summer-engine 3.5.0 → 3.5.2

package/dist/installer/agent-table.js

@@ -108,7 +108,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_CLAUDE_CONFIG_FILE",
         format: "json-stdio",
-        remoteMcp: { format: "json-http", signIn: (name) => `In Claude Code, run /mcp, choose ${name} and sign in.` },
+        remoteMcp: {
+            entry: (url) => ({ type: "http", url }),
+            signIn: (name) => `In Claude Code, run /mcp, choose ${name} and sign in.`,
+        },
         mcp: { user: home(".claude.json"), project: project(".mcp.json") },
         restart: "Restart Claude Code or run /mcp in a new session.",
         skills: skillDirs(home(".claude", "skills"), project(".claude", "skills")),
@@ -120,6 +123,7 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_CLAUDE_DESKTOP_CONFIG_FILE",
         format: "json",
+        // No Summer Games entry: Claude Desktop's file takes local servers only; remote ones are added as Connectors in its settings.
         mcp: {
             user: (ctx) => join(appConfigRoot(ctx), "Claude", "claude_desktop_config.json"),
             project: null,
@@ -136,7 +140,7 @@ const SPECS = [
         envOverride: "SUMMER_CODEX_CONFIG_FILE",
         format: "toml",
         remoteMcp: {
-            format: "toml-url",
+            entry: (url) => ({ url }),
             signIn: (name) => `In Codex, run /mcp login ${name} (or \`codex mcp login ${name}\` in a terminal) and sign in.`,
         },
         mcp: {
@@ -154,10 +158,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_CURSOR_MCP_CONFIG_FILE",
         format: "json-stdio",
-        // No remoteMcp (Summer Games) yet: Cursor's fallback OAuth flow registers
-        // cursor://anysphere.cursor-mcp/oauth/callback, which api.summer.games
-        // refuses (summer-platform#1681 allows it). Add { format: "json-url" }
-        // ({ mcpServers: { <name>: { url } } }) once that is live.
+        remoteMcp: {
+            entry: (url) => ({ url }),
+            signIn: (name) => `In Cursor Settings, open MCP and click Connect (or Authenticate) next to ${name}.`,
+        },
         mcp: { user: home(".cursor", "mcp.json"), project: project(".cursor", "mcp.json") },
         restart: "Restart Cursor and enable the summer-engine MCP server if prompted.",
         skills: sharedSkills({
@@ -173,6 +177,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_WINDSURF_MCP_CONFIG_FILE",
         format: "json",
+        remoteMcp: {
+            entry: (url) => ({ serverUrl: url }),
+            signIn: (name) => `Devin Desktop opens summer.games in your browser the first time ${name} connects; sign in there.`,
+        },
         mcp: {
             user: home(".codeium", "windsurf", "mcp_config.json"),
             project: null,
@@ -187,6 +195,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_ANTIGRAVITY_CONFIG_FILE",
         format: "json",
+        remoteMcp: {
+            entry: (url) => ({ serverUrl: url }),
+            signIn: (name) => `In Antigravity, open Settings > Customizations, choose Authenticate next to ${name}, sign in on summer.games, then paste the code back and choose Submit.`,
+        },
         mcp: {
             user: home(".gemini", "config", "mcp_config.json"),
             project: project(".agents", "mcp_config.json"),
@@ -202,6 +214,7 @@ const SPECS = [
         legacyNote: "Gemini CLI was retired for individual accounts on 2026-06-18 and replaced by Antigravity. Use `summer setup antigravity` unless you are on a Workspace/enterprise Gemini CLI.",
         envOverride: "SUMMER_GEMINI_CONFIG_FILE",
         format: "json-gemini",
+        // No Summer Games entry: legacy target; use antigravity.
         mcp: {
             user: home(".gemini", "extensions", "summer-engine", "gemini-extension.json"),
             project: null,
@@ -216,6 +229,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_CLINE_CONFIG_FILE",
         format: "json",
+        remoteMcp: {
+            entry: (url) => ({ type: "streamableHttp", url }),
+            signIn: (name) => `In Cline, open MCP Servers and click Authenticate next to ${name}.`,
+        },
         mcp: {
             user: (ctx) => vsCodeGlobalStorage(ctx, "saoudrizwan.claude-dev", "cline_mcp_settings.json"),
             project: null,
@@ -230,6 +247,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_CLINE_CLI_CONFIG_FILE",
         format: "json",
+        remoteMcp: {
+            entry: (url) => ({ type: "streamableHttp", url }),
+            signIn: (name) => `Run \`cline mcp\`, pick ${name} and choose Authorize OAuth.`,
+        },
         mcp: { user: home(".cline", "data", "settings", "cline_mcp_settings.json"), project: null },
         restart: "Restart the Cline CLI so it reloads its MCP settings.",
         skills: skillDirs(home(".cline", "skills"), project(".cline", "skills")),
@@ -242,6 +263,7 @@ const SPECS = [
         legacyNote: "Roo Code shut down on 2026-05-15. The extension may still run, but it is no longer maintained; consider Cline or Kilo Code.",
         envOverride: "SUMMER_ROO_CODE_CONFIG_FILE",
         format: "json",
+        // No Summer Games entry: Roo Code has no OAuth sign-in for remote MCP servers.
         mcp: {
             user: (ctx) => vsCodeGlobalStorage(ctx, "rooveterinaryinc.roo-cline", "cline_mcp_settings.json"),
             project: null,
@@ -261,6 +283,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_KILO_CODE_CONFIG_FILE",
         format: "json-opencode",
+        remoteMcp: {
+            entry: (url) => ({ type: "remote", url }),
+            signIn: (name) => `In Kilo, click the sign-in notice for ${name} (Kilo CLI: \`kilo mcp auth ${name}\`).`,
+        },
         mcp: {
             user: (ctx) => join(xdgOrAppData(ctx), "kilo", "kilo.json"),
             project: project("kilo.json"),
@@ -275,6 +301,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_GITHUB_COPILOT_CONFIG_FILE",
         format: "json-copilot",
+        remoteMcp: {
+            entry: (url) => ({ type: "http", url, tools: ["*"] }),
+            signIn: (name) => `Copilot CLI opens summer.games to sign in when ${name} first connects; /mcp signs in again.`,
+        },
         mcp: { user: home(".copilot", "mcp-config.json"), project: project(".mcp.json") },
         restart: "Restart Copilot CLI, or run /mcp reload and /skills reload in the active session.",
         skills: skillDirs(home(".copilot", "skills"), project(".github", "skills")),
@@ -286,6 +316,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_VSCODE_COPILOT_CONFIG_FILE",
         format: "json-vscode",
+        remoteMcp: {
+            entry: (url) => ({ type: "http", url }),
+            signIn: (name) => `In VS Code, click Allow when ${name} asks to authenticate, then sign in on summer.games.`,
+        },
         mcp: { user: (ctx) => join(vsCodeUserDir(ctx), "mcp.json"), project: project(".vscode", "mcp.json") },
         restart: "Restart VS Code or run MCP: List Servers, then start summer-engine in Copilot Agent mode.",
         skills: sharedSkills({ legacyDirs: { user: home(".copilot", "skills"), project: project(".github", "skills") } }),
@@ -297,6 +331,7 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_VISUAL_STUDIO_CONFIG_FILE",
         format: "json-vscode",
+        // No Summer Games entry: Visual Studio's OAuth redirect for MCP is not documented; not checked against api.summer.games.
         mcp: { user: home(".mcp.json"), project: project(".mcp.json") },
         restart: "Restart Visual Studio, open Copilot Chat in Agent mode, and enable summer-engine in the tools picker.",
         skills: null,
@@ -309,6 +344,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_COPILOT_JETBRAINS_CONFIG_FILE",
         format: "json-servers",
+        remoteMcp: {
+            entry: (url) => ({ url }),
+            signIn: (name) => `In your JetBrains IDE, click OK when ${name} asks to authenticate, then sign in on summer.games.`,
+        },
         mcp: {
             user: (ctx) => join(xdgOrAppData(ctx), "github-copilot", "intellij", "mcp.json"),
             project: null,
@@ -324,6 +363,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_OPENCODE_CONFIG_FILE",
         format: "json-opencode",
+        remoteMcp: {
+            entry: (url) => ({ type: "remote", url }),
+            signIn: (name) => `Run \`opencode mcp auth ${name}\`; it opens summer.games to sign in.`,
+        },
         mcp: {
             user: (ctx) => join(xdgOrAppData(ctx), "opencode", "opencode.json"),
             project: project("opencode.json"),
@@ -342,6 +385,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_ZED_CONFIG_FILE",
         format: "json-zed",
+        remoteMcp: {
+            entry: (url) => ({ url }),
+            signIn: (name) => `In Zed, open the agent settings and click Authenticate next to ${name}.`,
+        },
         mcp: {
             user: (ctx) => join(xdgOrAppData(ctx), "zed", "settings.json"),
             project: null,
@@ -356,6 +403,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_KIRO_CONFIG_FILE",
         format: "json",
+        remoteMcp: {
+            entry: (url) => ({ url }),
+            signIn: (name) => `Kiro opens summer.games to sign in when ${name} connects (Kiro CLI: /mcp auth).`,
+        },
         mcp: { user: home(".kiro", "settings", "mcp.json"), project: project(".kiro", "settings", "mcp.json") },
         restart: "Kiro reloads MCP config on save; open the MCP Servers view to confirm summer-engine is connected.",
         skills: skillDirs(home(".kiro", "skills"), project(".kiro", "skills")),
@@ -367,6 +418,19 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_GOOSE_CONFIG_FILE",
         format: "yaml-goose",
+        remoteMcp: {
+            entry: (url) => ({
+                type: "streamable_http",
+                name: "summer-games",
+                description: "Summer Games: friends, parties and messages as you",
+                uri: url,
+                enabled: true,
+                timeout: 300,
+                env_keys: [],
+                envs: {},
+            }),
+            signIn: (name) => `Goose opens summer.games to sign in when the ${name} extension starts.`,
+        },
         mcp: {
             user: (ctx) => ctx.os === "win32"
                 ? join(appData(ctx), "Block", "goose", "config", "config.yaml")
@@ -383,6 +447,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_HERMES_CONFIG_FILE",
         format: "yaml-hermes",
+        remoteMcp: {
+            entry: (url) => ({ url, auth: "oauth" }),
+            signIn: (name) => `Run \`hermes mcp login ${name}\`, or sign in on summer.games when Hermes first connects.`,
+        },
         mcp: { user: home(".hermes", "config.yaml"), project: null },
         restart: "Run /reload-mcp in Hermes Agent (or restart it).",
         skills: skillDirs(home(".hermes", "skills"), SHARED_SKILLS_PROJECT, {
@@ -397,6 +465,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_TRAE_CONFIG_FILE",
         format: "json",
+        remoteMcp: {
+            entry: (url) => ({ url }),
+            signIn: (name) => `Trae opens summer.games to sign in when ${name} connects.`,
+        },
         mcp: {
             user: null,
             project: project(".trae", "mcp.json"),
@@ -413,6 +485,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_QWEN_CODE_CONFIG_FILE",
         format: "json",
+        remoteMcp: {
+            entry: (url) => ({ httpUrl: url }),
+            signIn: (name) => `In Qwen Code, run /mcp auth ${name} and sign in.`,
+        },
         mcp: { user: home(".qwen", "settings.json"), project: project(".qwen", "settings.json") },
         restart: "Restart Qwen Code or run /mcp in a new session.",
         skills: skillDirs(home(".qwen", "skills"), project(".qwen", "skills")),
@@ -424,6 +500,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_KIMI_CODE_CONFIG_FILE",
         format: "json",
+        remoteMcp: {
+            entry: (url) => ({ url, auth: "oauth" }),
+            signIn: (name) => `Run \`kimi mcp auth ${name}\`; it opens summer.games to sign in.`,
+        },
         mcp: { user: home(".kimi-code", "mcp.json"), project: project(".kimi-code", "mcp.json") },
         restart: "Restart Kimi Code CLI so it reconnects its MCP servers.",
         skills: sharedSkills({ legacyDirs: { user: home(".kimi-code", "skills"), project: project(".kimi-code", "skills") } }),
@@ -435,6 +515,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_CRUSH_CONFIG_FILE",
         format: "json-crush",
+        remoteMcp: {
+            entry: (url) => ({ type: "http", url, oauth: true }),
+            signIn: (name) => `Crush opens summer.games to sign in when ${name} connects.`,
+        },
         mcp: {
             user: home(".config", "crush", "crushrc"),
             project: project(".crushrc"),
@@ -449,6 +533,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_AMP_CONFIG_FILE",
         format: "json-amp",
+        remoteMcp: {
+            entry: (url) => ({ url }),
+            signIn: (name) => `Amp opens summer.games to sign in for ${name} when it starts.`,
+        },
         mcp: { user: (ctx) => join(xdgOrAppData(ctx), "amp", "settings.json"), project: null },
         restart: "Restart Amp so it reloads settings.json.",
         skills: sharedSkills({ legacyDirs: { user: (ctx) => join(xdgOrAppData(ctx), "amp", "skills"), project: null } }),
@@ -460,6 +548,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_FACTORY_CONFIG_FILE",
         format: "json-stdio",
+        remoteMcp: {
+            entry: (url) => ({ type: "http", url }),
+            signIn: (name) => `In Droid, run /mcp, choose ${name} and Authenticate.`,
+        },
         mcp: { user: home(".factory", "mcp.json"), project: project(".factory", "mcp.json") },
         restart: "Restart droid or run /mcp in the active session.",
         skills: sharedSkills({ legacyDirs: { user: home(".factory", "skills"), project: project(".factory", "skills") } }),
@@ -471,6 +563,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_JUNIE_CONFIG_FILE",
         format: "json",
+        remoteMcp: {
+            entry: (url) => ({ url }),
+            signIn: (name) => `In Junie, run /mcp, open ${name} and choose Authorize.`,
+        },
         mcp: { user: home(".junie", "mcp", "mcp.json"), project: project(".junie", "mcp", "mcp.json") },
         restart: "Restart the JetBrains IDE so Junie reloads its MCP config.",
         skills: null,
@@ -483,6 +579,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_WARP_CONFIG_FILE",
         format: "json",
+        remoteMcp: {
+            entry: (url) => ({ url }),
+            signIn: (name) => `Warp opens summer.games to sign in when ${name} starts.`,
+        },
         mcp: { user: home(".warp", ".mcp.json"), project: project(".warp", ".mcp.json") },
         restart: "Warp detects the file and spawns the server; check Settings > AI > MCP servers.",
         skills: sharedSkills({ legacyDirs: { user: home(".warp", "skills"), project: project(".warp", "skills") } }),
@@ -494,6 +594,7 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_ROVO_DEV_CONFIG_FILE",
         format: "json-transport",
+        // No Summer Games entry: Rovo Dev CLI has no OAuth sign-in for remote MCP servers (headers only).
         mcp: { user: home(".rovodev", "mcp.json"), project: null },
         restart: "Restart Rovo Dev CLI so it reconnects its MCP servers.",
         skills: sharedSkills({ legacyDirs: { user: home(".rovodev", "skills"), project: project(".rovodev", "skills") } }),
@@ -505,6 +606,7 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_QODER_CONFIG_FILE",
         format: "json",
+        // No Summer Games entry: Qoder's remote-server fields in settings.json are not documented.
         mcp: { user: home(".qoder", "settings.json"), project: project(".mcp.json") },
         restart: "Restart Qoder CLI so it reloads its MCP settings (the Qoder IDE manages servers in its UI).",
         skills: skillDirs(home(".qoder", "skills"), project(".qoder", "skills")),
@@ -516,6 +618,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_GROK_BUILD_CONFIG_FILE",
         format: "toml",
+        remoteMcp: {
+            entry: (url) => ({ url }),
+            signIn: (name) => `In Grok Build, run /mcps, select ${name} and press i to sign in.`,
+        },
         mcp: { user: home(".grok", "config.toml"), project: project(".grok", "config.toml") },
         restart: "Restart Grok Build so it reloads config.toml (it also reads ~/.claude.json and .cursor/mcp.json).",
         skills: sharedSkills({ legacyDirs: { user: home(".grok", "skills"), project: project(".grok", "skills") } }),
@@ -527,6 +633,10 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_MISTRAL_VIBE_CONFIG_FILE",
         format: "toml-array",
+        remoteMcp: {
+            entry: (url) => ({ name: "summer-games", transport: "streamable-http", url, auth: { type: "oauth", scopes: [] } }),
+            signIn: (name) => `In Vibe, run /mcp login ${name}.`,
+        },
         mcp: { user: home(".vibe", "config.toml"), project: project(".vibe", "config.toml") },
         restart: "Restart Vibe so it reloads config.toml.",
         skills: skillDirs(home(".vibe", "skills"), SHARED_SKILLS_PROJECT, { legacyDirs: { user: home(".vibe", "skills"), project: project(".vibe", "skills") } }),
@@ -538,6 +648,7 @@ const SPECS = [
         status: "active",
         envOverride: "SUMMER_LM_STUDIO_CONFIG_FILE",
         format: "json",
+        // No Summer Games entry: LM Studio's MCP client registration is closed and unverified.
         mcp: { user: home(".lmstudio", "mcp.json"), project: null },
         restart: "Open LM Studio, toggle on the summer-engine MCP server in the Program tab, and raise the loaded model's context length to 32k or higher.",
         skills: null,

package/dist/mcp/hosted-mount.js

@@ -3,6 +3,7 @@ import { z } from "zod";
 import { connectHostedMcp } from "../core/hosted-mcp.js";
 import { getStoreAccessToken, OAuthError, resolveMcpResourceUrl } from "../core/oauth.js";
 import { appendMcpLogEvent } from "../core/mcp-log.js";
+import { providerSafeSchema } from "./provider-safe-schema.js";
 /**
  * One Summer Engine MCP. The cloud tools a creator's agent needs to publish
  * (projects, store page, build upload, submit for the owner's approval, the
@@ -73,7 +74,7 @@ export function prepareHostedMount(server, deps = defaultHostedMountDependencies
                 ...result,
                 tools: result.tools.map((tool) => {
                     const hosted = schemas.get(tool.name);
-                    return hosted ? { ...tool, inputSchema: hosted.inputSchema, ...(hosted.annotations ? { annotations: hosted.annotations } : {}), ...(hosted.title ? { title: hosted.title } : {}) } : tool;
+                    return hosted ? { ...tool, inputSchema: providerSafeSchema(hosted.inputSchema), ...(hosted.annotations ? { annotations: hosted.annotations } : {}), ...(hosted.title ? { title: hosted.title } : {}) } : tool;
                 }),
             };
         });

package/dist/mcp/provider-safe-schema.d.ts

@@ -0,0 +1,10 @@
+import type { McpServer } from "@modelcontextprotocol/sdk/server/mcp.js";
+/** String formats OpenAI strict mode accepts; other providers accept no more. */
+export declare const STRICT_PROVIDER_FORMATS: Set<string>;
+export declare function providerSafeSchema<T>(schema: T): T;
+/**
+ * Wrap the SDK's tools/list so every tool's inputSchema leaves the server in
+ * the provider-safe form. Call after the first registerTool (the SDK installs
+ * its tools/list handler then).
+ */
+export declare function serveProviderSafeToolSchemas(server: McpServer): void;

package/dist/mcp/provider-safe-schema.js

@@ -0,0 +1,96 @@
+import { ListToolsRequestSchema } from "@modelcontextprotocol/sdk/types.js";
+/** String formats OpenAI strict mode accepts; other providers accept no more. */
+export const STRICT_PROVIDER_FORMATS = new Set(["date-time", "time", "date", "duration", "email", "hostname", "ipv4", "ipv6", "uuid"]);
+// Where a schema holds subschemas: one, a list, or a name -> schema map.
+const SCHEMA_KEYS = new Set(["items", "additionalItems", "additionalProperties", "contains", "not", "if", "then", "else", "propertyNames", "unevaluatedItems", "unevaluatedProperties"]);
+const SCHEMA_LIST_KEYS = new Set(["anyOf", "oneOf", "allOf", "prefixItems"]);
+const SCHEMA_MAP_KEYS = new Set(["properties", "patternProperties", "dependentSchemas", "$defs", "definitions"]);
+const isObject = (value) => typeof value === "object" && value !== null && !Array.isArray(value);
+function resolvePointer(root, ref) {
+    let node = root;
+    for (const raw of ref.slice(2).split("/")) {
+        if (raw === "")
+            continue;
+        const key = raw.replace(/~1/g, "/").replace(/~0/g, "~");
+        if (Array.isArray(node))
+            node = node[Number(key)];
+        else if (isObject(node))
+            node = node[key];
+        else
+            return undefined;
+    }
+    return node;
+}
+function uniqueSchemas(schemas) {
+    const seen = new Map();
+    for (const schema of schemas)
+        seen.set(JSON.stringify(schema), schema);
+    return [...seen.values()];
+}
+function rewrite(schema, root, expanding) {
+    if (!isObject(schema))
+        return schema;
+    const child = (value) => rewrite(value, root, expanding);
+    const { $ref, ...rest } = schema;
+    if (typeof $ref === "string" && ($ref === "#" || $ref.startsWith("#/"))) {
+        // A recursive shape cannot be inlined; accept any value there and let zod validate it.
+        const target = expanding.includes($ref) ? {} : rewrite(resolvePointer(root, $ref), root, [...expanding, $ref]);
+        return { ...(isObject(target) ? target : {}), ...child(rest) };
+    }
+    const out = {};
+    for (const [key, value] of Object.entries(schema)) {
+        if (key === "additionalItems" || key === "prefixItems")
+            continue;
+        if (SCHEMA_KEYS.has(key))
+            out[key] = Array.isArray(value) ? value.map(child) : child(value);
+        else if (SCHEMA_LIST_KEYS.has(key) && Array.isArray(value))
+            out[key] = value.map(child);
+        else if (SCHEMA_MAP_KEYS.has(key) && isObject(value))
+            out[key] = Object.fromEntries(Object.entries(value).map(([name, sub]) => [name, child(sub)]));
+        else
+            out[key] = value;
+    }
+    if (Array.isArray(schema.type) && !("anyOf" in out)) {
+        delete out.type;
+        out.anyOf = schema.type.map((type) => ({ type }));
+    }
+    if (typeof out.format === "string" && !STRICT_PROVIDER_FORMATS.has(out.format))
+        delete out.format;
+    if (isObject(out.propertyNames) && Object.keys(out.propertyNames).length === 1 && out.propertyNames.type === "string")
+        delete out.propertyNames;
+    const tuple = Array.isArray(schema.prefixItems) ? schema.prefixItems : Array.isArray(schema.items) ? schema.items : null;
+    if (tuple) {
+        const extra = Array.isArray(schema.prefixItems) ? schema.items : schema.additionalItems;
+        const open = extra !== undefined && extra !== false;
+        const members = uniqueSchemas([...tuple, ...(isObject(extra) ? [extra] : [])].map(child));
+        out.items = members.length === 1 ? members[0] : members.length === 0 ? {} : { anyOf: members };
+        out.minItems ??= tuple.length;
+        if (!open)
+            out.maxItems ??= tuple.length;
+    }
+    return out;
+}
+export function providerSafeSchema(schema) {
+    const out = rewrite(schema, schema, []);
+    if (isObject(out)) {
+        // Every local $ref is inlined, so the definition tables are dead weight.
+        delete out.definitions;
+        delete out.$defs;
+    }
+    return out;
+}
+/**
+ * Wrap the SDK's tools/list so every tool's inputSchema leaves the server in
+ * the provider-safe form. Call after the first registerTool (the SDK installs
+ * its tools/list handler then).
+ */
+export function serveProviderSafeToolSchemas(server) {
+    const handlers = server.server._requestHandlers;
+    const listTools = handlers.get("tools/list");
+    if (!listTools)
+        return;
+    server.server.setRequestHandler(ListToolsRequestSchema, async (request, extra) => {
+        const result = await listTools(request, extra);
+        return { ...result, tools: result.tools.map((tool) => ({ ...tool, inputSchema: providerSafeSchema(tool.inputSchema) })) };
+    });
+}

package/dist/mcp/server.js

@@ -27,6 +27,7 @@ import { registerLibraryTools } from "./tools/library-tools.js";
 import { getCachedBootDriftNotice as getCachedNotice, setCachedBootDriftNotice, } from "./boot-notice.js";
 import { appendMcpLogEvent } from "../core/mcp-log.js";
 import { prepareHostedMount } from "./hosted-mount.js";
+import { serveProviderSafeToolSchemas } from "./provider-safe-schema.js";
 import { buildBootDriftNotice, fetchLatestRegistryVersion, } from "../installer/version-check.js";
 import { TOOLKIT_VERSION as version } from "../core/version.js";
 let processDiagnosticsInstalled = false;
@@ -329,6 +330,8 @@ export function createMcpServer() {
     // The playbook is also an MCP prompt so prompt-surfacing hosts get it
     // natively (same content as the summer_get_agent_playbook tool).
     registerPlaybookPrompt(server);
+    // Strict providers (Kimi, OpenAI strict) reject tuple and $ref schemas.
+    serveProviderSafeToolSchemas(server);
     return { server, getRegisteredToolCount };
 }
 export async function startMcpServer(options = {}) {

package/gemini-extension.json

@@ -1,7 +1,7 @@
 {
   "_generated": "GENERATED from integrations/gemini — do not edit; npm run generate:registry",
   "name": "summer",
-  "version": "3.5.0",
+  "version": "3.5.2",
   "description": "Agent tooling for Summer Engine: MCP bridge, context primer, and game-dev skills. Use with the npm CLI for skill files on disk.",
   "contextFileName": "GEMINI.md",
   "mcpServers": {
@@ -93,6 +93,7 @@
     "./library/skills/psx-retro-rendering/",
     "./library/skills/publish-your-game/",
     "./library/skills/realtime-wet-surfaces/",
+    "./library/skills/release-readiness/",
     "./library/skills/remote-deploy/",
     "./library/skills/retarget/",
     "./library/skills/running-in-the-cloud/",

package/integrations/README.md

@@ -24,6 +24,12 @@ never sits beside project-scope skills. `--scope project` moves both;
 `--recommended` installs only the recommended subset. Clients whose MCP config
 is user-only fall back to user scope with a warning.
 
+For every client with `remoteMcp` in `agent-table.ts`, setup also writes the
+remote `summer-games` server (`https://mcp.summer.games/mcp`) into the same
+file, in that client's entry shape, and prints its one sign-in step. A client
+gets `remoteMcp` only after its OAuth redirect is checked against what
+api.summer.games accepts; the table comments name why the rest have none.
+
 Generated root files (`.claude-plugin/plugin.json`, `gemini-extension.json`,
 `.mcp.json`, …) are build artifacts of `integrations/<agent>` + `library/`.
 Their `_generated` banner says so. CI `--check` fails on any drift between

package/library/skills/README.md

@@ -1,6 +1,6 @@
 # Summer skills
 
-> 122 skills, grouped by their primary domain. **Generated** by `npm run generate:registry` from each skill's `resource.yaml`; `--check` fails when this file and the library disagree. Do not edit by hand.
+> 123 skills, grouped by their primary domain. **Generated** by `npm run generate:registry` from each skill's `resource.yaml`; `--check` fails when this file and the library disagree. Do not edit by hand.
 
 The folder is flat on purpose (`docs/design/DECISIONS.md`, D3): a skill usually belongs to several domains, so categories live in each skill's `facets.domains` and this index is rendered from them. The first domain listed is the primary one. `summer skills list --by-domain` prints the same grouping; `summer skills info <slug>` shows one skill.
 
@@ -18,7 +18,7 @@ Status: **stable** unless marked; *preview* = not yet exercised in-engine by the
 - [character-controller](#character-controller) (2)
 - [creator](#creator) (4)
 - [debug](#debug) (1)
-- [deployment](#deployment) (2)
+- [deployment](#deployment) (3)
 - [editor](#editor) (1)
 - [gameplay](#gameplay) (6)
 - [level-design](#level-design) (2)
@@ -147,6 +147,7 @@ Status: **stable** unless marked; *preview* = not yet exercised in-engine by the
 | skill | when to use | also |
 |---|---|---|
 | [export-and-ship](./export-and-ship/SKILL.md) ★ | Assess and prepare a game export: inventory installed templates and targets, validate release assets and config, produce supported builds after approval. | project |
+| [*release-readiness*](./release-readiness/SKILL.md) (preview) | Before releasing a Summer game version, prove players can play it: server scene, online join, saved progress, no fixed Game ID, a released Summer compiles it. | multiplayer, playtest |
 | [remote-deploy](./remote-deploy/SKILL.md) ★ | Run or test the game on a real device — phone, tablet, another computer — via the Remote Deploy button, runnable export presets, and on-device debugging. | project |
 
 ## editor

package/library/skills/export-and-ship/SKILL.md

@@ -298,6 +298,8 @@ Per platform, point the user at the correct upload path:
 - **summer.games:** `summer_export_game` writes the summer.games `.zip`; `summer_publish_build` uploads it to the game's store listing after the user confirms the exact game, file and version (needs `summer login --store`). If it answers `store_auth_refused`, the user uploads the `.zip` in Studio instead.
   - Per platform, the store takes: iPhone, Android, macOS and Windows in the Summer apps = one summer.games bundle (`summer_export_game` `targets`, format `bundle`; no template, no signing; a game without a server targets `ios`/`android` only). Web = an HTML5 `.zip` on Summer's WebGPU Forward+ template (`targets:["web"]`; the project must render with Forward+ or Mobile). A macOS or Windows download for the store page = `targets:["macos"]` or `["windows"]` with format `download`. Download exports need the template: `summer_export_templates` `install` fetches it from Summer's CDN.
   - Hosted games: if `summer_export_game` fails with "… is in the source graph's authority_engine domain, which the client pack leaves out", an authority root in `source-domains.json` holds a file the client loads (often the composition `.tres`). Narrow that root to the server-only files, or move the shared file under a `shared` path, then export again. Every exporter message is in the `multiplayer-publish` skill's export-errors.md; the folder rules are in `multiplayer-project`.
+  - Every summer.games bundle: export with the released Summer editor from the download page, never a development build, and export again after updating Summer. Otherwise its scripts can fail to compile on players' devices and the game opens to an empty window, though every upload check passes. `release-readiness` check 7 proves it.
+  - Hosted games, before the upload: a clean export does not prove players can join. Run `release-readiness` on the `.zip`: the bundle's `server.pck`, started with no scene, must load the authority scene (the server preset needs the `summer_authority` custom feature), and `Summer.initialize` must pass no hard-coded Game ID. Otherwise every online join fails with `world_start_timeout`.
   - Store page art: key art, covers and icons carry no text, logos or UI (the store page shows the title). Screenshots are real gameplay and may show the game's own HUD; add no captions, logos or overlays. Capture them with `summer_capture_gameplay` (offscreen, no editor needed; `resolution` `1920x1080`, or `1080x1920` for portrait; get past a title menu with the game's own flags in `args`, e.g. `["--autostart"]`, or `steps` such as `[{"press":"Play"},{"wait":3000},{"shot":true}]`), or `summer_screenshot` target `game` while the editor runs the game.
 - **Steam:** `steamcmd` + Steam Pipe (`builder_app_xxx.vdf`). Set up depots first in Steamworks.
 - **itch.io:** `butler push <path> <user>/<game>:<channel>` (e.g. `butler push build/win <user>/mygame:windows`).

package/library/skills/make-game/SKILL.md

@@ -47,6 +47,7 @@ These rules from the playbooks apply to every genre:
 - **2D scales to the viewport.** Set `display/window/stretch/mode = canvas_items` and `stretch/aspect = expand`; UI uses Control anchors; code-positioned nodes compute from `get_viewport_rect().size`. Never hardcode 1920x1080.
 - **Playable slice, not tech demo.** Name the core loop in one sentence; every input gets feedback (tween, sound, particle, flash, shake); progression is visible; a restart exists. The bar is "feels good for 30 seconds".
 - **Fast first draft when someone is waiting.** The first playable version uses shapes, the palette and any template art, plus at most one or two generated assets the person specifically asked for; generation takes minutes, so it never blocks the first play. Say plainly that it is a first draft to get a feel for the game, that the art is not final, and ask if this is the direction they want. Generate the rest of the art in later passes.
+- **A way back to the title.** From inside play, a pause menu or a **Leave** button returns to the title screen without quitting the app.
 - **Text the default font can show.** No emoji or symbols (▲ ◀ ★ ♥ ✓) in UI text: they render as boxes with hex codes. Use words or icons; see `ui-basics`.
 
 ## The Pipeline
@@ -95,6 +96,12 @@ This phase doesn't have a dedicated skill yet — do it inline. Read `.summer/Ga
 2. **Core mechanics** — ranked, max 3 (the brief enforces this; respect it)
 3. **Cut list** — what's explicitly NOT in scope
 
+If the game has online play, the plan also fixes three product defaults; each one was missed by a real release:
+
+- **Online play is reachable by default.** A new player gets to it from the title without changing a setting. Hiding it behind a setting or a grown-ups gate is the owner's explicit decision, recorded in the plan, and it means someone joins online before every release.
+- **Progress is saved by the server.** Online progress goes through authority player data (`summer-player-data`), not only the player's local files.
+- **A way back to the title** from inside an online and an offline session.
+
 Save the plan to `.summer/build-plan.md`. Format:
 
 ```markdown
@@ -236,8 +243,10 @@ Only if `summer_get_diagnostics` flags rendering or physics hotspots. Don't opti
 1. `play` from main scene.
 2. Walk every mechanic from the plan.
 3. Hit the win condition (or lose condition).
-4. `summer_get_diagnostics` clean.
-5. `debug` until clean if not.
+4. Return to the title from inside play, then start again.
+5. Online games: run Local Play (`multiplayer-testing`) and reach online play from the title as a new player, with default settings.
+6. `summer_get_diagnostics` clean.
+7. `debug` until clean if not.
 
 **Don't skip this even if every mechanic worked individually.** Integration bugs hide between mechanics.
 
@@ -249,6 +258,14 @@ Skill: export-and-ship
 
 Pre-flight checklist (icon, store banners, build config) before producing release builds for the targets in the brief.
 
+Before any version reaches players, run:
+
+```
+Skill: release-readiness
+```
+
+It checks the file you upload, not the editor: a hosted game's `server.pck` starts its authority scene, `Summer.initialize` passes no hard-coded Game ID, online play is reachable, progress is saved by the server, and players can get back to the title. Then, after publishing, the user joins online with the released version. Report each check as pass, fail, not applicable or not run. Hosted games publish through `multiplayer-publish`; store pages through `publish-your-game`.
+
 If the brief said "jam" or "prototype", skip this phase. If the brief said "game I want to release", run it.
 
 ## Anti-Patterns
@@ -260,6 +277,8 @@ If the brief said "jam" or "prototype", skip this phase. If the brief said "game
 | Stack art direction on top of unfinished mechanics | Art changes are reversible only if the underlying scene structure is stable. Get mechanics done first. |
 | Treat "polish" as required | If the brief says "jam in 2 days", polish is a cut item. Respect the brief. |
 | Run all phases without confirming | The user owns scope. Stop at every checkpoint. |
+| Ship online play behind a setting nobody changes | Hosted join is never exercised, so it breaks without anyone noticing. Reachable by default, or the owner joins online before every release. |
+| Hard-code a Game ID in `Summer.initialize` | The summer.games bundle has no `gameId`; a different ID fails on the hosted server and every online join times out. Pass no ID. |
 | Build a fully featured menu before there's a playable mechanic | Menu work is endless polish; player-loop work is the actual game. Mechanics first. |
 | Fall back to "let me try a few things" mid-pipeline | If you don't know what to do, name the phase and ask the user, don't improvise around the structure. |
 

package/library/skills/make-game/resource.yaml

@@ -21,6 +21,7 @@ related:
   skills:
     - skill/audio-direction
     - skill/export-and-ship
+    - skill/release-readiness
     - skill/design-mechanic
     - skill/tune-performance
     - skill/art-direction

package/library/skills/multiplayer/SKILL.md

@@ -84,7 +84,7 @@ the sender's verified Session. Events are fire-and-forget.
 
 | Word | Meaning |
 |---|---|
-| Game | Your game on Summer; its id is `gameId` in `summer.build.json` and the argument to `Summer.initialize` |
+| Game | Your game on Summer; its id is `gameId` in `summer.build.json`. `Summer.initialize()` takes no ID: Summer knows which game is running |
 | World | One running match or shared place, simulated by one authority |
 | WorldDefinition | `world.json`: which scenes run the client and the authority, lifetime, persistence |
 | Queue | How players find a World; declared in `summer.build.json` |
@@ -109,6 +109,8 @@ Each skill continues the same small game, so their code fits together:
    what a passing run must show.
 5. **`multiplayer-publish`**: export the summer.games bundle and upload it as
    a Build.
+6. **`release-readiness`**: before players get a version, prove the server
+   starts its authority scene and a real online join works.
 
 ## Add Summer services