summer-engine 2.7.0 → 2.8.0

package/dist/mcp/tools/creator-tools.js

@@ -0,0 +1,105 @@
+import { z } from "zod";
+import { CreatorOperationError, listCreatorReleases, publishCreator, readCreatorLogs, } from "../../lib/creator.js";
+import { CONFIG_KEYS, getConfigValue, isConfigKey, readSummerConfig, setConfigValue, unsetConfigValue, } from "../../lib/config.js";
+function textJson(value, isError = false) {
+    return {
+        content: [
+            {
+                type: "text",
+                text: JSON.stringify(value, null, 2),
+            },
+        ],
+        ...(isError ? { isError: true } : {}),
+    };
+}
+async function creatorResult(operation) {
+    try {
+        return textJson(await operation());
+    }
+    catch (error) {
+        if (error instanceof CreatorOperationError) {
+            return textJson({
+                ok: false,
+                code: error.code,
+                operation: error.operation,
+                message: error.message,
+                recovery: error.recovery,
+            }, true);
+        }
+        return textJson({
+            ok: false,
+            code: "creator_request_invalid",
+            message: error instanceof Error ? error.message : String(error),
+        }, true);
+    }
+}
+export function registerCreatorTools(server) {
+    server.tool("summer_creator_publish", "Publish an exact exported Summer .pck through the versioned Summercraft creator API. First call with confirm=false and present the returned project, version, digest, size, artifact path, channel, and notes; set confirm only after the user approves that exact target. The server independently verifies token scope, ownership, bytes, and review state.", {
+        project: z.string().optional().describe("Project root. Defaults to the current working directory."),
+        artifact: z.string().describe("Exact path to the exported Summer .pck artifact."),
+        version: z.string().describe("Immutable release version."),
+        manifest: z.string().optional().describe("Optional path to a JSON release manifest."),
+        projectId: z.string().optional().describe("Creator project ID. Defaults to ~/.summer/config.json."),
+        channel: z.string().optional().describe("Release channel. Defaults to the configured channel or production."),
+        notes: z.string().optional().describe("Release notes shown during confirmation and recorded in the local audit."),
+        confirm: z.boolean().default(false).describe("Set true only after the user approves the exact release target."),
+    }, async (args) => creatorResult(() => publishCreator({
+        ...args,
+        face: "mcp",
+    })));
+    server.tool("summer_creator_releases", "List real creator-owned releases from the versioned Summercraft creator API. The server independently verifies the exact publish scope and project ownership.", {
+        projectId: z.string().optional().describe("Creator project ID. Defaults to ~/.summer/config.json."),
+        limit: z.number().int().min(1).max(100).default(20),
+        cursor: z.string().optional().describe("Opaque nextCursor from the previous page."),
+    }, async (args) => creatorResult(() => listCreatorReleases({
+        ...args,
+        face: "mcp",
+    })));
+    server.tool("summer_creator_logs", "Read creator runtime logs for a project or release. If the required platform route or token scope is unavailable, returns the exact recovery action instead of placeholder logs.", {
+        projectId: z.string().optional().describe("Creator project ID. Defaults to ~/.summer/config.json."),
+        releaseId: z.string().optional().describe("Optional release ID."),
+        limit: z.number().int().min(1).max(1000).default(100),
+    }, async (args) => creatorResult(() => readCreatorLogs({
+        ...args,
+        face: "mcp",
+    })));
+    server.tool("summer_creator_config", "Read or update the shared non-secret ~/.summer configuration used by the CLI and this MCP. Mutations require confirm=true. Tokens are never returned or accepted by this tool.", {
+        action: z.enum(["list", "get", "set", "unset"]),
+        key: z.enum(CONFIG_KEYS).optional(),
+        value: z.string().optional(),
+        confirm: z.boolean().default(false),
+    }, async ({ action, key, value, confirm }) => creatorResult(async () => {
+        if (action === "list") {
+            const config = await readSummerConfig();
+            return {
+                ok: true,
+                values: Object.fromEntries(CONFIG_KEYS.map((name) => [
+                    name,
+                    getConfigValue(config, name) ?? null,
+                ])),
+            };
+        }
+        if (!key || !isConfigKey(key)) {
+            throw new Error(`A valid key is required. Recovery: use one of ${CONFIG_KEYS.join(", ")}.`);
+        }
+        if (action === "get") {
+            return {
+                ok: true,
+                key,
+                value: getConfigValue(await readSummerConfig(), key) ?? null,
+            };
+        }
+        if (!confirm) {
+            throw new Error(`Changing ${key} requires confirmation. Recovery: show the exact change to the user, then retry with confirm=true.`);
+        }
+        if (action === "set") {
+            if (value === undefined) {
+                throw new Error(`A value is required for ${key}. Recovery: provide value and retry with confirm=true.`);
+            }
+            const config = await setConfigValue(key, value);
+            return { ok: true, key, value: getConfigValue(config, key) };
+        }
+        const config = await unsetConfigValue(key);
+        return { ok: true, key, value: getConfigValue(config, key) ?? null };
+    }));
+}

package/dist/mcp/tools/generate-tools.js

@@ -274,7 +274,9 @@ Known models:
   - "nano-banana-2" (default) — High quality, supports txt2img and img2img
   - "gemini-flash" — Google Gemini 2.5 Flash, fast
   - "flux-2" — FLUX.2, good for specific styles
-  - Any fal-ai model ID works as a passthrough
+
+Model ids are an ALLOWLIST, not a passthrough. An unrecognised id is rejected
+with 400 and the response lists every accepted id — it is not silently swapped.
 
 Two modes:
   - txt2img (default): just pass prompt
@@ -371,8 +373,12 @@ Capabilities:
   - "music" — Generate background music. Requires 'prompt'. Optional 'durationSeconds'.
   - "text_to_dialogue" — Multi-voice dialogue. Requires 'inputs' array of {text, voiceId} objects.
 
-The 'options' object is passed directly to ElevenLabs, so you can set any
-provider-specific parameter: stability, similarity_boost, style, speed, etc.
+The 'options' object is spread into the ElevenLabs SDK call at the TOP level, so
+only keys the SDK accepts there have any effect. Voice tuning is NOT top-level and
+is NOT snake_case: pass it as options.voiceSettings with camelCase keys —
+{ voiceSettings: { stability, similarityBoost, style, speed, useSpeakerBoost } }.
+Flat snake_case keys are accepted by the schema, silently dropped by the SDK, and
+return a normal 200 with the setting ignored.
 
 Returns the generated audio URL and asset metadata.
 Cloud tool — runs on Summer's servers and works WITHOUT the Summer Engine app open.
@@ -407,7 +413,9 @@ Requires authentication: run 'npx summer-engine login' first.`, {
         options: z
             .record(z.any())
             .optional()
-            .describe("Provider-specific params (stability, similarity_boost, style, speed, etc.)"),
+            .describe("Provider params, spread at the SDK's top level. Voice tuning goes in " +
+            "options.voiceSettings with camelCase keys (stability, similarityBoost, " +
+            "style, speed, useSpeakerBoost); flat snake_case is silently ignored."),
     }, async ({ capability, text, prompt, voiceId, modelId, durationSeconds, inputs, options }) => {
         const body = { capability };
         if (text)
@@ -439,7 +447,9 @@ Available models:
   - "hunyuan" (default) — Hunyuan 3D v3.1 Pro, high quality
   - "trellis" — Trellis 2, fast and detailed
   - "meshy" — Meshy, legacy option
-  - Any fal-ai model ID works as a passthrough
+
+Model ids are an ALLOWLIST, not a passthrough. An unrecognised id is rejected
+with 400 listing the accepted ids.
 
 Available kinds:
   - "text-to-3d" (default) — From text description. Requires 'prompt'.
@@ -699,7 +709,7 @@ Cost: ~$0.10 per clip. Confirm with user before spending.
 
 Custom prompt-driven motion is on the roadmap; not yet shipped. For one-off
 signature moves not on the curated list, fall back to hand-authoring in the
-Godot editor or importing from Mixamo.
+Summer Engine or importing from Mixamo.
 
 Cloud tool — runs on Summer's servers and works WITHOUT the Summer Engine app open.
 Requires authentication: run 'npx summer-engine login' first.`, {

package/dist/mcp/tools/project-tools.js

@@ -180,10 +180,12 @@ anti-patterns, and recovery steps.`, {}, async () => ({
                             "summer_stop  -> stop when runtime verification is finished; editor scene mutations are not categorically blocked by a running game, but an existing game instance may need a restart to observe them",
                         ],
                         "4_interactive": [
-                            "To prove input-driven behavior (does jump/move/shoot actually work), you have two routes when the engine build supports them (both go through summer_batch as raw ops — see rawOpsViaBatch):",
-                            "SimulateInput: inject a single action/key/mouse/axis into the RUNNING game, then re-check screenshot/debugger. Requires summer_play first.",
-                            "RunVerification: spawn a hidden, disposable game instance that runs a GDScript probe (press inputs, read state, save frames) and dies — never touches the user's editor. Returns results.json + frames. Best for a scripted 'does X happen when I do Y' assertion.",
-                            "If neither op is available on this engine build (failure_reason:'unsupported' or an unknown-op error comes back), do NOT fake it — ask the user to try the interaction and report what they see.",
+                            "To prove input-driven behavior (does jump/move/shoot actually work), use RunVerification. It is the ONLY interactive route available to MCP, and it is a real one — do NOT hand this rung to the user.",
+                            "RunVerification: spawn a hidden, disposable game instance that runs a GDScript probe (press inputs, read state, save frames) and dies — never touches the user's editor. Returns results.json + frames. Send it as a raw op through summer_batch (see rawOpsViaBatch).",
+                            "Unlike the editor's own --headless mode, the verify instance renders REAL PIXELS, so save_frame() writes a real image and Performance.TIME_FPS reports a real number.",
+                            "press()/key() are COROUTINES — 'await press(\"move_right\", 500)' or the hold never elapses and the input does nothing.",
+                            "Assert on physics-frame-derived state (positions after N 'await get_tree().physics_frame'), which is reproducible. press(hold_ms) waits on wall clock, so distance-travelled jitters run to run — assert 'moved more than X', never an exact value.",
+                            "SimulateInput is NOT reachable from MCP — see rawOpsViaBatch. Do not attempt it as a fallback.",
                         ],
                     },
                     // HONESTY — mirror the in-product agent's vision rules. A capture is
@@ -217,8 +219,10 @@ anti-patterns, and recovery steps.`, {}, async () => ({
                     // engine ops that have no dedicated tool are still reachable.
                     rawOpsViaBatch: [
                         "summer_batch runs an array of raw engine ops in one undo group; each op is passed through untouched, so newer engine ops with no dedicated tool are still callable.",
-                        "SimulateInput (drive the RUNNING game): summer_batch ops:[{op:'SimulateInput', type:'action', action:'jump', pressed:true}]. type is 'action' | 'key' | 'mouse_click' | 'axis'. summer_play first. Structured failure_reasons (incl 'unsupported' on older builds) come back verbatim — surface them.",
-                        "RunVerification (hidden probe instance): summer_batch ops:[{op:'RunVerification', probe_source:'<gdscript>', max_seconds:20}]. probe_source extends SummerProbeBase and uses report()/save_frame()/press()/key()/finish(); returns {ok, results, frames, out_dir} or {ok:false, failure_reason: spawn_failed|timeout|bad_args|no_project}.",
+                        "RunVerification (hidden probe instance): summer_batch ops:[{op:'RunVerification', probe_source:'<gdscript>', max_seconds:20}]. probe_source extends SummerProbeBase and uses report()/save_frame()/press()/key()/finish(); returns {ok, results, frames, out_dir} or {ok:false, failure_reason: spawn_failed|timeout|bad_args|no_project|probe_not_node}.",
+                        "SimulateInput is NOT reachable this way, on any engine build. It needs the in-editor chat bridge's async reply channel; every queued caller (MCP, CLI) is answered with {ok:false, failure_reason:'unsupported_transport'}. Use RunVerification's press()/key() instead.",
+                        "WriteFile and ReplaceText are rejected here by design — use summer_write_file / summer_replace_text so project identity, content guards and same-file ordering are enforced.",
+                        "You do not need an engine op to run a shell command: your own host already has a shell. The engine binary that runs project scripts is at OS.get_executable_path() (on macOS, /Applications/Summer.app/Contents/MacOS/Summer); see the summer-cli headless-scripting skill.",
                         "These are runtime ops, not scene mutations — the batch undo group is a harmless no-op for them.",
                     ],
                     recovery: [
@@ -228,7 +232,8 @@ anti-patterns, and recovery steps.`, {}, async () => ({
                         "If save fails: use the returned scenePath/error to repair the exact cause. A running game alone is not a generic scene-mutation blocker.",
                         "If a mutation is rejected with identity_mismatch: the engine switched projects — call summer_get_project_context to rebind (only if you meant to follow it), then retry.",
                         "If a guarded file mutation is rejected with content mismatch: call summer_read_file again, review the new content, and retry with its new sha256 only if the edit is still valid.",
-                        "If a run op or SimulateInput returns 'unsupported' / an unknown-op error: this engine build predates it — fall back to summer_play + summer_get_debugger_errors, or ask the user to interact.",
+                        "If a run op returns 'unsupported' / an unknown-op error: this engine build predates it — fall back to summer_play + summer_get_debugger_errors.",
+                        "If SimulateInput returns 'unsupported_transport': that is permanent for MCP, not a build gap. Rewrite the check as a RunVerification probe.",
                     ],
                     debugging: [
                         "Set SUMMER_MCP_DEBUG=1 in the MCP server's environment to log a structured stderr line per tool call (tool, ok, durationMs, terminalState, errorClass, failureReason, retried, boundProjectIdHash). With the flag OFF, only failures are logged. Use it to see exactly which op failed and why.",

package/dist/mcp/tools/scene-tools.js

@@ -120,7 +120,7 @@ Common node types:
 The parent path uses "./" prefix for relative paths from scene root. E.g., "./World" means the "World" child of the root node.`, {
         scenePath: z.string().describe("Target scene path, e.g. 'res://main.tscn'"),
         parent: z.string().describe("Parent node path, e.g. './World' or './World/Enemies'"),
-        type: z.string().describe("Godot node type, e.g. 'MeshInstance3D', 'CharacterBody3D'"),
+        type: z.string().describe("Summer Engine node type, e.g. 'MeshInstance3D', 'CharacterBody3D'"),
         name: z.string().describe("Name for the new node, e.g. 'Player', 'MainCamera'"),
     }, async ({ scenePath, parent, type, name }) => withEngine(async (client) => executeSceneMutation(client, scenePath, [{ op: "AddNode", parent, type, name }])));
     server.tool("summer_set_prop", `Set a property on a node. This is the primary way to configure nodes after adding them.
@@ -147,7 +147,7 @@ COMMON PROPERTIES:
         scenePath: z.string().describe("Target scene path, e.g. 'res://main.tscn'"),
         path: z.string().describe("Node path, e.g. './World/Player'"),
         key: z.string().describe("Property name, e.g. 'position', 'mesh', 'visible'"),
-        value: z.union([z.string(), z.number(), z.boolean()]).describe("Value in Godot string format for complex types, native JSON for primitives"),
+        value: z.union([z.string(), z.number(), z.boolean()]).describe("Value in Summer Engine variant-string format for complex types, native JSON for primitives"),
     }, async ({ scenePath, path, key, value }) => withEngine(async (client) => executeSceneMutation(client, scenePath, [{ op: "SetProp", path, key, value }])));
     server.tool("summer_set_resource_property", `Set a nested property on a resource attached to a node.
 
@@ -159,7 +159,7 @@ Use when you need to modify a sub-property of a resource, like:
         nodePath: z.string().describe("Node path, e.g. './Player/CollisionShape3D'"),
         resourceProperty: z.string().describe("Resource property on the node, e.g. 'shape', 'mesh', 'material_override'"),
         subProperty: z.string().describe("Property on the resource, e.g. 'size', 'radius', 'albedo_color'"),
-        value: z.union([z.string(), z.number(), z.boolean()]).describe("Value in Godot string format"),
+        value: z.union([z.string(), z.number(), z.boolean()]).describe("Value in Summer Engine variant-string format"),
     }, async ({ scenePath, nodePath, resourceProperty, subProperty, value }) => withEngine(async (client) => executeSceneMutation(client, scenePath, [
         { op: "SetResourceProperty", nodePath, resourceProperty, subProperty, value },
     ])));
@@ -260,9 +260,9 @@ Each op in the array uses the same format as the individual tools:
 - {"op": "SetProp", "path": "Floor", "key": "mesh", "value": "PlaneMesh"}
 - {"op": "SetResourceProperty", "nodePath": "Floor", "resourceProperty": "mesh", "subProperty": "size", "value": "Vector2(20, 20)"}
 
-RAW RUNTIME OPS (interactive verification — engine-build dependent; structured failure_reason incl "unsupported" passes through verbatim):
-- SimulateInput — drive the RUNNING game (summer_play first): {"op": "SimulateInput", "type": "action", "action": "jump", "pressed": true}. type is "action" | "key" | "mouse_click" | "axis".
-- RunVerification — spawn a hidden, disposable game instance that runs a GDScript probe and dies (never touches the editor): {"op": "RunVerification", "probe_source": "extends SummerProbeBase\\nfunc _ready(): await super._ready(); report('ok', true); finish()", "max_seconds": 20}. Returns {ok, results, frames, out_dir}. Probe API: report()/save_frame()/press()/key()/finish().
+RAW RUNTIME OPS (interactive verification — structured failure_reason passes through verbatim):
+- RunVerification — spawn a hidden, disposable game instance that runs a GDScript probe and dies (never touches the editor): {"op": "RunVerification", "probe_source": "extends SummerProbeBase\\nfunc _ready(): await super._ready(); report('ok', true); finish()", "max_seconds": 20}. Returns {ok, results, frames, out_dir}. Probe API: report()/save_frame()/press()/key()/finish(). This is the ONLY way to drive input from MCP, and unlike the editor it renders real pixels, so save_frame() produces a real image.
+- SimulateInput is NOT reachable from MCP or the CLI. It requires the in-editor chat bridge's async reply channel; every queued caller gets {"ok": false, "failure_reason": "unsupported_transport"} on every engine build. Do not send it and do not treat that reply as a version problem — use RunVerification's press()/key() instead.
 
 Do not mix OpenScene with scene mutations in one batch. OpenScene is a UI action;
 send it separately. scenePath selects every mutation target. The tool appends one

package/dist/mcp/tools/visual-tools.js

@@ -10,14 +10,15 @@ import { withEngine } from "./with-engine.js";
 export function registerVisualTools(server) {
     server.tool("summer_screenshot", `Capture a frame from Summer Engine and return it as an image you can look at directly.
 
-Use this to visually verify your work: scene layout, asset placement, scale, framing, lighting, materials, missing/untextured assets, or runtime gameplay state. You see the actual pixels — no description layer in between.
+Use this to visually verify your work: scene layout, asset placement, scale, framing, missing/untextured assets, or runtime gameplay state. You see the actual pixels — no description layer in between. Lighting and materials are only truthfully shown by the "viewport" and "game" targets — see the note on "scene" below.
 
 target:
   "viewport" (default) — the editor's CURRENT view (whatever scene/tab is open). No game boot. Use for edit-time checks of how the scene looks right now.
-  "scene" — an OFFSCREEN render of a scene file (no game boot; physics/particles/animations are static at t=0). Optionally pass scenePath/framing/size/nodePath. Use for a quick composed look at a scene without touching the editor's open tab.
+  "scene" — an OFFSCREEN render of a scene file (no game boot; physics/particles/animations are static at t=0). Optionally pass scenePath/framing/size/nodePath. Use for COMPOSITION, SCALE and FRAMING without touching the editor's open tab.
+    It does NOT use the scene's environment/sky, and it injects a synthetic camera and light when the scene has none. The scene's WorldEnvironment — sky, fog, tonemap, glow, SSAO, ambient — is replaced by a flat preview environment. So this target CANNOT verify lighting, mood, or any material property that depends on the environment: change them and the frame comes back identical. For those, boot the game or run a RunVerification probe, whose instance renders the real environment.
   "game" — a frame from the RUNNING game (real runtime state). Start the game first (summer_play). Not available over a plain local connection — needs the Summer desktop app bridge.
 
-Static frame only — one moment, not motion. If a game capture is unavailable, use "viewport" or "scene", or ask the user to share a screenshot of the running game.`, {
+Static frame only — one moment, not motion. For a SEQUENCE of frames over time, or for anything lighting-dependent when the desktop bridge is unavailable, use a RunVerification probe's save_frame() — its instance has a real renderer.`, {
         target: z
             .enum(["viewport", "scene", "game"])
             .optional()

package/hooks/session-start.sh

@@ -3,7 +3,7 @@
 #
 # Event:    SessionStart (matcher: startup|clear|compact)
 # Purpose:  Orient Claude on every fresh Summer-enabled session.
-#           Detect Godot project + GameSoul + doctor health, surface a one-line
+#           Detect Summer project + GameSoul + doctor health, surface a one-line
 #           Bob-style greeting as additional context.
 #
 # Input:    JSON on stdin with { session_id, source, model, cwd, ... }
@@ -36,7 +36,7 @@ else
     LINES+=("Summer ready.")
 fi
 
-# Line 2: Godot project + GameSoul one-liner (only if project.godot exists)
+# Line 2: Summer project + GameSoul one-liner (only if project.godot exists)
 if [ -f "${PROJECT_DIR}/project.godot" ]; then
     PROJECT_NAME=$(grep -E '^config/name=' "${PROJECT_DIR}/project.godot" 2>/dev/null \
         | head -1 | sed 's/^config\/name=//;s/^"//;s/"$//')
@@ -48,12 +48,12 @@ if [ -f "${PROJECT_DIR}/project.godot" ]; then
         SOUL_LINE=$(awk 'BEGIN{p=""} /^[^#[:space:]]/ && NF>0 {p=$0; exit} END{print p}' \
             "$SOUL_FILE" 2>/dev/null | cut -c1-120)
         if [ -n "$SOUL_LINE" ]; then
-            LINES+=("Godot project: ${PROJECT_NAME}. GameSoul: ${SOUL_LINE}")
+            LINES+=("Summer project: ${PROJECT_NAME}. GameSoul: ${SOUL_LINE}")
         else
-            LINES+=("Godot project: ${PROJECT_NAME}.")
+            LINES+=("Summer project: ${PROJECT_NAME}.")
         fi
     else
-        LINES+=("Godot project: ${PROJECT_NAME}.")
+        LINES+=("Summer project: ${PROJECT_NAME}.")
     fi
 fi
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "summer-engine",
-  "version": "2.7.0",
+  "version": "2.8.0",
   "description": "Local Summer CLI and MCP server for Summer Engine. Install and run the engine, connect Claude Code, Cursor, Codex, Gemini, and other agents, and build real games with bundled skills, hooks, and plugins.",
   "keywords": [
     "summer-engine",
@@ -41,6 +41,7 @@
   "files": [
     "dist/",
     "skills/",
+    "references/",
     "commands/",
     "hooks/",
     "assets/",
@@ -65,6 +66,7 @@
     "dev": "tsc --watch",
     "summer": "node dist/bin/summer.js",
     "test": "vitest run",
+    "test:public-language": "vitest run src/lib/public-surface-language.test.ts",
     "test:watch": "vitest",
     "prepublishOnly": "npm run build && npm test"
   },

package/references/collaborative-protocol.md

@@ -0,0 +1,50 @@
+# Collaborative Protocol — "May I write?"
+
+> Every Summer skill must follow this. The agent works *with* the user, not around them.
+
+## The rule
+
+**Before any user-visible write step, the agent must explicitly state what it is about to do and ask permission to proceed.**
+
+This applies to:
+- Creating files (`.gd`, `.tscn`, `.tres`, JSON, configs)
+- Modifying existing files (especially `.gd` and `.tscn`)
+- Running irreversible operations (deletion, reset, force-overwrite)
+- Setting up project-wide settings (`project.godot`)
+- Installing tools, libraries, or templates
+
+Reading is unconditional. Inspection, scene-tree walks, diagnostics — never need permission.
+
+## Phrasing
+
+Plain, short, action-first. Examples:
+
+> May I create `scenes/player.tscn` and add a CharacterBody3D + Camera3D?
+
+> I'm about to overwrite `levels/level_01.tscn`. The current version has 14 nodes — I'll preserve them and add the new lighting setup. Continue?
+
+> May I attach `scripts/player_controller.gd` to `./World/Player`?
+
+> I'm going to bind `move_forward`, `move_back`, `move_left`, `move_right`, `jump`. OK?
+
+## What this prevents
+
+1. **Silent overwrites.** The agent stomps the user's hand-edited script.
+2. **Cascading scope creep.** A "small fix" turns into a 30-file refactor.
+3. **Unclear state.** The user has no idea what changed when something breaks.
+4. **Trust loss.** One unauthorized edit and the user stops trusting the agent.
+
+## What this is NOT
+
+- Not a confirmation dialog for every property change in a single skill execution. Group related writes into one ask: "I'm about to add the player root, attach the controller script, and bind 5 input actions. OK?"
+- Not a request for design input. The skill should know what to do; the ask is for permission, not direction.
+- Not a stop on simple read-only ops or single-property tweaks the user clearly directed.
+
+## Linter check
+
+The `workflow/skill-test/SKILL.md` static linter looks for the phrases:
+- "May I" / "May I write" / "May I create" / "May I attach"
+- "I'm about to"
+- "Continue?" / "OK?" / "Proceed?"
+
+A skill that mutates files but never says any of these fails the linter.

package/references/gd-style.md

@@ -0,0 +1,121 @@
+# GDScript Style — Summer Conventions
+
+> The bar for GDScript in Summer. Skills should produce code that matches this. Where Godot's official style guide is silent, this is the tiebreaker.
+
+## File structure
+
+```gdscript
+class_name PlayerController
+extends CharacterBody3D
+
+# 1. Constants
+const SPEED := 5.0
+const JUMP_VELOCITY := 4.5
+const GRAVITY := 9.8
+
+# 2. Exports (designer-tweakable in inspector)
+@export var move_speed: float = 5.0
+@export var jump_height: float = 1.0
+@export_range(0.1, 10.0) var look_sensitivity: float = 1.0
+
+# 3. Signals (events this node emits)
+signal died
+signal health_changed(new_value: int)
+
+# 4. Onready references (cached node lookups)
+@onready var camera: Camera3D = $Camera3D
+@onready var collision: CollisionShape3D = $CollisionShape3D
+
+# 5. Private state (snake_case, leading underscore optional)
+var _is_grounded: bool = false
+var _velocity := Vector3.ZERO
+
+# 6. Lifecycle (in canonical order)
+func _ready() -> void:
+    pass
+
+func _process(delta: float) -> void:
+    pass
+
+func _physics_process(delta: float) -> void:
+    pass
+
+func _input(event: InputEvent) -> void:
+    pass
+
+# 7. Public API (PascalCase or snake_case methods, snake_case for funcs)
+func take_damage(amount: int) -> void:
+    pass
+
+# 8. Private helpers (leading underscore)
+func _calculate_movement(delta: float) -> Vector3:
+    return Vector3.ZERO
+```
+
+## Type hints
+
+**Always type-hint.** No bare `var x = 5`. Use `:=` for inferred typing or `:` for explicit.
+
+```gdscript
+# RIGHT
+var speed: float = 5.0
+var name := "Player"
+func attack(target: Node3D, amount: int) -> bool:
+    return true
+
+# WRONG
+var speed = 5.0
+func attack(target, amount):
+    return true
+```
+
+## Naming
+
+| Thing | Convention | Example |
+|---|---|---|
+| Class | PascalCase | `class_name PlayerController` |
+| File | snake_case | `player_controller.gd` |
+| Variable, function | snake_case | `move_speed`, `take_damage()` |
+| Constant | SCREAMING_SNAKE_CASE | `const MAX_HEALTH := 100` |
+| Signal | snake_case (past tense for events) | `died`, `health_changed` |
+| Private | leading underscore | `_is_grounded`, `_calculate_movement` |
+| Node in scene | PascalCase | `Player`, `Camera3D`, `CollisionShape3D` |
+
+## Signals
+
+Define with typed args. Connect in `_ready()` or in scene `.tscn` directly.
+
+```gdscript
+signal health_changed(new_value: int, max_value: int)
+
+func _ready() -> void:
+    health_changed.connect(_on_health_changed)
+
+func _on_health_changed(new_value: int, max_value: int) -> void:
+    pass
+```
+
+## Tweens
+
+Use `create_tween()` for animation. Don't manually lerp in `_process` unless you need fine control.
+
+```gdscript
+var tween := create_tween()
+tween.tween_property(self, "modulate", Color.WHITE, 0.3)
+```
+
+## What to avoid
+
+- Bare `var x = something` (no type)
+- `Object` typed parameters (use specific class)
+- `match` for two-branch logic (use `if`)
+- Recreating node lookups in `_process` (cache via `@onready`)
+- Hard-coded strings for node paths in code (use `@onready` + scene-relative paths)
+- Setting `position` in `_process` for physics objects (use `_physics_process` and `velocity`)
+
+## See also
+
+- [Official Godot GDScript style guide](https://docs.godotengine.org/en/stable/tutorials/scripting/gdscript/gdscript_styleguide.html)
+- `scripting-patterns/gdscript-patterns/SKILL.md` — patterns and idioms
+- `scripting-patterns/signal-patterns/SKILL.md` — signal usage
+- `scripting-patterns/state-machine-patterns/SKILL.md` — state machine patterns

package/references/godot-version.md

@@ -0,0 +1,51 @@
+# Summer Engine Compatibility Reference
+
+> Read this before writing version-sensitive code, especially shaders,
+> rendering code, extensions, or export configuration.
+
+## Current technical base
+
+Summer Engine is the product. Its current upstream technical base is **4.6.1**
+(stable, Mono), the approved next target is **4.7.1**, and Summer follows
+upstream continuously. These are compatibility and lineage facts. They are not
+the Summer product name or a permanent SDK version.
+
+The repository source of truth is
+`compatibility/summer-engine.json`. The running engine also reports its measured
+technical version:
+
+```bash
+<engineBinaryPath> --version      # measured: 4.6.1.stable.mono.custom_build.b708b1182
+```
+
+Get `engineBinaryPath` from `summer_get_project_context`. Prefer live
+inspection to a copied version string. Creator onboarding and headlines should
+say Summer Engine, Summer game, Summer SDK, and GDScript. Use the upstream name
+only where technical compatibility, migration, extension APIs, contribution
+routing, attribution, or licensing requires it.
+
+## LLM training cutoff versus upstream releases
+
+| Domain | Godot 4.x churn | Action |
+|---|---|---|
+| Scripting (GDScript core) | low | Trust your training. Spot-check signatures only when something feels off. |
+| Scene / node tree APIs | low | Trust your training. |
+| Renderer (`RenderingServer`, `Compositor`) | high in 4.4 / 4.5 | Verify before writing. Check `MovieMaker`, `Compositor` effects, `RenderSceneBuffers` — these renamed/added recently. |
+| Shaders (`canvas_item`, `spatial`, `compute`) | medium | Built-in functions stable, but `hint_*` flags shifted. Verify `hint_screen_texture` / `hint_depth_texture` syntax. |
+| Animation (`AnimationTree`, `AnimationMixer`) | high (4.0 → 4.3 rename) | Use `AnimationMixer` for new code, not deprecated `AnimationPlayer`-as-mixer. |
+| Multiplayer (`MultiplayerAPI`) | medium | High-level API stable. `SceneReplicationConfig` settled in 4.0+. |
+| Editor / EditorPlugin | medium | Spot-check. |
+| `Tween` / `SceneTreeTween` | low | Stable since 4.0. |
+
+## Summer-specific deltas from the upstream engine
+
+- Local API server runs on `localhost:6550` (set per machine via `~/.summer/api-token`).
+- Engine ships a webview module in `modules/1summer_engine/`. Do not assume the
+  unmodified upstream editor for UI patches.
+- Project root contains `.summer/` for project memory; do not delete it.
+
+## When in doubt
+
+1. Use Summer MCP tools (`summer_inspect_node`, `summer_inspect_resource`) to read live editor state instead of guessing.
+2. Use `summer_get_diagnostics` after every scene change.
+3. Check `references/mcp-tools-reference.md` for the canonical tool list.