fix: spell saves, rests, strategy conquest and migrations, from the engine audit (part 4) by Mnehmos · Pull Request #117 · Mnehmos/mnehmos.rpg.mcp

fix(math): bound dice expressions so a roll cannot hang or exhaust the server

claude

committed

970de09

fix(server): stop a dead event subscriber from taking the server down

claude

committed

9f626b0

fix(combat): a refused move has no consequences, and damage never heals

claude

committed

8549668

fix(deps): update MCP SDK to 1.32.2 for security advisories

claude

committed

e7269b7

fix(combat): enforce turn order, reach and sane numbers on attacks

claude

committed

805fb10

fix(storage): never close a campaign database out from under a running call

claude

committed

2bdec30

fix(world): scope the in-memory world cache to its campaign and bound it

claude

committed

18ed707

fix(storage): refuse a corrupted campaign database instead of replacing it

claude

committed

b9d509c

fix(audit): keep only the newest audit rows per campaign

claude

committed

fe247eb

fix(transport): compare transport tokens in constant time

claude

committed

324368b

chore: drop Node 18 from CI, quiet per-request startup logs, fix repo URLs

claude

committed

4e2847c

docs: correct tool and test counts

claude

committed

cb482a3

fix(combat): accept range through the combat_action tool schema

claude

committed

aa81cf6

chore: merge already-merged branch history so the branch fast-forwards

claude

committed

cbc9e67

Navigation Menu

Repository navigation

fix: spell saves, rests, strategy conquest and migrations, from the engine audit (part 4) - #117

fix: spell saves, rests, strategy conquest and migrations, from the engine audit (part 4)#117
Mnehmos merged 25 commits into
mainfrom
claude/practical-cannon-cel9je

Commits on Nov 9, 2026

fix(math): bound dice expressions so a roll cannot hang or exhaust the server

fix(server): stop a dead event subscriber from taking the server down

fix(combat): a refused move has no consequences, and damage never heals

fix(deps): update MCP SDK to 1.32.2 for security advisories

fix(combat): enforce turn order, reach and sane numbers on attacks

fix(storage): never close a campaign database out from under a running call

fix(world): scope the in-memory world cache to its campaign and bound it

fix(storage): refuse a corrupted campaign database instead of replacing it

fix(audit): keep only the newest audit rows per campaign

fix(transport): compare transport tokens in constant time

chore: drop Node 18 from CI, quiet per-request startup logs, fix repo URLs

docs: correct tool and test counts

fix(combat): accept range through the combat_action tool schema

chore: merge already-merged branch history so the branch fast-forwards

Commits on Nov 10, 2026

fix(deps): upgrade zod 3 to 4 to clear the remaining security advisory

chore: record already-merged branch history so the branch fast-forwards

fix(magic): report the roll when a spell attack misses

fix(agent): close the replay model loophole and bound agent timeouts

chore: record already-merged branch history so the branch fast-forwards

fix(magic): roll each spell save once, with the right DC and caster ability

fix(strategy): keep conquest inside the control scale and count each claimant once

fix(storage): migrations no longer move parties, and apply all-or-nothing

fix(world): bound the world cache by total tiles, not just world count

fix(rest): track hit dice, and restore spell slots on party long rests

chore: record already-merged branch history so the branch fast-forwards