summer-engine 3.2.1 → 3.4.0

package/.claude-plugin/marketplace.json

@@ -11,8 +11,8 @@
     {
       "name": "summer",
       "source": "./",
-      "version": "3.2.1",
-      "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 101-tool MCP bridge to the local desktop app.",
+      "version": "3.4.0",
+      "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 105-tool MCP bridge to the local desktop app.",
       "author": {
         "name": "Summer Engine",
         "email": "founders@summerengine.com"

package/.claude-plugin/plugin.json

@@ -2,8 +2,8 @@
   "$schema": "https://json.schemastore.org/claude-code-plugin-manifest.json",
   "_generated": "GENERATED from integrations/claude — do not edit; npm run generate:registry",
   "name": "summer",
-  "version": "3.2.1",
-  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 101-tool MCP bridge to the local desktop app.",
+  "version": "3.4.0",
+  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 105-tool MCP bridge to the local desktop app.",
   "author": {
     "name": "Summer Engine",
     "email": "founders@summerengine.com",
@@ -38,6 +38,7 @@
     "./library/skills/asset-strategy/",
     "./library/skills/audio-direction/",
     "./library/skills/auto-fire-targeting/",
+    "./library/skills/bounded-engine-runs/",
     "./library/skills/brainstorm-game/",
     "./library/skills/brainstorming/",
     "./library/skills/browse-templates/",
@@ -49,6 +50,7 @@
     "./library/skills/character-portrait/",
     "./library/skills/cinematic-cutscene/",
     "./library/skills/combat-basics/",
+    "./library/skills/compatibility-renderer-traps/",
     "./library/skills/concept-art/",
     "./library/skills/create-asset-sheet/",
     "./library/skills/debug/",

package/.codex-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "_generated": "GENERATED from integrations/codex — do not edit; npm run generate:registry",
   "name": "summer",
-  "version": "3.2.1",
-  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 101-tool MCP bridge. Build games by talking.",
+  "version": "3.4.0",
+  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 105-tool MCP bridge. Build games by talking.",
   "author": {
     "name": "Summer Engine",
     "email": "founders@summerengine.com",
@@ -33,6 +33,7 @@
     "./library/skills/asset-strategy/",
     "./library/skills/audio-direction/",
     "./library/skills/auto-fire-targeting/",
+    "./library/skills/bounded-engine-runs/",
     "./library/skills/brainstorm-game/",
     "./library/skills/brainstorming/",
     "./library/skills/browse-templates/",
@@ -44,6 +45,7 @@
     "./library/skills/character-portrait/",
     "./library/skills/cinematic-cutscene/",
     "./library/skills/combat-basics/",
+    "./library/skills/compatibility-renderer-traps/",
     "./library/skills/concept-art/",
     "./library/skills/create-asset-sheet/",
     "./library/skills/debug/",
@@ -144,7 +146,7 @@
   "interface": {
     "displayName": "Summer",
     "shortDescription": "Superpowers for AI game dev. Build games by talking.",
-    "longDescription": "Summer turns Codex into a game-dev studio for Summer Engine. Users make Summer games with the Summer SDK and GDScript. The plugin adds game-dev skills, lifecycle hooks, and a 101-tool MCP bridge for guarded project files, scene editing, asset import, play mode, diagnostics, generation, and creator workflows. Git, shell, and grep stay with the host agent. Summer follows its upstream technical base continuously; version-sensitive work uses the bundled compatibility reference instead of a fixed onboarding version. Session-start orients the session. Pre-commit doctor (opt-in) blocks bad commits.",
+    "longDescription": "Summer turns Codex into a game-dev studio for Summer Engine. Users make Summer games with the Summer SDK and GDScript. The plugin adds game-dev skills, lifecycle hooks, and a 105-tool MCP bridge for guarded project files, scene editing, asset import, play mode, diagnostics, generation, and creator workflows. Git, shell, and grep stay with the host agent. Summer follows its upstream technical base continuously; version-sensitive work uses the bundled compatibility reference instead of a fixed onboarding version. Session-start orients the session. Pre-commit doctor (opt-in) blocks bad commits.",
     "developerName": "Summer Engine",
     "category": "Coding",
     "capabilities": [

package/.cursor-plugin/plugin.json

@@ -3,8 +3,8 @@
   "_generated": "GENERATED from integrations/cursor — do not edit; npm run generate:registry",
   "name": "summer",
   "displayName": "Summer",
-  "version": "3.2.1",
-  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 101-tool MCP bridge to the local desktop app.",
+  "version": "3.4.0",
+  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 105-tool MCP bridge to the local desktop app.",
   "author": {
     "name": "Summer Engine",
     "email": "founders@summerengine.com"
@@ -45,6 +45,7 @@
     "./library/skills/asset-strategy/",
     "./library/skills/audio-direction/",
     "./library/skills/auto-fire-targeting/",
+    "./library/skills/bounded-engine-runs/",
     "./library/skills/brainstorm-game/",
     "./library/skills/brainstorming/",
     "./library/skills/browse-templates/",
@@ -56,6 +57,7 @@
     "./library/skills/character-portrait/",
     "./library/skills/cinematic-cutscene/",
     "./library/skills/combat-basics/",
+    "./library/skills/compatibility-renderer-traps/",
     "./library/skills/concept-art/",
     "./library/skills/create-asset-sheet/",
     "./library/skills/debug/",

package/.factory-plugin/plugin.json

@@ -1,8 +1,8 @@
 {
   "_generated": "GENERATED from integrations/factory — do not edit; npm run generate:registry",
   "name": "summer",
-  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 101-tool MCP bridge to the local desktop app.",
-  "version": "3.2.1",
+  "description": "Agent tooling for Summer Engine: game-dev skills, lifecycle hooks, and a 105-tool MCP bridge to the local desktop app.",
+  "version": "3.4.0",
   "author": {
     "name": "Summer Engine",
     "email": "founders@summerengine.com",
@@ -30,6 +30,7 @@
     "./library/skills/asset-strategy/",
     "./library/skills/audio-direction/",
     "./library/skills/auto-fire-targeting/",
+    "./library/skills/bounded-engine-runs/",
     "./library/skills/brainstorm-game/",
     "./library/skills/brainstorming/",
     "./library/skills/browse-templates/",
@@ -41,6 +42,7 @@
     "./library/skills/character-portrait/",
     "./library/skills/cinematic-cutscene/",
     "./library/skills/combat-basics/",
+    "./library/skills/compatibility-renderer-traps/",
     "./library/skills/concept-art/",
     "./library/skills/create-asset-sheet/",
     "./library/skills/debug/",

package/CHANGELOG.md

@@ -2,6 +2,67 @@
 
 All notable changes to summer-engine will be documented here. Following [Keep a Changelog](https://keepachangelog.com/en/1.1.0/) and [Semantic Versioning](https://semver.org/).
 
+## [3.4.0] - 2026-10-09
+
+Publishing a game from your agent now works end to end, with fewer surprises:
+
+- Take store screenshots of real gameplay without opening the editor (`summer_capture_gameplay`).
+- Make store-size art: ask `summer_generate_image` for an aspect ratio or a size.
+- See the store tools as soon as your agent connects, and use them from the terminal (`summer tool`). `summer doctor` checks that the store accepts your sign-in.
+- An export tells you first when your Summer Engine is too old, shows the engine's real error when it fails, and lists the project files it changed.
+- A publish preview checks that the game exists before it asks you to confirm.
+- `summer install --path` installs Summer.app into the folder you name, and every command uses that engine.
+- New skills for running the engine safely from an agent and for games that also run on the Compatibility renderer.
+
+### Added
+- `summer_capture_gameplay` (CLI `summer tool capture-gameplay`): saves real gameplay frames (HUD included) without a running editor. It starts the game in the engine's offscreen verify instance (`--summer-verify`, real renderer, window offscreen, no focus, never `--headless`) at `resolution` (default `1920x1080`), waits `waitSeconds`, and saves `frames` PNGs to `<project>/.summer/captures/<time>/`. It imports a never-opened project first, passes `--summer-no-api`, and returns each frame's path with its real width and height. It warns when the stretch settings render another size.
+- `summer_generate_image` `aspectRatio` (1:1, 16:9, 9:16, 4:3, 3:4, 3:2, 2:3, 5:4, 4:5, 21:9) and `width` + `height` (64 to 4096), sent to the image route as top-level fields. The server picks a model that reaches the size, or refuses a named model that cannot, before any spend. The result reports the real size and the model. The `options` description now says what the server really does. Until the server side ships, the new fields are accepted and ignored.
+- `summer tool` runs a name that is not a local tool on the hosted Summer Engine MCP with the store sign-in (`summer tool summer_store_list_games`). `summer tool --list` lists the hosted tools after the local ones, or says to run `summer login --store`.
+- `summer doctor` store-access check: with a store sign-in it calls `summer_store_list_games` (8 s limit) and shows the answer, or the store's code, message and request id on a refusal. Without a sign-in it says only publishing needs one.
+- `summer doctor` shows the installed engine version and warns below 0.7.0, the first version that exports for summer.games.
+- Skills `bounded-engine-runs` (run the engine from an agent with a time limit, a memory cap, one engine per project, muted and offscreen) and `compatibility-renderer-traps` (Forward+ games that also run on Compatibility: the instance-uniform budget, black MultiMesh colors, sRGB vertex colors, paired captures).
+
+### Changed
+- With a store sign-in, the first `tools/list` waits up to 5 s for the hosted mount, so hosts that list tools once see the store tools. Without a sign-in nothing waits. A slower mount still adds them later.
+- `summer_export_game` reads the engine version before it writes any preset. Below 0.7.0 it stops with `engine_too_old` and says how to update; nothing is written to the project.
+- `summer_export_game` runs the engine with `--summer-no-api`, so an export no longer starts the local engine API. The result lists `projectChanges` (top-level files created, changed or deleted) and warns when the engine rewrote `project.godot`.
+- `summer_publish_build` checks the game in the store before the confirmation preview. An unknown id returns `game_not_found` with your real games. A platform the store page does not list returns a warning. The preview shows the game name and id.
+- `summer install --path` on macOS installs to `<dir>/Summer.app` (before, the bundle's contents went loose into the folder). Each install is recorded in `~/.summer/engine-install.json`, and run, doctor and export use that engine before the default locations. Without a terminal, progress prints one line per 10%. After an install, a note says the first start of a new engine version can take several minutes.
+- `export-and-ship` skill: store key art, covers and icons carry no text, logos or UI; screenshots are real gameplay and may show the game's own HUD. On the hosted-game error "is in the source graph's authority_engine domain", narrow the authority root in `source-domains.json`.
+- `concept-art` skill no longer says the aspect ratio cannot be set over MCP.
+
+### Fixed
+- `summer_export_game` failures show the engine's own `ERROR:` lines: the first three in the message, up to 20 in `detail.errors`, instead of a guess about an old engine. The old-engine hint appears only when the engine names a missing or invalid preset. A source-graph domain error gets its own recovery step.
+- `summer_publish_build` without a `gameId` says why the game list is missing (for example the store's 401 message). `store_auth_refused` carries the store's message and request id and no longer sends you to `summer login --store --force` first, which looped.
+- `gateway.url`, `creator.apiUrl` and the creator upload URL accept the IPv6 loopback (`http://[::1]:3000`) as local HTTP.
+- `in-game-purchases` skill: uses only engine APIs that exist. It no longer calls `Summer.client.store.request_sparks_purchase`, `check_sparks_purchase_readiness` or `Summer.authority.items.consume`, which the engine does not have. Short players get Sparks in the Summer app; an authority grants a paid effect after checking `Summer.authority.items.inventory_for_session` and recording the redemption in the player's secret player data.
+- `summer_api_docs`: the offline class reference is rebuilt from the engine's current class XML (1282 classes), so it now includes `SummerRuntime` (`Summer`), `Summer.client.*`, `Summer.authority.*` and the Summer SDK types.
+
+## [3.3.0] - 2026-10-09
+
+Your agent can now take a game from the editor to the Summer Games store:
+
+- Export for every platform the store takes: iPhone, Android, Mac, Windows and the web, as a summer.games bundle or as a store download.
+- Install the export templates for your engine version with one tool call. Each file is checked before it is installed.
+- Sign in to the store from the terminal with `summer login --store`.
+- Upload a build and publish it with `summer_publish_build`, after you confirm the game, file and version.
+- Use the Studio, board and store tools (projects, store page, art, build upload, send for the owner's approval, the board, Grow) through the one Summer Engine MCP. After the store sign-in, the local MCP loads the hosted tools, prompts and resources next to the engine tools.
+
+### Added
+- `summer_export_game` (preview): exports the game for summer.games with the installed Summer Engine, headless and without a window (`--headless --path <project> --export-release "summer.games" <out>.zip`), and returns the `.zip` path, sha256, size and the bundle manifest (main scene, target platforms, hosted or not). The default output is `<project>/.summer/exports/`, ignored by the editor and by git. No running editor and no export template are needed.
+- `summer_publish_build` (preview): uploads that `.zip` to the creator's game through the creator store routes Studio's export upload uses: declare the export, upload 64 MiB parts straight from disk to presigned URLs, seal, wait until Summer makes the Build, name its client pack, and with `publish: true` approve it. The first call returns the exact game, file, digest, size and version for the user to confirm. A retry with the same file and version continues the same upload. Defaults to the last export.
+- `summer login --store`: browser sign-in to the Summer store (OAuth 2.1 with PKCE and a loopback redirect) against the hosted MCP's authorization server. The CLI is one public client: it listens on a fixed loopback port (47615, 47616 or 47617), registers its client once per machine for exactly those redirects (`~/.summer/oauth-client`) and reuses it on later logins and refreshes; `--store --force` registers a new one. The token and its refresh token live in `~/.summer/oauth-token`; `summer logout` clears it.
+- `summer_export_game` `targets` and `format`: export in the exact file the Summer Games store takes per platform. `format: "bundle"` (default) makes the summer.games bundle for `ios`, `android`, `macos`, `windows` through a named `summer.games <targets>` preset written to `export_presets.cfg` (only its platform options are ever rewritten). `format: "download"` with one target makes the store's web build (`web`: an HTML5 `.zip` with `index.html` at the root, on Summer's WebGPU/JSPI Forward+ template, checked against the store's size limits; Compatibility-renderer projects are refused) or a desktop download (`macos`: ad hoc signed `.app` zip for `macos-universal`; `windows`: `.exe` with its pack embedded, zipped for `windows-x64`). Missing templates, platforms the installed engine cannot export and platforms the store will refuse come back as clear errors and warnings.
+- `summer_export_templates` (preview): `list` and `install` export templates from Summer's CDN (`<base>/<summerVersion>/manifest.json`, schema `summer.export-templates.v1`; `SUMMER_TEMPLATES_URL` overrides the base) into the folder the engine reads, `<data>/Godot/export_templates/<FULL_CONFIG>/`, each file sha256-checked before it is installed.
+- One Summer Engine MCP: with a store sign-in (`summer login --store`), the local MCP mounts the hosted Summer Engine MCP's tools, prompts and resources (mcp.summerengine.com: projects, store page, art, build upload, `summer_store_submit` for the owner's approval, the board, Grow, the publish-your-game, store-listing and store-art skills, the docs pointer) under their own names and forwards each call with that sign-in. A name the local MCP already has stays local. The mount runs after the server is up and never delays the engine tools; without a sign-in, `summer_store_tools` says how to sign in and mounts on the next call.
+- `summer_publish_build` uploads web builds and desktop downloads (`summer_export_game` `format: "download"`) as the game's store version for `web`, `macos-universal`, `windows-x64` or `linux-x64` (the store's second build path): create, upload parts from disk (16 MiB for web, 64 MiB for native), complete, wait until checked. The platform comes from the last export or `platform`. A retry continues an unfinished upload of the same file and version and skips the parts storage has. Web zips are checked first (`index.html` at the root, at most 2000 files, 500 MiB). On a game that is already live the store leaves finishing the upload to the owner, and the tool says so.
+
+### Fixed
+- `summer_publish_build` accepted only iPhone for a game without a server; the store also takes Android (summer-platform `StandaloneTargets`). It now accepts `ios` and `android` and declares exactly the bundle's platforms.
+
+### Deprecated
+- `summer_creator_publish` and `summer publish` (a `.pck` to the legacy Summercraft creator API with a separate `sc_` token). Use `summer_export_game`, then `summer_publish_build`.
+
 ## [3.2.1] - 2026-10-07
 
 ### Changed

package/README.md

@@ -97,7 +97,7 @@ The first invocation downloads the npm package transparently to npx's cache (~3
 
 Read the JSON output. **Top-level `ok: true` means "no check failed" — it does NOT mean Summer is installed.** A machine with no skills, no MCP config, and no login can report `ok: true` (those checks warn, they do not fail). So never skip Step 1 on `ok`: it is idempotent and fast. Use the `checks` array (each entry: `id`, `label`, `status` of `ok` / `warning` / `fail`, `message`, optional `details`) only to decide whether the expensive steps — engine download (Step 2) and browser login (Step 3) — are needed.
 
-The check ids are `node-version`, `cli-version`, `cli-version-current`, `skills-version-stale`, `login`, `engine-install`, `local-api`, `project-memory`, `mcp-boot`, and `mcp-tools-list`. For any check whose `status` is not `ok`, run the action in the table below, then re-run doctor.
+The check ids are `node-version`, `cli-version`, `cli-version-current`, `skills-version-stale`, `login`, `store-access`, `engine-install`, `local-api`, `project-memory`, `mcp-boot`, and `mcp-tools-list`. For any check whose `status` is not `ok`, run the action in the table below, then re-run doctor.
 
 | Check id | If `status` is `ok` | Action when attention is needed |
 |---|---|---|
@@ -106,6 +106,7 @@ The check ids are `node-version`, `cli-version`, `cli-version-current`, `skills-
 | `cli-version-current` | continue | run `npx clear-npx-cache && npx -y summer-engine@latest doctor --json` (forces a fresh resolve) |
 | `skills-version-stale` | run Step 1 anyway (idempotent) | run Step 1 (`--force` is already in the command) |
 | `login` | skip Step 3 | run Step 3 |
+| `store-access` | continue | only for publishing: surface the `message` (it carries the store's own reason); signing in again does not fix a refusal the store gives a valid sign-in |
 | `engine-install` | skip Step 2 | run Step 2 |
 | `local-api` | skip Step 5b wait-loop | expected before `summer run`; run the wait-loop after it |
 | `project-memory` | continue | if a project is open, use the `brainstorm-game` skill before building |
@@ -226,7 +227,7 @@ Only skip brainstorm if the user explicitly said "skip brainstorm" or "just buil
 |---|---|---|
 | **Create** | Available | Scaffold from a pinned template, build scenes and scripts through MCP, generate 2D/3D/audio/video assets, guided by the library. |
 | **Test** | Available | The verification ladder: compile checks, screenshots, live play with debugger reads, and input-driven probes (`RunVerification`) that press real keys and assert on real frames. |
-| **Publish** | Available (creator CLI) | `summer publish` streams an already-exported Summer `.pck` to the Summer Platform for review — explicit, confirmed, immutable releases with real history (`summer releases`). Nothing is ever submitted silently. |
+| **Publish** | Preview | `summer_export_game` exports the summer.games `.zip` with the installed engine (headless); `summer_publish_build` uploads it to your game's store listing after you confirm the exact game, file and version (sign in once with `summer login --store`). The older `summer publish` (`.pck` to the legacy creator API) is deprecated. Nothing is ever submitted silently. |
 | **Grow** | Direction | Store distribution, analytics, retention and live-ops tooling arrive as new library entries (the structure is built for it — lifecycle is metadata, not architecture). Not promised by this package today. |
 
 ## What's in this repo
@@ -321,6 +322,7 @@ We tell you before we touch your disk.
 | Summer Engine app | ~1 GB (engine + bundled Git/runtime tools) | `npx -y summer-engine@latest install` | Summer's signed releases |
 | Auth token | ~1 KB | `npx -y summer-engine@latest login` | Browser to `~/.summer/auth-token` |
 | Creator token | ~50 bytes | only when you run `summer login --creator` and mint one | One-time browser value to `~/.summer/creator-token`; never replaces the auth token |
+| Store sign-in | ~2 KB | only when you run `summer login --store` | Browser OAuth (PKCE, loopback port 47615-47617) to `~/.summer/oauth-token` with its refresh token, plus this machine's public client id in `~/.summer/oauth-client`; never replaces the auth token |
 | Skill files | small, bundled | in the npm package | no extra network call |
 | Generated assets (3D / image / audio / video) | varies | only on explicit `summer_generate_*` calls when that provider route is enabled for the account | Summer Engine Studio |
 | URL imports | varies | only on explicit `summer_import_from_url` calls | the URL you provide |
@@ -348,10 +350,11 @@ matchmaking are not promised by this package.
 |---|---|
 | `summer install [--yes]` | Download Summer Engine. Prints URL and size first; never replaces an installed engine without confirmation. |
 | `summer login` | Browser-based core Summer sign-in. |
-| `summer login --creator` | Open the Summer Platform token settings and securely connect a separate publish-scoped creator token. |
+| `summer login --store` | Browser sign-in to the Summer store so agents can upload builds (`summer_publish_build`). |
+| `summer login --creator` | Deprecated with `summer publish`: connect a separate publish-scoped creator token for the legacy creator API. |
 | `summer logout` | Clear auth tokens. |
 | `summer config [get\|set\|unset]` | Read or update the shared non-secret `~/.summer/config.json`. |
-| `summer publish [project] --artifact <game.pck> --version <value> [--confirm]` | Compute and show the exact immutable target; after approval, stream it through prepare → write-once PUT → finalize. |
+| `summer publish [project] --artifact <game.pck> --version <value> [--confirm]` | Deprecated: use `summer tool export-game`, then `summer tool publish-build`. Streams a `.pck` to the legacy creator API through prepare → write-once PUT → finalize. |
 | `summer releases [--cursor <value>]` | List real creator-owned release history. |
 | `summer status` | Engine state, port, auth. |
 | `summer doctor` | Diagnose Node, login, engine, project memory, MCP. |

package/dist/cli/commands/install.d.ts

@@ -44,6 +44,16 @@ export declare function replaceMacApp(mountPoint: string, destApp: string, exec:
  *  setup.exe CLI). The old NSIS flags (/S, /D=) are rejected by the Velopack
  *  installer with "unexpected argument '/S' found" — this is the wizard bug. */
 export declare function windowsInstallerArgs(customPath?: string): string;
+/** Printed after an install: the first start of a new engine is slow and silent. */
+export declare const FIRST_START_NOTE: string;
+/** Where the Velopack installer put Summer.exe: <dir>/current/Summer.exe for --path, else the default locations. */
+export declare function windowsInstalledBinary(customPath?: string, exists?: (path: string) => boolean): string | null;
+/**
+ * Download progress: rewrites one line on a terminal; elsewhere (an agent,
+ * a log file) one line per 10%, so a 1 GB download is about ten lines
+ * instead of hundreds of kilobytes.
+ */
+export declare function createProgressReporter(isTTY: boolean, write: (text: string) => void): (downloaded: number, total: number) => void;
 export declare const installCommand: Command;
 export declare function downloadFile(url: string, dest: string): Promise<{
     sha256: string;

package/dist/cli/commands/install.js

@@ -6,8 +6,8 @@ import { chmodSync, createWriteStream, existsSync, mkdirSync, readdirSync, renam
 import { pipeline } from "stream/promises";
 import { Readable } from "stream";
 import { tmpdir, platform } from "os";
-import { join, resolve } from "path";
-import { ENGINE_BINARY_ENV, LINUX_ENGINE_BINARY_NAME, findExtractedEngineBinary, linuxArchiveKind, linuxEngineInstallDir, pickLinuxReleaseAsset, resolveLinuxInstallSource, } from "../../core/engine-install.js";
+import { dirname, join, resolve } from "path";
+import { ENGINE_BINARY_ENV, LINUX_ENGINE_BINARY_NAME, macInstallDestination, recordEngineInstall, windowsEnginePaths, findExtractedEngineBinary, linuxArchiveKind, linuxEngineInstallDir, pickLinuxReleaseAsset, resolveLinuxInstallSource, } from "../../core/engine-install.js";
 const RELEASES_URL = "https://www.summerengine.com/api/desktop/releases";
 /** Guard a download URL from the releases endpoint. A missing/empty URL (an
  *  outdated or misconfigured endpoint) otherwise becomes a cryptic
@@ -116,9 +116,42 @@ async function confirm(question) {
 export function windowsInstallerArgs(customPath) {
     return customPath ? `--silent --installto "${customPath}"` : "--silent";
 }
+/** Printed after an install: the first start of a new engine is slow and silent. */
+export const FIRST_START_NOTE = "The first start of a new engine version can take several minutes with no output " +
+    "(the system checks the new app and the engine builds its caches). Later starts are fast.";
+/** Where the Velopack installer put Summer.exe: <dir>/current/Summer.exe for --path, else the default locations. */
+export function windowsInstalledBinary(customPath, exists = existsSync) {
+    const candidates = customPath
+        ? [join(customPath, "current", "Summer.exe"), join(customPath, "Summer.exe")]
+        : windowsEnginePaths();
+    return candidates.find((path) => exists(path)) ?? null;
+}
+/**
+ * Download progress: rewrites one line on a terminal; elsewhere (an agent,
+ * a log file) one line per 10%, so a 1 GB download is about ten lines
+ * instead of hundreds of kilobytes.
+ */
+export function createProgressReporter(isTTY, write) {
+    let lastStep = -1;
+    return (downloaded, total) => {
+        if (total <= 0)
+            return;
+        const pct = Math.min(100, Math.floor((downloaded / total) * 100));
+        const mb = (downloaded / 1024 / 1024).toFixed(1);
+        if (isTTY) {
+            write(`\r  ${pct}% (${mb}MB)`);
+            return;
+        }
+        const step = Math.floor(pct / 10);
+        if (step > lastStep) {
+            lastStep = step;
+            write(`  ${pct}% (${mb}MB)\n`);
+        }
+    };
+}
 export const installCommand = new Command("install")
     .description("Download and install Summer Engine")
-    .option("--path <dir>", "Custom install directory")
+    .option("--path <dir>", "Custom install directory (macOS: the engine goes in <dir>/Summer.app). summer remembers it, so later commands find this engine")
     .option("--yes", "Replace an already-installed engine without prompting")
     .action(async (opts) => {
     const os = platform();
@@ -160,7 +193,8 @@ async function installMac(releases, customPath, yes = false) {
     }
     const dmgUrl = requireDownloadUrl(info.dmg_url, "macOS DMG");
     console.log(`Latest version: ${info.version}`);
-    const destApp = customPath || "/Applications/Summer.app";
+    const destApp = macInstallDestination(customPath);
+    const destBinary = join(destApp, "Contents", "MacOS", "Summer");
     const exists = existsSync(destApp);
     const installedVersion = exists ? readMacBundleVersion(destApp) : null;
     const plan = planMacInstall({
@@ -171,6 +205,7 @@ async function installMac(releases, customPath, yes = false) {
         isTTY: Boolean(process.stdin.isTTY),
     });
     if (plan.action === "up-to-date") {
+        await recordEngineInstall(destBinary, plan.version);
         console.log(`Summer Engine v${plan.version} is already installed at ${destApp} (up to date).`);
         return;
     }
@@ -218,6 +253,7 @@ async function installMac(releases, customPath, yes = false) {
     }
     try {
         console.log("Installing to " + destApp + "...");
+        mkdirSync(dirname(destApp), { recursive: true });
         replaceMacApp(mountPoint, destApp, (command) => execSync(command, { stdio: "ignore" }));
         console.log("Done!");
     }
@@ -235,7 +271,9 @@ async function installMac(releases, customPath, yes = false) {
         catch { }
         releaseSignals();
     }
+    await recordEngineInstall(destBinary, info.version);
     console.log(`\nSummer Engine v${info.version} installed to ${destApp}`);
+    console.log(FIRST_START_NOTE);
     console.log("\nNext steps:");
     console.log("  summer login    # Sign in to your account");
     console.log("  summer run      # Launch the engine");
@@ -276,7 +314,11 @@ async function installWindows(releases, customPath) {
         execSync(`del "${exePath}"`, { stdio: "ignore" });
     }
     catch { }
-    console.log(`\nSummer Engine v${info.version} installed!`);
+    const installed = windowsInstalledBinary(customPath);
+    if (installed)
+        await recordEngineInstall(installed, info.version);
+    console.log(`\nSummer Engine v${info.version} installed${installed ? ` to ${installed}` : "!"}`);
+    console.log(FIRST_START_NOTE);
     console.log("\nNext steps:");
     console.log("  summer login    # Sign in to your account");
     console.log("  summer run      # Launch the engine");
@@ -338,6 +380,7 @@ async function installLinux(customPath) {
     const source = resolveLinuxInstallSource();
     if (source.kind === "binary") {
         registerExistingLinuxBinary(source.path, destDir, destBinary);
+        await recordEngineInstall(destBinary, null);
         printLinuxNextSteps(destBinary);
         return;
     }
@@ -409,7 +452,9 @@ async function installLinux(customPath) {
     finally {
         rmSync(downloadPath, { force: true });
     }
+    await recordEngineInstall(destBinary, versionLabel === "custom" ? null : versionLabel);
     console.log(`\nSummer Engine (${versionLabel}) installed to ${destBinary}`);
+    console.log(FIRST_START_NOTE);
     printLinuxNextSteps(destBinary);
 }
 function printLinuxNextSteps(binary) {
@@ -433,15 +478,15 @@ export async function downloadFile(url, dest) {
     const hash = createHash("sha256");
     let downloaded = 0;
     const total = parseInt(res.headers.get("content-length") || "0", 10);
+    const isTTY = Boolean(process.stdout.isTTY);
+    const report = createProgressReporter(isTTY, (text) => process.stdout.write(text));
     readable.on("data", (chunk) => {
         hash.update(chunk);
         downloaded += chunk.length;
-        if (total > 0) {
-            const pct = Math.round((downloaded / total) * 100);
-            process.stdout.write(`\r  ${pct}% (${(downloaded / 1024 / 1024).toFixed(1)}MB)`);
-        }
+        report(downloaded, total);
     });
     await pipeline(readable, fileStream);
-    process.stdout.write("\n");
+    if (isTTY)
+        process.stdout.write("\n");
     return { sha256: hash.digest("hex") };
 }

package/dist/cli/commands/login.js

@@ -3,6 +3,7 @@ import { randomUUID } from "crypto";
 import open from "open";
 import { getAuthToken, getCreatorToken, saveCreatorToken, saveLoginSession, } from "../../core/auth.js";
 import { getCreatorApiUrl, resolveGatewayUrl } from "../../core/config.js";
+import { readStoredOAuthToken, runStoreLogin } from "../../core/oauth.js";
 const POLL_INTERVAL_MS = 2000;
 // One generous window on ONE session id. First-time users may need to create an
 // account and confirm an email before they can approve the CLI. The gateway
@@ -14,8 +15,19 @@ const HEARTBEAT_MS = 30000;
 export const loginCommand = new Command("login")
     .description("Sign in to Summer Engine via your browser")
     .option("--creator", "Connect a separately scoped Summercraft creator token for publishing")
+    .option("--store", "Sign in to the Summer store so agents can upload builds (summer_publish_build)")
     .option("--force", "Force re-authentication even if already logged in")
     .action(async (opts) => {
+    if (opts.store) {
+        if ((await readStoredOAuthToken()) && !opts.force) {
+            console.log("Already signed in to the Summer store. Use --store --force to sign in again.");
+            return;
+        }
+        // --force also registers a new client, the way back if this machine's was removed.
+        await runStoreLogin({ fetch, now: Date.now, openUrl: open, log: console.log, newClient: Boolean(opts.force) });
+        console.log("Signed in to the Summer store. Your core Summer login was not changed.");
+        return;
+    }
     if (opts.creator) {
         const existingCreator = await getCreatorToken();
         if (existingCreator && !opts.force) {

package/dist/cli/commands/publish.js

@@ -1,7 +1,7 @@
 import { Command } from "commander";
 import { publishCreator } from "../../core/capabilities/creator.js";
 export const publishCommand = new Command("publish")
-    .description("Publish a confirmed creator release")
+    .description("Deprecated: publish a .pck to the legacy creator API (use `summer tool export-game`, then `summer tool publish-build`)")
     .argument("[project]", "Project root. Defaults to the current directory.")
     .requiredOption("--artifact <path>", "Exact exported Summer .pck artifact")
     .requiredOption("--version <value>", "Immutable release version")
@@ -11,6 +11,7 @@ export const publishCommand = new Command("publish")
     .option("--notes <text>", "Release notes")
     .option("--confirm", "Confirm the exact project and channel after reviewing them")
     .action(async (project, opts) => {
+    console.error("summer publish is deprecated: run `summer tool export-game`, then `summer tool publish-build`, to upload the summer.games .zip to your game.");
     const result = await publishCreator({
         project,
         ...opts,

package/dist/cli/commands/tool.d.ts

@@ -1,5 +1,12 @@
 import { Command } from "commander";
 import { type ToolDispatchEntry } from "../../core/capabilities/tool-dispatch.js";
+import { callHostedToolForCli, listHostedToolsForCli, type HostedToolsListing } from "../../core/hosted-mcp.js";
+/** The hosted store and publishing tools (Summer Engine MCP); replaceable in tests. */
+export declare const hostedCli: {
+    list: typeof listHostedToolsForCli;
+    call: typeof callHostedToolForCli;
+};
+export declare function formatHostedToolList(listing: HostedToolsListing): string;
 /** Resolve a name through the compiled registry index when it exists —
  *  accepts full ids ("tool/add-node") and legacy aliases, returning the slug
  *  the dispatch table knows. Returns null when the index is absent or the

package/dist/cli/commands/tool.js

@@ -14,6 +14,25 @@ import { PACKAGE_ROOT } from "../../core/package-root.js";
 import { Command, Option } from "commander";
 import { ToolDispatchError, ToolResultError, dispatchTool, listToolDispatches, resolveToolDispatch, } from "../../core/capabilities/tool-dispatch.js";
 import { c } from "../../core/format.js";
+import { callHostedToolForCli, hostedResultPayload, listHostedToolsForCli, } from "../../core/hosted-mcp.js";
+/** The hosted store and publishing tools (Summer Engine MCP); replaceable in tests. */
+export const hostedCli = { list: listHostedToolsForCli, call: callHostedToolForCli };
+const STORE_SIGN_IN_HINT = "Store and publishing tools (summer_store_*, summer_upload_image_*, summer_list_projects, ...) come from the hosted Summer Engine MCP: run 'summer login --store' to use them here.";
+export function formatHostedToolList(listing) {
+    if (listing.status === "not_signed_in")
+        return c.dim(STORE_SIGN_IN_HINT);
+    if (listing.status === "unavailable")
+        return c.dim(`Store and publishing tools: the hosted Summer Engine MCP did not answer (${listing.message}).`);
+    const local = new Set(listToolDispatches().map((entry) => `summer_${entry.slug.replace(/-/g, "_")}`));
+    const tools = listing.tools.filter((tool) => !local.has(tool.name)).sort((a, b) => a.name.localeCompare(b.name));
+    if (!tools.length)
+        return c.dim("Store and publishing tools: none listed by the hosted Summer Engine MCP.");
+    const width = Math.max(...tools.map((tool) => tool.name.length));
+    return [
+        c.bold(`Store and publishing tools (${tools.length}, hosted, with your store sign-in)`),
+        ...tools.map((tool) => `  ${tool.name.padEnd(width)}  ${(tool.description ?? "").split(/(?<=\.)\s/)[0].slice(0, 120)}`),
+    ].join("\n");
+}
 /** Resolve a name through the compiled registry index when it exists —
  *  accepts full ids ("tool/add-node") and legacy aliases, returning the slug
  *  the dispatch table knows. Returns null when the index is absent or the
@@ -86,6 +105,8 @@ export const toolCommand = new Command("tool")
     .action(async (name, options) => {
     if (options.list || name === undefined) {
         console.log(formatToolList(listToolDispatches()));
+        console.log("");
+        console.log(formatHostedToolList(await hostedCli.list()));
         if (name === undefined && !options.list) {
             console.log("");
             console.log(c.dim("Pass a tool name to run one."));
@@ -94,7 +115,21 @@ export const toolCommand = new Command("tool")
     }
     const entry = resolveToolForCli(name);
     if (!entry) {
-        throw new ToolDispatchError(`Unknown tool "${name}". Run 'summer tool --list' to see all ${listToolDispatches().length} tools.`);
+        // Not a local tool: the hosted store and publishing tools, with the store sign-in.
+        const hosted = await hostedCli.call(name, parseJsonArgs(options.args ?? options.json));
+        if (hosted.status === "called") {
+            const payload = hostedResultPayload(hosted.result);
+            console.log(payload.json ? JSON.stringify(payload.json, null, 2) : payload.text);
+            if (payload.isError)
+                process.exitCode = 1;
+            return;
+        }
+        const why = hosted.status === "not_signed_in"
+            ? ` ${STORE_SIGN_IN_HINT}`
+            : hosted.status === "unavailable"
+                ? ` The hosted Summer Engine MCP did not answer: ${hosted.message}.`
+                : "";
+        throw new ToolDispatchError(`Unknown tool "${name}". Run 'summer tool --list' to see every tool.${why}`);
     }
     if (options.json !== undefined && options.args === undefined) {
         console.error("Note: 'summer tool --json <args>' is deprecated; use --args <json>.");

package/dist/core/auth.js

@@ -6,6 +6,8 @@ const LEGACY_CLOUD_TOKEN_FILE = "cloud-token";
 const CREATOR_TOKEN_FILE = "creator-token";
 const USER_FILE = "user.json";
 const METADATA_FILE = "credential-metadata.json";
+/** The Summer store OAuth token (core/oauth.ts OAUTH_TOKEN_FILE). */
+const STORE_OAUTH_TOKEN_FILE = "oauth-token";
 function decodeJwtMetadata(token, explicitScopes = []) {
     const payload = decodeJwtPayload(token);
     const aud = payload.aud;
@@ -194,6 +196,7 @@ export async function clearAuthCredentials() {
         AUTH_TOKEN_FILE,
         LEGACY_CLOUD_TOKEN_FILE,
         CREATOR_TOKEN_FILE,
+        STORE_OAUTH_TOKEN_FILE,
         USER_FILE,
         METADATA_FILE,
     ]) {

package/dist/core/capabilities/audit/args.d.ts

@@ -34,11 +34,11 @@ export declare const sceneAuditShape: {
         key: z.ZodString;
         reason: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        reason: string;
         key: string;
-    }, {
         reason: string;
+    }, {
         key: string;
+        reason: string;
     }>, "many">>;
     show_accepted: z.ZodOptional<z.ZodBoolean>;
     render: z.ZodOptional<z.ZodEnum<["sheet", "none"]>>;
@@ -55,38 +55,38 @@ export declare const sceneAuditArgsSchema: z.ZodObject<{
         key: z.ZodString;
         reason: z.ZodString;
     }, "strict", z.ZodTypeAny, {
-        reason: string;
         key: string;
-    }, {
         reason: string;
+    }, {
         key: string;
+        reason: string;
     }>, "many">>;
     show_accepted: z.ZodOptional<z.ZodBoolean>;
     render: z.ZodOptional<z.ZodEnum<["sheet", "none"]>>;
 }, "strict", z.ZodTypeAny, {
-    limit?: number | undefined;
-    root?: string | undefined;
-    scenePath?: string | undefined;
     accept?: {
-        reason: string;
         key: string;
+        reason: string;
     }[] | undefined;
+    limit?: number | undefined;
+    root?: string | undefined;
+    scenePath?: string | undefined;
     render?: "none" | "sheet" | undefined;
-    checks?: ("through_hole" | "floor_gap" | "floating" | "sunken" | "interpenetration" | "exposed_edge" | "open_fixture_end" | "orientation" | "uv_stretch" | "duplicate" | "z_fight" | "depth_step" | "lights" | "transform" | "resource")[] | undefined;
+    checks?: ("resource" | "through_hole" | "floor_gap" | "floating" | "sunken" | "interpenetration" | "exposed_edge" | "open_fixture_end" | "orientation" | "uv_stretch" | "duplicate" | "z_fight" | "depth_step" | "lights" | "transform")[] | undefined;
     min_severity?: "error" | "warn" | "look" | undefined;
     offset?: number | undefined;
     budget_ms?: number | undefined;
     show_accepted?: boolean | undefined;
 }, {
-    limit?: number | undefined;
-    root?: string | undefined;
-    scenePath?: string | undefined;
     accept?: {
-        reason: string;
         key: string;
+        reason: string;
     }[] | undefined;
+    limit?: number | undefined;
+    root?: string | undefined;
+    scenePath?: string | undefined;
     render?: "none" | "sheet" | undefined;
-    checks?: ("through_hole" | "floor_gap" | "floating" | "sunken" | "interpenetration" | "exposed_edge" | "open_fixture_end" | "orientation" | "uv_stretch" | "duplicate" | "z_fight" | "depth_step" | "lights" | "transform" | "resource")[] | undefined;
+    checks?: ("resource" | "through_hole" | "floor_gap" | "floating" | "sunken" | "interpenetration" | "exposed_edge" | "open_fixture_end" | "orientation" | "uv_stretch" | "duplicate" | "z_fight" | "depth_step" | "lights" | "transform")[] | undefined;
     min_severity?: "error" | "warn" | "look" | undefined;
     offset?: number | undefined;
     budget_ms?: number | undefined;