@homie-rocks/studio 0.21.0 → 0.23.0

package/assets/safety.mjs

@@ -0,0 +1,194 @@
+/**
+ * IS THIS MODEL FILE SAFE TO LOAD? One answer for every place a model enters a game: the browser loader
+ * (assets/assets.ts, before three.js parses a byte), `homie-studio assets add` and `assets check` (Node), and the
+ * starter library's build. Plain JavaScript with no imports, so a browser bundle and Node read the same rules.
+ *
+ * A model is a glTF 2.0 binary (.glb): a 12-byte header, a JSON chunk and one binary chunk. It is refused when:
+ *   - it is not a GLB (a bare .gltf names its buffers and pictures by address: that is an external file);
+ *   - any buffer or picture names a `uri` other than a small `data:` one (an external URI could be fetched from
+ *     anywhere, at any size, by every player's browser);
+ *   - the file, its declared buffers, a buffer view or an accessor is bigger than the limits (a 200 MB buffer would
+ *     take a phone's whole page memory before anything checked it), or an accessor reaches past its buffer;
+ *   - it requires an extension three.js cannot read, or names more meshes, nodes, pictures or animations than any
+ *     game asset needs.
+ * Warnings (extensions used but not required, a picture type a phone may not decode) never refuse.
+ */
+
+/** The limits, in bytes and counts: `LIMITS.game` for a shipped asset, `LIMITS.import` for a raw file coming in. */
+export const LIMITS = Object.freeze({
+  game: Object.freeze({ bytes: 5 * 1024 * 1024, json: 2 * 1024 * 1024, buffer: 5 * 1024 * 1024, dataUri: 256 * 1024, vertices: 500_000, meshes: 512, nodes: 4096, materials: 64, images: 32, textures: 64, animations: 256, skins: 16, accessors: 8192 }),
+  import: Object.freeze({ bytes: 64 * 1024 * 1024, json: 8 * 1024 * 1024, buffer: 64 * 1024 * 1024, dataUri: 1024 * 1024, vertices: 4_000_000, meshes: 4096, nodes: 16384, materials: 256, images: 128, textures: 256, animations: 1024, skins: 64, accessors: 32768 }),
+});
+
+/** Extensions three.js's GLTFLoader reads (r185). A file that REQUIRES any other is refused. */
+export const READABLE_EXTENSIONS = Object.freeze([
+  'KHR_meshopt_compression', 'EXT_meshopt_compression', 'KHR_mesh_quantization', 'KHR_texture_basisu', 'EXT_texture_webp',
+  'EXT_texture_avif', 'KHR_texture_transform', 'KHR_materials_unlit', 'KHR_materials_emissive_strength', 'KHR_materials_clearcoat',
+  'KHR_materials_ior', 'KHR_materials_specular', 'KHR_materials_transmission', 'KHR_materials_volume', 'KHR_materials_sheen',
+  'KHR_materials_iridescence', 'KHR_materials_anisotropy', 'KHR_materials_dispersion', 'KHR_lights_punctual', 'EXT_mesh_gpu_instancing',
+  'KHR_draco_mesh_compression',
+]);
+
+const PICTURE_TYPES = ['image/png', 'image/jpeg', 'image/webp', 'image/ktx2', 'image/avif'];
+const COMPONENT_BYTES = { 5120: 1, 5121: 1, 5122: 2, 5123: 2, 5125: 4, 5126: 4 };
+const TYPE_SIZE = { SCALAR: 1, VEC2: 2, VEC3: 3, VEC4: 4, MAT2: 4, MAT3: 9, MAT4: 16 };
+const MAGIC = 0x46546c67; // "glTF"
+const JSON_CHUNK = 0x4e4f534a;
+const BIN_CHUNK = 0x004e4942;
+
+const view = (bytes) => new DataView(bytes.buffer, bytes.byteOffset, bytes.byteLength);
+const size = (n) => (n >= 1024 * 1024 ? `${(n / 1024 / 1024).toFixed(1)} MB` : `${Math.ceil(n / 1024)} KB`);
+
+/** The bytes a `data:` URI decodes to, without decoding it. */
+function dataUriBytes(uri) {
+  const comma = uri.indexOf(',');
+  if (comma < 0) return Infinity;
+  const head = uri.slice(5, comma);
+  const body = uri.length - comma - 1;
+  return /;base64$/i.test(head) ? Math.floor((body * 3) / 4) : body;
+}
+
+/**
+ * Read a GLB's header and chunks: { json, bin: { offset, length } | null } or throws a plain-words Error.
+ * `bytes` is a Uint8Array (a Node Buffer is one).
+ */
+export function readGlb(bytes, { maxJson = LIMITS.import.json } = {}) {
+  if (!(bytes instanceof Uint8Array)) throw new Error('not a file (expected bytes)');
+  if (bytes.byteLength < 20) throw new Error('too short to be a glTF binary (.glb)');
+  const dv = view(bytes);
+  if (dv.getUint32(0, true) !== MAGIC) {
+    const head = new TextDecoder().decode(bytes.subarray(0, Math.min(64, bytes.byteLength))).trimStart();
+    throw new Error(head.startsWith('{') ? 'a .gltf with separate files (its buffers and pictures are loaded by address): only a self-contained .glb is loaded' : 'not a glTF binary (.glb)');
+  }
+  const version = dv.getUint32(4, true);
+  if (version !== 2) throw new Error(`glTF version ${version} (only 2 is read)`);
+  const length = dv.getUint32(8, true);
+  if (length > bytes.byteLength) throw new Error(`the header says ${size(length)} but the file has ${size(bytes.byteLength)}: it is cut short`);
+  let at = 12;
+  let json = null;
+  let bin = null;
+  while (at + 8 <= length) {
+    const chunkLength = dv.getUint32(at, true);
+    const type = dv.getUint32(at + 4, true);
+    const start = at + 8;
+    if (start + chunkLength > length) throw new Error('a chunk runs past the end of the file');
+    if (type === JSON_CHUNK && json === null) {
+      if (chunkLength > maxJson) throw new Error(`its JSON is ${size(chunkLength)}, over ${size(maxJson)}`);
+      try { json = JSON.parse(new TextDecoder().decode(bytes.subarray(start, start + chunkLength))); } catch { throw new Error('its JSON chunk is not JSON'); }
+    } else if (type === BIN_CHUNK && bin === null) bin = { offset: start, length: chunkLength };
+    at = start + chunkLength + ((4 - (chunkLength % 4)) % 4);
+  }
+  if (!json || typeof json !== 'object') throw new Error('it has no JSON chunk');
+  return { json, bin, length };
+}
+
+/**
+ * Check a GLB against `limits` (LIMITS.game by default). Returns
+ *   { ok, problems: [plain words], warnings: [plain words], info: { bytes, triangles, vertices, meshes, nodes,
+ *     materials, images, textures, animations, skins, joints, extensions: { used, required } } }
+ * Never throws: a file it cannot read is `ok: false` with the reason.
+ */
+export function checkGlb(bytes, limits = LIMITS.game) {
+  const L = { ...LIMITS.game, ...limits };
+  const problems = [];
+  const warnings = [];
+  const info = { bytes: bytes?.byteLength ?? 0, triangles: 0, vertices: 0, meshes: 0, nodes: 0, materials: 0, images: 0, textures: 0, animations: 0, skins: 0, joints: 0, extensions: { used: [], required: [] } };
+  if (info.bytes > L.bytes) problems.push(`the file is ${size(info.bytes)}, over the ${size(L.bytes)} a model may be here`);
+  let glb;
+  try { glb = readGlb(bytes, { maxJson: L.json }); } catch (error) { problems.push(error.message); return { ok: false, problems, warnings, info }; }
+  const j = glb.json;
+  const arr = (k) => (Array.isArray(j[k]) ? j[k] : []);
+  const v = String(j.asset?.version ?? '');
+  if (!/^2\./.test(v)) problems.push(`asset.version is "${v || 'missing'}" (glTF 2.x is read)`);
+
+  // Counts.
+  const counts = { meshes: arr('meshes').length, nodes: arr('nodes').length, materials: arr('materials').length, images: arr('images').length, textures: arr('textures').length, animations: arr('animations').length, skins: arr('skins').length, accessors: arr('accessors').length };
+  Object.assign(info, { meshes: counts.meshes, nodes: counts.nodes, materials: counts.materials, images: counts.images, textures: counts.textures, animations: counts.animations, skins: counts.skins });
+  for (const [k, n] of Object.entries(counts)) if (L[k] !== undefined && n > L[k]) problems.push(`${n} ${k} (at most ${L[k]})`);
+
+  // Extensions.
+  const used = arr('extensionsUsed').map(String);
+  const required = arr('extensionsRequired').map(String);
+  info.extensions = { used, required };
+  for (const e of required) if (!READABLE_EXTENSIONS.includes(e)) problems.push(`it requires the extension ${e}, which three.js cannot read`);
+  for (const e of used) if (!required.includes(e) && !READABLE_EXTENSIONS.includes(e)) warnings.push(`it uses ${e}, which three.js ignores`);
+  if (required.includes('KHR_draco_mesh_compression')) warnings.push('Draco geometry: the decoder is about 250 KB more to download; meshopt is the house format');
+
+  // Buffers: only the GLB's own binary chunk, or a small data: URI. Never an address.
+  let declared = 0;
+  arr('buffers').forEach((b, i) => {
+    const len = Number(b?.byteLength);
+    if (!Number.isFinite(len) || len < 0) { problems.push(`buffer ${i} has no byteLength`); return; }
+    // A meshopt fallback buffer (no uri, never loaded by a reader that decodes meshopt) holds nothing in the file.
+    const fallback = b.uri === undefined && (b.extensions?.EXT_meshopt_compression?.fallback === true || b.extensions?.KHR_meshopt_compression?.fallback === true);
+    if (fallback) { if (len > L.buffer * 4) problems.push(`buffer ${i} (a meshopt fallback) declares ${size(len)}`); return; }
+    declared += len;
+    if (len > L.buffer) problems.push(`buffer ${i} declares ${size(len)}, over ${size(L.buffer)}`);
+    if (typeof b.uri === 'string') {
+      if (!/^data:/i.test(b.uri)) problems.push(`buffer ${i} is loaded from an address (${b.uri.slice(0, 60)}): an external URI`);
+      else if (dataUriBytes(b.uri) > L.dataUri) problems.push(`buffer ${i} is a data: URI of ${size(dataUriBytes(b.uri))}, over ${size(L.dataUri)}`);
+    } else if (i === 0) {
+      if (!glb.bin) problems.push('buffer 0 has no binary chunk to point at');
+      else if (len > glb.bin.length) problems.push(`buffer 0 declares ${size(len)} but the binary chunk holds ${size(glb.bin.length)}`);
+    } else problems.push(`buffer ${i} has no uri and is not the binary chunk`);
+  });
+  if (declared > L.bytes) problems.push(`its buffers declare ${size(declared)} in all, over ${size(L.bytes)}`);
+  const bufLen = (i) => Number(arr('buffers')[i]?.byteLength ?? -1);
+
+  // Buffer views and accessors stay inside what was declared.
+  const views = arr('bufferViews');
+  views.forEach((bv, i) => {
+    const end = Number(bv?.byteOffset ?? 0) + Number(bv?.byteLength ?? NaN);
+    if (!Number.isFinite(end) || bufLen(Number(bv?.buffer)) < 0 || end > bufLen(Number(bv.buffer))) problems.push(`buffer view ${i} reaches past its buffer`);
+  });
+  let maxCount = 0;
+  arr('accessors').forEach((a, i) => {
+    const count = Number(a?.count);
+    if (!Number.isInteger(count) || count < 0) { problems.push(`accessor ${i} has no count`); return; }
+    maxCount = Math.max(maxCount, count);
+    if (count > L.vertices * 3) problems.push(`accessor ${i} holds ${count.toLocaleString('en-US')} elements`);
+    if (a.bufferView === undefined) return;
+    const bv = views[Number(a.bufferView)];
+    const el = (COMPONENT_BYTES[a.componentType] ?? 0) * (TYPE_SIZE[a.type] ?? 0);
+    if (!bv || !el) { problems.push(`accessor ${i} points at nothing it can read`); return; }
+    const stride = Number(bv.byteStride ?? 0) || el;
+    const need = Number(a.byteOffset ?? 0) + (count ? stride * (count - 1) + el : 0);
+    // A meshopt-compressed view holds its decoded size in its extension; the plain view is the fallback.
+    const decoded = Number(bv.extensions?.EXT_meshopt_compression?.byteLength ?? bv.extensions?.KHR_meshopt_compression?.byteLength ?? bv.byteLength);
+    if (need > Math.max(Number(bv.byteLength), decoded)) problems.push(`accessor ${i} reaches past its buffer view`);
+  });
+
+  // Pictures: inside the file (a buffer view), or a small data: URI. Never an address.
+  arr('images').forEach((im, i) => {
+    if (typeof im?.uri === 'string') {
+      if (!/^data:/i.test(im.uri)) problems.push(`picture ${i} is loaded from an address (${im.uri.slice(0, 60)}): an external URI`);
+      else if (dataUriBytes(im.uri) > L.dataUri) problems.push(`picture ${i} is a data: URI of ${size(dataUriBytes(im.uri))}, over ${size(L.dataUri)}`);
+    } else if (im?.bufferView === undefined) problems.push(`picture ${i} has neither a buffer view nor a uri`);
+    const type = String(im?.mimeType ?? (typeof im?.uri === 'string' ? /^data:([^;,]+)/.exec(im.uri)?.[1] ?? '' : ''));
+    if (type && !PICTURE_TYPES.includes(type)) warnings.push(`picture ${i} is ${type}`);
+  });
+
+  // Triangles and vertices, as drawn: each mesh times the nodes that place it (GPU instancing counted once per node).
+  const accessors = arr('accessors');
+  const meshTris = arr('meshes').map((m) => (Array.isArray(m?.primitives) ? m.primitives : []).reduce((n, p) => {
+    const mode = p?.mode ?? 4;
+    const count = p?.indices !== undefined ? Number(accessors[p.indices]?.count ?? 0) : Number(accessors[p?.attributes?.POSITION]?.count ?? 0);
+    return n + (mode === 4 ? Math.floor(count / 3) : mode === 5 || mode === 6 ? Math.max(0, count - 2) : 0);
+  }, 0));
+  const meshVerts = arr('meshes').map((m) => (Array.isArray(m?.primitives) ? m.primitives : []).reduce((n, p) => n + Number(accessors[p?.attributes?.POSITION]?.count ?? 0), 0));
+  for (const node of arr('nodes')) {
+    if (node?.mesh === undefined) continue;
+    const inst = Number(accessors[node.extensions?.EXT_mesh_gpu_instancing?.attributes?.TRANSLATION]?.count ?? 1) || 1;
+    info.triangles += (meshTris[node.mesh] ?? 0) * inst;
+    info.vertices += (meshVerts[node.mesh] ?? 0) * inst;
+  }
+  info.joints = arr('skins').reduce((n, s) => Math.max(n, Array.isArray(s?.joints) ? s.joints.length : 0), 0);
+  if (info.vertices > L.vertices) problems.push(`${info.vertices.toLocaleString('en-US')} vertices drawn (at most ${L.vertices.toLocaleString('en-US')})`);
+  void maxCount;
+  return { ok: problems.length === 0, problems, warnings, info };
+}
+
+/** One line for a refusal: "refused <label>: a; b". */
+export function refusal(label, result) {
+  return `refused ${label}: ${result.problems.slice(0, 4).join('; ')}${result.problems.length > 4 ? `; and ${result.problems.length - 4} more` : ''}`;
+}

package/bin/homie-studio.mjs

@@ -100,6 +100,10 @@
  *                                          tap in their own browser, from the link this prints)
  *   homie-studio office revoke            (every office key, play ticket and pending ask ends)
  *
+ *   homie-studio chat [--game <id>]       room chat (NETPLAY.md section 19): each game's rules, every live room's last
+ *                                          minutes, players' reports, the review's day; chat rules <game> [--server <id>]
+ *                                          --mode off|emoji|lines|text --who anyone|signed-in|members … | --reset;
+ *                                          chat remove <game> <room> <line id>; chat budget <neurons>; chat words
  *   homie-studio servers [--game <id>]    every server of every game (worker/servers.mjs): its policy, door, the AI's
  *                                          level, live rooms and AI, members, and builds that predate servers
  *   homie-studio servers new <game> "<Name>" --policy open|humans-only|hybrid|beginner [--ai <n>] [--guides <n>]
@@ -163,6 +167,31 @@
  *                                         Claude artifact; --open: open it in this computer's browser
  *   homie-studio codex link <id>          a one-time link to the codex on the live site (a private page for the owner)
  *
+ *   homie-studio style init <id> [--prompt "<the person's words>"] [--hands-on] [--budget <usd>]
+ *                                         art direction as decisions (games/<id>/codex/decisions.json): render style,
+ *                                          palette, shape, proportions, materials, light, camera, fonts, effects; the cast,
+ *                                          its routes, library family, scale and budgets; rigs, animation, in-game budgets.
+ *                                          Each starts as an automatic pick with a why; the first asset built on one pins it
+ *   homie-studio style [show] <id> [--phase style]   the decisions (· auto, ~ steered, ● pinned by use, ■ locked)
+ *   homie-studio style set|steer|lock|unlock <id> <decision> …   change one ("warmer"), lock it for the person (--words
+ *                                          "<what they said>"); a locked one changes only with --unlock --reason, and
+ *                                          --confirm after the person saw what goes stale (style blast)
+ *   homie-studio style board <id>         three directions drawn by the engine (free): swatches in codex/board/
+ *   homie-studio style pick <id> <a|b|c> [--mix style.palette=b]   the person's pick (or a mix) from the board
+ *   homie-studio style mood|golden|blast|prompt <id> …   a paid mood image's record, golden images, the blast radius
+ *                                          of a change, the derived style prompt every generation starts from
+ *   homie-studio assets [list] <id>       every asset: route, licence, measurements, spend (games/<id>/assets/manifest.json)
+ *   homie-studio assets find "<words>" [--kind prop] [--family kenney]   the free CC0 starter library (HOMIE_LIBRARY: a copy)
+ *   homie-studio assets add <id> <library item> [--height <m>] | --file <model> --license <kind> [--attribution "…"]
+ *                                          copied in, checked (no external URIs, no oversized files), made phone-sized,
+ *                                          recorded with its licence; RIGHTS.md and credits.json follow
+ *   homie-studio assets redo <id> <asset>   made again from its kept raw file, free (today's budgets and style)
+ *   homie-studio assets optimise <in> --out <file> [--triangles 1500] [--texture 512] [--height <m>]
+ *   homie-studio assets check <id>        phone budgets (triangles, draw calls, picture memory, download), the
+ *                                          glTF-Validator, licences, stale assets, big files in git
+ *   homie-studio assets lineup|review|rights|stale|remove <id> …   the lineup (true scale, silhouettes, palette drift),
+ *                                          a reviewer's score, RIGHTS.md, what a changed decision made stale
+ *
  *   homie-studio statusline               the current build in one line (what Claude Code's status line shows)
  *   homie-studio statusline --install [--project <folder>]
  *                                         turn it on in Claude Code for this studio (.claude/settings.local.json);
@@ -194,6 +223,7 @@ import { STUDIO_VERSION } from '../lib/version.mjs';
 import { statsKey, statsLink, statsRevoke, statsShare, statsShow } from '../lib/stats.mjs';
 import { playersOwner, playersShow } from '../lib/players.mjs';
 import { officeAnnounce, officeClose, officeInvite, officeKey, officeKick, officeLaunch, officeLines, officeLink, officeMute, officeRevoke, officeShow } from '../lib/office.mjs';
+import { chatBudget, chatLines, chatRemove, chatRulesSet, chatShow, chatWords } from '../lib/chat-cli.mjs';
 import { agentsBrain, agentsBrainKey, agentsPass, agentsPasses, agentsRevoke, serversClose, serversLevel, serversLines, serversList, serversMember, serversNew, serversSet } from '../lib/servers.mjs';
 import { AgentSeat } from '../lib/agent-seat.mjs';
 import { Feed, currentFeed, currentId, flushProgress, publicFeed, readFeed, recordChange, startProgress } from '../lib/progress.mjs';
@@ -203,11 +233,12 @@ import { installStatusLine, statusLine } from '../lib/statusline.mjs';
 import { restartWithProxy } from '../lib/net.mjs';
 import { demoGames, formatDemo } from '../lib/demo.mjs';
 import { serveMcp } from '../lib/mcp.mjs';
+import { artLines, assetsCommand, styleCommand } from '../lib/art-cli.mjs';
 import { formatHandoff, handoff } from '../lib/handoff.mjs';
 
 const argv = process.argv.slice(2);
 const flags = new Map();
-const BOOL_FLAGS = ['off', 'revoke', 'json', 'yes', 'detach', 'no-install', 'plan', 'stop', 'share', 'apply', 'diff', 'template', 'ci', 'fresh', 'install', 'remove', 'replace', 'artifact', 'open', 'reopen', 'kids', 'remote-ai', 'dry-run', 'verify', 'maps', 'profile'];
+const BOOL_FLAGS = ['off', 'revoke', 'json', 'yes', 'detach', 'no-install', 'plan', 'stop', 'share', 'apply', 'diff', 'template', 'ci', 'fresh', 'install', 'remove', 'replace', 'artifact', 'open', 'reopen', 'kids', 'remote-ai', 'dry-run', 'verify', 'maps', 'profile', 'hands-on', 'automatic', 'unlock', 'confirm', 'no-library', 'no-validate', 'rigged'];
 const positional = [];
 for (let i = 0; i < argv.length; i++) {
   const a = argv[i];
@@ -226,15 +257,27 @@ function print(result) {
   if (result.ok === false && result.command !== 'port check' && !(result.command === 'look' && result.rows)) { process.stdout.write(`homie-studio: ${result.why ?? 'failed'}${result.instead ? `\n${result.instead}` : ''}\n`); return; }
   if (result.ok === false && result.command === 'port check' && !result.rows) { process.stdout.write(`homie-studio: ${result.why ?? 'failed'}\n`); return; }
   const lines = [];
+  if (/^(style|assets)( |$)/.test(String(result.command ?? ''))) { process.stdout.write(`${artLines(result).join('\n')}\n`); return; }
   switch (result.command) {
     case 'new':
       lines.push(`${result.name} is a studio now: ${result.dir}`, '', 'Wrote:', ...result.wrote.map((f) => `  ${f}`), '', `Dependencies: ${result.installed}`, '', 'Next:', ...result.next.map((n) => `  ${n}`), '', result.online);
       break;
     case 'game remix':
       lines.push(`games/${result.id} is a remix of ${result.from} (${result.files.length} files). Its game.json credits the original: "${result.credit}"${result.page ? ` (${result.page})` : ''}, on its landing and in its credits. Make it yours in games/${result.id}/src/, then: npx homie-studio dev`);
+      if (result.assets?.carried) lines.push(`  assets: ${result.assets.fetched.length} carried from the original (checked by SHA-256)${result.assets.placeholders.length ? `, ${result.assets.placeholders.length} grey placeholder(s) where the licence does not let a remix carry them (${result.assets.placeholders.map((p) => p.asset).join(', ')}): see games/${result.id}/assets/RIGHTS.md` : ''}`);
+      if (result.installNeeded) lines.push(`It needs ${result.needsAdded.map((n) => `${n.name} ${n.version}`).join(', ')}, now in the studio's package.json: run npm install first.`);
+      for (const h of result.needsHeld ?? []) lines.push(`It was written against ${h.name} ${h.want}; this studio pins ${h.have}, which stays.`);
+      if (result.needsNotAdded?.length) lines.push(`Its game.json also asks for ${result.needsNotAdded.join(', ')}: not added (a remix adds only what the toolkit's starters use). Read the code before adding any.`);
       break;
     case 'game new':
       lines.push(`games/${result.id} is a new game from the ${result.from} starter. Change it in games/${result.id}/src/, then: npx homie-studio dev`);
+      if (result.installNeeded) lines.push(`It needs ${result.needsAdded.map((n) => `${n.name} ${n.version}`).join(', ')}, now in the studio's package.json: run npm install first.`);
+      for (const h of result.needsHeld ?? []) lines.push(`It was written against ${h.name} ${h.want}; this studio pins ${h.have}, which stays.`);
+      if (result.models) {
+        const m = result.models;
+        lines.push(`Models: ${m.fetched} from the starter library (${m.from}) into games/${result.id}/public/models/, each checked by SHA-256.`);
+        if (m.missing.length) lines.push(`  ${m.missing.length} not here${m.why ? ` (${m.why})` : `: ${m.missing.map((x) => `${x.asset} (${x.why})`).join(', ')}`}. The game draws stand-ins for them; once the library is reachable, homie-studio assets add ${result.id} <item> --as <asset> brings each in (assets/manifest.json names them).`);
+      }
       break;
     case 'dev stop':
       lines.push(result.stopped.length ? `Stopped this studio's dev server (${result.stopped.join(', ')}).` : `Nothing to stop: ${result.why ?? 'no dev server of this studio is running'}.`);
@@ -388,6 +431,20 @@ function print(result) {
     case 'servers':
       lines.push(...serversLines(result));
       break;
+    case 'chat':
+      lines.push(...chatLines(result));
+      break;
+    case 'chat words':
+      for (const [k, v] of Object.entries(result.groups)) lines.push(`${k}: ${v.join(', ')}`);
+      lines.push(result.note);
+      break;
+    case 'chat remove':
+      lines.push(result.message);
+      break;
+    case 'chat rules':
+    case 'chat budget':
+      lines.push(result.asked ? `Asked: ${result.what}` : result.message, ...(result.asked ? [`Owner's one-tap link (until the ask ends, 15 min): ${result.link}`, result.use] : []));
+      break;
     case 'servers new':
       lines.push(result.message, ...(result.notes ?? []).map((n) => `  ${n}`));
       break;
@@ -552,6 +609,8 @@ async function main() {
   if (cmd === 'version' || flags.has('version')) return { ok: true, command: 'version', version: STUDIO_VERSION };
   if (cmd === 'new') return newStudio(positional[1], { name: flags.get('name'), homie: flags.get('homie'), slug: flags.get('slug'), install: !flags.has('no-install'), template: flags.has('template') });
   if (cmd === 'starters') return { ok: true, command: 'starters', starters: starters() };
+  // The floor's built-in words need no studio: anyone can read what a studio's chat always holds.
+  if (cmd === 'chat' && sub === 'words') return chatWords();
   if (cmd === 'demo') return demoGames();
   if (cmd === 'mcp') {
     // stdout carries MCP messages only from here on (lib/mcp.mjs); every word for a person goes to stderr.
@@ -573,7 +632,11 @@ async function main() {
     if (!positional[2] || !positional[3]) return { ok: false, command: 'perf compare', why: 'usage: homie-studio perf compare <before dir> <after dir> [--goal <metric>] [--min 3]' };
     return perfCompare(positional[2], positional[3], { goal: String(flags.get('goal') ?? DEFAULT_GOAL), min: flags.has('min') ? Number(flags.get('min')) / 100 : 0.03, guards: flags.get('guards') ? String(flags.get('guards')).split(',').map((x) => x.trim()).filter(Boolean) : null, also: flags.get('also') ? String(flags.get('also')).split(',').map((x) => x.trim()).filter(Boolean) : [] });
   }
+  // The starter library and the optimiser work anywhere; the rest of style and assets inside a studio (lib/art-cli.mjs).
+  if (cmd === 'assets' && ['find', 'optimise', 'optimize'].includes(sub)) return assetsCommand(null, sub, positional, flags, { log });
   const root = requireStudio();
+  if (cmd === 'style') return styleCommand(root, sub, positional, flags, { log });
+  if (cmd === 'assets') return assetsCommand(root, sub, positional, flags, { log });
   if (cmd === 'statusline') return installStatusLine(root, { remove: flags.has('remove'), replace: flags.has('replace'), project: flags.get('project') ?? null });
   if (cmd === 'codex') return codexCommand(root, sub);
   if (cmd === 'progress') return progressCommand(root, sub);
@@ -614,6 +677,10 @@ async function main() {
     const game = positional[1] ?? listGames(root)[0]?.id;
     const url = flags.get('url') ?? siteUrl(root);
     if (!url) return { ok: false, command: 'check', why: 'give --url (the local dev address or the live site)' };
+    // A big binary committed under games/ fails the check before any browser starts: it belongs in R2, never in git.
+    const { bigCommittedFiles } = await import('../lib/asset-check.mjs');
+    const big = bigCommittedFiles(root).filter((f) => f.path.startsWith(`games/${game}/`));
+    if (big.length) return { ok: false, command: 'check', why: `committed files over 5 MB under games/${game}: ${big.map((f) => `${f.path} (${(f.bytes / 1024 / 1024).toFixed(1)} MB)`).join(', ')}. Big media goes to the studio's R2 (homie-studio storage add, then media move); raw models stay in art/<slug>/raw/ (git-ignored); a shipped model is made phone-sized with homie-studio assets optimise. Take it out of git (git rm --cached), then check again.` };
     return tracked(root, 'checks', (report) => check({ url, game, shots: flags.get('shots') ? resolve(flags.get('shots')) : null, log, report }), 'check');
   }
   if (cmd === 'look') {
@@ -660,6 +727,16 @@ async function main() {
     if (sub === 'close') return officeClose(root, positional[2], positional[3], { url, minutes: flags.get('minutes'), reopen: flags.has('reopen') });
     if (sub === 'revoke') return officeRevoke(root, { url });
   }
+  if (cmd === 'chat') {
+    // Room chat (0.23.0, NETPLAY.md section 19): rules, the room's last minutes, reports, the review's budget.
+    const url = flags.get('url');
+    if (sub === 'words') return chatWords();
+    if (!sub) return chatShow(root, { url, game: flags.get('game') });
+    if (sub === 'rules') return chatRulesSet(root, positional[2], flags, { url });
+    if (sub === 'remove') return chatRemove(root, positional[2], positional[3], positional[4], { url, all: flags.has('all') });
+    if (sub === 'budget') return chatBudget(root, positional[2], { url });
+    return { ok: false, command: 'chat', why: `unknown: chat ${sub} (rules, remove, budget, words)` };
+  }
   if (cmd === 'servers') {
     const url = flags.get('url');
     if (!sub || sub === 'list') return serversList(root, { url, game: flags.get('game') });
@@ -882,7 +959,9 @@ async function dev(root) {
   log(`Local site: http://127.0.0.1:${port}/  (each game: http://127.0.0.1:${port}/<id>/play — open it in two browsers)`);
   const ai = devConfig(root, flags.has('remote-ai'));
   if (ai.note) log(ai.note);
-  const child = spawn(bin, ['dev', '--local', '--ip', '127.0.0.1', '--port', port, ...ai.args], { cwd: workerDir(root), env, stdio: 'inherit' });
+  // --remote-ai: Wrangler's --local turns every remote binding off ("not supported"), so a dev with the real Workers AI
+  // (the guides' brains, room chat's review) runs without it; everything else stays local all the same.
+  const child = spawn(bin, ['dev', ...(flags.has('remote-ai') ? [] : ['--local']), '--ip', '127.0.0.1', '--port', port, ...ai.args], { cwd: workerDir(root), env, stdio: 'inherit' });
   mkdirSync(dirname(devFile(root)), { recursive: true });
   writeFileSync(devFile(root), `${JSON.stringify({ pid: process.pid, child: child.pid, port: Number(port), at: new Date().toISOString() })}\n`);
   log(`Stop it with: npx --no-install homie-studio dev --stop   (this studio's dev server only)`);

package/chat/CHAT.md

@@ -0,0 +1,101 @@
+# Room chat
+
+Every studio game has room chat from `@homie-rocks/studio` 0.23.0: reactions that float up every
+screen in the room (the players', the watchers', the big screen's), the game's quick lines, and
+typed messages where the room's rules allow them. It feels like the Homie app's live rooms and
+homie.rocks's room chat because it is the same thing: the same five reactions in the same order,
+the same message shapes, the same float on a television.
+
+The wire, the rules and the helper are in [NETPLAY.md section 19](../netplay/NETPLAY.md). This
+page is the short version for a game's author, and why the review uses what it uses. For what a
+studio's owner is responsible for, read [OWNERS.md](OWNERS.md).
+
+## What a game gets with no work
+
+- **The Chat pill** on the play page, beside the room button: the room's last minutes, the
+  reactions, the quick lines, typing where allowed, Report on a line, and two switches ("Show my
+  messages over my character", "Show chat on this screen").
+- **The float:** every reaction rises up every screen in the room.
+- **The ticker:** a new line shows for a moment where the play page's status chip sits.
+- **The big screen** (`/<game>/tv`) shows the room's lines in a corner; the **watch page** has a
+  Chat button; **homie.rocks** shows the room's chat on its card when the studio allows it.
+
+## What a game can add
+
+**Its rules, in game.json** (the owner can change every one in the office):
+
+```json
+"chat": {
+  "mode": "text",
+  "who": "signed-in",
+  "react": "anyone",
+  "slow": 2,
+  "max": 140,
+  "emoji": { "gem": "💎" },
+  "lines": { "gg": "Good game!", "gem": "Grab that gem!", "help": "Help me!", "wait": "Wait for me!" }
+}
+```
+
+| Field | | Default |
+|---|---|---|
+| `mode` | `off`, `emoji` (reactions only), `lines` (and quick lines), `text` (and typing) | `text` |
+| `who` | who may type: `anyone`, `signed-in` (a player account with a passkey), `members` (of the room's server) | `signed-in` |
+| `react` | who may send reactions and quick lines (the same three) | `anyone` |
+| `slow`, `max` | seconds between one person's lines; a typed line's length | 2, 140 |
+| `links`, `swears` | `block` or `allow` (a link is never clickable; slurs, sexual words, threats and contact details are always held) | `block` |
+| `ai` | review typed messages with the studio's own Workers AI | `true` |
+| `bubbles`, `watchers`, `hub` | over the speaker's character; watchers may send; homie.rocks may show it | `true` |
+| `emoji`, `lines` | up to 3 more reactions; up to 12 quick lines (each passes the chat floor at build) | the five; 8 friendly lines |
+| `block`, `allow` | the studio's own words to hold (`word*` inside words) or to let through | none |
+
+`"chat": false` turns it off. A kids server, and every beginner server, keeps chat to emoji and
+quick lines whatever the game says. Where new lines show for a moment: game.json
+`"screen": { "chat": "bottom-right" }` (any corner, `top-center` or `bottom-center`), or `false`
+for only the pill's count.
+
+**Speech bubbles over characters**, with the port kit (the starters draw them):
+
+```ts
+import { createBubbles, paintBubbles, BUBBLE_FONT } from '@homie-rocks/studio/port';
+const bubbles = createBubbles({ measure: (t) => { ctx.font = BUBBLE_FONT; return ctx.measureText(t).width; } });
+net.on('say', (s) => bubbles.say(s.seat, s.text, { id: s.id, kind: s.kind }));
+net.on('unchat', (e) => e.ids.forEach((id) => bubbles.remove(id)));
+// each frame, after the names: the anchor is just over each speaking body's name
+paintBubbles(ctx, bubbles.place(speakers.map((s) => ({ key: s.seat, x: s.x, y: s.nameTop, self: s.mine }))));
+```
+
+A 3D game draws them the same way on its HUD canvas (Gem Rush 3D does), or reads `place()`'s boxes
+and draws its own. **The game's own chat UI** (a key that opens a wheel of quick lines, say):
+`net.sayLine('gg')`, `net.react('fire')`, `net.say(text)`; `net.on('chat')` for a log of your own.
+
+## Moderation: what it uses, and why
+
+The owner asked for "Cloudflare's new decisions API". That is **Clef**, Cloudflare's decision
+models, launched on Workers AI on 2026-10-01 (Birthday Week): `@cf/cloudflare/clef-flash` (9B) and
+`@cf/cloudflare/clef` (27B). They do not write text: you send a `state` (here, the message) and
+typed questions, and they return a probability for every allowed answer. Cloudflare names "trust
+and safety: score user submissions against your own policy rubric" as a use.
+
+| | Clef-flash (the default) | Clef | Llama Guard 3 8B | AI Gateway Guardrails |
+|---|---|---|---|---|
+| What | a decision model: our own question, a probability per answer | the same, larger | Meta's fixed safety categories (S1–S14) | Llama Guard run on prompts and responses of model calls through a gateway |
+| Price | $0.09 per M input tokens, no output charge: measured about 2.3 neurons a short message (the question is most of it) | $0.24 per M: about 6 neurons | $0.48 per M in, $0.03 out: up to about 10 neurons a message with its policy prompt | Llama Guard's price, plus the model call it guards |
+| Speed | about 40 ms median, 120 ms p95 (Cloudflare's numbers) | about 210 ms median | about 500 ms (Cloudflare's guardrails notes) | a model call plus about 500 ms |
+| Fits game chat | our categories: insults, hate, sexual, grooming, harm, spam | the same, more accurate | no insults or bullying category; most game-chat abuse reads as "safe" | not for arbitrary text: it guards model traffic |
+
+Clef-flash is the default because it is the cheapest per message by about five times, the fastest
+by far (a message waits for it before anyone sees it), and lets the studio ask exactly what game
+chat needs. Honest caveats: it is one day old as this ships, Cloudflare publishes no moderation
+accuracy numbers for it, and the message it reads is a player's, so a player can try to steer it
+(less of a risk than with a model that writes, since it only scores fixed answers). That is why
+**the word list always runs first and decides alone** whenever the review cannot (no binding, the
+day's budget used, an error, a slow answer). `HOMIE_CHAT_MODEL` switches to Clef or Llama Guard.
+Firewall for AI (now "AI Security for Apps") was ruled out: it reads HTTP requests at the zone, not
+messages inside a Durable Object, and its detections are an Enterprise add-on.
+
+**What it costs a studio.** Workers AI gives every account 10,000 neurons a day free, on the free
+Workers plan too, with no payment method. The review's day is 2,000 neurons by default (about
+850 typed messages, measured), leaving the AI guides their 8,000; `homie-studio chat budget <n>` changes it. On the free plan, past the allocation
+Workers AI refuses (the floor decides); on Workers Paid, past it is $0.011 per 1,000 neurons, which
+is why the review stops at its own budget. `homie-studio deploy` binds Workers AI when a game lets
+players type; `homie-studio dev --remote-ai` uses the real one (billed to the signed-in account).

package/chat/OWNERS.md

@@ -0,0 +1,78 @@
+# Room chat: a note for studio owners
+
+**This is not legal advice.** It says what Homie's tooling does and does not do, so you can decide
+what your studio needs. Laws about online chat and children's data differ by country and change;
+if your games are for children, or many children play them, talk to someone who advises on that
+where you and your players are.
+
+## Your studio, your rooms, your responsibility
+
+A Homie studio runs on **your own Cloudflare account**: your Worker, your Durable Objects, your D1
+database, your Workers AI. Homie (and homie.rocks) does not run your rooms, does not see your
+players' chat, and does not moderate it for you. You choose the rules, you hold the owner's
+controls, and you are the one responsible for what happens in your rooms, as the operator of the
+service. Homie gives you the tools to do that well; it cannot do it for you.
+
+What that means in practice:
+
+- **Choose rules that fit your players.** Each game sets its defaults in game.json, and you change
+  them per game and per server in the office (`/_studio/office`) or with `homie-studio chat rules`.
+  If your players are young, keep chat to emoji and quick lines, or put them on a kids server (a
+  beginner server with `kids` on): typing is then off whatever the game says.
+- **Watch your rooms, and act.** The office shows every live room's last minutes. Remove a message,
+  mute or kick its sender (their messages come down with them), and read what players report.
+- **Answer reports.** Players can report a message. You see it in the office and with
+  `homie-studio chat`; dismiss it once you have dealt with it.
+- **Say who your game is for, and what chat it has,** on your game's page and in your own terms or
+  rules, if you have them.
+
+## What the tooling does
+
+| | |
+|---|---|
+| **Who can say what** | By default: everyone can send emoji and the game's quick lines; only **signed-in players** (an account with a passkey on your studio) can type. You can open typing to guests, keep it to members of a server, keep a room to emoji or quick lines, or turn chat off. |
+| **Before anyone sees a typed message** | 1) a built-in word list and patterns (slurs, sexual words, telling someone to hurt themselves, asking a player's age or where they live, asking for pictures, moving a player to another app, email addresses and phone numbers, links, swears), plus your own words; 2) a review on your own Workers AI (Cloudflare's Clef decision model) that holds insults, hate, sexual content, grooming, threats and spam. The list always runs; the review runs within a daily budget. Neither is perfect: both are English-first, and a determined person can get past any filter. |
+| **Emoji and quick lines** | Fixed words you (the game) chose. They are never reviewed and reach every screen at once. |
+| **Children** | A kids server keeps chat to emoji and quick lines, gives players handles instead of names, and never asks anyone's age. Homie never asks for a player's age, birthday or address anywhere. |
+| **AI players** | An AI never types in room chat. |
+| **Slow mode and limits** | One line every 2 s by default (you choose), and message length, repeats and floods are capped. |
+
+## What is stored, and for how long
+
+| What | Where | How long |
+|---|---|---|
+| The chat itself (every message and reaction) | Only in the room's memory, on your Cloudflare account | The last 50 messages of the last 15 minutes, for someone who just opened the room. **Never written to storage.** An empty room forgets them a minute after the last person leaves. |
+| Who said what | The same memory, for your office's Mute and Kick | As long as the message is in that memory. Never an IP address. |
+| A **report** | Your D1 (`chat_reports`) | The one message reported (its words, its sender's name and account id if they had one, the room, when, the reason picked), for **30 days** or until you dismiss it. Never who reported it. |
+| Your chat rules and your words | Your D1 (`chat_rules`) | Until you change them. |
+| Counts (messages sent, held and why, reviews) | Your D1 (`stats_daily`) | Daily numbers, never a message and never a person. |
+| Player accounts | Your D1 (the players tables, `saves/SAVES.md`) | A random id, a display name, a passkey's public key. No email unless a player adds one; players can download and delete everything of theirs at `/account/`. |
+
+**The review** sends a typed message's words (and nothing about who wrote it) to Workers AI on your
+own Cloudflare account. Cloudflare says it does not store or train on Clef's requests or responses.
+**homie.rocks** stores nothing of your chat: when your rules allow it, a visitor's own browser opens
+your room's socket to show its chat on your room's card there. Turn that off with `hub` off.
+
+## Children's data, in plain words
+
+Laws in many places (for example COPPA in the United States, GDPR and the UK's Children's Code in
+Europe and the UK) set rules for online services that collect personal information from children,
+or that are directed at children. A typed message can contain personal information. What helps:
+
+- **Keep chat to emoji and quick lines for games aimed at children** (or a kids server). Then no
+  child types anything, and there is nothing personal in your chat to keep or lose.
+- **Typing for signed-in players only** (the default) means a person behind each typed line has an
+  account you can act on.
+- **Little is stored**, and only briefly (see above). Reports are the exception, kept 30 days.
+- **You can delete**: a report with Dismiss, a message with Remove, a player's whole account in
+  their own account page (or `players` in the office).
+
+Homie does not know your players' ages and does not verify them. Whether your game is "directed at
+children", and what that requires of you, is for you to decide with advice where you need it.
+
+## What the tooling cannot promise
+
+No filter catches everything, and a review model can be wrong both ways. The word list is English;
+other languages rely on the review. A studio past its daily review budget, or whose Worker has no
+Workers AI binding yet, relies on the word list alone until the next day (the office says so). Your
+attention, your rules and your owner's controls are the real safety net.