@crowdedkingdoms/construct 0.2.1-dev.1 → 0.2.3-dev.1

package/README.md

@@ -9,15 +9,21 @@ and the games built on it share.
 | `engine/` | `GameLoop`, `SceneRouter`, `Input`, `Controls`, the `GameScene` contract |
 | `platform/` | Hosted sign-in and app entry (`AuthService`, `NetworkManager`), `GameSession`, World Stores presence and the pose codec, chat, voice, webcam, envScope storage |
 | `platform/exec/`, `platform/model/` | The game's world hub on ck-exec (`WorldHub`, one connection per page as `NetworkManager.worldHub`) and `ModelService`, which reads the pulse, programs and progression from it |
-| `platform/studio/` | The Crowdy Studio dock (the SERVER target as a ck-exec mod), grid claims and the world hub's claim registry (`GridService`), CLIENT mods for the player's grid and consented grid mods, the agent's player host |
+| `platform/studio/` | The Crowdy Studio dock (a project runs as a ck-exec mod and its CLIENT half), grid claims and the world hub's claim registry (`GridService`), the CLIENT halves of the grid the player stands in (`GridClientHalves`, over CrowdyJS's `ExecClientHalves`) and the host calls they reach, the agent's player host |
 | `grid/` | JS grid programs (`GridProgramRunner`): player JavaScript with the full CrowdyJS SDK, sandboxed, relayed with a grid-scoped token |
 | `node/` | `security-headers` (site, `/dsh/`, `/grid-program.html`), `vite-plugins`, `construct-copy-dsh` |
 | `sandbox/boot` | The grid program sandbox bootstrap |
 
 It ships **TypeScript source** for Vite (it uses `?worker&url` and
 `import.meta.env`). Peer dependencies: `@crowdedkingdoms/crowdyjs` 17.7+ (17.12
-for `ModelService`, `GridService` and the Studio's SERVER target on ck-exec)
-and, for the Studio agent pane, `@crowdedkingdoms/crowdy-dsh` 0.4+.
+for `ModelService`, `GridService` and the Studio's SERVER target on ck-exec,
+17.14 for its CLIENT target and `GridClientHalves`) and, for the Studio agent
+pane, `@crowdedkingdoms/crowdy-dsh` 0.4+. On a
+prerelease tier the ranges name each `X.Y.Z` line they admit, because npm
+matches a prerelease only against a comparator on the same `X.Y.Z`. A game can
+take a new CrowdyJS line only once a construct release names it (until then
+`npm install` refuses the pin with `ERESOLVE`); npm lets an unnamed crowdy-dsh
+line through with a warning, but keep that pin on a named line too.
 
 ## Installing it
 
@@ -25,7 +31,7 @@ Releases are on npm under one dist-tag per tier, and a game pins the exact
 version of its own tier, as it pins CrowdyJS:
 
 ```bash
-npm install --save-exact @crowdedkingdoms/construct@dev   # a 0.2.0-dev.N build
+npm install --save-exact @crowdedkingdoms/construct@dev   # an X.Y.Z-dev.N build
 ```
 
 `dev` is `X.Y.Z-dev.N`, `test` is `X.Y.Z-test.N`, and `prod` is `X.Y.Z` on

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@crowdedkingdoms/construct",
-  "version": "0.2.1-dev.1",
+  "version": "0.2.3-dev.1",
   "description": "The Construct framework: the Crowded Kingdoms game platform layer (hosted sign-in, World Stores, voice/webcam/chat, Crowdy Studio dock, app and grid mods, grid programs) and engine loop, shared by the-construct starter and the games built on it. Ships TypeScript source for Vite.",
   "license": "MIT",
   "type": "module",
@@ -45,8 +45,8 @@
     "./grid/*": "./src/grid/*.ts"
   },
   "peerDependencies": {
-    "@crowdedkingdoms/crowdyjs": ">=17.7.0-dev.0 <18 || >=17.8.0-dev.0 <18 || >=17.9.0-dev.0 <18 || >=17.12.0-dev.0 <18",
-    "@crowdedkingdoms/crowdy-dsh": ">=0.4.0-dev.0 <1"
+    "@crowdedkingdoms/crowdyjs": ">=17.7.0-dev.0 <18 || >=17.8.0-dev.0 <18 || >=17.9.0-dev.0 <18 || >=17.12.0-dev.0 <18 || >=17.13.0-dev.0 <18 || >=17.14.0-dev.0 <18",
+    "@crowdedkingdoms/crowdy-dsh": ">=0.4.0-dev.0 <1 || >=0.4.1-dev.0 <1"
   },
   "peerDependenciesMeta": {
     "@crowdedkingdoms/crowdy-dsh": {

package/src/index.ts

@@ -3,8 +3,8 @@
  *
  * The platform layer every Crowded Kingdoms browser game needs (hosted
  * sign-in, app entry, World Stores presence, voice / webcam / chat, the
- * Crowdy Studio dock with app and grid mods, JS grid programs) and the engine
- * loop around it. Deep imports (`@crowdedkingdoms/construct/platform/...`,
+ * Crowdy Studio dock with grid mods and their CLIENT halves, JS grid programs)
+ * and the engine loop around it. Deep imports (`@crowdedkingdoms/construct/platform/...`,
  * `/engine/...`, `/grid/...`) reach every module; this barrel re-exports the
  * pieces a game wires at boot.
  */
@@ -85,4 +85,11 @@ export {
   type ClientModHostReads,
   type ClientModHostWrites,
 } from './platform/studio/clientModHost';
+export {
+  GridClientHalves,
+  describeClientHalfPrompt,
+  isOwnClientHalfPrompt,
+  type ClientHalvesGrid,
+  type GridClientHalvesOptions,
+} from './platform/studio/clientHalves';
 export { GridProgramRunner, type GridProgramRunnerOptions } from './grid/GridProgramRunner';

package/src/platform/studio/ClientModLifecycle.ts

@@ -21,6 +21,11 @@ export interface ClientModScope {
 
 interface RunningClientMod extends ClientModDescriptor, ClientModHandle {}
 
+/**
+ * @deprecated For the legacy grid-attached client mods (`runConsentedGridMod`),
+ * which CrowdyJS 18 removes; `GridClientHalves` keeps a ck-exec grid's CLIENT
+ * halves.
+ */
 export class ClientModLifecycle {
   private readonly running = new Map<string, RunningClientMod>();
   private activeGridId: string | null = null;

package/src/platform/studio/StudioService.ts

@@ -1,31 +1,41 @@
 /**
  * Crowdy Studio, embedded — the in-game IDE where players write SERVER and
- * CLIENT Rust mods for the grid they stand on. A project's SERVER target is a
- * ck-exec mod (`serverEngine: 'ck-exec'`): a `ckx-sdk` crate the platform
- * builds, deploys to the grid and switches on, which players in the grid call
- * as `mod:<name>`. The CLIENT target runs in the browser sandbox as before.
+ * CLIENT Rust mods for the grid they stand on. A project runs as a ck-exec mod
+ * (`serverEngine: 'ck-exec'`): its SERVER target is a `ckx-sdk` crate the
+ * platform builds, deploys to the grid and switches on, which players in the
+ * grid call as `mod:<name>`; its CLIENT target is a `crowdy-client-sdk` crate
+ * the platform builds as that mod's CLIENT half, which the grid serves to the
+ * players who stand in it.
  *
  * The SDK's embed kit owns the chrome (dock, fullscreen fallback, Context
  * drawer, focus trap, HUD sink). This service supplies what only the game
  * knows:
  *  - the grid the player is on and their effective permissions on it,
- *  - the same-origin glue worker that runs CLIENT mods,
- *  - the allowlisted host-call router (what a mod may read),
+ *  - the same-origin glue worker that runs CLIENT halves,
+ *  - the allowlisted host-call router (what a CLIENT half may read),
  *  - input suppression and layout hooks,
- *  - the visitor lifecycle: when you stand on someone else's grid, their
- *    trusted CLIENT mods run for you after you approve them, and
+ *  - the grid's CLIENT halves wherever you stand (`GridClientHalves`): the
+ *    ones you consented to, or whose author you trust, run for you, you are
+ *    asked about the rest, and they stop when you leave the grid, and
  *  - the Agentic Crowdy Studio host (Ask / Build / Play) when the platform
  *    policy and `use_studio_agent` are armed.
  *
- * CLIENT mods need `crossOriginIsolated` (COOP + COEP headers on the host). The
- * service checks that at construction and hides the CLIENT half when it is
- * missing, saying so in the HUD, rather than letting a worker fail silently.
+ * CLIENT halves need `crossOriginIsolated` (COOP + COEP headers on the host).
+ * The service checks that at construction and hides the CLIENT target when it
+ * is missing, saying so in the HUD, rather than letting a worker fail silently.
  */
-import { createGridHostCalls, type PlayerCodeHostCall } from '@crowdedkingdoms/crowdyjs';
+import {
+  createGridHostCalls,
+  type ExecClientHalfPrompt,
+  type ExecGridClientMod,
+  type PlayerCodeHostCall,
+} from '@crowdedkingdoms/crowdyjs';
 import {
   CrowdyStudioEmbed,
   CrowdyStudioTextHud,
+  type CrowdyStudioController,
   type CrowdyStudioEmbedContext,
+  type CrowdyStudioPlayerCompute,
 } from '@crowdedkingdoms/crowdyjs/crowdy-studio';
 import glueWorkerAssetUrl from '@crowdedkingdoms/crowdyjs/player-glue-worker?worker&url';
 
@@ -36,7 +46,7 @@ import { messageOf } from '../network/NetworkManager';
 import { isTextEntry } from '../../engine/Input';
 import { chunkKey, worldToChunk, type ChunkCoord, type Vec3 } from '../realtime/space';
 import { AgentLocomotion } from './agentLocomotion';
-import { ClientModLifecycle, type ClientModScope } from './ClientModLifecycle';
+import { describeClientHalfPrompt, GridClientHalves, studioPreviewModName } from './clientHalves';
 import { ConstructPlayerHostAdapter } from './ConstructPlayerHostAdapter';
 import { HumanInputMonitor } from './HumanInputMonitor';
 import {
@@ -44,14 +54,13 @@ import {
   DEFAULT_VOXEL_STATE,
   routeClientHostCall,
   routeWithFallback,
-  runConsentedGridMod,
   type ClientModHostReads,
   type ClientModHostWrites,
 } from './clientModHost';
 import { PointerClickBuffer } from './pointerClicks';
 import { ModOverlayStore } from './modOverlay';
 import { GridService, type GridSnapshot } from './GridService';
-import { hasAnyStudioPermission, toBrokerBounds } from './permissions';
+import { hasAnyStudioPermission, toBrokerBounds, type GridBounds } from './permissions';
 import { Emitter } from '../util/Emitter';
 
 export interface StudioState {
@@ -59,6 +68,7 @@ export interface StudioState {
   grid: GridSnapshot | null;
   /** COOP/COEP present and the build flag on. */
   clientModsAvailable: boolean;
+  /** The grid's CLIENT halves running for this player. */
   clientModsRunning: number;
   /** Why CLIENT mods are unavailable, when they are. */
   clientModsReason: string | null;
@@ -72,8 +82,17 @@ export interface StudioHooks {
   suppressGameplayInput(): () => void;
   onLayoutChange(rightInsetPx: number): void;
   notify(text: string, tone?: 'info' | 'warn' | 'error'): void;
-  /** Ask the player whether to trust an author's mods; defaults to `confirm`. */
-  confirmTrust?(summary: string): Promise<boolean>;
+  /**
+   * Ask the player whether to run a grid's CLIENT halves; `summary` is the
+   * question as plain text. `signal` aborts when they leave the grid. Defaults
+   * to `confirm`.
+   */
+  confirmTrust?(
+    summary: string,
+    context: { prompt: ExecClientHalfPrompt; signal: AbortSignal },
+  ): Promise<boolean>;
+  /** Ask once per author (the default) or once per CLIENT half. */
+  clientHalfConsent?: 'author' | 'mod';
   /** Screenshot hook for the agent pane. */
   captureFrame?(): Promise<HTMLCanvasElement | ImageBitmap | Blob | null>;
   describeView?(): string | undefined;
@@ -103,6 +122,29 @@ function createConstructTextHud(): CrowdyStudioTextHud {
   return hud;
 }
 
+/**
+ * CrowdyJS 17's embed types a legacy player compute service, which it never
+ * calls while both targets run on ck-exec; this one refuses, so nothing can
+ * reach the switched-off engine.
+ */
+const NO_PLAYER_COMPUTE: CrowdyStudioPlayerCompute = {
+  deploy: refuseLegacyEngine,
+  versions: refuseLegacyEngine,
+  setEnabled: refuseLegacyEngine,
+  setRequires: refuseLegacyEngine,
+  artifactBytes: refuseLegacyEngine,
+  usage: refuseLegacyEngine,
+  runs: refuseLegacyEngine,
+  logs: refuseLegacyEngine,
+  invoke: refuseLegacyEngine,
+};
+
+function refuseLegacyEngine(): Promise<never> {
+  return Promise.reject(
+    new Error('Crowdy Studio runs mods on ck-exec here; legacy player compute is not used'),
+  );
+}
+
 const GRID_REFRESH_MS = 8_000;
 const MODS_REFRESH_MS = 10_000;
 /**
@@ -121,14 +163,12 @@ export class StudioService {
   /** CLIENT overlay_draw gizmos; the holodeck merges these onto instances. */
   readonly overlay = new ModOverlayStore();
   private readonly hud = createConstructTextHud();
-  private readonly lifecycle = new ClientModLifecycle();
-  private readonly declinedAuthors = new Set<string>();
-  private readonly approvedAuthors = new Set<string>();
   private readonly agentHost: ConstructPlayerHostAdapter;
   private readonly humanInput = new HumanInputMonitor();
   private readonly pointerClicks = new PointerClickBuffer();
   /** JS grid programs the agent (or the player) runs on the current grid. */
   readonly programs: GridProgramRunner;
+  private halves: GridClientHalves | null = null;
   private gridEnteredAt = 0;
   private embed: CrowdyStudioEmbed | null = null;
   private hooks: StudioHooks | null = null;
@@ -137,8 +177,11 @@ export class StudioService {
   private lastGridChunkKey: string | null = null;
   private lastGridReadAt = 0;
   private lastModsReadAt = 0;
-  private modsInFlight = false;
   private timer: ReturnType<typeof setInterval> | null = null;
+  /** The grid the open Studio edits, and the mod its project runs as. */
+  private studioGridId: string | null = null;
+  private studioMod: string | null = null;
+  private unwatchStudio: (() => void) | null = null;
 
   constructor(private readonly session: GameSession) {
     this.grids = new GridService(session.network);
@@ -189,11 +232,8 @@ export class StudioService {
         get crowdyStudio() {
           return network().game.crowdyStudio;
         },
-        // Still the CLIENT target's compile and artifact service.
-        get playerCompute() {
-          return network().game.playerCompute;
-        },
-        // The SERVER target's mod builds, deploys and switch (`serverEngine` below).
+        playerCompute: NO_PLAYER_COMPUTE,
+        // Both targets' builds, deploys, switch and preview (`serverEngine` below).
         get exec() {
           return network().game.exec;
         },
@@ -213,8 +253,8 @@ export class StudioService {
       },
       appId: () => this.session.appId,
       gameName: GAME_NAME,
-      // A mod has no CLIENT pairing, so ck-api attaches no CLIENT half of such a project for
-      // visitors (docs/MODDING.md); the author still runs it in their own tab.
+      // The SERVER target runs as the grid's mod and the CLIENT target as that mod's CLIENT
+      // half, which the grid serves to the players standing in it (GridClientHalves).
       serverEngine: 'ck-exec',
       closeKeyCode: 'KeyM',
       dsh: {
@@ -230,7 +270,8 @@ export class StudioService {
         studioOrigin: STUDIO_ORIGIN ?? undefined,
         openOnMount: true,
       },
-      onAgentMounted: (_handle) => {
+      onAgentMounted: (handle) => {
+        this.watchStudio(handle.controller);
         this.state = { ...this.state, agentReady: true, agentReason: null };
         this.emit();
       },
@@ -239,6 +280,7 @@ export class StudioService {
         this.emit();
       },
       onAgentUnmounted: () => {
+        this.watchStudio(null);
         this.state = { ...this.state, agentReady: false, agentReason: null };
         this.emit();
       },
@@ -250,7 +292,9 @@ export class StudioService {
           this.overlay.remove(source);
           this.hud.remove(source);
         }
+        this.studioGridId = null;
         this.setOpen(false);
+        void this.refreshClientHalves();
       },
     });
     if (!this.timer) this.timer = setInterval(() => void this.poll(), 2000);
@@ -321,7 +365,9 @@ export class StudioService {
   dispose(): void {
     if (this.timer) clearInterval(this.timer);
     this.timer = null;
-    this.lifecycle.shutdown();
+    this.halves?.stop();
+    this.halves = null;
+    this.watchStudio(null);
     this.programs.stopAll();
     this.embed?.destroy();
     this.embed = null;
@@ -337,6 +383,7 @@ export class StudioService {
   private openOn(grid: GridSnapshot): void {
     if (!this.embed) throw new Error('Studio not attached');
     this.embed.toggle(this.contextFor(grid));
+    this.studioGridId = this.embed.open ? grid.gridId : null;
     this.setOpen(true);
   }
 
@@ -345,7 +392,7 @@ export class StudioService {
     const clientOk = this.state.clientModsAvailable;
     const reads = this.reads();
     const writes = this.writes();
-    const serverCalls = this.serverCallsFor(grid);
+    const serverCalls = this.serverCallsFor(grid.gridId, grid.bounds);
     const overlaySource = `studio:${grid.gridId}`;
     return {
       gridId: grid.gridId,
@@ -394,16 +441,87 @@ export class StudioService {
   }
 
   /**
-   * The rest of the CLIENT host catalog for a mod on `grid` (DN-10): channels,
-   * the player-tier model, sessions and user state through CrowdyJS, confined
-   * to the grid. The local router still answers world reads and voxel writes.
+   * The rest of the CLIENT host catalog for a mod on a grid (DN-10): channels,
+   * sessions and user state through CrowdyJS, confined to the grid. The local
+   * router still answers world reads and voxel writes.
    */
-  private serverCallsFor(grid: GridSnapshot): (call: PlayerCodeHostCall) => Promise<unknown> {
+  private serverCallsFor(
+    gridId: string,
+    bounds: GridBounds,
+  ): (call: PlayerCodeHostCall) => Promise<unknown> {
     const game = this.session.network.game;
-    const scope = game.grid(this.session.appId, grid.gridId, toBrokerBounds(grid.bounds));
+    const scope = game.grid(this.session.appId, gridId, toBrokerBounds(bounds));
     return createGridHostCalls({ scope, client: game });
   }
 
+  /**
+   * The grid's CLIENT halves, made on first use: the app is entered by then,
+   * and the whole service is rebuilt for another app.
+   */
+  private clientHalves(): GridClientHalves {
+    this.halves ??= new GridClientHalves({
+      exec: () => this.session.network.game.exec,
+      appId: this.session.appId,
+      workerUrl: glueWorkerAssetUrl,
+      selfUserId: () => this.session.network.user?.userId ?? null,
+      reads: this.reads(),
+      writes: this.writes(),
+      input: this.pointerClicks,
+      serverCalls: (grid) =>
+        this.serverCallsFor(grid.gridId, {
+          low: stringCorner(grid.bounds.low),
+          high: stringCorner(grid.bounds.high),
+        }),
+      hud: this.hud,
+      overlay: this.overlay,
+      ask: this.hooks?.clientHalfConsent ?? 'author',
+      confirm: (prompt, signal) =>
+        this.confirmTrust(describeClientHalfPrompt(prompt, this.authorName(prompt)), {
+          prompt,
+          signal,
+        }),
+      filter: (mod) => !this.previewedByStudio(mod),
+      onChange: (running) => {
+        this.state = { ...this.state, clientModsRunning: running.length };
+        this.emit();
+      },
+      log: (line) => this.session.network.log(line),
+    });
+    return this.halves;
+  }
+
+  /** The open Studio previews its project's CLIENT half itself; the grid's copy waits. */
+  private previewedByStudio(mod: ExecGridClientMod): boolean {
+    return (
+      this.isOpen &&
+      this.studioMod !== null &&
+      String(mod.gridId) === this.studioGridId &&
+      mod.name === this.studioMod
+    );
+  }
+
+  private watchStudio(controller: CrowdyStudioController | null): void {
+    this.unwatchStudio?.();
+    this.unwatchStudio = null;
+    const follow = (mod: string | null) => {
+      if (mod === this.studioMod) return;
+      this.studioMod = mod;
+      void this.refreshClientHalves();
+    };
+    if (!controller) {
+      follow(null);
+      return;
+    }
+    this.unwatchStudio = controller.subscribe((state) =>
+      follow(state.project ? studioPreviewModName(state.project) : null),
+    );
+  }
+
+  private authorName(prompt: ExecClientHalfPrompt): string | null {
+    const grid = this.currentGrid;
+    return grid && grid.gridId === String(prompt.gridId) ? (grid.ownerName ?? null) : null;
+  }
+
   private observationFrame() {
     const pose = this.session.joined ? this.session.world.self.state : null;
     const nearby = this.session.players().map((player) => ({
@@ -495,15 +613,19 @@ export class StudioService {
   }
 
   private adoptGrid(grid: GridSnapshot | null, chunk: ChunkCoord): void {
+    const entered = (grid?.gridId ?? null) !== (this.currentGrid?.gridId ?? null);
     this.currentGrid = grid;
     this.lastGridChunkKey = chunkKey(chunk);
     this.lastGridReadAt = Date.now();
-    if (this.lifecycle.enterGrid(grid?.gridId ?? null)) {
-      this.declinedAuthors.clear();
-      this.approvedAuthors.clear();
+    if (entered) {
       this.lastModsReadAt = 0;
       this.gridEnteredAt = Date.now();
       this.overlay.clear();
+      if (this.state.clientModsAvailable) {
+        this.clientHalves().enterGrid(
+          grid ? { gridId: grid.gridId, bounds: toBrokerBounds(grid.bounds) } : null,
+        );
+      }
     }
     this.state = { ...this.state, grid };
     this.emit();
@@ -522,7 +644,7 @@ export class StudioService {
     return Number.isFinite(px) ? px : 0;
   }
 
-  /** Periodic: which grid are we on, and are there mods to run for us? */
+  /** Periodic: which grid are we on, and are there CLIENT halves to run for us? */
   private async poll(): Promise<void> {
     if (!this.session.joined || !this.session.network.hasGame) return;
     const selfChunk = this.session.world.self.chunk;
@@ -538,118 +660,31 @@ export class StudioService {
         this.session.network.log(`grid lookup failed: ${messageOf(error)}`);
       }
     }
-    if (
-      this.state.clientModsAvailable &&
-      this.currentGrid &&
-      !this.currentGrid.owned &&
-      now - this.gridEnteredAt >= GRID_SETTLE_MS
-    ) {
-      await this.syncGridClientMods(this.currentGrid);
-    }
+    if (now - this.lastModsReadAt >= MODS_REFRESH_MS) await this.refreshClientHalves();
   }
 
   /**
-   * Visitor path: fetch the grid's attached CLIENT mods, ask once per author
-   * whether to trust them, and run the trusted/consented ones. Re-run on a
-   * cadence so a hash change stops the old worker.
+   * Reconcile the grid's CLIENT halves: start the consented ones, ask about
+   * the rest, stop what changed or went. Waits out the presence race after
+   * entering a grid.
    */
-  private async syncGridClientMods(grid: GridSnapshot): Promise<void> {
-    const now = Date.now();
-    if (this.modsInFlight || now - this.lastModsReadAt < MODS_REFRESH_MS) return;
-    const scope = this.lifecycle.scope(grid.gridId);
-    if (!scope) return;
-    this.lastModsReadAt = now;
-    this.modsInFlight = true;
+  private async refreshClientHalves(): Promise<void> {
+    const halves = this.halves;
+    if (!halves || !this.currentGrid || !this.state.clientModsAvailable) return;
+    if (Date.now() - this.gridEnteredAt < GRID_SETTLE_MS) return;
+    this.lastModsReadAt = Date.now();
     try {
-      const client = this.session.network.game;
-      const appId = this.session.appId;
-      let mods = await client.marketplace.gridClientMods({ appId, gridId: grid.gridId });
-      if (!this.lifecycle.reconcile(scope, mods.map(descriptorOf))) return;
-
-      let trustedAny = false;
-      for (const mod of mods) {
-        if (mod.callerTrustsAuthor) continue;
-        const authorKey = `${mod.authorKind}:${mod.authorRef}:${mod.authorCapabilityHash}`;
-        if (this.declinedAuthors.has(authorKey)) continue;
-        if (!this.approvedAuthors.has(authorKey)) {
-          const approved = await this.confirmTrust(
-            `Trust ${String(mod.authorKind).toLowerCase()} ${mod.authorRef}'s mods on this grid?\n\n` +
-              'Their client code will run in a sandbox while you are here.\n\n' +
-              prettyCapabilities(mod.authorCapabilitySummaryJson),
-          );
-          if (!approved) {
-            this.declinedAuthors.add(authorKey);
-            continue;
-          }
-          // Remembered so a transient refusal (presence not registered yet)
-          // retries silently instead of asking the player again.
-          this.approvedAuthors.add(authorKey);
-        }
-        await client.marketplace.trustGridAuthor({
-          appId,
-          gridId: grid.gridId,
-          authorKind: mod.authorKind,
-          authorRef: mod.authorRef,
-          consentCapabilityHash: mod.authorCapabilityHash,
-        });
-        if (!this.lifecycle.isCurrent(scope)) return;
-        trustedAny = true;
-      }
-      if (trustedAny) {
-        mods = await client.marketplace.gridClientMods({ appId, gridId: grid.gridId });
-        if (!this.lifecycle.isCurrent(scope)) return;
-      }
-      for (const mod of mods) {
-        if (!this.lifecycle.isCurrent(scope)) return;
-        if (
-          (mod.callerTrustsAuthor || mod.callerConsented) &&
-          !this.lifecycle.has(mod.attachmentId)
-        ) {
-          await this.runGridMod(mod, grid, scope);
-        }
-      }
+      await halves.refresh();
     } catch (error) {
-      this.session.network.log(`grid client-mod refresh failed: ${messageOf(error)}`);
-    } finally {
-      this.modsInFlight = false;
-      this.state = { ...this.state, clientModsRunning: this.lifecycle.runningCount };
-      this.emit();
+      this.session.network.log(`grid CLIENT halves unavailable: ${messageOf(error)}`);
     }
   }
 
-  private async runGridMod(
-    mod: {
-      attachmentId: string;
-      clientArtifactHash: string;
-      capabilityHash: string;
-      listingName?: string | null;
-    },
-    grid: GridSnapshot,
-    scope: ClientModScope,
-  ): Promise<void> {
-    const handle = await runConsentedGridMod({
-      client: this.session.network.game,
-      appId: this.session.appId,
-      attachmentId: mod.attachmentId,
-      artifactCacheKey: mod.clientArtifactHash,
-      hudSource: `grid:${mod.attachmentId}`,
-      hudLabel: mod.listingName || 'Grid mod',
-      grid: toBrokerBounds(grid.bounds, grid.gridId),
-      workerUrl: glueWorkerAssetUrl,
-      serverCalls: this.serverCallsFor(grid),
-      reads: this.reads(),
-      writes: this.writes(),
-      hud: this.hud,
-      overlay: this.overlay,
-      input: this.pointerClicks,
-    });
-    if (handle) {
-      this.lifecycle.track(scope, descriptorOf(mod), handle);
-    }
-  }
-
-  private async confirmTrust(summary: string): Promise<boolean> {
-    if (this.hooks?.confirmTrust) return this.hooks.confirmTrust(summary);
+  private async confirmTrust(
+    summary: string,
+    context: { prompt: ExecClientHalfPrompt; signal: AbortSignal },
+  ): Promise<boolean> {
+    if (this.hooks?.confirmTrust) return this.hooks.confirmTrust(summary, context);
     return window.confirm(summary);
   }
 
@@ -658,29 +693,6 @@ export class StudioService {
   }
 }
 
-function descriptorOf(mod: {
-  attachmentId: string;
-  clientArtifactHash: string;
-  capabilityHash: string;
-}) {
-  return {
-    attachmentId: mod.attachmentId,
-    artifactHash: mod.clientArtifactHash,
-    capabilityHash: mod.capabilityHash,
-  };
-}
-
-function prettyCapabilities(json: string | null | undefined): string {
-  if (!json) return '(no capability summary)';
-  try {
-    const parsed = JSON.parse(json) as unknown;
-    if (parsed && typeof parsed === 'object') {
-      return Object.entries(parsed as Record<string, unknown>)
-        .map(([k, v]) => `• ${k}: ${Array.isArray(v) ? v.join(', ') : String(v)}`)
-        .join('\n');
-    }
-    return String(parsed);
-  } catch {
-    return json;
-  }
+function stringCorner(corner: { x: bigint; y: bigint; z: bigint }) {
+  return { x: corner.x.toString(), y: corner.y.toString(), z: corner.z.toString() };
 }