and `cp2077.lua.eval`
 -- (added 2026-09-11). They are the two handlers in this
@@ -816,6 +819,116 @@ Probes.handlers = {
         end,
     },
 
+    -- World-placed object verification — **unverified**, written 2026-09-10 with no game on
+    -- hand and never run in game. `gameObject` (parent `entGameEntity`) carries
+    -- `GetNPCsAroundObject(range: Float) -> array<ref<NPCPuppet>>` and
+    -- `GetEntitiesAroundObject(range: Float, searchFilter: gameTargetSearchFilter) -> array<ref<entEntity>>`
+    -- in the shipped game's own RTTI (rayshader/cp2077-nativedb at b5d29af, game 2.31), so both
+    -- exist — stronger evidence than "nothing on disk", which is why this row exists instead of
+    -- sitting out like `cp2077.loot.roll`. Neither a shipped CET mod nor a wiki page calls either
+    -- one from Lua, but CET's own source (yamashi/CyberEngineTweaks 9a8522f; knowledge facts
+    -- cp2077.cet.*) settles the calling convention:
+    --   * the TSF_* filter constructors are exposed as bare globals, `Game.TSF_X` and
+    --     `Game["TSF_X;"]`; a returned struct is a ClassReference copy that passes straight back
+    --     as a struct parameter (no layout is ever guessed);
+    --   * an enum parameter accepts a number, a member name or `Enum.new(type, name)`, but an
+    --     UNDECLARED value is coerced to 0 silently — so no ORed masks; declared members only,
+    --     combined with TSF_Or, and `Enum.new` with the full type name so a mistake is loud;
+    --   * an array return is a 1-based table whose null handles are nil holes — count with
+    --     pairs, never `#`.
+    -- Two shapes, chosen by `params.filter`:
+    --   "npc" (default): `GetNPCsAroundObject(radius)`, one scalar argument, the same risk class
+    --     as `ent:GetWorldPosition()` and `GetTaggedIDs(tag)` above.
+    --   "objects": `GetEntitiesAroundObject(radius, TSF_Or(TSF_Any(Obj_Device), TSF_Any(Obj_Other),
+    --     TSF_Any(Obj_Puppet), TSF_Any(Obj_Sensor)))` — the call that could verify a placed static
+    --     prop (a loot-container template carrying a gameTargetingComponent is plausibly in the
+    --     targeting set). TSF_Any/TSF_Or semantics and whether the prop is in the set are exactly
+    --     what a live run observes; every step is pcall-wrapped and reported, never swallowed.
+    -- The anchor defaults to the player; `params.tag`/`params.entityRef` pick another, exactly as
+    -- `resolveEntity` does for the rows above.
+    ["cp2077.entity.nearby"] = {
+        attestation = "unverified (RTTI dump confirms gameObject::GetNPCsAroundObject/GetEntitiesAroundObject exist; CET source pins the Lua calling convention; no live call observed yet)",
+        citation = "rayshader/cp2077-nativedb classes.json at b5d29af (gameObject::GetNPCsAroundObject;Float, GetEntitiesAroundObject;FloatTargetSearchFilter); " ..
+            "yamashi/CyberEngineTweaks 9a8522f (RTTI binding)",
+        effect = "read",
+        run = function(probe)
+            local p = params(probe)
+            local radius = tonumber(p.radius)
+            if radius == nil or radius <= 0 then return errored("params.radius is required and must be a positive number") end
+            local filter = p.filter == nil and "npc" or tostring(p.filter)
+            if filter ~= "npc" and filter ~= "objects" then
+                return errored("params.filter must be \"npc\" (default) or \"objects\", got " .. tostring(p.filter))
+            end
+
+            local anchorParams = p
+            if p.tag == nil and p.entityRef == nil then anchorParams = { entityRef = "$player" } end
+            local ent, describe, e = resolveEntity(anchorParams)
+            if ent == nil then return errored(e or "could not resolve an anchor entity", { resolve = describe }) end
+
+            local evidence = { resolve = describe, radius = radius, filter = filter }
+
+            local list
+            if filter == "npc" then
+                evidence.attemptedCall = "GetNPCsAroundObject(radius) — NPCs only; a static prop like a placed item does not " ..
+                    "show up here even when it does exist"
+                local okCall, callErr = pcall(function() list = ent:GetNPCsAroundObject(radius) end)
+                if not okCall then
+                    return errored("obj:GetNPCsAroundObject(" .. tostring(radius) .. ") raised an error (recorded rather " ..
+                        "than swallowed, since this row is unverified): " .. tostring(callErr), evidence)
+                end
+            else
+                evidence.attemptedCall = "GetEntitiesAroundObject(radius, TSF_Or(TSF_Any(Obj_Device), TSF_Any(Obj_Other), " ..
+                    "TSF_Any(Obj_Puppet), TSF_Any(Obj_Sensor))) — each member via Enum.new so a wrong name is an error, " ..
+                    "never a silent 0"
+                local searchFilter
+                local okFilter, filterErr = pcall(function()
+                    local function member(name) return Enum.new("gametargetingSystemSearchFilterMaskValue", name) end
+                    searchFilter = TSF_Or(TSF_Any(member("Obj_Device")), TSF_Any(member("Obj_Other")),
+                        TSF_Any(member("Obj_Puppet")), TSF_Any(member("Obj_Sensor")))
+                end)
+                if not okFilter or searchFilter == nil then
+                    return errored("building the gameTargetSearchFilter raised an error or returned nil (TSF_*/Enum.new " ..
+                        "exposure is what this settles): " .. tostring(filterErr), evidence)
+                end
+                local okCall, callErr = pcall(function() list = ent:GetEntitiesAroundObject(radius, searchFilter) end)
+                if not okCall then
+                    return errored("obj:GetEntitiesAroundObject(" .. tostring(radius) .. ", filter) raised an error (recorded " ..
+                        "rather than swallowed, since this row is unverified): " .. tostring(callErr), evidence)
+                end
+            end
+            if list == nil then
+                return errored(evidence.attemptedCall:match("^[%w]+") .. " returned nil — the RTTI method exists but this " ..
+                    "call did not resolve here; a live run is needed to say why", evidence)
+            end
+            if type(list) ~= "table" then
+                return errored("expected a table from the array return, got " .. type(list), evidence)
+            end
+
+            -- CET returns an array as a 1-based table, but a null handle inside it becomes a nil
+            -- hole, so `#` and ipairs can stop early: walk with pairs and count what is there.
+            local count, holes = 0, 0
+            local out = Protocol.array({})
+            local slots = 0
+            for k, _ in pairs(list) do if type(k) == "number" and k > slots then slots = k end end
+            for i = 1, slots do
+                local other = list[i]
+                if other == nil then
+                    holes = holes + 1
+                else
+                    count = count + 1
+                    local okName, name = pcall(function() return other:GetClassName() end)
+                    local entry = { className = (okName and name ~= nil) and tostring(name) or nil }
+                    local okApp, app = pcall(function() return other:GetCurrentAppearanceName() end)
+                    if okApp and app ~= nil then entry.appearance = tostring(app) end
+                    out[#out + 1] = entry
+                end
+            end
+            evidence.entities = out
+            evidence.nilHoles = holes
+            return ok(count, evidence)
+        end,
+    },
+
     -- Row 10. `TweakDB:GetRecord(id)`, not attested by any page or mod on disk, but observed
     -- to work from the CET console (2026-09-08):
     --   print(tostring(TweakDB:GetRecord("Items.Preset_Example")))

package/bridges/cp2077-cet/README.md

@@ -111,7 +111,7 @@ be diagnosed.
 
 Fenced with `-- MODWRIGHT-PROBE-TABLE-BEGIN` / `-- MODWRIGHT-PROBE-TABLE-END` in
 `probes.lua`, so the parity test reads only the table and never an id that appears in a
-comment. Thirteen ids, one per catalogue row, each carrying that row's own status word:
+comment. Fifteen ids, one per catalogue row, each carrying that row's own status word:
 
 | id | Status | If its call is missing |
 |---|---|---|
@@ -120,10 +120,12 @@ comment. Thirteen ids, one per catalogue row, each carrying that row's own statu
 | `cp2077.player.present` | attested(engine) | `error` if `Game` is absent |
 | `cp2077.item.equipped` | attested(engine) | — |
 | `cp2077.inventory.add` | attested(doc), **mutate** | `error`; skipped without `allowMutate` |
+| `cp2077.lua.eval` | **mutate**; runs a request's Lua chunk | skipped without the `session` tier |
 | `cp2077.entity.tagged` | attested(engine) | — |
 | `cp2077.entity.components` | attested(engine) for the call; names unverified | `error` without `params.names` |
 | `cp2077.entity.transform` | attested(engine) for item objects; unverified for a sector prop | says which, in `evidence.attestationForThisCall` |
 | `cp2077.entity.appearance` | unverified (composite) | `skipped` without a baseline |
+| `cp2077.entity.nearby` | unverified — the RTTI methods exist; never run in game | `error` naming the call that raised or returned nil |
 | `cp2077.tweakdb.record` | unverified | `error` |
 | `cp2077.tweakdb.flat` | unverified | `error` |
 | `cp2077.interaction.present` | unverified (the component *name*) | `error` without `params.names` |
@@ -155,6 +157,20 @@ The Lua is kept inside the 5.1-compatible subset shipped CET mods use, and check
 against both dialects — CET embeds a 5.4-era sol2, but nothing on disk pins which dialect
 features are available, so the intersection is the safe target.
 
+## Trust model
+
+While this bridge is deployed and the game is running, anything that can write a file into
+its write root (the folders listed under "The `io` write-root discovery") can run Lua inside
+the game, and so can anything that can type into the CET console. A request names its own
+probes and its own grants, and `cp2077.lua.eval` runs whatever code a request carries once
+the request grants the `session` tier. There is no token. The nonce and the request's expiry
+only stop a consumed or stale request from running again; they do not say who wrote it. So:
+
+- deploy the bridge only to an install you control, and only while you are verifying a mod;
+- remove `bin/x64/plugins/cyber_engine_tweaks/mods/ModWrightBridge` when you are done,
+  before playing normally;
+- never ship it. `cp2077.history.bridge-never-ships` blocks a release build that contains it.
+
 ## What this bridge never does
 
 * It never observes: no CET listener API is attested, so `effect: "observe"` is `unsupported`

package/bridges/cp2077-cet/bridge.json

@@ -43,7 +43,7 @@
     },
     {
       "path": "ModWrightBridge/probes.lua",
-      "sha256": "a9dc28d3fd949f353f17404366bd2bb329813b9ca639e06a9b51aa34c104fb7d"
+      "sha256": "169a31b158edcefda6721c3b90656c59fd9f7d7bf928a96d03ef3645a5eb1991"
     },
     {
       "path": "ModWrightBridge/protocol.lua",

package/dist/core/bridge/pending.js

@@ -51,7 +51,14 @@ export async function readPendingArm(projectRoot, id) {
     catch {
         return undefined;
     }
-    const parsed = pendingArmSchema.safeParse(JSON.parse(raw));
+    let json;
+    try {
+        json = JSON.parse(raw);
+    }
+    catch {
+        return undefined;
+    }
+    const parsed = pendingArmSchema.safeParse(json);
     return parsed.success ? parsed.data : undefined;
 }
 export async function listPendingArms(projectRoot, game, opts) {

package/dist/core/bridge/stage.js

@@ -4,7 +4,7 @@ import * as path from "node:path";
 import { isDirectory, pathExists } from "../fsutil.js";
 import { parseProject } from "../project/schema.js";
 import { PROJECT_FILE } from "../project/types.js";
-import { executePlan, planCopy, planFile, planMkdir } from "../safety/index.js";
+import { executePlan, planCopy, planDelete, planFile, planMkdir } from "../safety/index.js";
 const BRIDGE_DIR_BY_GAME = {
     baldursgate3: "bg3-se",
     cyberpunk2077: "cp2077-cet",
@@ -77,7 +77,7 @@ export async function planStageBridge(projectRoot, game) {
     }
     const to = stagedBridgeDir(projectRoot, game);
     const registration = await planDeployTargetRegistration(projectRoot, game);
-    const operations = [planMkdir(path.dirname(to)), planCopy(from, to)];
+    const operations = [planMkdir(path.dirname(to)), ...(await pathExists(to) ? [planDelete(to)] : []), planCopy(from, to)];
     if (registration.op)
         operations.push(registration.op);
     return {

package/dist/core/build/run.js

@@ -2,7 +2,9 @@ import { promises as fs } from "node:fs";
 import * as path from "node:path";
 import { pathExists, walk } from "../fsutil.js";
 import { normalizeBuildSteps } from "../project/build-steps.js";
+import { outsideRootPaths } from "../project/outside-root.js";
 import { locateTool as coreLocateTool, TOOL_SPECS } from "../toolchain/index.js";
+import { describeNeeds, isProjectTrusted, trustRefusal } from "../trust.js";
 import { buildContext, runValidators } from "../validate/index.js";
 import { runAssertAbsentStep, runAssertPresentStep, runExecStep, runZipStep } from "./steps/core.js";
 import { runBlenderExportStep, runVerifyArchiveListingStep, runWolvenkitImportStep, runWolvenkitPackStep, } from "./steps/cyberpunk.js";
@@ -168,6 +170,18 @@ export async function runBuild(project, surface, options) {
         throw new Error(`--only named no matching step id(s): ${options.only.join(", ")}. Known ids: ${active.map(({ step }) => step.id).filter(Boolean).join(", ") || "(none declared)"}`);
     }
     const skippedVariant = gatedOut.map(stepName);
+    const outside = outsideRootPaths(project.project, selected.map(({ step }) => step)).filter((e) => e.kind === "build-step" && !e.allowed);
+    if (outside.length > 0) {
+        throw new Error(`${project.project.name}: ${outside.map((e) => e.message).join("; ")}. A build writes only under build.outDir and runs only inside the project; ` +
+            `set "allowOutsideRoot": true on the step if this is intended.`);
+    }
+    if (options.mode === "apply") {
+        const exec = selected.flatMap(({ step, stepIndex }) => (step.step === "exec" ? [`"${stepName({ step, stepIndex })}" (${step.command})`] : []));
+        const what = describeNeeds({ toolchain: Object.keys(project.project.toolchain ?? {}), exec });
+        if (what && !(await (options.isTrusted ?? ((root) => isProjectTrusted(root)))(project.root))) {
+            throw new Error(trustRefusal(project.root, what));
+        }
+    }
     const version = options.version ?? project.project.version ?? "0.0.0";
     const stagingDir = project.build.staging
         ? path.resolve(project.root, project.build.staging)

package/dist/core/build/stage.js

@@ -96,12 +96,13 @@ async function planFiles(step, ctx) {
         };
         const isIncluded = (relForMatch) => includeRes.length === 0 || includeRes.some((re) => re.test(relForMatch));
         const add = (abs, relDest) => {
-            const existing = claimed.get(relDest);
+            const key = relDest.toLowerCase();
+            const existing = claimed.get(key);
             if (existing !== undefined && existing !== origin) {
                 throw new BuildStepError(`stage: ${existing} and ${origin} both write "${relDest}" — one would silently overlay the other. ` +
                     `Give one of them its own "into" prefix.`, step.id, step.step);
             }
-            claimed.set(relDest, origin);
+            claimed.set(key, origin);
             files.push({ abs, relDest, origin });
         };
         if (entry.output !== undefined) {

package/dist/core/build/steps/core.js

@@ -3,6 +3,7 @@ import * as path from "node:path";
 import { isDirectory, walk } from "../../fsutil.js";
 import { globToRegExp } from "../../validate/context.js";
 import { runTool } from "../../toolchain/run.js";
+import { DEFAULT_TOOL_TIMEOUT_MS } from "../../toolchain/types.js";
 import { TOOL_SPECS } from "../../toolchain/specs.js";
 import { directoryEntry, pathEntries } from "../manifest.js";
 import { resolveOutDirPath, resolveSourceOrStagePath, resolveStageId } from "../paths.js";
@@ -86,9 +87,8 @@ export async function runZipStep(step, ctx) {
         .sort((a, b) => (a.name < b.name ? -1 : a.name > b.name ? 1 : 0));
     await fs.mkdir(path.dirname(out), { recursive: true });
     await writeZipFile(out, entries.map((entry) => ({ name: entry.name, read: () => fs.readFile(entry.abs) })));
-    const stat = await fs.stat(out);
-    if (stat.size === 0)
-        throw new BuildStepError(`zip: wrote an empty archive: ${out}`, step.id, step.step);
+    if (entries.length === 0)
+        throw new BuildStepError(`zip: nothing to archive under ${from}`, step.id, step.step);
     const outputs = await pathEntries([out]);
     return {
         inputs: [await directoryEntry(from)],
@@ -128,7 +128,7 @@ async function resolveCommandLocation(step, ctx) {
     }
     return { id: "exec", label, found: true, path: resolveSourceOrStagePath(step.command, ctx), usedBy: [] };
 }
-export const EXEC_DEFAULT_TIMEOUT_MS = 30 * 60 * 1000;
+export const EXEC_DEFAULT_TIMEOUT_MS = DEFAULT_TOOL_TIMEOUT_MS;
 export async function runExecStep(step, ctx) {
     const location = await resolveCommandLocation(step, ctx);
     const command = location.path;

package/dist/core/deploy/plan.js

@@ -1,7 +1,8 @@
 import { promises as fs } from "node:fs";
 import * as path from "node:path";
-import { pathExists, walk } from "../fsutil.js";
+import { isDirectory, pathExists, walk } from "../fsutil.js";
 import { globToRegExp, isExcludedByGlobs } from "../validate/index.js";
+import { outsideRootPaths } from "../project/outside-root.js";
 import { findRunningProcesses } from "../process.js";
 import { executePlan, isIdenticalFile, planCopy, planDelete, planJunction, planMkdir, planUnlink, sha256File } from "../safety/index.js";
 import { classifyReload } from "./reload.js";
@@ -158,6 +159,60 @@ export async function planDeploy(inputs) {
             backupRoot,
         };
     }
+    if (inputs.variant !== undefined) {
+        const named = new Set([
+            ...deploy.targets.flatMap((t) => (t.variant ? [t.variant] : [])),
+            ...Object.keys(project.project.build?.variants ?? {}),
+        ]);
+        if (!named.has(inputs.variant)) {
+            const known = [...named].sort();
+            return {
+                blocked: [
+                    {
+                        code: "unknown-variant",
+                        message: `${project.project.name}: variant "${inputs.variant}" is named by no deploy target and no build.variants entry` +
+                            (known.length > 0 ? ` (known: ${known.join(", ")})` : " (this project declares none)") +
+                            "; nothing was deployed rather than silently deploying only the ungated targets.",
+                        detail: { variant: inputs.variant, known },
+                    },
+                ],
+                confidence: { level: "high", assumptions: [], verifiedBy: ["modwright.json"] },
+                targets: [],
+                skipped: [],
+                deferred: [],
+                junctions: [],
+                pruned: [],
+                skippedDestDirs: [],
+                excluded: [],
+                warnings,
+                writtenPaths: [],
+                processCheck: emptyProcessCheck,
+                backupRoot,
+            };
+        }
+    }
+    const outside = outsideRootPaths(project.project).filter((e) => (e.kind === "deploy-target" || e.kind === "junction") && !e.allowed);
+    if (outside.length > 0) {
+        return {
+            blocked: outside.map((e) => ({
+                code: "outside-root",
+                message: `${e.message}; a deploy writes only under the game's mod roots. Set "allowOutsideRoot": true on that entry if this is intended.`,
+                detail: { kind: e.kind, value: e.value },
+            })),
+            confidence: { level: "high", assumptions: [], verifiedBy: ["modwright.json"] },
+            targets: [],
+            skipped: [],
+            deferred: [],
+            junctions: [],
+            pruned: [],
+            skippedDestDirs: [],
+            excluded: [],
+            warnings,
+            writtenPaths: [],
+            processCheck: emptyProcessCheck,
+            backupRoot,
+        };
+    }
     const roots = inputs.roots ?? (inputs.install ? surface.modRoots(inputs.install) : undefined);
     if (!roots) {
         return {
@@ -202,6 +257,7 @@ export async function planDeploy(inputs) {
         }
         if (target.mode && target.mode !== deployMode) {
             skipped.push({ rootId: target.rootId, from: target.from, reason: `target is mode "${target.mode}", this deploy is mode "${deployMode}"` });
+            variantExcludedTargets.add(target);
             const skippedRoot = roots.find((r) => r.id === target.rootId);
             if (skippedRoot && (target.locked ?? defaultLocked(target.rootId))) {
                 notDeployedLocked.push({ target, rootPath: skippedRoot.path });
@@ -365,7 +421,18 @@ export async function planDeploy(inputs) {
             }
         }
         else {
+            const fold = (p) => (process.platform === "win32" ? path.resolve(p).toLowerCase() : path.resolve(p));
             for (const j of junctions) {
+                if (!(await isDirectory(j.target))) {
+                    blocked.push({
+                        code: "junction-target-missing",
+                        message: `deploy.junctions: ${j.linkPath} would point at ${j.target}, which is not a directory. Build or create it first, or fix the junction's target.`,
+                        detail: { linkPath: j.linkPath, target: j.target },
+                    });
+                    continue;
+                }
+                if (j.before === "link" && j.linkTargetBefore !== undefined && fold(j.linkTargetBefore) === fold(j.target))
+                    continue;
                 if (j.before === "directory" || j.before === "file") {
                     warnings.push(`${j.linkPath} is a real ${j.before}, not a link. It will be backed up and replaced by a link to ${j.target}.`);
                 }

package/dist/core/deploy/reload.js

@@ -331,9 +331,11 @@ export function classifyReload(surfaceId, project, writtenPaths, options = {}) {
         .map((c) => RANK[c.action]);
     if (unclassified.length > 0)
         ranked.push(RANK.restart);
-    const overall = ranked.length === 0
-        ? "unknown"
-        : Object.keys(RANK).find((a) => RANK[a] === Math.max(...ranked));
+    const overall = writtenPaths.length === 0
+        ? "none"
+        : ranked.length === 0
+            ? "unknown"
+            : Object.keys(RANK).find((a) => RANK[a] === Math.max(...ranked));
     const notes = [];
     if (writtenPaths.length === 0) {
         notes.push("nothing was written, so there is nothing to reload");

package/dist/core/ini.js

@@ -0,0 +1,26 @@
+export function parseIni(text) {
+    const out = new Map();
+    let section = "";
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith(";") || line.startsWith("#"))
+            continue;
+        const sec = /^\[(.+)\]$/.exec(line);
+        if (sec) {
+            section = sec[1].trim().toLowerCase();
+            continue;
+        }
+        const eq = line.indexOf("=");
+        if (eq < 0)
+            continue;
+        const key = line.slice(0, eq).trim().toLowerCase();
+        let value = line.slice(eq + 1).trim();
+        const wrapped = /^@ByteArray\((.*)\)$/.exec(value);
+        if (wrapped)
+            value = wrapped[1];
+        if (!out.has(section))
+            out.set(section, new Map());
+        out.get(section).set(key, value);
+    }
+    return out;
+}