@homie-rocks/studio 0.26.0 → 0.26.1

package/CHANGELOG.md

@@ -17,9 +17,41 @@ To bring a studio up to date, tell Claude: "Upgrade my studio to the newest Homi
 `npx -y @homie-rocks/studio@latest upgrade`, which shows what's new since the version your studio pins (from this
 file) and what the upgrade would change, and changes nothing until you agree.
 
+## [0.26.1] - 2026-10-03
+
+**Plugin 0.27.1** · [#41](https://github.com/homie-rocks/homie/pull/41)
+
+In Codex, Homie now holds what the Claude Code mod holds: protected files, deploys, Cloudflare changes, spending past the budget and model downloads wait for your own "proceed", and secrets come out of what Codex reads.
+
+### Added
+
+- Homie's hooks for Codex (`hooks/codex.json`, `hooks/codex.mjs`). They hold and refuse the same calls as the Claude Code mod, with the same words:
+  - Held: an edit to a file `studio.json` `"protect"` lists (an `apply_patch`, with its diff), a production deploy, a change to the studio's Cloudflare account outside its deploy (Wrangler or Cloudflare's MCP servers), a paid fal, ElevenLabs or Tripo call past the budget or whose cost cannot be read first, and a Clef model download.
+  - Refused: a change to a locked art decision, an unlicensed asset in a public game's deploy, a file over 5 MB under `games/` into git, and a Stripe write that would hand back a webhook's signing secret.
+  - Secrets come out of every tool result before the model reads it.
+- How you answer a hold in Codex. A Codex hook cannot ask you, so a held call is refused with a short code, and Codex shows you what it holds. Then:
+  - Reply `proceed H7K2` to let exactly that call through once, or `cancel H7K2` to refuse it.
+  - Only your own message counts; the model cannot answer for you.
+  - In `codex exec`, `codex exec resume <session> "proceed H7K2"` answers a hold.
+- `node hooks/codex.mjs check -- <command>` says what Homie would do with a command, and runs nothing.
+
+### Changed
+
+- The decisions behind every hold live in one module, `hooks/lib/holds.mjs`. The Claude Code mod and the Codex hooks both ask it, so the two cannot drift. The mod holds exactly what it held before, with the same words.
+- The plugin's root `plugin.json` no longer declares the Agent Plugins `$schema`. Codex 0.156.1 to 0.160.0 read a root manifest only when it declares that schema, and then run none of the plugin's hooks. Codex now reads `.codex-plugin/plugin.json`, which names the hooks, the skills and the Homie MCP server.
+- The studio-setup, publish, art, video, models, music, servers and shop skills say what Homie's hooks hold in Codex, and how a hold is answered there.
+
+### Upgrade notes
+
+- Codex runs a plugin's hooks only once you trust them. After updating the Homie plugin in Codex, open `/hooks` and trust Homie's three hooks. Until then nothing is held in Codex, and `codex exec` skips untrusted hooks without a word.
+- The plugin README's "Homie's holds in Codex" compares what Claude Code and Codex cover. Not in Codex:
+  - a question dialog;
+  - redaction of the output on your own screen and in Codex's session file;
+  - the mod's panes and commands.
+
 ## [0.26.0] - 2026-10-03
 
-**Plugin 0.27.0** · [#40](https://github.com/homie-rocks/homie/pull/40)
+**Plugin 0.27.0** · [#40](https://github.com/homie-rocks/homie/pull/40) · [release-2026-10-03-studio-0.26.0](https://github.com/homie-rocks/homie/releases/tag/release-2026-10-03-studio-0.26.0)
 
 A game's first minute: Play never opens on a blank screen, a bright game gets a bright landing in its own palette, and in Hero Rush 3D a new player's first round is a race they are in.
 

package/lib/template-history.json

@@ -1273,6 +1273,45 @@
      }
     }
    }
+  },
+  "0.26.1": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "ce7a8fd91c6bbee2",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "ca131cd0472464fb",
+    "site/src/worker.mjs": "ca3f1630f2420ad3"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "214aa46eb3a895d5",
+     "## Layout": "8baf49e4291e7e88",
+     "## Commands (all through the pinned CLI in node_modules)": "d80ec56e4b4fc4c6",
+     "## The site": "ab922bb6bde23293",
+     "## Making games": "abf2f0d59341512d",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "aaea65236db52126",
+     "## Running live games (the back office)": "4aa5f513a7cd2c3b",
+     "## Servers and AI seats": "98d08705087a33ec",
+     "## Selling things (the shop)": "b04b0a2b25f524f2",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "7e8458adc1b81ece",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "b35df2c19cd4b534"
+      }
+     }
+    }
+   }
   }
  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homie-rocks/studio",
-  "version": "0.26.0",
+  "version": "0.26.1",
   "description": "A studio for games, music and video on its own Cloudflare: scaffold, multiplayer starters on the netplay contract, a port toolkit that makes existing single-player web games multiplayer, the site Worker with public rooms (Table/Lobby Durable Objects and D1, all on the free Workers plan, no payment method), a site with the hub's sections (Home, Games, Music, Videos, Rooms, Posts with feeds) in the studio's own look, an epic landing page for every game, big songs and videos in the studio's own R2 once it has storage (uploaded, checked by SHA-256, served at the same addresses), deploy, and the homie.rocks directory.",
   "type": "module",
   "license": "Apache-2.0",

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.26.0';
+export const STUDIO_VERSION_TAG = '0.26.1';