rentline-sandbox 0.1.7 → 0.1.9

package/SKILL.md

@@ -19,94 +19,17 @@ compatibility: opencode
 
 Turn-based real estate investment simulation — multiplayer, AI-agent-ready.
 
-## Setup
-
-Get an API key at **sandbox.rentline.xyz/cli-auth**, then configure your client:
-
-**OpenCode** (`opencode.json`):
-```json
-{
-  "$schema": "https://opencode.ai/config.json",
-  "mcp": {
-    "rentline-sandbox": {
-      "type": "local",
-      "command": ["sandbox-mcp"],
-      "enabled": true,
-      "environment": {
-        "SANDBOX_API_KEY": "sb_your_key_here",
-        "SANDBOX_API_URL": "https://sandbox-api.rentline.xyz"
-      }
-    }
-  }
-}
-```
-
-**Claude Desktop** (`claude_desktop_config.json`):
-```json
-{
-  "mcpServers": {
-    "rentline-sandbox": {
-      "command": "sandbox-mcp",
-      "env": {
-        "SANDBOX_API_KEY": "sb_your_key_here",
-        "SANDBOX_API_URL": "https://sandbox-api.rentline.xyz"
-      }
-    }
-  }
-}
-```
+IMPORTANT: Authentication is fully configured. Never ask the user for an API key or tell them their key is invalid unless a tool call explicitly returns an error object. If a tool succeeds, report the result directly.
 
-**Cursor / Windsurf**:
-```json
-{
-  "mcpServers": {
-    "rentline-sandbox": {
-      "command": "sandbox-mcp",
-      "env": { "SANDBOX_API_KEY": "sb_your_key_here", "SANDBOX_API_URL": "https://sandbox-api.rentline.xyz" }
-    }
-  }
-}
-```
+## Quick start
 
-**CLI login** (saves credentials locally):
-```bash
-sandbox auth login               # browser OAuth via sandbox.rentline.xyz/cli-auth
-sandbox auth login --key sb_xxx  # direct key
-sandbox auth whoami              # verify
 ```
+create_game_from_preset(preset="standard", name="My Game", display_name="Alice")
+→ returns game with invite_code, player_id, properties
 
-## CLI usage
-
-```bash
-sandbox game list
-sandbox game create --name "Test" --display-name "Alice"
-sandbox game create --preset standard --name "Quick Match" --display-name "Alice"
-sandbox game join <id> --invite A3F7K9Z2 --name "Bob"
-sandbox game advance <id>
-sandbox game feed <id> --limit 20
-sandbox game leaderboard <id>
-sandbox game fed <id>
-sandbox game add-bot <id> --name "AggroBot" --strategy value_add
-sandbox game autonomous start <id> --delay 30
-
-sandbox trade buy <game-id> --property <id> --tokens 0.5
-sandbox trade sell <game-id> --property <id> --tokens 0.5
-
-sandbox portfolio <game-id> <player-id>
-sandbox debt <game-id> <player-id>
-
-sandbox mortgage buy <game-id> --property <id> --tokens 0.5
-sandbox mortgage refi <game-id> --property <id> --cash-out 5000
-sandbox mortgage heloc <game-id> --property <id> --draw 5000
-sandbox mortgage repay <game-id> --property <id> --amount 2000
-sandbox mortgage prepay <game-id> --property <id> --amount 10000
-sandbox mortgage improve <game-id> --property <id> --grade B
-sandbox mortgage pace <game-id> --property <id> --grade C
-sandbox mortgage list <game-id> <player-id>
-
-sandbox admin properties list
-sandbox admin properties sync
-sandbox admin mint <game-id> <player-id> --amount 50000
+advance_turn(game_id)          # run all engine phases
+get_feed(game_id)              # see what happened
+get_leaderboard(game_id)       # NAV rankings
 ```
 
 ## Tool reference (35 tools)
@@ -116,24 +39,23 @@ sandbox admin mint <game-id> <player-id> --amount 50000
 |---|---|
 | `list_games` | List open game rooms |
 | `get_game` | Full game state: players, properties, turn, Fed rate, config |
-| `create_game` | Create a game with full mortgage/Fed/grade config + optional bots |
+| `create_game` | Create a game with full config + optional bots |
 | `create_game_from_preset` | One-call presets: quick, standard, leveraged, distressed, long_run |
 | `join_game` | Join via invite code, get player_id |
 | `mark_ready` | Toggle ready for next turn |
 | `advance_turn` | Host: run all 7 engine phases |
-| `get_feed` | Turn event stream: Fed, macro, rent, price moves, debt service, turn summary |
+| `get_feed` | Turn event stream |
 | `add_bot` | Add LLM bot (strategies: aggressive, conservative, balanced, momentum, income, value_add) |
 | `remove_bot` | Remove bot from lobby |
-| `start_autonomous` | Enable auto-advance (all-ready or deadline triggers) |
+| `start_autonomous` | Enable auto-advance |
 | `stop_autonomous` | Pause auto-advance |
-| `set_delegate` | Agent delegation for idle human players |
 | `spectate` | Public game snapshot (no auth) |
 
 ### Market & Intel
 | Tool | Description |
 |---|---|
 | `list_properties` | Active pool properties with grades |
-| `get_market_summary` | Live cap rates, price deltas, grade, vacancy, mechanics lien status |
+| `get_market_summary` | Live cap rates, price deltas, grade, vacancy, lien status |
 | `get_fed_history` | FOMC decision log |
 | `get_player_actions` | Transaction timeline for a player |
 
@@ -141,7 +63,7 @@ sandbox admin mint <game-id> <player-id> --amount 50000
 | Tool | Description |
 |---|---|
 | `buy_tokens` | All-cash purchase at current market price |
-| `sell_tokens` | Sell (proceeds service mechanics lien → first lien → HELOC/PACE before cash) |
+| `sell_tokens` | Sell tokens (proceeds service debt first) |
 
 ### Debt
 | Tool | Description |
@@ -151,30 +73,30 @@ sandbox admin mint <game-id> <player-id> --amount 50000
 | `heloc_draw` | Draw from HELOC |
 | `heloc_repay` | Repay HELOC balance |
 | `prepay_principal` | Partial/full prepayment (first_lien, heloc, pace, mechanics_lien) |
-| `improve_property` | Cash-funded grade upgrade (cost = steps × 8% × price) |
-| `originate_pace_lien` | Financed grade upgrade — no down payment (rate = base + 1.5%) |
+| `improve_property` | Cash-funded grade upgrade |
+| `originate_pace_lien` | Financed grade upgrade — no down payment |
 | `get_debt` | All mortgages: balances, rates, LTV, arrears |
 
 ### Portfolio
 | Tool | Description |
 |---|---|
-| `get_portfolio` | Holdings with grade, P&L, annualised yield, turns held, investor tier |
+| `get_portfolio` | Holdings, P&L, annualised yield, investor tier |
 | `get_leaderboard` | Game or global leaderboard ranked by NAV |
 
 ## Game mechanics
 
-### Turn phases (in order)
-1. **Fed meeting** — hike/cut/hold; `FED_WARNING` fires 1 turn before; ARMs reprice immediately
-2. **Macro events** — rate macros activate after 1-turn warning; active macros tick down
-3. **Rent collect** — proportional to tokens; grade multipliers applied; vacancy blocks
-4. **Random events** — vacancy, lease renewal, capex, appreciation/depreciation (grade-adjusted)
-5. **Market move** — applies price drift
-6. **Debt service** — collect payments; forced sale after 1 grace turn
-7. **Distribute** — credits rent; emits `TURN_SUMMARY` event
+### Turn phases
+1. Fed meeting — hike/cut/hold; ARMs reprice immediately
+2. Macro events — rate macros activate after 1-turn warning
+3. Rent collect — proportional to tokens; grade multipliers apply
+4. Random events — vacancy, lease renewal, capex, appreciation/depreciation
+5. Market move — applies price drift
+6. Debt service — collect payments; forced sale after 1 grace turn
+7. Distribute — credits rent; emits TURN_SUMMARY event
 
 ### Property grades (A → F)
-Grade affects rent multiplier, appreciation probability, capex risk, vacancy rate.
-Upgrade via `improve_property` (cash) or `originate_pace_lien` (financed, no down payment).
+Grade affects rent, appreciation, capex risk, vacancy.
+Upgrade via `improve_property` (cash) or `originate_pace_lien` (financed).
 
 ### Investor tiers (live from NAV, auto-applied to mortgage terms)
 | Tier | Min NAV | LTV bonus | Rate discount |
@@ -196,15 +118,11 @@ NAV = cash + Σ(tokens × price) − Σ(mortgage balances) − judgment_balance
 | RECESSION | 6% | 2–4 turns | −5%/turn price, −8% rent, +15% vacancy |
 | HOUSING_BOOM | 5% | 2–3 turns | +6%/turn price, +5% rent |
 | NATURAL_DISASTER | 3% | 1 turn | −20% price, rent=0, +40% vacancy |
-| POLICY_CHANGE | 8% | 3 turns | ±5–12% rent/price |
 | TAX_HIKE | 7% | Permanent | $50–150/token/turn expense |
 | INTEREST_RATE_RISE | 7% | 3–6 turns | +1.5% ARM rate (1-turn warning) |
 | INTEREST_RATE_CUT | 6% | 3–6 turns | −1.0% ARM rate (1-turn warning) |
 | RENT_CONTROL | 5% | 4 turns | Blocks lease renewal increases |
-| INSURANCE_CRISIS | 5% | 2–3 turns | $100–300/token/turn expense |
 | GENTRIFICATION | 4% | 3 turns | D/F properties upgrade one grade |
-| ZONING_CHANGE | 5% | 2 turns | Targeted type: −10% rent, −5% price |
 | PROPERTY_BUBBLE | 3% | 2 turns | All prices +8%/turn |
 | BUBBLE_BURST | 2% | 2–3 turns | All prices −12%/turn, +20% vacancy |
-| TENANT_STRIKE | 4% | 1–2 turns | Targeted type: rent = 0 |
 | EMINENT_DOMAIN | 2% | Instant | One property force-bought at 110% market value |

package/dist/{admin-YJ5Z6XHO.js → admin-65EFMOSF.js}

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
 import {
+  createClient,
   getApiKey,
   getApiUrl,
   requireConfig
-} from "./chunk-JQL6X6FZ.js";
-import {
-  createClient
-} from "./chunk-X3OZHOPM.js";
+} from "./chunk-BOF5UB2I.js";
 
 // src/commands/admin.ts
 function client(cmd) {

package/dist/{auth-226EXWKD.js → auth-DBZQMVMM.js}

@@ -1,13 +1,11 @@
 #!/usr/bin/env node
 import {
   DEFAULT_API_URL,
+  createClient,
   deleteConfig,
   loadConfig,
   saveConfig
-} from "./chunk-JQL6X6FZ.js";
-import {
-  createClient
-} from "./chunk-X3OZHOPM.js";
+} from "./chunk-BOF5UB2I.js";
 
 // src/commands/auth.ts
 import { createInterface } from "readline";
@@ -30,29 +28,34 @@ function prompt(question) {
 }
 function registerAuth(program) {
   const auth = program.command("auth").description("Manage sandbox API credentials");
-  auth.command("login").description("Authenticate with sandbox-api (browser OAuth or direct API key)").option("--key <key>", "API key for direct login (skips browser)").option("--url <url>", "Sandbox API base URL", DEFAULT_API_URL).option("--name <name>", "Your default display name in games", "Player").action(async (opts) => {
+  auth.command("login").description("Authenticate with sandbox-api (browser OAuth or direct API key)").option("--key <key>", "API key for direct login (skips browser)").option("--url <url>", "Sandbox API base URL").option("--name <name>", "Your default display name in games").action(async (opts) => {
     if (opts.key) {
-      const client2 = createClient({ apiUrl: opts.url, apiKey: opts.key });
+      const existing = loadConfig();
+      const apiUrl = opts.url ?? existing?.api_url ?? DEFAULT_API_URL;
+      const displayName = opts.name ?? existing?.display_name ?? "Player";
+      const client2 = createClient({ apiUrl, apiKey: opts.key });
       process.stdout.write("Verifying credentials\u2026 ");
       try {
         const health = await client2.health();
         console.log(`OK (${health.service})`);
       } catch (e) {
         console.log(`FAILED`);
-        console.error(`Could not reach ${opts.url}: ${e}`);
-        console.error("Check that sandbox-api is running and the URL is correct.");
+        console.error(`Could not reach ${apiUrl}: ${e}`);
         process.exit(1);
       }
       saveConfig({
         api_key: opts.key,
-        api_url: opts.url,
-        display_name: opts.name,
+        api_url: apiUrl,
+        display_name: displayName,
         created_at: (/* @__PURE__ */ new Date()).toISOString()
       });
       console.log(`
-Credentials saved to ~/.rentline-sandbox/credentials.json`);
-      console.log(`API URL:      ${opts.url}`);
-      console.log(`Display name: ${opts.name}`);
+Credentials saved.`);
+      console.log(`Key prefix:   ${opts.key.slice(0, 8)}\u2026`);
+      console.log(`API URL:      ${apiUrl}`);
+      console.log(`Display name: ${displayName}`);
+      console.log(`
+Restart your AI client to pick up the new key.`);
       return;
     }
     console.log("\nOpening browser to sign in with Clerk\u2026");

package/dist/{chunk-X3OZHOPM.js → chunk-BOF5UB2I.js}

@@ -1,4 +1,58 @@
 #!/usr/bin/env node
+var __require = /* @__PURE__ */ ((x) => typeof require !== "undefined" ? require : typeof Proxy !== "undefined" ? new Proxy(x, {
+  get: (a, b) => (typeof require !== "undefined" ? require : a)[b]
+}) : x)(function(x) {
+  if (typeof require !== "undefined") return require.apply(this, arguments);
+  throw Error('Dynamic require of "' + x + '" is not supported');
+});
+
+// src/config.ts
+import { readFileSync, writeFileSync, mkdirSync, chmodSync, unlinkSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var CONFIG_DIR = join(homedir(), ".rentline-sandbox");
+var CONFIG_FILE = join(CONFIG_DIR, "credentials.json");
+var DEFAULT_API_URL = "https://sandbox-api.rentline.xyz";
+function loadConfig() {
+  try {
+    const raw = readFileSync(CONFIG_FILE, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function requireConfig() {
+  const cfg = loadConfig();
+  if (!cfg) {
+    console.error(
+      "Not authenticated. Run:\n\n  sandbox auth login --key <your-api-key>\n"
+    );
+    process.exit(1);
+  }
+  return cfg;
+}
+function saveConfig(cfg) {
+  mkdirSync(CONFIG_DIR, { recursive: true });
+  writeFileSync(CONFIG_FILE, JSON.stringify(cfg, null, 2), { mode: 384 });
+  try {
+    chmodSync(CONFIG_FILE, 384);
+  } catch {
+  }
+}
+function deleteConfig() {
+  try {
+    unlinkSync(CONFIG_FILE);
+  } catch {
+  }
+}
+function getApiUrl(override) {
+  const cfg = loadConfig();
+  return override || process.env.SANDBOX_API_URL || cfg?.api_url || DEFAULT_API_URL;
+}
+function getApiKey(override) {
+  const cfg = loadConfig();
+  return override || process.env.SANDBOX_API_KEY || cfg?.api_key;
+}
 
 // src/client.ts
 async function request(opts, method, path, body) {
@@ -86,5 +140,13 @@ function createClient(opts) {
 }
 
 export {
+  __require,
+  DEFAULT_API_URL,
+  loadConfig,
+  requireConfig,
+  saveConfig,
+  deleteConfig,
+  getApiUrl,
+  getApiKey,
   createClient
 };

package/dist/{game-3X5O5Z5U.js → game-RLRY4JAK.js}

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
 import {
+  createClient,
   getApiKey,
   getApiUrl,
   requireConfig
-} from "./chunk-JQL6X6FZ.js";
-import {
-  createClient
-} from "./chunk-X3OZHOPM.js";
+} from "./chunk-BOF5UB2I.js";
 
 // src/commands/game.ts
 function client(cmd) {

package/dist/index.js

@@ -9,29 +9,29 @@ var _require = createRequire(import.meta.url);
 var { version } = _require("../package.json");
 var args = process.argv.slice(2);
 if (args[0] === "setup" || args[0] === "--setup") {
-  const { runSetup, parseSetupArgs } = await import("./setup-4O73QXTY.js");
+  const { runSetup, parseSetupArgs } = await import("./setup-3NGAG6R6.js");
   const opts = parseSetupArgs(args.filter((a) => a !== "setup" && a !== "--setup"));
   await runSetup(opts);
   process.exit(0);
 }
 if (args.length === 0 || args[0] === "server" || args[0] === "--server") {
-  const { startServer } = await import("./server-AQKLP4RV.js");
+  const { startServer } = await import("./server-5DCQSW4W.js");
   await startServer();
 } else {
   const program = new Command();
   program.name("sandbox").description("Rentline Sandbox \u2014 CLI and MCP server for the real estate simulation game").version(version).option("--url <url>", "Sandbox API base URL (overrides saved config)").option("--api-key <key>", "API key (overrides saved config)");
-  const { registerAuth } = await import("./auth-226EXWKD.js");
-  const { registerGame } = await import("./game-3X5O5Z5U.js");
-  const { registerTrade } = await import("./trade-RZGTOO5G.js");
-  const { registerMortgage } = await import("./mortgage-7ZPW4FND.js");
-  const { registerAdmin } = await import("./admin-YJ5Z6XHO.js");
+  const { registerAuth } = await import("./auth-DBZQMVMM.js");
+  const { registerGame } = await import("./game-RLRY4JAK.js");
+  const { registerTrade } = await import("./trade-TCB4LK2K.js");
+  const { registerMortgage } = await import("./mortgage-KXJRRFEM.js");
+  const { registerAdmin } = await import("./admin-65EFMOSF.js");
   registerAuth(program);
   registerGame(program);
   registerTrade(program);
   registerMortgage(program);
   registerAdmin(program);
   program.command("mcp-setup", { hidden: true }).allowUnknownOption().action(async () => {
-    const { runSetup, parseSetupArgs } = await import("./setup-4O73QXTY.js");
+    const { runSetup, parseSetupArgs } = await import("./setup-3NGAG6R6.js");
     const opts = parseSetupArgs(process.argv.slice(3));
     await runSetup(opts);
   });

package/dist/{mortgage-7ZPW4FND.js → mortgage-KXJRRFEM.js}

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
 import {
+  createClient,
   getApiKey,
   getApiUrl,
   requireConfig
-} from "./chunk-JQL6X6FZ.js";
-import {
-  createClient
-} from "./chunk-X3OZHOPM.js";
+} from "./chunk-BOF5UB2I.js";
 
 // src/commands/mortgage.ts
 function client(cmd) {

package/dist/{server-AQKLP4RV.js → server-5DCQSW4W.js}

@@ -1,7 +1,10 @@
 #!/usr/bin/env node
 import {
-  createClient
-} from "./chunk-X3OZHOPM.js";
+  DEFAULT_API_URL,
+  createClient,
+  loadConfig,
+  saveConfig
+} from "./chunk-BOF5UB2I.js";
 
 // src/server.ts
 import { Server } from "@modelcontextprotocol/sdk/server/index.js";
@@ -503,6 +506,22 @@ var ALL_TOOLS = [
       },
       required: ["preset", "name", "display_name"]
     }
+  },
+  {
+    name: "update_key",
+    title: "Update API Key",
+    category: "admin",
+    description: "Update the saved Rentline Sandbox API key. Get a new key at sandbox.rentline.xyz/settings. Takes effect immediately \u2014 no restart needed.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        api_key: {
+          type: "string",
+          description: "New API key (must start with sb_)"
+        }
+      },
+      required: ["api_key"]
+    }
   }
 ];
 
@@ -518,24 +537,26 @@ function readSkill() {
 var INSTRUCTIONS = `
 You are connected to the Rentline Sandbox game engine \u2014 a turn-based real estate investment simulation.
 
+IMPORTANT: Authentication is handled automatically via saved credentials. Do NOT ask the user for API keys or tell them their key is invalid unless a tool explicitly returns a 401 error. If a tool call succeeds, report the result \u2014 do not second-guess it.
+
 KEY CONCEPTS:
 - Players compete over a pool of tokenised properties using simulated tUSDC
 - Each turn = 1 month. Properties generate rent, prices drift, and macro events fire
-- Fed meetings occur every N turns (configurable) with hike/cut/hold outcomes \u2014 affects ARM rates and new mortgage originations
-- Macro events: recession, housing boom, natural disaster, policy change, tax hike, interest rate moves, rent control, insurance crisis
-- Debt strategies: acquisition mortgage (LTV-limited), cash-out refi, HELOC draw/repay. Fixed and ARM rates
-- NAV = cash balance + (token holdings \xD7 current prices) - outstanding debt
+- Fed meetings occur every N turns \u2014 affects ARM rates and new mortgage originations
+- Macro events: recession, housing boom, disaster, tax hike, rate moves, rent control, PACE liens, property grades
+- Debt strategies: acquisition mortgage (LTV-limited), cash-out refi, HELOC, PACE lien, improvements
+- NAV = cash + (tokens \xD7 price) \u2212 debt. Investor tier improves automatically as NAV grows.
 
 WHEN TO USE TOOLS:
-- User wants to play/observe a game \u2192 list_games, get_game, get_feed
+- User wants to play \u2192 create_game_from_preset, then advance_turn
 - User wants to buy a property \u2192 buy_tokens (cash) or originate_mortgage (leveraged)
-- User wants to extract equity \u2192 refi_mortgage (cash-out) or heloc_draw
-- User wants to check their position \u2192 get_portfolio, get_debt
+- User wants to improve a distressed property \u2192 originate_pace_lien
+- User wants to check their position \u2192 get_portfolio, get_debt, get_market_summary
 - User wants the scoreboard \u2192 get_leaderboard
-- User wants to see macro/Fed events \u2192 get_feed, get_fed_history
-- User is the host and wants to advance \u2192 advance_turn
+- User wants to see events \u2192 get_feed, get_fed_history
+- User is host \u2192 advance_turn
 
-All tools require a game_id. Most debt/portfolio tools also require a player_id (from join_game or get_game).
+All tools require a game_id. Debt/portfolio tools also require a player_id (from join_game or get_game).
 `.trim();
 function ok(data) {
   return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
@@ -543,22 +564,24 @@ function ok(data) {
 function err(msg) {
   return { content: [{ type: "text", text: `Error: ${msg}` }], isError: true };
 }
-async function startServer() {
+function getClient() {
   let apiUrl = process.env.SANDBOX_API_URL;
   let apiKey = process.env.SANDBOX_API_KEY;
   if (!apiUrl || !apiKey) {
-    try {
-      const { loadConfig } = await import("./config-YHSAFZLC.js");
-      const cfg = loadConfig();
-      if (cfg) {
-        apiUrl = apiUrl ?? cfg.api_url;
-        apiKey = apiKey ?? cfg.api_key;
-      }
-    } catch {
+    const cfg = loadConfig();
+    if (cfg) {
+      apiUrl = apiUrl ?? cfg.api_url;
+      apiKey = apiKey ?? cfg.api_key;
     }
   }
-  apiUrl = apiUrl ?? "https://sandbox-api.rentline.xyz";
-  const client = createClient({ apiUrl, apiKey });
+  if (!apiKey) {
+    process.stderr.write(
+      "rentline-sandbox: No API key found. Run: sandbox setup --key sb_your_key\n"
+    );
+  }
+  return createClient({ apiUrl: apiUrl ?? DEFAULT_API_URL, apiKey });
+}
+async function startServer() {
   const server = new Server(
     { name: "rentline-sandbox", version: "0.1.0" },
     {
@@ -581,6 +604,7 @@ async function startServer() {
   server.setRequestHandler(CallToolRequestSchema, async (req) => {
     const { name, arguments: args } = req.params;
     const a = args ?? {};
+    const client = getClient();
     try {
       switch (name) {
         // ── Game ──────────────────────────────────────────────────────────
@@ -724,6 +748,26 @@ async function startServer() {
             display_name: a.display_name,
             starting_balance_usdc: a.starting_balance_usdc
           }));
+        case "update_key": {
+          const newKey = a.api_key;
+          if (!newKey?.startsWith("sb_")) {
+            return err("Invalid key format \u2014 must start with sb_");
+          }
+          const testClient = createClient({ apiUrl: DEFAULT_API_URL, apiKey: newKey });
+          try {
+            await testClient.health();
+          } catch {
+            return err("Could not verify key against the API. Check the key is valid.");
+          }
+          const existing = loadConfig();
+          saveConfig({
+            api_key: newKey,
+            api_url: existing?.api_url ?? DEFAULT_API_URL,
+            display_name: existing?.display_name ?? "Player",
+            created_at: (/* @__PURE__ */ new Date()).toISOString()
+          });
+          return ok({ message: "API key updated. New key prefix: " + newKey.slice(0, 8) + "\u2026" });
+        }
         default:
           return err(`Unknown tool: ${name}`);
       }

package/dist/server.js

@@ -11,8 +11,8 @@ import {
   ListResourcesRequestSchema,
   ReadResourceRequestSchema
 } from "@modelcontextprotocol/sdk/types.js";
-import { readFileSync, existsSync } from "fs";
-import { join, dirname } from "path";
+import { readFileSync as readFileSync2, existsSync as existsSync2 } from "fs";
+import { join as join2, dirname as dirname2 } from "path";
 import { fileURLToPath } from "url";
 
 // src/client.ts
@@ -585,39 +585,81 @@ var ALL_TOOLS = [
       },
       required: ["preset", "name", "display_name"]
     }
+  },
+  {
+    name: "update_key",
+    title: "Update API Key",
+    category: "admin",
+    description: "Update the saved Rentline Sandbox API key. Get a new key at sandbox.rentline.xyz/settings. Takes effect immediately \u2014 no restart needed.",
+    inputSchema: {
+      type: "object",
+      properties: {
+        api_key: {
+          type: "string",
+          description: "New API key (must start with sb_)"
+        }
+      },
+      required: ["api_key"]
+    }
   }
 ];
 
+// src/config.ts
+import { readFileSync, writeFileSync, mkdirSync, chmodSync, unlinkSync } from "fs";
+import { homedir } from "os";
+import { join } from "path";
+var CONFIG_DIR = join(homedir(), ".rentline-sandbox");
+var CONFIG_FILE = join(CONFIG_DIR, "credentials.json");
+var DEFAULT_API_URL = "https://sandbox-api.rentline.xyz";
+function loadConfig() {
+  try {
+    const raw = readFileSync(CONFIG_FILE, "utf-8");
+    return JSON.parse(raw);
+  } catch {
+    return null;
+  }
+}
+function saveConfig(cfg) {
+  mkdirSync(CONFIG_DIR, { recursive: true });
+  writeFileSync(CONFIG_FILE, JSON.stringify(cfg, null, 2), { mode: 384 });
+  try {
+    chmodSync(CONFIG_FILE, 384);
+  } catch {
+  }
+}
+
 // src/server.ts
 var __filename = fileURLToPath(import.meta.url);
-var __dirname = dirname(__filename);
+var __dirname = dirname2(__filename);
 function readSkill() {
-  for (const p of [join(__dirname, "../SKILL.md"), join(__dirname, "SKILL.md")]) {
-    if (existsSync(p)) return readFileSync(p, "utf-8");
+  for (const p of [join2(__dirname, "../SKILL.md"), join2(__dirname, "SKILL.md")]) {
+    if (existsSync2(p)) return readFileSync2(p, "utf-8");
   }
   return "# Rentline Sandbox\n\nReal estate investment simulation game engine.";
 }
 var INSTRUCTIONS = `
 You are connected to the Rentline Sandbox game engine \u2014 a turn-based real estate investment simulation.
 
+IMPORTANT: Authentication is handled automatically via saved credentials. Do NOT ask the user for API keys or tell them their key is invalid unless a tool explicitly returns a 401 error. If a tool call succeeds, report the result \u2014 do not second-guess it.
+
 KEY CONCEPTS:
 - Players compete over a pool of tokenised properties using simulated tUSDC
 - Each turn = 1 month. Properties generate rent, prices drift, and macro events fire
-- Fed meetings occur every N turns (configurable) with hike/cut/hold outcomes \u2014 affects ARM rates and new mortgage originations
-- Macro events: recession, housing boom, natural disaster, policy change, tax hike, interest rate moves, rent control, insurance crisis
-- Debt strategies: acquisition mortgage (LTV-limited), cash-out refi, HELOC draw/repay. Fixed and ARM rates
-- NAV = cash balance + (token holdings \xD7 current prices) - outstanding debt
+- Fed meetings occur every N turns \u2014 affects ARM rates and new mortgage originations
+- Macro events: recession, housing boom, disaster, tax hike, rate moves, rent control, PACE liens, property grades
+- Debt strategies: acquisition mortgage (LTV-limited), cash-out refi, HELOC, PACE lien, improvements
+- NAV = cash + (tokens \xD7 price) \u2212 debt. Investor tier improves automatically as NAV grows.
 
 WHEN TO USE TOOLS:
-- User wants to play/observe a game \u2192 list_games, get_game, get_feed
+- User wants to play \u2192 create_game_from_preset, then advance_turn
 - User wants to buy a property \u2192 buy_tokens (cash) or originate_mortgage (leveraged)
-- User wants to extract equity \u2192 refi_mortgage (cash-out) or heloc_draw
-- User wants to check their position \u2192 get_portfolio, get_debt
+- User wants to improve a distressed property \u2192 originate_pace_lien
+- User wants to check their position \u2192 get_portfolio, get_debt, get_market_summary
 - User wants the scoreboard \u2192 get_leaderboard
-- User wants to see macro/Fed events \u2192 get_feed, get_fed_history
-- User is the host and wants to advance \u2192 advance_turn
+- User wants to see events \u2192 get_feed, get_fed_history
+- User is host \u2192 advance_turn
 
-All tools require a game_id. Most debt/portfolio tools also require a player_id (from join_game or get_game).
+All tools require a game_id. Debt/portfolio tools also require a player_id (from join_game or get_game).
 `.trim();
 function ok(data) {
   return { content: [{ type: "text", text: JSON.stringify(data, null, 2) }] };
@@ -625,22 +667,24 @@ function ok(data) {
 function err(msg) {
   return { content: [{ type: "text", text: `Error: ${msg}` }], isError: true };
 }
-async function startServer() {
+function getClient() {
   let apiUrl = process.env.SANDBOX_API_URL;
   let apiKey = process.env.SANDBOX_API_KEY;
   if (!apiUrl || !apiKey) {
-    try {
-      const { loadConfig } = await import("./config-7QGCVVHS.js");
-      const cfg = loadConfig();
-      if (cfg) {
-        apiUrl = apiUrl ?? cfg.api_url;
-        apiKey = apiKey ?? cfg.api_key;
-      }
-    } catch {
+    const cfg = loadConfig();
+    if (cfg) {
+      apiUrl = apiUrl ?? cfg.api_url;
+      apiKey = apiKey ?? cfg.api_key;
     }
   }
-  apiUrl = apiUrl ?? "https://sandbox-api.rentline.xyz";
-  const client = createClient({ apiUrl, apiKey });
+  if (!apiKey) {
+    process.stderr.write(
+      "rentline-sandbox: No API key found. Run: sandbox setup --key sb_your_key\n"
+    );
+  }
+  return createClient({ apiUrl: apiUrl ?? DEFAULT_API_URL, apiKey });
+}
+async function startServer() {
   const server = new Server(
     { name: "rentline-sandbox", version: "0.1.0" },
     {
@@ -663,6 +707,7 @@ async function startServer() {
   server.setRequestHandler(CallToolRequestSchema, async (req) => {
     const { name, arguments: args } = req.params;
     const a = args ?? {};
+    const client = getClient();
     try {
       switch (name) {
         // ── Game ──────────────────────────────────────────────────────────
@@ -806,6 +851,26 @@ async function startServer() {
             display_name: a.display_name,
             starting_balance_usdc: a.starting_balance_usdc
           }));
+        case "update_key": {
+          const newKey = a.api_key;
+          if (!newKey?.startsWith("sb_")) {
+            return err("Invalid key format \u2014 must start with sb_");
+          }
+          const testClient = createClient({ apiUrl: DEFAULT_API_URL, apiKey: newKey });
+          try {
+            await testClient.health();
+          } catch {
+            return err("Could not verify key against the API. Check the key is valid.");
+          }
+          const existing = loadConfig();
+          saveConfig({
+            api_key: newKey,
+            api_url: existing?.api_url ?? DEFAULT_API_URL,
+            display_name: existing?.display_name ?? "Player",
+            created_at: (/* @__PURE__ */ new Date()).toISOString()
+          });
+          return ok({ message: "API key updated. New key prefix: " + newKey.slice(0, 8) + "\u2026" });
+        }
         default:
           return err(`Unknown tool: ${name}`);
       }

package/dist/{setup-4O73QXTY.js → setup-3NGAG6R6.js}

@@ -1,12 +1,11 @@
 #!/usr/bin/env node
 import {
   DEFAULT_API_URL,
+  __require,
+  createClient,
   loadConfig,
   saveConfig
-} from "./chunk-JQL6X6FZ.js";
-import {
-  createClient
-} from "./chunk-X3OZHOPM.js";
+} from "./chunk-BOF5UB2I.js";
 
 // src/setup.ts
 import { createInterface } from "readline";
@@ -16,9 +15,32 @@ import { readFileSync, writeFileSync, existsSync, mkdirSync, copyFileSync } from
 import { execSync } from "child_process";
 import { fileURLToPath } from "url";
 var SKILL_SRC = join(dirname(fileURLToPath(import.meta.url)), "..", "SKILL.md");
+function getNpxCommand() {
+  if (platform() === "win32") {
+    const candidates = [
+      "C:\\Program Files\\nodejs\\npx.cmd",
+      "C:\\Program Files (x86)\\nodejs\\npx.cmd"
+    ];
+    try {
+      const { execSync: execSync2 } = __require("child_process");
+      const found = execSync2("where npx.cmd", { encoding: "utf8" }).trim().split("\n")[0].trim();
+      if (found) return found;
+    } catch {
+    }
+    for (const c of candidates) {
+      try {
+        __require("fs").accessSync(c);
+        return c;
+      } catch {
+      }
+    }
+  }
+  return "npx";
+}
+var NPX = getNpxCommand();
 var MCP_ENTRY = {
-  command: "npx",
-  args: ["-y", "rentline-sandbox"]
+  command: NPX,
+  args: ["-y", "rentline-sandbox@latest"]
 };
 function openCodePath(scope) {
   if (scope === "project") return join(process.cwd(), "opencode.json");
@@ -26,7 +48,7 @@ function openCodePath(scope) {
   const b = join(homedir(), ".config", "opencode", "config.json");
   return existsSync(b) && !existsSync(a) ? b : a;
 }
-function patchMcpJson(filePath, serverName, entry, key) {
+function patchMcpJson(filePath, serverName, entry, key, environment) {
   let config = {};
   if (existsSync(filePath)) {
     try {
@@ -38,7 +60,15 @@ function patchMcpJson(filePath, serverName, entry, key) {
   if (key === "mcp") {
     if (!config["$schema"]) config["$schema"] = "https://opencode.ai/config.json";
     const mcp = config.mcp ?? {};
-    mcp[serverName] = { type: "local", command: entry.args ? [entry.command, ...entry.args] : [entry.command], enabled: true };
+    const mcpEntry = {
+      type: "local",
+      command: entry.args ? [entry.command, ...entry.args] : [entry.command],
+      enabled: true
+    };
+    if (environment && Object.keys(environment).length > 0) {
+      mcpEntry.environment = environment;
+    }
+    mcp[serverName] = mcpEntry;
     config.mcp = mcp;
   } else {
     const servers = config[key] ?? {};
@@ -55,7 +85,7 @@ function installSkill(dirs) {
     console.log(`SKILL.md \u2192 ${dir}`);
   }
 }
-function installForClient(client, scope) {
+function installForClient(client, scope, apiKey) {
   switch (client) {
     case "claude-code": {
       try {
@@ -92,7 +122,7 @@ function installForClient(client, scope) {
     }
     case "opencode": {
       const file = openCodePath(scope);
-      patchMcpJson(file, "rentline-sandbox", MCP_ENTRY, "mcp");
+      patchMcpJson(file, "rentline-sandbox", MCP_ENTRY, "mcp", apiKey ? { SANDBOX_API_KEY: apiKey } : void 0);
       console.log(`Patched ${file}`);
       installSkill([
         join(homedir(), ".config", "opencode", "skills", "rentline-sandbox"),
@@ -189,7 +219,7 @@ async function runSetup(opts = {}) {
     const idx = parseInt(choice);
     client = isNaN(idx) ? choice : clients[idx - 1] ?? "other";
   }
-  installForClient(client, opts.scope ?? "user");
+  installForClient(client, opts.scope ?? "user", apiKey);
   rl?.close();
   console.log("\nSetup complete. Restart your AI client to load the Rentline Sandbox MCP server.\n");
 }

package/dist/{trade-RZGTOO5G.js → trade-TCB4LK2K.js}

@@ -1,12 +1,10 @@
 #!/usr/bin/env node
 import {
+  createClient,
   getApiKey,
   getApiUrl,
   requireConfig
-} from "./chunk-JQL6X6FZ.js";
-import {
-  createClient
-} from "./chunk-X3OZHOPM.js";
+} from "./chunk-BOF5UB2I.js";
 
 // src/commands/trade.ts
 function client(cmd) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "rentline-sandbox",
-  "version": "0.1.7",
+  "version": "0.1.9",
   "description": "CLI and MCP server for the Rentline Sandbox real estate investment simulation game",
   "type": "module",
   "bin": {

package/dist/chunk-JQL6X6FZ.js

@@ -1,59 +0,0 @@
-#!/usr/bin/env node
-
-// src/config.ts
-import { readFileSync, writeFileSync, mkdirSync, chmodSync, unlinkSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-var CONFIG_DIR = join(homedir(), ".rentline-sandbox");
-var CONFIG_FILE = join(CONFIG_DIR, "credentials.json");
-var DEFAULT_API_URL = "https://sandbox-api.rentline.xyz";
-function loadConfig() {
-  try {
-    const raw = readFileSync(CONFIG_FILE, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-function requireConfig() {
-  const cfg = loadConfig();
-  if (!cfg) {
-    console.error(
-      "Not authenticated. Run:\n\n  sandbox auth login --key <your-api-key>\n"
-    );
-    process.exit(1);
-  }
-  return cfg;
-}
-function saveConfig(cfg) {
-  mkdirSync(CONFIG_DIR, { recursive: true });
-  writeFileSync(CONFIG_FILE, JSON.stringify(cfg, null, 2), { mode: 384 });
-  try {
-    chmodSync(CONFIG_FILE, 384);
-  } catch {
-  }
-}
-function deleteConfig() {
-  try {
-    unlinkSync(CONFIG_FILE);
-  } catch {
-  }
-}
-function getApiUrl(override) {
-  const cfg = loadConfig();
-  return override || process.env.SANDBOX_API_URL || cfg?.api_url || DEFAULT_API_URL;
-}
-function getApiKey(override) {
-  const cfg = loadConfig();
-  return override || process.env.SANDBOX_API_KEY || cfg?.api_key;
-}
-
-export {
-  DEFAULT_API_URL,
-  loadConfig,
-  requireConfig,
-  saveConfig,
-  deleteConfig,
-  getApiUrl,
-  getApiKey
-};

package/dist/config-7QGCVVHS.js

@@ -1,58 +0,0 @@
-#!/usr/bin/env node
-
-// src/config.ts
-import { readFileSync, writeFileSync, mkdirSync, chmodSync, unlinkSync } from "fs";
-import { homedir } from "os";
-import { join } from "path";
-var CONFIG_DIR = join(homedir(), ".rentline-sandbox");
-var CONFIG_FILE = join(CONFIG_DIR, "credentials.json");
-var DEFAULT_API_URL = "https://sandbox-api.rentline.xyz";
-function loadConfig() {
-  try {
-    const raw = readFileSync(CONFIG_FILE, "utf-8");
-    return JSON.parse(raw);
-  } catch {
-    return null;
-  }
-}
-function requireConfig() {
-  const cfg = loadConfig();
-  if (!cfg) {
-    console.error(
-      "Not authenticated. Run:\n\n  sandbox auth login --key <your-api-key>\n"
-    );
-    process.exit(1);
-  }
-  return cfg;
-}
-function saveConfig(cfg) {
-  mkdirSync(CONFIG_DIR, { recursive: true });
-  writeFileSync(CONFIG_FILE, JSON.stringify(cfg, null, 2), { mode: 384 });
-  try {
-    chmodSync(CONFIG_FILE, 384);
-  } catch {
-  }
-}
-function deleteConfig() {
-  try {
-    unlinkSync(CONFIG_FILE);
-  } catch {
-  }
-}
-function getApiUrl(override) {
-  const cfg = loadConfig();
-  return override || process.env.SANDBOX_API_URL || cfg?.api_url || DEFAULT_API_URL;
-}
-function getApiKey(override) {
-  const cfg = loadConfig();
-  return override || process.env.SANDBOX_API_KEY || cfg?.api_key;
-}
-export {
-  DEFAULT_API_URL,
-  deleteConfig,
-  getApiKey,
-  getApiUrl,
-  loadConfig,
-  requireConfig,
-  saveConfig
-};

package/dist/config-YHSAFZLC.js

@@ -1,19 +0,0 @@
-#!/usr/bin/env node
-import {
-  DEFAULT_API_URL,
-  deleteConfig,
-  getApiKey,
-  getApiUrl,
-  loadConfig,
-  requireConfig,
-  saveConfig
-} from "./chunk-JQL6X6FZ.js";
-export {
-  DEFAULT_API_URL,
-  deleteConfig,
-  getApiKey,
-  getApiUrl,
-  loadConfig,
-  requireConfig,
-  saveConfig
-};