Craft Anything

Audit basis. Refreshed 2026-11-07 against tag v0.5.0, commit 622d023cdfdb91c00df8b9a37c486a2a18fb0917 — git rev-parse HEAD in the pinned checkout confirms, and the installed bundle matches (Info.plist CFBundleShortVersionString 0.5.0, bundle id ai.storyteller.craft-anything; its craft-anything-cli --version prints craft-anything-cli 0.5.0). The previous release this skill described was v0.3.0 (e6280b5).

v0.3.0 → v0.5.0 delta. 481 files changed in the tree diff. Engine tools 299 → 301 in the same 17 toolsets: core 34 → 35 (core_finding_edit) and projects 19 → 20 (project_plan_fold), with MIN_TOOLS still 271 (docs/tools.md; crates/engine/src/tool_list.rs). The installed craft-anything-cli commands lists 321 commands — the 20 AI/setup-layer tools on top (rebuild_*, assets_key_*, ai_model*, setup_*) — so 321 is not the engine count. MCP gained a shared-host mode: mcp --restricted drops and refuses machine-acting and network tools, --allow-web / --allow-capture re-enable those classes, and --target passes desktop target metadata (apps/craft-anything-cli/src/main.rs; crates/mcp/src/lib.rs). Coding-agent adapters went 3 → 6 — copilot, dsh (DeepSeek Harness) and maki joined antigravity, hermes and opencode (crates/ai/src/cli_agents/adapters.rs; docs/copilot.md, docs/opencode.md); Claude Code remains the first-class builder, README says only Maki among the ACP agents has been run live, and Codex is still unverified. New projects in Python, Go, .NET, Maven, Gradle and Make now build, test and launch through the same catalogue as Rust and Node.js (crates/engine/src/toolchains.toml, 8 toolchains; docs/STATUS.md). UI languages 5 → 15 (crates/ui-egui/src/i18n.rs LANGUAGES, crates/ui-egui/src/i18n/*.tsv). Versioned files grew to 12 rows with inbox/build-progress.json, pin.json version 2 and feed.json version 5 (docs/file-formats.md; crates/engine/src/workspace/progress.rs, crates/engine/src/pins.rs, crates/engine/src/feed.rs). Public installers are now published, and the README now states that Clean room is not an OS sandbox and that dependency installs run code.

v0.2.0 → v0.3.0 delta. 135 files changed. Engine tools 298 → 299 (the projects toolset 18 → 19). The macOS bundle does ship craft-anything-cli — the previous skill said it did not, and packaging/macos/package.sh copies, signs and version-checks it. CLI: --build-with and --generate-assets added, --resume requires --continue-in and ignores the request, --rounds defaults to 2. Repo docs are stale against the generated docs/tools.md (README says 314/298 at that tag).

v0.1.0 → v0.2.0: the engine tool surface is unchanged (299 tools / 17 toolsets, docs/tools.md byte-identical). The wave is in the agent/AI layer: an OpenCode adapter (crates/ai/src/cli_agents/adapters/opencode.rs — invokes opencode run, without run OpenCode reads its first argument as a folder to open), npm-installed coding agents start on Windows, local model servers (LM Studio et al.) accept the tools because boolean sub-schemas are sent as objects, failed agent runs are explained with a keepable log (failure_log.rs), the build activity feed shows what the build is doing now and how long it has been quiet (crates/ai/src/rebuild/activity.rs), "Try again" resumes where a build stopped (crates/engine/src/journal.rs), deadlocks are stopped as they form with a lock watchdog, crashing programs are named by their error instead of the last stack line, CJK scripts render in release builds (fonts and licences ship), a builder writing /app/… paths builds the app instead of being refused, doctor calls a local AI server reachable only when it answers with its models (and no longer offers another program squatting on the model-server port), agent checks that only probed the version say so, and the coding agent's cost is labelled an estimate. Claude Code remains the first-class, verified builder; Codex and OpenCode adapters exist but are unverified.

Verify against your installed version — the ArtCraft Launcher auto-updates, so a newer build may differ; every count quoted here was re-measured at this tag, and code paths that moved were re-cited. The measurement method for each count is in evidence.md.

Overview

Craft Anything is "See how any website, app or game works, then have AI build your own version" — an open-source, clean-room engine in pure Rust by the ArtCraft/storytold project (README.md, MIT OR Apache-2.0). It works in four steps — Study → Build → Check → Ready — asking the person question/approval cards when a decision is theirs (README.md "How it works"). Two UI modes drive the same engine: Simple (a project page with the four steps) and the Advanced workbench (functions, pseudo-C, disassembly, hex, call graphs, evidence ledger, agent console). Clean room (default) inspects only what a visitor can see — screenshots, visible text, measured layout, colours, fonts — and refuses look-inside tools; Deep reads code and files with the built-in engines and Ghidra when installed (README.md "Clean room or Deep"; crates/engine/src/tools/deep.rs). Building needs a coding agent signed in on your machine — Claude Code is supported first (your own unmodified claude, your own sign-in); Codex, Copilot (ACP), OpenCode, DeepSeek Harness and other ACP agents are built but unverified — README says only Maki among the ACP agents has been run live (README "AI"; docs/claude-code.md, docs/copilot.md). Status: early alpha — website rebuilds with three-width checks and game rebuilds in Unity/Unreal/Godot work today; app/game behaviour checks are partial; some engine tools are tested only against stand-ins (README.md Status; docs/STATUS.md; docs/tool-status.md). Source: GitHub storytold/craft-anything.

Capabilities (verified)

One tool registry, three surfaces

• 301 engine tools in 17 toolsets at this tag, generated into docs/tools.md by cargo xtask tools and kept honest by a test floor (MIN_TOOLS = 271, unchanged at v0.5.0; crates/engine/src/tool_list.rs:9). Each tool is simultaneously an MCP tool, a CLI command (craft-anything-cli <id with dashes>) and a callable tool for the coding agent; the AI and setup layers add 20 more on top (rebuild_* 9, assets_key_* 3, ai_model* 4, setup_* 4), so craft-anything-cli commands prints 321, not 301. Toolsets: core 35, native 55, apple 14, formats 36, managed (.NET) 8, android 14, java 6, adb 24, browser 22, javascript 11, runtime 14, frida 9, application 17, database 1, projects 20, setup 9, build 6 (docs/tools.md). The README's "320 tools (300 in the engine)" is stale — trust the generated list.
• Results are evidence, not answers: every result carries confidence, coverage and limitations; big ones come back as a summary and page with core_evidence_browse. The discipline rules (predict-then-check, cite evidence ids, absence is not proof) are appended to every guided prompt (crates/mcp/src/prompts.rs DISCIPLINE).
• MCP server (craft-anything-cli mcp): stdio JSON-RPC; tools default to Essentials plus enabled toolsets, --all-tools lists everything; --inbox DIR posts core_person_ask/core_action_approve cards for the desktop app to answer; --target <json> takes desktop target metadata (apps/craft-anything-cli/src/main.rs Mcp). On a shared host use --restricted: it omits and refuses tools that act on the machine or reach the network, with --allow-web and --allow-capture to turn those classes back on (crates/mcp/src/lib.rs restricted_refusal). 6 guided prompts, unchanged at v0.5.0 (crates/mcp/src/prompts.rs PROMPTS).
• CLI subcommands (apps/craft-anything-cli/src/main.rs Command): 12 named — mcp, setup, doctor, uninstall, commands, capabilities, triage <path>, report [--html] [--out] [--no-evidence], chat, rebuild, ai, and the hidden builder-notes hook (--help shows the first 11) — plus Tool(Vec<String>) pass-through so every engine tool id is a subcommand (the 12 named subcommands are unchanged at v0.5.0). Unknown flags are refused.
• Rebuild from the terminal (questions asked in the terminal): craft-anything-cli rebuild <target|"-" for none> "<request>" with --rounds N (default 2), --backend, --unattended, --projects-dir, --project-folder + --existing edit|start-from, --continue-in + --resume, --deep / --clean-room (apps/craft-anything-cli/src/rebuild_cmd.rs); this flag set is unchanged at v0.5.0.

Study (the inspection engine)

• Its own pure-Rust decoders, disassembler and decompiler work without outside programs; Deep mode additionally uses Ghidra when installed (README.md "Under the hood"). Native programs (ELF/Mach-O/PE), .NET (incl. IL2CPP, bundles), Java (with decompilation), Android (adb, APK/AXML/ARSC signing), Apple (runtime, codesign, CAR), Electron (asar, fuse, runtime), JavaScript/JS bundles, websites (CDP browser automation), firmware, packet captures, databases, game archives — one toolset each (crates/engine/src/tools/, crates/formats/src/).
• External engines are optional and detected: Ghidra, Cutter, rizin, GDB, Frida, adb, jadx, JEB, tshark, apktool and CDP browsers (crates/engines/src/; engines_* tools in docs/tools.md); craft-anything-cli doctor checks the install, registrations, engines, AI backends and the MCP server.
• "Just look inside" opens a target for questions without building anything (Deep mode).

Build, check, refine

• The builder is your own Claude Code (first-class; Codex adapter built but unverified). GitHub Copilot can be used through ACP after copilot login, and other ACP agents (Gemini CLI, Qwen Code, opencode, goose, Hermes, Maki) are switchable per backend — README says only Maki among them has been run live (README.md "AI"; docs/copilot.md, docs/opencode.md, crates/ai/src/cli_agents/adapters.rs). Craft Anything never sees your account; generated pictures and 3D models are opt-in with your own fal.ai key.
• Checks: websites are compared at three screen widths; games run the generated program's own --self-test against checks/round-N/self-test.json; app runs are compared; each round writes into checks/ and the agent refines what doesn't match (README.md Status; crates/engine/src/self_test.rs; docs/file-formats.md). New projects in Python, Go, .NET, Maven, Gradle and Make are built, tested and launched from one catalogue (crates/engine/src/toolchains.toml — 8 toolchains with Rust and Node.js; docs/STATUS.md "New-project toolchains").
• Plugins: MCP servers, and WASM components in builds with the wasm-plugins option (crates/engine/src/plugins.rs; crates/engines/src/wasm_plugin.rs).

Project folder and file formats (all versioned, migration steps on open)

• New projects go to Documents/Craft Anything (Settings → General) unless --project-folder. Layout: craft.json (request, target, status, history), capture/, app/ (the generated project), checks/, investigation.cany/ (evidence ledger), inbox/ (open questions and build-progress.json) (README.md "Get started").
• Version constants in code: craft.json MANIFEST_VERSION 2 (crates/engine/src/workspace.rs), config.toml SETTINGS_VERSION 3 (crates/engine/src/settings.rs), investigation.cany/project.toml FORMAT_VERSION 1 (crates/engine/src/project.rs) — each with a compile-time assertion that the migration-step list has one step per version. The docs/file-formats.md table now has 12 rows: the three constants above, transcript.json, usage.json, questions.json, mechanics.json, standin.json and self-test.json (all 1), plus pin.json 2 (crates/engine/src/pins.rs), feed.json 5 (crates/engine/src/feed.rs) and inbox/build-progress.json 1 (crates/engine/src/workspace/progress.rs). Newer files: craft.json = read-only, saving refused; project.toml = refused with "update Craft Anything"; build-progress.json = the build stops and leaves the record unchanged. A newer file is never downgraded or overwritten. ⚠️ Repo-doc drift: the same table still shows manifest 1 / settings 2 — it lags the constants (measured in code at v0.1.0, v0.3.0 and v0.5.0 alike); trust the constants.

Known limitations and not-implemented

Do not assign these at v0.5.0:

• Only Claude Code is the first-class, verified builder. The Codex, Copilot and other ACP adapters are built but unverified; README says only Maki among the ACP agents has been run live (README.md "AI", "Status").
• Behaviour checks for apps and games are partial; website checks are the mature path.
• Some engine tools are tested only against stand-ins (crates/engine/src/tools/standin_tools.rs; docs/tool-status.md marks each tool).
• Clean room is not an OS sandbox: it is a rule about which tools Craft Anything offers and refuses. A coding agent you run still acts as you, with its own permissions (README.md "Clean room or Deep").
• Installing dependencies runs code: npm install scripts, Rust build scripts and Python source packages execute on your machine. Craft Anything asks before a command kind it has not seen in the project; "always allow" then covers every later command of that kind, so grant it only for trusted dependencies (README.md "Responsible use").
• The managed tier is still "next"; public installers are published, and the browser build is a viewer, not the full workbench (apps/craft-anything-web; README.md Status).
• It never bypasses DRM, logins or anti-cheat, and the builder is told not to copy logos/photos/text without confirmation of ownership — respect that when writing requests (README.md "Responsible use").

How to operate

• GUI: open -a "Craft Anything"; the app binary is Contents/MacOS/craft-anything. The macOS bundle ships craft-anything-cli beside it (Contents/MacOS/craft-anything-cli, 0.5.0) — no separate install is needed on a launcher install; on another machine get it from the release assets or cargo install --path apps/craft-anything-cli --locked, and keep versions matched. Do not launch the GUI just to run a CLI command.
• Mode: switch Clean room/Deep in the title bar or Settings, settings_set deep_mode true, or --deep/--clean-room per CLI run.
• Typical agent flow:

  craft-anything-cli doctor                      # what's missing (agents, engines, AI)
  craft-anything-cli capabilities                # toolsets, availability, engines
  craft-anything-cli triage ./target.bin         # first look, evidence records
  craft-anything-cli rebuild https://example.com "Recreate this website" --rounds 2
  craft-anything-cli rebuild - "A snake game in Rust"
  craft-anything-cli rebuild https://example.com "Make the header blue" --continue-in "<folder>"
  craft-anything-cli report --out report.md      # readable report from the ledger

• Settings live in config.toml (engine::settings::config_dir(), version 3); LIGHTCRAFT-style env overrides are not a thing here — check craft-anything-cli doctor output for paths.

Working with an AI agent

• You are also the builder Craft Anything drives. When its coding-agent bridge launches you, read the inbox/notes flow: the person's answers arrive via the builder-notes hook; approval-required actions go through core_action_approve rather than being assumed.
• Study first, honestly: keep the investigation memory current (core_investigation_show, core_brief_write, core_plan_update, core_hypothesis_record, core_finding_record, core_handoff_write) — the MCP prompts enforce this discipline and it makes your answers auditable.
• Respect the mode. In Clean room the look-inside tools refuse; don't try to work around them. Switching to Deep is the person's decision.
• Prepare inputs in formats the toolsets open (archives, binaries, captures, DB dumps); use core_archive_extract rather than shelling out, so evidence lands in the ledger.
• Verify rebuilds from checks/ outputs and the per-round comparison reports; a "Ready" step is a claim — open the result and re-check before telling the person it matches.
• What not to attempt: bypassing DRM/logins/anti-tamper (refused by design), promising Codex/Copilot builds, editing craft.json/.cany by hand while a run is active, quoting the README's 320-tool number, assuming Ghidra is present (check doctor), or serving MCP to a shared host without --restricted.

Verification protocol

1. Round-trip on a throwaway target first: rebuild a tiny known website with --rounds 1, then read craft.json, checks/round-1/ and app/ before real work.
2. Cite evidence ids for every claim about the original; absence is not proof.
3. Version your project folders (copy the whole folder; every file carries a version and a newer file refuses saves).
4. One project per run: never edit a project folder while a rebuild is active; --resume exists for continuation.
5. Update between projects: this skill is pinned to v0.5.0; re-run doctor after updates.

Sources & evidence

• Repo: https://github.com/storytold/craft-anything — inspected at tag v0.5.0, commit 622d023cdfdb91c00df8b9a37c486a2a18fb0917 ("Release 0.5.0", 2026-11-06), inspection date 2026-11-07; the previous tag v0.3.0 (e6280b5dc518b9f3266c82d794a4e2f0367d9a53) was diffed against it for the delta. Apache-2.0 and MIT (LICENSE-APACHE/LICENSE-MIT).
• Installed /Applications/Craft Anything.app: CFBundleShortVersionString 0.5.0, CFBundleIdentifier ai.storyteller.craft-anything; the bundled craft-anything-cli --version prints craft-anything-cli 0.5.0. The GUI was never launched and the app binary was not executed.
• Read: README.md, Cargo.toml, docs/{tools,STATUS,tool-status,claude-code,copilot,opencode,file-formats,pitfalls,extending,tool-ids,localization}.md, apps/craft-anything-cli/src/{main,rebuild_cmd,setup_cmd,ai_cmd}.rs, crates/engine/src/{tool_list,registry,project,settings,self_test,plugins,pins,feed,workspace,versioned}.rs, crates/engine/src/workspace/progress.rs, crates/engine/src/toolchains.toml, crates/engine/src/tools/ (list), crates/mcp/src/{lib,prompts}.rs, crates/ai/src/cli_agents/adapters.rs and its adapters, crates/ui-egui/src/i18n.rs, crates/engines/src/ (list), crates/formats/src/ (list).
• Counts recomputed from source at v0.5.0: 301 engine tools in 17 toolsets (docs/tools.md generated list, 301 ids; MIN_TOOLS = 271), 321 commands entries (301 + 20 AI/setup extras), 6 MCP prompts (unchanged at v0.5.0), 12 named CLI subcommands (unchanged at v0.5.0) + hidden/external pass-through, 12 versioned-file rows in docs/file-formats.md, 15 UI languages (LANGUAGES in crates/ui-egui/src/i18n.rs), 8 toolchains in crates/engine/src/toolchains.toml; version constants from code: MANIFEST_VERSION/FORMAT_VERSION/SETTINGS_VERSION = 2/1/3 (⚠️ docs/file-formats.md's table still shows manifest 1 / settings 2 — stale repo doc).
• Workspace: 13 crates (ai, analysis, disasm, engine, engines, evidence, formats, js, mcp, platform, setup, testkit, ui-egui) + 3 apps (desktop, CLI, web), unchanged at v0.5.0.
• Evidence table: evidence.md next to this file.