modwright 0.1.2 → 0.1.4

package/README.md

@@ -64,6 +64,43 @@ without tcli." Most features need nothing. ModWright can install some
 external tools itself, and any other tool or data folder only has to be
 pointed at once.
 
+## Which mod is doing this?
+
+With hundreds of mods installed, the usual question is not "is something
+broken" but "which mod did it". Three tools answer it from different sides,
+without launching the game:
+
+- **`owner_of`**: which mod a file comes from. Give it a DLL named in a
+  crash log, a path from `triage_logs`, or a bare file name. It answers
+  from the game's own mod folders, Vortex's deployment records and Mod
+  Organizer 2's profiles (Skyrim), and says how it decided. For example,
+  `owner_of game=cyberpunk2077 paths=["TweakXL.dll"]` names the Vortex mod
+  that deployed it.
+- **`who_touches`**: which mods write the same record or entry: Cyberpunk
+  2077 TweakDB records and flats, Baldur's Gate 3 stats entries, Stardew
+  Valley Content Patcher assets and entries. With no `key` it lists the
+  keys mods actually disagree on, for example
+  `who_touches game=cyberpunk2077`. These don't count as a disagreement:
+  - identical writes;
+  - list edits on different items;
+  - a mod the game does not load (a BG3 pak missing from
+    `modsettings.lsx`);
+  - a second copy of the same mod.
+
+  Copies of one mod are reported separately, under `duplicateCopies`.
+  `who_touches key=<record>` shows every writer of one key, and `mod=<name>`
+  shows what one mod writes.
+- **`triage_logs`** with `attributionFor`: what the frameworks' own logs say
+  happened. For example, TweakXL's log gives the order it read tweak files
+  in, and a later file wins the same flat.
+
+Together they catch the quiet problems, for example a tweak file installed
+twice and loaded twice, or a stale copy of a mod that the game binds instead
+of the current one. `who_touches` reads files, not the running game, so
+scripts that change things at runtime are not seen. Which of two
+disagreeing mods wins depends on load order, which these tools report but
+do not decide.
+
 ## Supported games
 
 | Surface | Game | Tested | Mod systems modeled |
@@ -99,11 +136,13 @@ Epic paths where they apply. Override with `installPath` on any tool, or set
 | `detect_install` | Locate one game, and report every mod root and log source, marking which exist. |
 | `list_mods` | Enumerate installed mods across all roots, with sizes, timestamps and parsed manifests. |
 | `inspect_mod` | Full detail on one mod: files owned, manifest, warnings. |
-| `find_conflicts` | Paths claimed by more than one mod, restricted to roots where that is actually possible. |
+| `find_conflicts` | Paths claimed by more than one mod, restricted to roots where that is actually possible. Where Mod Organizer 2 manages the game, it also reports the files one MO2 mod overrides in another. |
+| `owner_of` | Which installed mod a file comes from, and which copy the game sees when several provide it: for a DLL named in a crash log, a path from `triage_logs`, or a bare file name. It reads the game's own mod folders, Mod Organizer 2's profiles (Skyrim) and Vortex's deployment records, and says how each answer was decided. |
+| `who_touches` | Which installed mods write a given record or entry, at the level the game merges on: Cyberpunk 2077 TweakDB records and flats, Baldur's Gate 3 stats entries (read out of paks), Stardew Valley Content Patcher assets and entries. With no key it lists the contested ones. A mod the game does not load is listed but never contests, and copies of one mod count once. Static: it does not decide load order, and runtime scripts are not seen. |
 | `load_order` | Read the game's explicit load order and cross-check it against what is installed. |
 | `load_order_diff` | Snapshot the load order before a launch, then report what the game dropped, added or reordered (BG3 `modsettings.lsx`). |
 | `read_log` | Tail a mod-related log (redscript, RED4ext, CET, SKSE, BG3SE, BepInEx, SMAPI and more). |
-| `triage_logs` | Read every mod log for the current run and classify lines against known failure signatures. It returns one verdict: which systems loaded, what failed first, and the usual fix. |
+| `triage_logs` | Read every mod log for the current run and classify lines against known failure signatures. It returns one verdict: which systems loaded, what failed first, and the usual fix. Where a framework's log names who acted (TweakXL's read order, ArchiveXL's merges), it also says which mod did what; `attributionFor` narrows that to one asset, record or mod. |
 | `check_compat` | Detect the game build, loaders, frameworks and tools, and check them against cited compatibility floors. |
 | `check_toolchain` | Locate the external tools (LSLib divine, WolvenKit CLI, Blender, Cpp2IL and others), report each one's path and version (never guessed), and say what each feature needs. It also remembers a tool or data folder you point it at, installs the tools ModWright can install, and trusts a project to run its own build commands. |
 | `project_info` | Load a `modwright.json` mod project: sources, build, deploy targets, dependencies and publish targets, with paths resolved and structural warnings. |
@@ -114,7 +153,7 @@ Epic paths where they apply. Override with `installPath` on any tool, or set
 | `deploy` | Copy a built mod into the game's mod roots as one write plan. It refuses an artifact the build did not produce or one older than its sources, prunes what a previous build left behind, and defers a file the running game holds locked. Every overwrite and delete is backed up first. |
 | `rollback` | List the deploy backups under a project's `.modwright/backups/`, or restore one, re-checking every file's hash first. |
 | `reload_plan` | Classify deployed changes into hot / hot-degraded / save-reload / restart / unknown, with the caveat for each and the single most conservative recommendation. |
-| `bridge` | The in-game bridge (BG3 Script Extender, Cyberpunk 2077 CET): `stage` the bridge into a project, check its heartbeat with `status`, `arm` a probe request and `poll` for its result. |
+| `bridge` | The in-game bridge (BG3 Script Extender, Cyberpunk 2077 CET): `stage` the bridge into a project, check its heartbeat with `status`, `arm` a probe request and `poll` for its result, and `remove` it from the game when you are done. |
 | `run_tests` | Run a mod's in-game test plan (`<mod>/tests/*.yaml`) through the bridge. Probe rows are armed and polled; manual rows become a checklist. Results are written back into the plan. |
 | `ledger` | Track claims and decisions across a fix (`<mod>/ledger/`). A claim moves `authored → checker-clean → built → verified \| contradicted`, and nothing is verified without evidence. |
 | `convert` | Run one registered conversion: BG3 lsx↔lsf and xml↔loca through divine, Cyberpunk cr2w↔json through WolvenKit CLI. Each one checks its own round trip. |
@@ -266,7 +305,7 @@ What it runs, and where it writes:
 - **The in-game bridges.** While a verification bridge is deployed and the
   game runs, anything that can write the bridge's request folder can run Lua
   in the game. There is no token. Deploy a bridge only while you verify,
-  remove it afterwards, and never ship it (the release validators block a
+  remove it afterwards (`bridge action=remove`), and never ship it (the release validators block a
   build that contains it). The bridge READMEs under `bridges/` describe each
   one's trust model.
 

package/bridges/bg3-se/README.md

@@ -93,8 +93,9 @@ from running again; they do not say who wrote it. So:
 
 - deploy the bridge only to a machine and a profile you control, and only while you are
   verifying a mod;
-- remove `Mods/ModWrightBridge` from the profile when you are done, before playing normally
-  or sharing the profile;
+- remove it when you are done, before playing normally or sharing the profile:
+  `bridge action=remove path=<project> mode=apply` deletes every folder the project's
+  `withBridge` targets deployed, with a backup (a dry run first shows which);
 - never ship it. `bg3.history.bridge-never-ships` blocks a release build that contains it.
 
 ## What this bridge never does

package/bridges/bg3-se/bridge.json

@@ -17,7 +17,7 @@
     "prune": [
       "ModWrightBridge/**"
     ],
-    "note": "The deploy target a shipped SE mod uses, verbatim: `bridge stage` adds it to the project's deploy targets when no target already names this rootId, into and variant, so a fresh project deploys the bridge without a hand edit. A deploy WITHOUT `--variant withBridge` prunes the folder back out, with backup."
+    "note": "The deploy target a shipped SE mod uses, verbatim: `bridge stage` adds it to the project's deploy targets when no target already names this rootId, into and variant, so a fresh project deploys the bridge without a hand edit. A deploy without `--variant withBridge` leaves an installed bridge where it is: a variant's prune runs only in a deploy that writes that variant. Take it out with `bridge action=remove path=<project> mode=apply` when you are done verifying (dry-run first; backed up)."
   },
   "sha256": {
     "algorithm": "sha256",

package/bridges/cp2077-cet/ModWrightBridge/probes.lua

@@ -39,6 +39,9 @@
 --                                                   (verified, 2.31, observed in game 2026-08-16)
 --   TweakDB:GetRecord / TweakDB:GetFlat             observed in the CET console on
 --                                                   2026-09-08 (see the rows below).
+--   obj:GetNPCsAroundObject(radius)                 the game's RTTI dump (rayshader/cp2077-nativedb,
+--   obj:GetEntitiesAroundObject(radius, filter)     gameObject methods); no CET mod or wiki page calls
+--   TSF_Or / TSF_Any / Enum.new                     them — `unverified`; CET's source pins the Lua side
 --
 -- MUTATION. Two rows have effect `mutate`: `cp2077.inventory.add`, and `cp2077.lua.eval`
 -- (added 2026-09-11). They are the two handlers in this
@@ -816,6 +819,116 @@ Probes.handlers = {
         end,
     },
 
+    -- World-placed object verification — **unverified**, written 2026-09-10 with no game on
+    -- hand and never run in game. `gameObject` (parent `entGameEntity`) carries
+    -- `GetNPCsAroundObject(range: Float) -> array<ref<NPCPuppet>>` and
+    -- `GetEntitiesAroundObject(range: Float, searchFilter: gameTargetSearchFilter) -> array<ref<entEntity>>`
+    -- in the shipped game's own RTTI (rayshader/cp2077-nativedb at b5d29af, game 2.31), so both
+    -- exist — stronger evidence than "nothing on disk", which is why this row exists instead of
+    -- sitting out like `cp2077.loot.roll`. Neither a shipped CET mod nor a wiki page calls either
+    -- one from Lua, but CET's own source (yamashi/CyberEngineTweaks 9a8522f; knowledge facts
+    -- cp2077.cet.*) settles the calling convention:
+    --   * the TSF_* filter constructors are exposed as bare globals, `Game.TSF_X` and
+    --     `Game["TSF_X;"]`; a returned struct is a ClassReference copy that passes straight back
+    --     as a struct parameter (no layout is ever guessed);
+    --   * an enum parameter accepts a number, a member name or `Enum.new(type, name)`, but an
+    --     UNDECLARED value is coerced to 0 silently — so no ORed masks; declared members only,
+    --     combined with TSF_Or, and `Enum.new` with the full type name so a mistake is loud;
+    --   * an array return is a 1-based table whose null handles are nil holes — count with
+    --     pairs, never `#`.
+    -- Two shapes, chosen by `params.filter`:
+    --   "npc" (default): `GetNPCsAroundObject(radius)`, one scalar argument, the same risk class
+    --     as `ent:GetWorldPosition()` and `GetTaggedIDs(tag)` above.
+    --   "objects": `GetEntitiesAroundObject(radius, TSF_Or(TSF_Any(Obj_Device), TSF_Any(Obj_Other),
+    --     TSF_Any(Obj_Puppet), TSF_Any(Obj_Sensor)))` — the call that could verify a placed static
+    --     prop (a loot-container template carrying a gameTargetingComponent is plausibly in the
+    --     targeting set). TSF_Any/TSF_Or semantics and whether the prop is in the set are exactly
+    --     what a live run observes; every step is pcall-wrapped and reported, never swallowed.
+    -- The anchor defaults to the player; `params.tag`/`params.entityRef` pick another, exactly as
+    -- `resolveEntity` does for the rows above.
+    ["cp2077.entity.nearby"] = {
+        attestation = "unverified (RTTI dump confirms gameObject::GetNPCsAroundObject/GetEntitiesAroundObject exist; CET source pins the Lua calling convention; no live call observed yet)",
+        citation = "rayshader/cp2077-nativedb classes.json at b5d29af (gameObject::GetNPCsAroundObject;Float, GetEntitiesAroundObject;FloatTargetSearchFilter); " ..
+            "yamashi/CyberEngineTweaks 9a8522f (RTTI binding)",
+        effect = "read",
+        run = function(probe)
+            local p = params(probe)
+            local radius = tonumber(p.radius)
+            if radius == nil or radius <= 0 then return errored("params.radius is required and must be a positive number") end
+            local filter = p.filter == nil and "npc" or tostring(p.filter)
+            if filter ~= "npc" and filter ~= "objects" then
+                return errored("params.filter must be \"npc\" (default) or \"objects\", got " .. tostring(p.filter))
+            end
+
+            local anchorParams = p
+            if p.tag == nil and p.entityRef == nil then anchorParams = { entityRef = "$player" } end
+            local ent, describe, e = resolveEntity(anchorParams)
+            if ent == nil then return errored(e or "could not resolve an anchor entity", { resolve = describe }) end
+
+            local evidence = { resolve = describe, radius = radius, filter = filter }
+
+            local list
+            if filter == "npc" then
+                evidence.attemptedCall = "GetNPCsAroundObject(radius) — NPCs only; a static prop like a placed item does not " ..
+                    "show up here even when it does exist"
+                local okCall, callErr = pcall(function() list = ent:GetNPCsAroundObject(radius) end)
+                if not okCall then
+                    return errored("obj:GetNPCsAroundObject(" .. tostring(radius) .. ") raised an error (recorded rather " ..
+                        "than swallowed, since this row is unverified): " .. tostring(callErr), evidence)
+                end
+            else
+                evidence.attemptedCall = "GetEntitiesAroundObject(radius, TSF_Or(TSF_Any(Obj_Device), TSF_Any(Obj_Other), " ..
+                    "TSF_Any(Obj_Puppet), TSF_Any(Obj_Sensor))) — each member via Enum.new so a wrong name is an error, " ..
+                    "never a silent 0"
+                local searchFilter
+                local okFilter, filterErr = pcall(function()
+                    local function member(name) return Enum.new("gametargetingSystemSearchFilterMaskValue", name) end
+                    searchFilter = TSF_Or(TSF_Any(member("Obj_Device")), TSF_Any(member("Obj_Other")),
+                        TSF_Any(member("Obj_Puppet")), TSF_Any(member("Obj_Sensor")))
+                end)
+                if not okFilter or searchFilter == nil then
+                    return errored("building the gameTargetSearchFilter raised an error or returned nil (TSF_*/Enum.new " ..
+                        "exposure is what this settles): " .. tostring(filterErr), evidence)
+                end
+                local okCall, callErr = pcall(function() list = ent:GetEntitiesAroundObject(radius, searchFilter) end)
+                if not okCall then
+                    return errored("obj:GetEntitiesAroundObject(" .. tostring(radius) .. ", filter) raised an error (recorded " ..
+                        "rather than swallowed, since this row is unverified): " .. tostring(callErr), evidence)
+                end
+            end
+            if list == nil then
+                return errored(evidence.attemptedCall:match("^[%w]+") .. " returned nil — the RTTI method exists but this " ..
+                    "call did not resolve here; a live run is needed to say why", evidence)
+            end
+            if type(list) ~= "table" then
+                return errored("expected a table from the array return, got " .. type(list), evidence)
+            end
+
+            -- CET returns an array as a 1-based table, but a null handle inside it becomes a nil
+            -- hole, so `#` and ipairs can stop early: walk with pairs and count what is there.
+            local count, holes = 0, 0
+            local out = Protocol.array({})
+            local slots = 0
+            for k, _ in pairs(list) do if type(k) == "number" and k > slots then slots = k end end
+            for i = 1, slots do
+                local other = list[i]
+                if other == nil then
+                    holes = holes + 1
+                else
+                    count = count + 1
+                    local okName, name = pcall(function() return other:GetClassName() end)
+                    local entry = { className = (okName and name ~= nil) and tostring(name) or nil }
+                    local okApp, app = pcall(function() return other:GetCurrentAppearanceName() end)
+                    if okApp and app ~= nil then entry.appearance = tostring(app) end
+                    out[#out + 1] = entry
+                end
+            end
+            evidence.entities = out
+            evidence.nilHoles = holes
+            return ok(count, evidence)
+        end,
+    },
+
     -- Row 10. `TweakDB:GetRecord(id)`, not attested by any page or mod on disk, but observed
     -- to work from the CET console (2026-09-08):
     --   print(tostring(TweakDB:GetRecord("Items.Preset_Example")))
@@ -935,6 +1048,114 @@ Probes.handlers = {
             }
         end,
     },
+    -- Workbench probes: session-tier mutations that put the world into a testable state, so
+    -- a common setup is a catalogue row rather than hand-written Lua each time. Listed in
+    -- Probes.MUTATING_KINDS below and gated on the `session` tier like the other mutating rows.
+
+    -- attested 2026-10-04: this row ran live and the entity appeared. The call:
+    --   exEntitySpawner.Spawn('base\characters\entities\gang\gang__wraith_ma.ent',
+    --                         Game.GetPlayer():GetWorldTransform(), '')
+    -- returned a userdata handle, and Game.FindEntityByID(handle) resolved the entity.
+    -- Despawn takes the RESOLVED object, not the handle, and the handle does not persist across
+    -- bridge calls, so a despawn belongs in the same cp2077.lua.eval as its spawn.
+    ["cp2077.world.spawn"] = {
+        attestation = "attested 2026-10-04 (ran live; the entity appeared)",
+        citation = "exEntitySpawner.Spawn(entPath, GetPlayer():GetWorldTransform(), appearance), a CET-added native (RTTIExtender.cpp)",
+        effect = "mutate",
+        mutates = true,
+        run = function(probe)
+            local p = params(probe)
+            if p.entPath == nil then
+                return errored("params.entPath is required, e.g. \"base\\characters\\entities\\gang\\gang__wraith_ma.ent\"")
+            end
+            local entPath = tostring(p.entPath)
+            local appearance = p.appearance ~= nil and tostring(p.appearance) or ""
+            if not have("Game") then return absent("the `Game` global", "design §8 step 4") end
+            local pl = player()
+            if pl == nil then return failed("Game.GetPlayer() returned nil — load a save first", nil, { entPath = entPath }) end
+
+            local spawner
+            local okG = pcall(function() spawner = exEntitySpawner end)
+            if not okG or spawner == nil then
+                return missingAttested("`exEntitySpawner`", "exEntitySpawner.Spawn", { entPath = entPath })
+            end
+
+            local transform
+            local okT, e = pcall(function() transform = pl:GetWorldTransform() end)
+            if not okT then return errored("GetPlayer():GetWorldTransform() raised: " .. tostring(e), { entPath = entPath }) end
+
+            local handle
+            local okS, e2 = pcall(function() handle = exEntitySpawner.Spawn(entPath, transform, appearance) end)
+            local evidence = {
+                entPath = entPath,
+                appearance = appearance,
+                spawnedAtPlayerTransform = true,
+                note = "spawned at the player's own transform: the player is inside the entity until they separate. " ..
+                    "The entity arrives after this call returns, so `resolved` is normally false here. " ..
+                    "The id handle does not persist across bridge calls; despawn within one eval (cp2077.lua.eval) or re-find the entity.",
+            }
+            if not okS then return errored("exEntitySpawner.Spawn raised: " .. tostring(e2), evidence) end
+            evidence.handle = handle ~= nil and tostring(handle) or nil
+            if handle == nil then return failed("exEntitySpawner.Spawn returned nil for \"" .. entPath .. "\"", nil, evidence) end
+            local ent
+            pcall(function() ent = Game.FindEntityByID(handle) end)
+            evidence.resolved = ent ~= nil
+            return ok(tostring(handle), evidence)
+        end,
+    },
+
+    -- attested 2026-10-04: a teleport to x+4 moved the player by exactly that.
+    --   Game.GetTeleportationFacility():Teleport(GetPlayer(), Vector4, EulerAngles)
+    ["cp2077.player.teleport"] = {
+        attestation = "attested 2026-10-04 (ran live, read back)",
+        citation = "Game.GetTeleportationFacility():Teleport(player, Vector4, EulerAngles), from the CET wiki",
+        effect = "mutate",
+        mutates = true,
+        run = function(probe)
+            local p = params(probe)
+            local x, y, z = tonumber(p.x), tonumber(p.y), tonumber(p.z)
+            if x == nil or y == nil or z == nil then
+                return errored("params.x, params.y and params.z (numbers) are required")
+            end
+            local yaw = tonumber(p.yaw) or 0.0
+            if not have("Game") then return absent("the `Game` global", "design §8 step 4") end
+            local pl = player()
+            if pl == nil then return failed("Game.GetPlayer() returned nil — load a save first") end
+            local evidence = {
+                x = x, y = y, z = z, yaw = yaw,
+                call = "Game.GetTeleportationFacility():Teleport(player, Vector4.new(x,y,z,1), EulerAngles.new(0,0,yaw))",
+                note = "the call and the Vector4/EulerAngles construction from the CET wiki; confirmed live 2026-10-04.",
+            }
+            local okTp, e = pcall(function()
+                Game.GetTeleportationFacility():Teleport(pl, Vector4.new(x, y, z, 1.0), EulerAngles.new(0.0, 0.0, yaw))
+            end)
+            if not okTp then return errored("Teleport raised: " .. tostring(e), evidence) end
+            return ok(true, evidence)
+        end,
+    },
+
+    -- attested 2026-10-04: the level followed 15 -> 16 -> 15, read back each time.
+    --   Game.SetLevel(kind, n, 1)   (kind defaults to "Level")
+    ["cp2077.player.level"] = {
+        attestation = "attested 2026-10-04 (ran live, read back)",
+        citation = "Game.SetLevel(kind, level, 1), from the CET wiki",
+        effect = "mutate",
+        mutates = true,
+        run = function(probe)
+            local p = params(probe)
+            local lvl = tonumber(p.level)
+            if lvl == nil then return errored("params.level (a number) is required") end
+            local kind = p.kind ~= nil and tostring(p.kind) or "Level"
+            if not have("Game") then return absent("the `Game` global", "design §8 step 4") end
+            local evidence = {
+                level = lvl, kind = kind, call = "Game.SetLevel(kind, level, 1)",
+                note = "from the CET wiki; confirmed live 2026-10-04 (level read back).",
+            }
+            local okL, e = pcall(function() Game.SetLevel(kind, lvl, 1) end)
+            if not okL then return errored("Game.SetLevel raised: " .. tostring(e), evidence) end
+            return ok(true, evidence)
+        end,
+    },
 }
 -- MODWRIGHT-PROBE-TABLE-END
 
@@ -1025,7 +1246,13 @@ end
 --- The ids allowed to mutate anything: the inventory row it always had, and
 --- (since 2026-09-11) the eval row. Named
 --- as a constant so the gate below reads as the rule it enforces.
-Probes.MUTATING_KINDS = { ["cp2077.inventory.add"] = true, ["cp2077.lua.eval"] = true }
+Probes.MUTATING_KINDS = {
+    ["cp2077.inventory.add"] = true,
+    ["cp2077.lua.eval"] = true,
+    ["cp2077.world.spawn"] = true,
+    ["cp2077.player.teleport"] = true,
+    ["cp2077.player.level"] = true,
+}
 
 --- Run one probe. NEVER throws: one probe failing can never abort the batch, and a handler
 --- that raises is reported as `error` with the raised message.

package/bridges/cp2077-cet/README.md

@@ -111,7 +111,7 @@ be diagnosed.
 
 Fenced with `-- MODWRIGHT-PROBE-TABLE-BEGIN` / `-- MODWRIGHT-PROBE-TABLE-END` in
 `probes.lua`, so the parity test reads only the table and never an id that appears in a
-comment. Thirteen ids, one per catalogue row, each carrying that row's own status word:
+comment. Fifteen ids, one per catalogue row, each carrying that row's own status word:
 
 | id | Status | If its call is missing |
 |---|---|---|
@@ -120,10 +120,12 @@ comment. Thirteen ids, one per catalogue row, each carrying that row's own statu
 | `cp2077.player.present` | attested(engine) | `error` if `Game` is absent |
 | `cp2077.item.equipped` | attested(engine) | — |
 | `cp2077.inventory.add` | attested(doc), **mutate** | `error`; skipped without `allowMutate` |
+| `cp2077.lua.eval` | **mutate**; runs a request's Lua chunk | skipped without the `session` tier |
 | `cp2077.entity.tagged` | attested(engine) | — |
 | `cp2077.entity.components` | attested(engine) for the call; names unverified | `error` without `params.names` |
 | `cp2077.entity.transform` | attested(engine) for item objects; unverified for a sector prop | says which, in `evidence.attestationForThisCall` |
 | `cp2077.entity.appearance` | unverified (composite) | `skipped` without a baseline |
+| `cp2077.entity.nearby` | unverified — the RTTI methods exist; never run in game | `error` naming the call that raised or returned nil |
 | `cp2077.tweakdb.record` | unverified | `error` |
 | `cp2077.tweakdb.flat` | unverified | `error` |
 | `cp2077.interaction.present` | unverified (the component *name*) | `error` without `params.names` |
@@ -165,8 +167,9 @@ the request grants the `session` tier. There is no token. The nonce and the requ
 only stop a consumed or stale request from running again; they do not say who wrote it. So:
 
 - deploy the bridge only to an install you control, and only while you are verifying a mod;
-- remove `bin/x64/plugins/cyber_engine_tweaks/mods/ModWrightBridge` when you are done,
-  before playing normally;
+- remove it when you are done, before playing normally:
+  `bridge action=remove path=<project> mode=apply` deletes every folder the project's
+  `withBridge` targets deployed, with a backup (a dry run first shows which);
 - never ship it. `cp2077.history.bridge-never-ships` blocks a release build that contains it.
 
 ## What this bridge never does

package/bridges/cp2077-cet/bridge.json

@@ -26,7 +26,7 @@
     "prune": [
       "ModWrightBridge/**"
     ],
-    "note": "The deploy target `bridge stage` adds to the project's deploy targets when no target already names this rootId, into and variant, so a fresh project deploys the bridge without a hand edit; paste it in yourself only if you want it there before staging. A deploy WITHOUT `--variant withBridge` prunes the folder back out, with backup."
+    "note": "The deploy target `bridge stage` adds to the project's deploy targets when no target already names this rootId, into and variant, so a fresh project deploys the bridge without a hand edit; paste it in yourself only if you want it there before staging. A deploy without `--variant withBridge` leaves an installed bridge where it is: a variant's prune runs only in a deploy that writes that variant. Take it out with `bridge action=remove path=<project> mode=apply` when you are done verifying (dry-run first; backed up)."
   },
   "sha256": {
     "algorithm": "sha256",
@@ -43,7 +43,7 @@
     },
     {
       "path": "ModWrightBridge/probes.lua",
-      "sha256": "a9dc28d3fd949f353f17404366bd2bb329813b9ca639e06a9b51aa34c104fb7d"
+      "sha256": "759015ac7c1167faecbc5d29e91f567d7c45446164544ad7d72029c115a60df6"
     },
     {
       "path": "ModWrightBridge/protocol.lua",

package/dist/core/bridge/remove.js

@@ -0,0 +1,48 @@
+import * as path from "node:path";
+import { pathExists } from "../fsutil.js";
+import { escapesRoot } from "../project/outside-root.js";
+import { executePlan, planDelete } from "../safety/index.js";
+export const BRIDGE_VARIANT = "withBridge";
+export async function planRemoveBridge(project, roots) {
+    const removals = [];
+    const operations = [];
+    for (const target of project.project.deploy?.targets ?? []) {
+        if (target.variant !== BRIDGE_VARIANT || !target.into)
+            continue;
+        const base = { rootId: target.rootId, into: target.into };
+        if (escapesRoot(target.into)) {
+            removals.push({ ...base, action: "outside-root" });
+            continue;
+        }
+        const root = roots.find((r) => r.id === target.rootId);
+        if (!root) {
+            removals.push({ ...base, action: "unknown-root" });
+            continue;
+        }
+        const dest = path.join(root.path, target.into);
+        if (await pathExists(dest)) {
+            operations.push(planDelete(dest));
+            removals.push({ ...base, path: dest, action: "remove" });
+        }
+        else {
+            removals.push({ ...base, path: dest, action: "absent" });
+        }
+    }
+    return {
+        plan: {
+            purpose: `remove the deployed bridge of ${project.project.name}`,
+            operations,
+            backupRoot: path.join(project.root, ".modwright", "backups"),
+        },
+        removals,
+    };
+}
+export async function removeBridge(project, roots, options = {}) {
+    const { plan, removals } = await planRemoveBridge(project, roots);
+    const report = await executePlan(plan, {
+        mode: options.mode ?? "dry-run",
+        ...(options.now ? { now: options.now } : {}),
+        confidence: { level: "high", assumptions: [], verifiedBy: ["the project's withBridge deploy targets", "the game's mod roots"] },
+    });
+    return { ...report, removals };
+}

package/dist/core/build/stage.js

@@ -96,12 +96,13 @@ async function planFiles(step, ctx) {
         };
         const isIncluded = (relForMatch) => includeRes.length === 0 || includeRes.some((re) => re.test(relForMatch));
         const add = (abs, relDest) => {
-            const existing = claimed.get(relDest);
+            const key = relDest.toLowerCase();
+            const existing = claimed.get(key);
             if (existing !== undefined && existing !== origin) {
                 throw new BuildStepError(`stage: ${existing} and ${origin} both write "${relDest}" — one would silently overlay the other. ` +
                     `Give one of them its own "into" prefix.`, step.id, step.step);
             }
-            claimed.set(relDest, origin);
+            claimed.set(key, origin);
             files.push({ abs, relDest, origin });
         };
         if (entry.output !== undefined) {

package/dist/core/ini.js

@@ -0,0 +1,26 @@
+export function parseIni(text) {
+    const out = new Map();
+    let section = "";
+    for (const raw of text.split(/\r?\n/)) {
+        const line = raw.trim();
+        if (!line || line.startsWith(";") || line.startsWith("#"))
+            continue;
+        const sec = /^\[(.+)\]$/.exec(line);
+        if (sec) {
+            section = sec[1].trim().toLowerCase();
+            continue;
+        }
+        const eq = line.indexOf("=");
+        if (eq < 0)
+            continue;
+        const key = line.slice(0, eq).trim().toLowerCase();
+        let value = line.slice(eq + 1).trim();
+        const wrapped = /^@ByteArray\((.*)\)$/.exec(value);
+        if (wrapped)
+            value = wrapped[1];
+        if (!out.has(section))
+            out.set(section, new Map());
+        out.get(section).set(key, value);
+    }
+    return out;
+}

package/dist/core/knowledge/facts.js

@@ -20,18 +20,6 @@ export function idPrefixFor(game) {
 }
 const ID_PATTERN = /^[a-z0-9]+(\.[a-z0-9-]+)+$/;
 const TOPIC_PATTERN = /^[a-z0-9]+(\.[a-z0-9-]+)*$/;
-const KNOWN_FACT_KEYS = [
-    "id",
-    "claim",
-    "status",
-    "verified_on",
-    "verified_by",
-    "source",
-    "tags",
-    "detail",
-    "supersedes",
-    "related",
-];
 const factStatusSchema = z.enum(FACT_STATUSES);
 const optionalString = () => z
     .string()

package/dist/core/logs/registry.js

@@ -21,6 +21,25 @@ export class SignatureRegistry {
                     }
                 }
             }
+            if (sig.attribution) {
+                const spec = sig.attribution;
+                const groups = namedGroupsOf(sig.pattern);
+                for (const field of ["subject", "subjectFallback", "actor", "via", "detail"]) {
+                    const name = spec[field];
+                    if (name !== undefined && !groups.has(name)) {
+                        throw new Error(`Signature "${sig.id}" attribution ${field} "${name}" has no named group "(?<${name}>...)" in its pattern`);
+                    }
+                }
+                if (spec.setsContext && spec.subject === undefined && spec.actor === undefined) {
+                    throw new Error(`Signature "${sig.id}" sets attribution context but captures neither subject nor actor`);
+                }
+                if (spec.setsContext && spec.alsoFinding) {
+                    throw new Error(`Signature "${sig.id}" cannot both set attribution context and report a finding`);
+                }
+                if (spec.subject !== undefined && spec.subjectLabel !== undefined) {
+                    throw new Error(`Signature "${sig.id}" attribution names both a subject group and a subjectLabel`);
+                }
+            }
             seenInBatch.add(sig.id);
         }
         for (const sig of signatures) {