🔒 Security

• Hardened create_db_backup — mysqldump is now spawned with an argv array (no shell), the MySQL password is passed via the MYSQL_PWD env var so it's no longer visible in tasklist/ps, and table/database names are validated as identifiers before being passed in.
• Locked down update_config — the tool can no longer rewrite the config_files section. Without this, an agent could repoint worldserver_conf to any path and then write to it via write_server_config. Edit config.json directly to change those paths.
• Redact passwords in RA echoes — create_account and set_account_password no longer surface the plaintext password through RA command echoes back to the agent.

🐛 Fixes

• Fixed dead schemaOverride config (the headline v1.3.0 feature actually does something now). index.ts was calling initializeSchema() with no argument, so the override file was never loaded. The override is now read from config.schemaOverride and merged on top of the default MoP schema. Per-table deep merge so partial overrides (e.g. just account.dp) no longer wipe the other columns in that table.
• Fixed creature (spawn) schema — get_creature_spawns now goes through the schema resolver instead of hard-coding id, and discover_schema detects whether your core uses creature.id (MoP/Cata) or creature.id1 (TC 3.3.5 / AzerothCore).
• Fixed add_dp race condition — the previous SELECT-then-UPDATE pattern lost concurrent updates. Now uses a single atomic UPDATE … SET dp = dp + ?.

🧹 Cleanups

• Removed dead player_name parameter from spawn_creature — the parameter was accepted but its value was ignored. RA has no per-call player context.
• Schema resolver footgun fix — tool handlers now call getSchema() per-invocation instead of capturing it at registration time. This means a future reload_schema tool would actually work.
• example.config.json now ships with schemaOverride pre-set to schema_override.json, so the post-discover_schema flow works out of the box.

📝 Documentation

• Rewrote the Add to Your AI Client section with clear, copy-paste install blocks for Claude Desktop, Claude Code (VS Code extension + CLI), Codex CLI, and Antigravity (UI flow first, JSON config as fallback).
• Removed the inline changelog (release notes now live here on the Releases page).
• Fixed the Lookup & Editing tool count (10 → 13). Total is still 76.
• Tightened the Dynamic Schema section now that the override flow actually works.

🛠️ Build / repo hygiene

• Added .github/workflows/build.yml — type-check + build matrix on Node 18 / 20 / 22 for every push and PR to main.
• .gitignore now covers .mcp.json, .claude/, .vscode/mcp.json (per-developer MCP client wiring with user-specific absolute paths).

v1.3.1 was intentionally skipped between v1.3.0 and v1.3.2.

Full diff: v1.3.2...v1.3.3