@homie-rocks/studio 0.27.0 → 0.28.0

package/CHANGELOG.md

@@ -17,9 +17,38 @@ To bring a studio up to date, tell Claude: "Upgrade my studio to the newest Homi
 `npx -y @homie-rocks/studio@latest upgrade`, which shows what's new since the version your studio pins (from this
 file) and what the upgrade would change, and changes nothing until you agree.
 
+## [0.28.0] - 2026-10-03
+
+**Plugin 0.29.0** · [#43](https://github.com/homie-rocks/homie/pull/43)
+
+Tell Homie: when something confuses you or gets in your way, Claude can offer to send the people who make Homie a short note about it. You see the note word for word first, and nothing is sent without your yes.
+
+### Added
+
+- `homie_feedback`, a new tool on both Homie MCP servers (the remote one at homie.rocks, and the local `homie-studio mcp` in Homie for Claude Desktop), with the same name and inputs on each:
+  - `draft` (the default) sends nothing. It answers with the note exactly as it would go: its kind (stuck, confusing, idea, praise or bug), the words, and what goes with them (the step or skill, the studio's and the plugin's versions, the app, and whether Claude offered it or you asked). Keys, tokens, private links, code, home folders, email addresses, network addresses and your Cloudflare account's name are taken out first, and the note says what was taken out.
+  - `send` sends only the note you were shown. It names the draft, and a note whose words or details changed since then is refused.
+  - `decline` records your no.
+  - A note goes only to homie.rocks: a studio.json can name Homie's own directory or this computer, nothing else.
+- A Tell Homie card in Claude Desktop and Claude on the web or a phone: the note as it would go, with **Send**, **Edit** (your own words, your kind, an optional reply address) and **Don't send**.
+- In Claude Code, the Homie mod:
+  - `/feedback <your words>` shows your note in a Tell Homie pane with Send and Don't send. `/feedback` alone opens the pane to write one, or puts an ask for Claude to draft one in your prompt box. The Studio pane has a **Tell Homie** button (`t`).
+  - Every send from Claude waits for **Send** in Claude Code's own question, with the note's exact words. Once you have sent or declined a note in a session, Claude cannot offer another.
+  - A note is drawn in the transcript as a framed note.
+- In Codex, Homie's hooks hold every send until your own `proceed <code>`, with the note's exact words in the hold.
+- Skills and the studio's `AGENTS.md` (a new "Telling Homie" section) tell Claude when to offer: after an error it could not fix, when you sound confused or frustrated, and at the end of your first studio setup or first publish. It offers at most once a session, never makes help wait on it, and takes no for an answer.
+
+### Changed
+
+- The studio-setup and publish skills, the plugin's README and both MCP servers' instructions describe Tell Homie.
+
+### Upgrade notes
+
+- Nothing to do. `homie-studio upgrade` adds the "Telling Homie" section to the studio's `AGENTS.md`. The tool is on the Homie MCP for every app; in Claude Code, update the plugin for `/feedback` and the send hold. Notes are private; homie.rocks/privacy says what is kept.
+
 ## [0.27.0] - 2026-10-03
 
-**Plugin 0.28.0** · [#42](https://github.com/homie-rocks/homie/pull/42)
+**Plugin 0.28.0** · [#42](https://github.com/homie-rocks/homie/pull/42) · [release-2026-10-03-studio-0.27.0](https://github.com/homie-rocks/homie/releases/tag/release-2026-10-03-studio-0.27.0)
 
 Search engines and AI agents read a studio's site correctly: schema.org data on every page, a full VideoGame on every landing, and a sitemap, robots.txt and llms.txt made from what is public.
 

package/README.md

@@ -49,6 +49,14 @@ feed; MCP Apps cards (setup, build progress, studio, codex) are served as `ui://
 answers in plain text. Homie for Claude Desktop (`desktop/` in this repository) is this server as a Desktop
 Extension: the plain Claude app gets it with one install, and no terminal.
 
+**Tell Homie** (0.28.0): `homie_feedback` drafts a short note to the people who make Homie (stuck, confusing, idea,
+praise or bug) from what happened, and sends it only after the person has seen it word for word and said yes: its
+card (`ui://homie-studio/feedback`) has Send, Edit and Don't send, and a send must name the draft the person saw,
+with the same words. Keys, home folders, email addresses, code and a workers.dev account name are taken out before
+it is shown (`lib/feedback.mjs`, with the Homie mod's own redaction). Claude offers one at most once a session, and a
+no is final for it. It goes to homie.rocks (`/api/feedback/tell`): a studio.json can name only Homie's own directory or
+this computer, so a borrowed studio cannot send notes elsewhere.
+
 ## From a phone: a one-line hand-off
 
 The Claude app on a phone hands a build to a Claude Code cloud session with one line, `Continue building <Studio>:
@@ -785,7 +793,8 @@ pinned a tarball at `https://homie.rocks/npm/homie-studio-<version>.tgz`, which
 ## Beta
 
 This is a beta. Bugs, port requests and questions go to
-<https://github.com/homie-rocks/homie/issues/new/choose>.
+<https://github.com/homie-rocks/homie/issues/new/choose>, or, from inside Claude or Codex, to the people who make
+Homie as a short note you see and send yourself (`homie_feedback`, above).
 
 ## License
 

package/lib/feedback.mjs

@@ -0,0 +1,181 @@
+/**
+ * TELL HOMIE (0.28.0): a short note from a creator to the people who make Homie, drafted by Claude in plain words,
+ * shown to the person exactly as it would go, and sent ONLY after they say yes. One module for every road a note
+ * takes from this side: the local MCP's `homie_feedback` (lib/mcp-tools.mjs), its card (mcp/ui/feedback.js), and
+ * the rules the Homie mod and the remote Homie MCP keep the same (homie.rocks has its own copy of these rules and
+ * applies them again when a note arrives).
+ *
+ * What a note is, and nothing more: its kind (stuck, confusing, idea, praise, bug), the words, the step or skill it
+ * is about, the studio and plugin versions, which app it came from, whether Claude offered it or the person asked,
+ * and a reply address only when the person typed one. No file, no log, no code, no key, no studio name, no path.
+ *
+ * Before anything is shown, the words go through the mod's own redaction (lib/redact.mjs, the same rules the mod
+ * uses on tool output: keys, tokens, private keys, owner links) and then a note's own: fenced code, home folders
+ * (a user's home becomes ~), email addresses, a workers.dev address's account name, network addresses and long
+ * opaque strings. What was taken out is listed with the draft, so the person sees it too.
+ *
+ * THE DRAFT IS THE NOTE. A draft's id is a hash of everything that would be sent; a send carries the id and the same
+ * fields, and a send whose fields do not hash to its id is refused. So what goes out is exactly what was shown.
+ */
+import { redactText } from './redact.mjs';
+
+export const FEEDBACK_KINDS = Object.freeze(['stuck', 'confusing', 'idea', 'praise', 'bug']);
+export const FEEDBACK_APPS = Object.freeze(['claude-code', 'codex', 'claude-desktop', 'claude-ai', 'other']);
+export const FEEDBACK_LIMITS = Object.freeze({ text: 1500, raw: 6000, lines: 30, step: 80, email: 254, version: 32, perSession: 5, offers: 3 });
+export const KIND_LABEL = Object.freeze({ stuck: 'Stuck', confusing: 'Confusing', idea: 'Idea', praise: 'Praise', bug: 'Bug' });
+export const APP_LABEL = Object.freeze({ 'claude-code': 'Claude Code', codex: 'Codex', 'claude-desktop': 'the Claude desktop app', 'claude-ai': 'Claude on the web or a phone', other: 'another app' });
+
+/** Where a note goes on a Homie directory (homie.rocks, or a local one for tests). */
+export const feedbackUrl = (directory = 'https://homie.rocks') => `${String(directory || 'https://homie.rocks').replace(/\/+$/, '')}/api/feedback/tell`;
+
+const EMAIL = /^[^\s@]{1,64}@[^\s@]{1,255}\.[^\s@]{2,63}$/;
+const VERSION = /^[0-9A-Za-z][0-9A-Za-z.+-]{0,31}$/;
+const CONTROL = /[\u0000-\u0008\u000b\u000c\u000e-\u001f\u007f-\u009f\u2028\u2029\u200b-\u200f\u202a-\u202e\u2060-\u206f\ufeff]/g;
+const HIDDEN = (what) => `[${what} hidden by Homie]`;
+
+/*
+ * A note's own rules, after the mod's. Each: what it is (said to the person), the pattern, and its replacement.
+ * Order matters: code first (whatever is inside a fence goes whole), then links and addresses.
+ */
+const NOTE_RULES = [
+  { kind: 'code', re: /```[\s\S]*?(?:```|$)/g, to: () => '[code left out by Homie]' },
+  // A workers.dev address names the Cloudflare account, often after its owner: the account part goes.
+  // (Labels are bounded, as DNS bounds them: an unbounded one makes this rule quadratic on a long run of hyphens.)
+  { kind: 'a workers.dev account name', re: /\b([a-z0-9-]{1,63}\.)?([a-z0-9-]{1,63})(\.workers\.dev)\b/gi, to: (m, sub, account, tail) => `${sub ?? ''}[account]${tail}` },
+  { kind: 'a home folder', re: /(?:\/Users\/|\/home\/)([^/\s"'`]+)/g, to: () => '~' },
+  { kind: 'a home folder', re: /\b[A-Za-z]:\\Users\\([^\\\s"'`]+)/g, to: () => '~' },
+  { kind: 'an email address', re: /\b[A-Za-z0-9._%+-]{1,64}@[A-Za-z0-9.-]{1,253}\.[A-Za-z]{2,63}\b/g, to: () => HIDDEN('an email address') },
+  // A network address that is not this computer's own.
+  { kind: 'a network address', re: /\b(?!127\.0\.0\.1\b)(?!0\.0\.0\.0\b)(?:25[0-5]|2[0-4]\d|1?\d?\d)(?:\.(?:25[0-5]|2[0-4]\d|1?\d?\d)){3}\b/g, to: () => HIDDEN('a network address') },
+  // A signed token (three dotted parts, the first two JSON in base64): whole, before the rule below takes one part.
+  { kind: 'a token', re: /\beyJ[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}\.[A-Za-z0-9_-]{8,}/g, to: () => HIDDEN('a token') },
+  // Anything long and opaque that a rule above did not name (a token of a kind nobody listed, a hash, a blob), after
+  // a dot too.
+  { kind: 'a long code', re: /(?<![A-Za-z0-9_\-+/=])(?=[A-Za-z0-9_\-+/=]*[0-9])(?=[A-Za-z0-9_\-+/=]*[A-Za-z])[A-Za-z0-9_\-+/=]{32,}(?![A-Za-z0-9_\-+/=])/g, to: () => HIDDEN('a long code') },
+];
+
+/** The words of a note as they may go: redacted, plain, and the list of what was taken out. */
+export function redactNote(value) {
+  let text = String(value ?? '').replace(/\r\n?/g, '\n').replace(CONTROL, '');
+  const taken = [];
+  for (const rule of NOTE_RULES.slice(0, 1)) text = applyRule(text, rule, taken);
+  const r = redactText(text);
+  if (r.hits.length) {
+    taken.push(...r.hits.map((h) => (h === 'owner link' ? 'a private link' : `a ${h}`.replace(/^a ([aeiou])/i, 'an $1'))));
+    // The mod's words for a link it showed in its pane are not true of a note: here the link is simply gone.
+    text = r.text.split('[one-time owner link: the Homie mod showed it to the person in its Studio pane; Claude never sees it]').join(HIDDEN('a private link'));
+  }
+  for (const rule of NOTE_RULES.slice(1)) text = applyRule(text, rule, taken);
+  text = text.replace(/[ \t]+\n/g, '\n').replace(/\n{3,}/g, '\n\n').trim();
+  return { text, taken: [...new Set(taken)] };
+}
+
+function applyRule(text, rule, taken) {
+  rule.re.lastIndex = 0;
+  return text.replace(rule.re, (...m) => {
+    const out = rule.to(...m);
+    if (out !== m[0]) taken.push(rule.kind);
+    return out;
+  });
+}
+
+const oneLine = (value, max) => String(value ?? '').replace(CONTROL, ' ').replace(/\s+/g, ' ').trim().slice(0, max);
+
+/**
+ * A note as it may be shown and sent, or why not: { ok: true, note, taken } | { ok: false, why }.
+ * `input`: { kind, text, step?, studioVersion?, pluginVersion?, app?, email?, offered? }.
+ */
+export function cleanNote(input = {}) {
+  const kind = String(input.kind ?? '').trim().toLowerCase();
+  if (!FEEDBACK_KINDS.includes(kind)) return { ok: false, why: `kind is one of ${FEEDBACK_KINDS.join(', ')}` };
+  const raw = String(input.text ?? '');
+  // Before any rule reads it: a note is short, and a rule's cost grows with what it is given.
+  if (raw.length > FEEDBACK_LIMITS.raw) return { ok: false, why: `the note is ${raw.length.toLocaleString('en-US')} characters: keep it under ${FEEDBACK_LIMITS.text.toLocaleString('en-US')} (a short note, never a log or a file)` };
+  const { text, taken } = redactNote(raw);
+  if (!text) return { ok: false, why: 'the note is empty: write what happened in a sentence or two, in plain words' };
+  if (text.length > FEEDBACK_LIMITS.text) return { ok: false, why: `the note is ${text.length} characters: keep it under ${FEEDBACK_LIMITS.text.toLocaleString('en-US')} (a short note, never a log or a file)` };
+  if (text.split('\n').length > FEEDBACK_LIMITS.lines) return { ok: false, why: `the note has more than ${FEEDBACK_LIMITS.lines} lines: a short note, never a log or a file` };
+  const stepRaw = oneLine(input.step, 400);
+  const step = stepRaw ? oneLine(redactNote(stepRaw).text, FEEDBACK_LIMITS.step) || null : null;
+  const version = (v) => { const s = String(v ?? '').trim().replace(/^v/, ''); return VERSION.test(s) ? s : null; };
+  const app = FEEDBACK_APPS.includes(String(input.app ?? '')) ? String(input.app) : 'other';
+  const emailRaw = String(input.email ?? '').trim();
+  if (emailRaw && (emailRaw.length > FEEDBACK_LIMITS.email || !EMAIL.test(emailRaw))) return { ok: false, why: 'the reply address is not a whole email address: leave it out, or ask the person for theirs' };
+  const note = {
+    kind, text, step,
+    studioVersion: version(input.studioVersion), pluginVersion: version(input.pluginVersion),
+    app, email: emailRaw || null, offered: input.offered === true,
+  };
+  return { ok: true, note, taken };
+}
+
+/** A draft's id: what would be sent, hashed. The same note always has the same id; any change gives another. */
+export async function draftId(note) {
+  const canonical = JSON.stringify([note.kind, note.text, note.step, note.studioVersion, note.pluginVersion, note.app, note.email, note.offered]);
+  const digest = await crypto.subtle.digest('SHA-256', new TextEncoder().encode(canonical));
+  return `fd_${[...new Uint8Array(digest)].slice(0, 12).map((b) => b.toString(16).padStart(2, '0')).join('')}`;
+}
+
+/** What goes with the words, in a line the person reads. */
+export function withLine(note) {
+  const parts = [
+    note.step ? `the step (${note.step})` : null,
+    note.studioVersion ? `studio ${note.studioVersion}` : null,
+    note.pluginVersion ? `plugin ${note.pluginVersion}` : null,
+    APP_LABEL[note.app] ?? null,
+    note.offered ? 'that Claude offered it' : 'that you asked to send it',
+  ].filter(Boolean);
+  return `${parts.join(' · ')}. ${note.email ? `A reply address: ${note.email}.` : 'No reply address.'}`;
+}
+
+/** The note, exactly as it would go, as the text a chat shows (for an app with no card). */
+export function noteBlock(note, taken = []) {
+  return [
+    `  Kind: ${KIND_LABEL[note.kind]}`,
+    ...note.text.split('\n').map((l, i, all) => `  ${i === 0 ? '"' : ' '}${l}${i === all.length - 1 ? '"' : ''}`),
+    `  Sent with it: ${withLine(note)}`,
+    ...(taken.length ? [`  Homie took out: ${taken.join(', ')}.`] : []),
+  ].join('\n');
+}
+
+/** The body a Homie directory takes at /api/feedback/tell. `source`: 'plugin' (this toolkit) or 'mod'. */
+export function noteBody(note, { source, consent }) {
+  const body = { kind: note.kind, text: note.text, source, consent, offered: note.offered, app: note.app };
+  for (const k of ['step', 'studioVersion', 'pluginVersion', 'email']) if (note[k]) body[k] = note[k];
+  return body;
+}
+
+/**
+ * Send a note the person said yes to: { ok, reference, repeat } | { ok: false, why, status }. Never retried here:
+ * a second press is the person's to make, and the directory answers a repeat with the same reference.
+ */
+export async function sendNote(note, { directory, source = 'plugin', consent = 'chat', fetchImpl = fetch, timeoutMs = 15_000 } = {}) {
+  let res;
+  try {
+    res = await fetchImpl(feedbackUrl(directory), {
+      method: 'POST',
+      headers: { 'content-type': 'application/json', accept: 'application/json', 'user-agent': `homie-studio-feedback (${source})` },
+      body: JSON.stringify(noteBody(note, { source, consent })),
+      redirect: 'manual',
+      signal: AbortSignal.timeout(timeoutMs),
+    });
+  } catch (error) {
+    return { ok: false, status: 0, why: `Homie could not be reached (${error?.name === 'TimeoutError' ? 'no answer in 15 s' : error?.cause?.code ?? error?.message ?? 'no connection'}). Nothing was sent; the person can try again later.` };
+  }
+  let body = null;
+  try { body = JSON.parse(await res.text()); } catch { body = null; }
+  if (res.ok && body?.ok === true && typeof body.reference === 'string') return { ok: true, reference: body.reference, repeat: body.repeat === true };
+  const said = typeof body?.message === 'string' ? oneLine(body.message, 300) : null;
+  if (res.status === 429) return { ok: false, status: 429, why: said ?? 'Homie has had enough notes from this network today. Nothing was sent; try again tomorrow.' };
+  if (res.status === 404) return { ok: false, status: 404, why: 'This Homie directory does not take notes yet. Nothing was sent.' };
+  return { ok: false, status: res.status, why: `${said ?? `Homie answered ${res.status}`}. Nothing was sent.` };
+}
+
+/** Which app a client is, from its MCP initialize clientInfo. */
+export function appOf(clientInfo) {
+  const name = String(clientInfo?.name ?? '').toLowerCase();
+  if (/codex/.test(name)) return 'codex';
+  if (/claude[-_ ]?code/.test(name)) return 'claude-code';
+  if (/claude/.test(name)) return 'claude-desktop';
+  return 'other';
+}

package/lib/mcp-tools.mjs

@@ -37,6 +37,7 @@ import { detectLocalAi } from './local-ai.mjs';
 import { LAB_PORT, runningLab } from './lab.mjs';
 import { pictureFor } from './pictures.mjs';
 import { ART_UI, artToolDefs } from './art-tools.mjs';
+import { FEEDBACK_APPS, FEEDBACK_KINDS, FEEDBACK_LIMITS, appOf, cleanNote, draftId, noteBlock, sendNote, withLine } from './feedback.mjs';
 
 export const UI = Object.freeze({
   setup: 'ui://homie-studio/setup',
@@ -44,6 +45,7 @@ export const UI = Object.freeze({
   studio: 'ui://homie-studio/studio',
   codex: 'ui://homie-studio/codex',
   lab: 'ui://homie-studio/lab',
+  feedback: 'ui://homie-studio/feedback',
   ...ART_UI,
 });
 
@@ -72,6 +74,10 @@ export class StudioContext {
     this.notes = new Map();
     this.runs = new Map();
     this.status = null;
+    // Tell Homie: this session's drafts (what the person was shown), and whether an offered note was answered.
+    this.feedback = { drafts: new Map(), sent: 0, offers: 0, offeredDone: false, declined: false };
+    // The MCP client (initialize's clientInfo), which a note names as an app and nothing more.
+    this.client = null;
   }
 
   note(root) { if (!this.notes.has(root)) this.notes.set(root, {}); return this.notes.get(root); }
@@ -580,6 +586,110 @@ async function githubLogin(ctx) {
   return ok(`GitHub's sign-in is waiting for the person: open https://github.com/login/device and enter the code ${code} (job ${job.id}; studio_job says when it is done). The code is GitHub's one-time device code, not a password.`, { kind: 'job', ...jobView(job), deviceCode: code });
 }
 
+/* ------------------------------------------------------------------ Tell Homie (lib/feedback.mjs) */
+
+/** The plugin's version, from the skills folder this server was given (the plugin's own manifest beside it). */
+function pluginVersion(ctx) {
+  if (!ctx.skillsDir) return null;
+  for (const f of [join(ctx.skillsDir, '..', '.claude-plugin', 'plugin.json'), join(ctx.skillsDir, '..', 'plugin.json')]) {
+    try { const v = JSON.parse(readFileSync(f, 'utf8')).version; if (typeof v === 'string') return v; } catch { /* not here */ }
+  }
+  return null;
+}
+
+/** What this server knows that a note carries: the toolkit's version (the studio's own pin, in a studio), the plugin's, the app, and where notes go. */
+function feedbackFacts(ctx, studioArg) {
+  let root = null;
+  try { root = ctx.root(studioArg, { need: false }); } catch { root = null; }
+  let studio = null;
+  try { studio = root ? readStudio(root) : null; } catch { studio = null; }
+  const pinned = (() => {
+    try { const pkg = JSON.parse(readFileSync(join(root, 'package.json'), 'utf8')); return pinnedVersion(pkg?.devDependencies?.['@homie-rocks/studio'] ?? pkg?.dependencies?.['@homie-rocks/studio']); } catch { return null; }
+  })();
+  const fromStudio = String(studio?.homie?.directory ?? '');
+  // Where notes go: the directory this server was started with (--homie, the operator's own word), else the studio's,
+  // and a studio.json (which may be a clone of somebody else's) can only name Homie's own directory or this computer.
+  const loopback = (u) => u.protocol === 'http:' && ['127.0.0.1', 'localhost'].includes(u.hostname);
+  const started = (d) => { try { const u = new URL(d); return u.protocol === 'https:' || loopback(u); } catch { return false; } };
+  const homies = (d) => { try { const u = new URL(d); return (u.protocol === 'https:' && /(^|\.)homie\.rocks$/.test(u.hostname)) || loopback(u); } catch { return false; } };
+  const directory = (ctx.directory && started(ctx.directory) ? ctx.directory : null) ?? (fromStudio && homies(fromStudio) ? fromStudio : null) ?? 'https://homie.rocks';
+  return { studioVersion: pinned ?? STUDIO_VERSION, pluginVersion: pluginVersion(ctx), app: appOf(ctx.client), directory: directory.replace(/\/+$/, ''), studio: root ? basename(root) : null };
+}
+
+const hostOfUrl = (u) => { try { return new URL(u).host; } catch { return 'homie.rocks'; } };
+
+/**
+ * homie_feedback: draft (shows the note exactly as it would go, sends nothing), send (only the note a draft showed,
+ * after the person's yes), decline (the person said no: nothing is sent, and no note is offered again this session).
+ *
+ * A send is tied to its draft by the draft's id alone (a hash of the whole note), never by this process's memory: an
+ * app may start a new server between the draft and the yes (a resumed session, a restart), and the remote Homie MCP
+ * keeps no session at all. What this process remembers is only a convenience (a send that names just its draft) and
+ * the once-a-session rule.
+ */
+async function feedbackTool(ctx, a) {
+  const action = ['draft', 'send', 'decline'].includes(a.action) ? a.action : 'draft';
+  const session = ctx.feedback;
+  const facts = feedbackFacts(ctx, a.studio);
+  const to = hostOfUrl(facts.directory);
+  const view = (state, extra = {}) => ({ kind: 'feedback', state, to, ...extra });
+  if (action === 'decline') {
+    const kept = a.draft ? session.drafts.get(String(a.draft)) : null;
+    session.declined = true;
+    if (kept?.note.offered || !kept) session.offeredDone = true;
+    if (kept) session.drafts.delete(String(a.draft));
+    return ok('Not sent: nothing left this computer. Tell the person so in a few words, and do not offer to send a note again in this session.',
+      view('declined', { draft: a.draft ?? null, note: kept?.note ?? null, taken: kept?.taken ?? [], with: kept ? withLine(kept.note) : null, next: 'Not sent. Say so in a few words, and do not offer to send a note again in this session.' }));
+  }
+  // A send of a draft this process showed sends THAT note (its facts are the ones the person saw, whichever studio is
+  // in use now); words that come with it must be its own. A draft it does not know is rebuilt from the call's fields.
+  const known = a.draft ? session.drafts.get(String(a.draft)) : null;
+  const worded = !(a.text === undefined || a.text === null || a.text === '');
+  let c;
+  if (action === 'send' && known) {
+    const said = worded ? cleanNote({ ...known.note, kind: a.kind ?? known.note.kind, text: a.text }) : null;
+    if (said && (!said.ok || said.note.text !== known.note.text || said.note.kind !== known.note.kind)) {
+      return fail('Not sent: this is not the note the person was shown (its words or kind changed since the draft). Draft it again, show them the new note, and send that one after their yes.', view('changed', { draft: String(a.draft), note: known.note, taken: known.taken, with: withLine(known.note), studio: facts.studio, why: 'changed since the draft' }));
+    }
+    c = { ok: true, note: known.note, taken: known.taken };
+  } else {
+    c = cleanNote({ kind: a.kind, text: a.text, step: a.step, email: a.email, offered: a.offered === true, studioVersion: facts.studioVersion, pluginVersion: facts.pluginVersion, app: facts.app });
+  }
+  if (!c.ok) return fail(`Not sent: ${c.why}.`, view('invalid', { why: c.why }));
+  const id = await draftId(c.note);
+  const shown = { draft: id, note: c.note, taken: c.taken, with: withLine(c.note), studio: facts.studio };
+  if (action === 'draft') {
+    if (c.note.offered && (session.declined || session.offeredDone)) {
+      return fail(`Not drafted: ${session.declined ? 'the person said no to a note earlier in this session' : 'a note was already offered in this session'}, and Homie offers at most once a session. Do not offer again. If the person asks, in their own words, to tell Homie something, draft it with offered: false.`, view('invalid', { why: 'offered once already this session' }));
+    }
+    // An offer nobody answered may be reworded a few times (the person asked for a change); it is not asked over and over.
+    if (c.note.offered && !session.drafts.has(id)) {
+      if (session.offers >= FEEDBACK_LIMITS.offers) return fail('Not drafted: a note was offered several times in this session and the person has not said yes. Do not offer again. If they ask to tell Homie something, draft it with offered: false.', view('invalid', { why: 'offered several times already' }));
+      session.offers += 1;
+    }
+    session.drafts.set(id, { note: c.note, taken: c.taken, at: Date.now() });
+    const next = `Nothing has been sent. Show the person this note exactly as it is and ask whether to send it. Only after they say yes in their own words: homie_feedback { "action": "send", "draft": "${id}" } with the same kind and text. If they want it worded differently, draft it again in their words. If they say no: homie_feedback { "action": "decline", "draft": "${id}" }, say nothing was sent, and do not offer again in this session.`;
+    return ok([
+      'Nothing has been sent. Show the person this note exactly as it is (where a card shows, it has Send, Edit and Don\'t send), and ask whether to send it to Homie:',
+      '',
+      noteBlock(c.note, c.taken),
+      '',
+      `Send it only after they say yes in their own words: homie_feedback { "action": "send", "draft": "${id}" } with the same kind and text. If they want it worded differently, draft it again in their words and show the new note. If they say no: homie_feedback { "action": "decline", "draft": "${id}" }, tell them nothing was sent, and do not offer again in this session. It goes privately to the people who make Homie (${to}).`,
+    ].join('\n'), view('draft', { ...shown, next }));
+  }
+  // send
+  if (!a.draft) return fail(`Not sent: a send names the draft the person saw (homie_feedback { "action": "draft", … } first, show it, and send its "draft" id after their yes).`, view('invalid', { why: 'no draft' }));
+  if (String(a.draft) !== id) return fail('Not sent: this is not the note the person was shown (its words or details changed since the draft). Draft it again, show them the new note, and send that one after their yes.', view('changed', { ...shown, why: 'changed since the draft' }));
+  if (session.sent >= FEEDBACK_LIMITS.perSession) return fail(`Not sent: ${FEEDBACK_LIMITS.perSession} notes is the most one session sends.`, view('invalid', { ...shown, why: 'too many this session' }));
+  const r = await sendNote(c.note, { directory: facts.directory, source: 'plugin', consent: ['card', 'dialog'].includes(a.by) ? a.by : 'chat' });
+  if (!r.ok) return fail(`Not sent: ${r.why}`, view('failed', { ...shown, why: r.why }));
+  session.sent += 1;
+  session.drafts.delete(id);
+  if (c.note.offered) session.offeredDone = true;
+  return ok(`Sent to Homie${r.repeat ? ' (it had this exact note already)' : ''}: reference ${r.reference.slice(0, 8)}. Thank the person in one line. The note is private: only the people who make Homie read it. Do not offer another note in this session.`,
+    view('sent', { ...shown, reference: r.reference, next: 'Sent. Thank the person in one line, and do not offer another note in this session.' }));
+}
+
 /* ------------------------------------------------------------------ guides (the plugin's skills) */
 
 function guideTopics(ctx) {
@@ -1120,6 +1230,29 @@ export function toolDefs(ctx, avail = {}) {
         return ok(`${v.label}: ${v.state}${v.state === 'running' ? ` (${v.seconds} s so far)` : ` after ${v.seconds} s`}${v.state === 'failed' ? `: ${whyOf(job)}` : ''}${v.result ? `\n${JSON.stringify(v.result, null, 1).slice(0, 8000)}` : v.tail.length ? `\n${v.tail.join('\n')}` : ''}`, { kind: 'job', ...v });
       },
     },
+    {
+      name: 'homie_feedback', title: 'Tell Homie',
+      description: 'A short private note to the people who make Homie, and ONLY with the person\'s yes. action "draft" (the default) sends nothing: it shows the note exactly as it would go (a card with Send, Edit and Don\'t send; the words, the step, the studio and plugin versions and the app, after keys, paths, emails and code are taken out), and you show the same text in the chat and ask. action "send" sends that draft (its "draft" id, with the same kind and text) only after the person said yes in their own words; "decline" records their no. OFFER it (offered: true) at most once a session, at a natural moment: after an error you could not fix, when the person sounds confused or frustrated, or at the end of their first studio setup or first publish. Never nag; a no is final for the session. When the person asks to tell Homie something, draft it with offered: false. Write it in plain words from what happened (what they tried, what they expected, what they saw), never a log, a file, code, a key or someone\'s name; a reply address only if they typed it themselves.',
+      inputSchema: {
+        type: 'object',
+        properties: {
+          action: str('draft (show it; sends nothing), send (after the person\'s yes) or decline (their no)', { enum: ['draft', 'send', 'decline'] }),
+          kind: str('What it is', { enum: [...FEEDBACK_KINDS] }),
+          text: str(`What happened, in plain words, at most ${FEEDBACK_LIMITS.text.toLocaleString('en-US')} characters: your draft, or the person\'s own words`),
+          step: str('Optional: the step or skill it is about, e.g. "studio-setup: put it online" or "publish"'),
+          email: str('Optional: a reply address, only if the person typed it themselves'),
+          offered: { type: 'boolean', description: 'true when you offered it; false when the person asked to tell Homie' },
+          draft: str('With send or decline: the draft id the draft returned (fd_…)'),
+          by: str('How the person said yes: chat (in their own words), card (the card\'s Send) or dialog (Send in Claude Code\'s own question, which the Homie mod asks)', { enum: ['chat', 'card', 'dialog'] }),
+          studioVersion: str('Filled in here from the studio (the remote Homie MCP takes it from you)'),
+          pluginVersion: str('Filled in here from the plugin (the remote Homie MCP takes it from you)'),
+          app: str('Filled in here from this app (the remote Homie MCP takes it from you)', { enum: [...FEEDBACK_APPS] }),
+          ...STUDIO_ARG,
+        },
+      },
+      annotations: { title: 'Tell Homie', readOnlyHint: false, destructiveHint: false, idempotentHint: false, openWorldHint: true }, _meta: ui(UI.feedback),
+      run: async (a) => feedbackTool(ctx, a),
+    },
     {
       name: 'file_list', title: 'List studio files',
       description: 'The files and folders in the studio (or one folder of it), two levels deep. Paths are relative to the studio.',
@@ -1238,4 +1371,4 @@ export function slimCodex(html, { max = 140_000, pictures = true } = {}) {
   return h.length <= max ? h : null;
 }
 
-export const _test = { checklist, feedFor, slimCodex, expandHome };
+export const _test = { checklist, feedFor, slimCodex, expandHome, feedbackFacts };

package/lib/mcp.mjs

@@ -50,10 +50,12 @@ To make one mechanic of a game feel better (a jump, a hit, a dash), game_lab ope
 
 A game's look is a set of decisions (render style, palette, light, camera, fonts, the cast and its budgets), automatic from the person's words until they steer or lock one (studio_guide { "topic": "style" }). style_explore draws three directions with the game engine for free; decision_set picks, steers and locks; assets_find searches the free CC0 starter library and asset_add copies a model in with its licence; asset_make makes a prop on the person's own fal account only after they agreed to its price; asset_check, asset_lineup and asset_rights keep it one game, phone-sized and properly licensed (studio_guide { "topic": "models" }).
 
+Telling Homie (homie_feedback): when the person is stuck, confused or frustrated, after an error you could not fix, or at the end of their first studio setup or first publish, you may OFFER, once a session, to send the people who make Homie a short note about it. Draft it in plain words from what happened (it sends nothing), show it exactly as it would go (its card has Send, Edit and Don't send), and send only after they say yes. Never nag: a no is final for the session. When they ask to tell Homie something, draft it with offered: false.
+
 Long work (npm install, check, playtest, deploy, renders) runs in the background: the tool answers at once with a card that follows it, and build_progress or studio_job reads where it is. studio_guide has Homie's full guide for each job (game, plan, port, playtest, publish, music, sound, art, video). Never put a key or password in a file or the chat. If Homie's homie.rocks connector is connected too, its tools of the same names say what to run; these run it.`;
 
-const CARD_FILES = { [UI.setup]: 'setup.js', [UI.build]: 'build.js', [UI.studio]: 'studio.js', [UI.codex]: 'codex.js', [UI.lab]: 'lab.js', [UI.style]: 'style.js', [UI.decision]: 'decision.js', [UI.cast]: 'cast.js', [UI.lineup]: 'lineup.js', [UI.rights]: 'rights.js', [UI.animation]: 'animation.js' };
-const CARD_TITLES = { [UI.setup]: 'Studio setup', [UI.build]: 'Build progress', [UI.studio]: 'Studio', [UI.codex]: 'Game Codex', [UI.lab]: 'Game Lab', [UI.style]: 'Style board', [UI.decision]: 'Look decision', [UI.cast]: 'Cast', [UI.lineup]: 'Lineup', [UI.rights]: 'Rights', [UI.animation]: 'Clips' };
+const CARD_FILES = { [UI.setup]: 'setup.js', [UI.build]: 'build.js', [UI.studio]: 'studio.js', [UI.codex]: 'codex.js', [UI.lab]: 'lab.js', [UI.style]: 'style.js', [UI.decision]: 'decision.js', [UI.cast]: 'cast.js', [UI.lineup]: 'lineup.js', [UI.rights]: 'rights.js', [UI.animation]: 'animation.js', [UI.feedback]: 'feedback.js' };
+const CARD_TITLES = { [UI.setup]: 'Studio setup', [UI.build]: 'Build progress', [UI.studio]: 'Studio', [UI.codex]: 'Game Codex', [UI.lab]: 'Game Lab', [UI.style]: 'Style board', [UI.decision]: 'Look decision', [UI.cast]: 'Cast', [UI.lineup]: 'Lineup', [UI.rights]: 'Rights', [UI.animation]: 'Clips', [UI.feedback]: 'Tell Homie' };
 const UI_DIR = join(PACKAGE_ROOT, 'mcp', 'ui');
 
 /** One card's whole document: the shared look and bridge, and the card's own script, as the files are. */
@@ -160,6 +162,8 @@ export async function serveMcp({ studios = null, skills = null, cwd = process.cw
       switch (method) {
         case 'initialize': {
           const asked = params?.protocolVersion;
+          // Which app this is (Claude Code, Codex, the Claude desktop app): a note to Homie says so, and nothing more.
+          ctx.client = params?.clientInfo ?? null;
           return reply({
             protocolVersion: PROTOCOLS.includes(asked) ? asked : PROTOCOLS[0],
             capabilities: { tools: { listChanged: true }, resources: { listChanged: false }, prompts: { listChanged: false } },

package/lib/redact.mjs

@@ -0,0 +1,99 @@
+/**
+ * SECRETS OUT OF TOOL OUTPUT. The Homie mod runs every tool result through `redact` before Claude reads it or the
+ * transcript keeps it. It only matches text: it never opens a key file, the keychain or the environment.
+ *
+ * What it hides: the studio's own one-time and owner keys (office and stats keys `hsk_`, progress write keys `hbk_`,
+ * agent passes `hap_…`, whose public id part stays), Cloudflare API tokens and global keys, provider keys (fal,
+ * ElevenLabs, Anthropic, OpenAI, GitHub, npm, Stripe keys and webhook secrets, AWS, Google), bearer tokens, private key blocks, and the value
+ * of any `NAME=value` whose name says key, token or secret.
+ *
+ * A link that carries one (the owner's one-time sign-in link, a confirm link, a player-owner link) is a link for the
+ * person, not for Claude: it is taken out whole and handed back in `links`, so the mod can show it to the person in
+ * its pane, and Claude reads that it is there.
+ */
+
+const HIDE = (kind) => `[${kind} hidden by Homie]`;
+
+/** Each rule: what it is, the pattern, and how to write what replaces a match (the default hides the whole match). */
+export const RULES = [
+  { kind: 'private key', re: /-----BEGIN [A-Z ]*PRIVATE KEY-----[\s\S]*?-----END [A-Z ]*PRIVATE KEY-----/g },
+  { kind: 'office key', re: /\bhsk_[a-f0-9]{48}\b/g },
+  { kind: 'progress key', re: /\bhbk_[a-f0-9]{48}\b/g },
+  // An agent pass: its id (hap_ and ten hex digits) is public and stays; the secret after it goes.
+  { kind: 'agent pass', re: /\b(hap_[a-f0-9]{10})_[A-Za-z0-9_-]{40}(?![A-Za-z0-9_-])/g, to: (m, id) => `${id}_${HIDE('agent pass')}` },
+  { kind: 'Anthropic key', re: /\bsk-ant-[A-Za-z0-9_-]{20,}/g },
+  { kind: 'OpenAI key', re: /\bsk-(?:proj-|svcacct-|admin-)?[A-Za-z0-9_-]{32,}/g },
+  { kind: 'ElevenLabs key', re: /\bsk_[a-f0-9]{48}\b/g },
+  { kind: 'Stripe key', re: /\b(?:sk|rk)_(?:live|test)_[A-Za-z0-9]{16,}\b/g },
+  // A webhook signing secret has no live/test part: whsec_ and the secret itself.
+  { kind: 'Stripe webhook secret', re: /\bwhsec_[A-Za-z0-9+/=_-]{16,}/g },
+  { kind: 'fal key', re: /\b[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}:[0-9a-f]{32}\b/g },
+  { kind: 'GitHub token', re: /\b(?:gh[pousr]_[A-Za-z0-9]{36,}|github_pat_[A-Za-z0-9_]{40,})\b/g },
+  { kind: 'npm token', re: /\bnpm_[A-Za-z0-9]{36}\b/g },
+  { kind: 'AWS key', re: /\b(?:AKIA|ASIA)[0-9A-Z]{16}\b/g },
+  { kind: 'Google key', re: /\bAIza[0-9A-Za-z_-]{35}\b/g },
+  { kind: 'Cloudflare key', re: /(X-Auth-Key["']?\s*[:=]\s*["']?)([a-f0-9]{37})\b/gi, to: (m, head) => `${head}${HIDE('Cloudflare key')}` },
+  { kind: 'token', re: /(\b[Bb]earer\s+)([A-Za-z0-9_\-.~+/]{24,}=*)/g, to: (m, head) => `${head}${HIDE('token')}` },
+  // NAME=value (or NAME: value) where the name says what it is: CLOUDFLARE_API_TOKEN, FAL_KEY, ELEVENLABS_API_KEY ...
+  // Only a value that looks like a key (16+ characters of letters AND digits, no dots or brackets), so source code
+  // that names a key (`const FAL_KEY = process.env.FAL_KEY`) is never changed under Claude's eyes.
+  {
+    kind: 'secret',
+    re: /\b([A-Z][A-Z0-9_]*(?:API_KEY|API_TOKEN|_TOKEN|_SECRET|SECRET_KEY|_KEY|PASSWORD)\b["']?\s*[=:]\s*["']?)([A-Za-z0-9_\-+/=:]{16,})(?![A-Za-z0-9_.(])/g,
+    to: (m, head, value) => (/[A-Za-z]/.test(value) && /[0-9]/.test(value) ? `${head}${HIDE('secret')}` : m),
+  },
+];
+
+const URL_RE = /https?:\/\/[^\s"'<>`)\]]+/g;
+const LINK_SECRET = /\b(?:hsk|hbk)_[a-f0-9]{48}\b|\bhap_[a-f0-9]{10}_[A-Za-z0-9_-]{40}/;
+export const LINK_NOTE = '[one-time owner link: the Homie mod showed it to the person in its Studio pane; Claude never sees it]';
+
+/** Redact one string: { text, hits: [kinds], links: [urls] }. Unchanged text keeps its identity. */
+export function redactText(text) {
+  if (typeof text !== 'string' || text.length < 8) return { text, hits: [], links: [] };
+  const hits = [];
+  const links = [];
+  let out = text.replace(URL_RE, (url) => {
+    if (!LINK_SECRET.test(url)) return url;
+    links.push(url.replace(/[.,;:]+$/, ''));
+    hits.push('owner link');
+    return LINK_NOTE + url.slice(url.replace(/[.,;:]+$/, '').length);
+  });
+  for (const rule of RULES) {
+    rule.re.lastIndex = 0;
+    out = out.replace(rule.re, (...m) => {
+      const replaced = rule.to ? rule.to(...m) : HIDE(rule.kind);
+      if (replaced !== m[0]) hits.push(rule.kind);
+      return replaced;
+    });
+  }
+  return hits.length ? { text: out, hits, links } : { text, hits, links };
+}
+
+/**
+ * Redact every string inside a value (a tool's result record, an MCP result, a string), at most 12 levels deep.
+ * Returns { value, hits, links }; `value` is the same object when nothing was hidden.
+ */
+export function redact(value) {
+  const hits = [];
+  const links = [];
+  const walk = (v, depth) => {
+    if (typeof v === 'string') {
+      const r = redactText(v);
+      if (r.hits.length) { hits.push(...r.hits); links.push(...r.links); }
+      return r.text;
+    }
+    if (depth > 12 || v === null || typeof v !== 'object') return v;
+    if (Array.isArray(v)) {
+      let changed = false;
+      const next = v.map((x) => { const y = walk(x, depth + 1); if (y !== x) changed = true; return y; });
+      return changed ? next : v;
+    }
+    let changed = false;
+    const next = {};
+    for (const [k, x] of Object.entries(v)) { const y = walk(x, depth + 1); if (y !== x) changed = true; next[k] = y; }
+    return changed ? next : v;
+  };
+  const out = walk(value, 0);
+  return { value: out, hits: [...new Set(hits)], links: [...new Set(links)] };
+}

package/lib/scaffold.mjs

@@ -427,6 +427,18 @@ chat's card follows the work from then on) and, for a studio still being set up,
   the budget until the person says Proceed, and takes keys out of command output. When it refuses a call, say what
   you meant to do and why; do not retry it unless the person asks.
 
+## Telling Homie
+
+The people who make Homie read every note, and someone who is stuck rarely writes to a forum. So when the person is
+stuck, confused or frustrated, after an error you could not fix, or at the end of their first studio setup or first
+publish, you may OFFER, once in a session, to send them a short note about it: the Homie MCP's \`homie_feedback\`
+(in Claude Code also \`/feedback\`, and Tell Homie in the Studio pane). Draft it in plain words from what happened
+(what they tried, what they expected, what they saw); a draft sends nothing. Show it exactly as it would go, and send
+it only after they say yes (in Claude Code, Claude Code itself asks them with the exact note). Never nag: a no is
+final for the session, and help never depends on it. Never put a key, a log, a file, code or anyone's name in a
+note; a reply address only if they typed it. When they ask to tell Homie something, draft it with
+\`offered: false\`.
+
 ## Beta
 
 Homie for studios is in beta. When something breaks, or a game you want to port does

package/lib/template-history.json

@@ -1351,6 +1351,46 @@
      }
     }
    }
+  },
+  "0.28.0": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "ce7a8fd91c6bbee2",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "2928ca4f079ab76b",
+    "site/src/worker.mjs": "ca3f1630f2420ad3"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "214aa46eb3a895d5",
+     "## Layout": "8baf49e4291e7e88",
+     "## Commands (all through the pinned CLI in node_modules)": "d80ec56e4b4fc4c6",
+     "## The site": "366ecce1a424837a",
+     "## Making games": "abf2f0d59341512d",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "aaea65236db52126",
+     "## Running live games (the back office)": "4aa5f513a7cd2c3b",
+     "## Servers and AI seats": "98d08705087a33ec",
+     "## Selling things (the shop)": "b04b0a2b25f524f2",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "7e8458adc1b81ece",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "b35df2c19cd4b534"
+      }
+     }
+    }
+   }
   }
  }
 }

package/mcp/ui/card.css

@@ -92,3 +92,11 @@ details summary{cursor:pointer;color:var(--c-fg2);font-size:13px;margin-top:10px
 .clips{display:grid;grid-template-columns:repeat(auto-fill,minmax(104px,1fr));gap:8px}
 .clip{display:grid;gap:3px;align-content:start;padding:6px;border-radius:var(--r-sm);background:var(--c-bg)}.clip .art{aspect-ratio:1;border-radius:var(--r-sm);background:var(--c-bg3);display:grid;place-items:center;overflow:hidden;color:var(--c-fg3);font-size:20px}.clip .art img{width:100%;height:100%;object-fit:cover}
 .clip b{font-size:13px}.clip span{font-size:11.5px;color:var(--c-fg2);overflow-wrap:anywhere}.clip.missing{opacity:.8;box-shadow:inset 0 0 0 1px var(--c-line2)}.clip button{justify-self:start}
+/* Tell Homie (feedback.js): the note as it would go, and the editor that rewords it. */
+.quote{margin:8px 0 0;padding:12px 14px;border-radius:var(--r-md);background:var(--c-bg2);border-left:3px solid var(--accent);font:15px/1.5 var(--f-sans);color:var(--c-fg);white-space:normal;overflow-wrap:anywhere}
+.kinds{display:flex;flex-wrap:wrap;gap:6px;margin:4px 0 10px}
+textarea{display:block;width:100%;min-height:110px;resize:vertical;font:15px/1.45 var(--f-sans);padding:10px 12px;border-radius:var(--r-md);border:1px solid var(--c-line2);background:var(--c-bg);color:var(--c-fg)}
+input[type=email]{display:block;width:100%;margin:8px 0 12px;font:14px/1.2 var(--f-sans);padding:9px 10px;border-radius:var(--r-sm);border:1px solid var(--c-line2);background:var(--c-bg);color:var(--c-fg)}
+textarea:focus-visible,input[type=email]:focus-visible{outline:2px solid var(--c-fg);outline-offset:1px}
+.actions.send{margin-top:14px}
+@media (max-width:420px){.actions.send button{flex:1 1 auto}}

package/mcp/ui/feedback.js

@@ -0,0 +1,112 @@
+/* The Tell Homie card: a note to the people who make Homie, exactly as it would go, with Send, Edit and Don't send.
+ * Nothing leaves this computer until the person presses Send here (or says yes in the chat). Edit drafts the note
+ * again from the person's own words, through the same redaction, so what the card shows is always what would go.
+ * The model is told what the person chose, once. Every text is set as text, never as HTML. */
+(function () {
+  var C = Card;
+  var KINDS = [['stuck', 'Stuck'], ['confusing', 'Confusing'], ['idea', 'Idea'], ['praise', 'Praise'], ['bug', 'Bug']];
+  var LABEL = { stuck: 'Stuck', confusing: 'Confusing', idea: 'Idea', praise: 'Praise', bug: 'Bug' };
+  var ui = { editing: false, busy: false, why: null, kind: null, text: null, email: null };
+
+  function fieldsOf(sc) {
+    var n = sc.note || {};
+    return { kind: n.kind, text: n.text, step: n.step || undefined, email: n.email || undefined, offered: n.offered === true,
+      studioVersion: n.studioVersion || undefined, pluginVersion: n.pluginVersion || undefined, app: n.app || undefined,
+      // The studio the draft was made for (its pinned version is in the note): a send is checked against the same one.
+      studio: sc.studio || undefined };
+  }
+
+  function act(sc, args, after) {
+    if (ui.busy) return;
+    ui.busy = true; ui.why = null; C.render();
+    C.call('homie_feedback', args).then(function (res) {
+      ui.busy = false;
+      // Refused (not sent, a reworded note that cannot go, the app said no): the note stays on screen with why.
+      var d = res && res.structuredContent;
+      if (!d || d.kind !== 'feedback' || res.isError) { ui.why = C.textOf(res) || 'That did not work. Nothing was sent.'; C.render(); return; }
+      if (after) after(res);
+      C.take(res);
+    }).catch(function () { ui.busy = false; ui.why = 'The app did not answer. Nothing was sent.'; C.render(); });
+  }
+
+  function quote(text) {
+    var q = C.el('blockquote', 'quote');
+    String(text || '').split('\n').forEach(function (line, i) { if (i) q.appendChild(C.el('br')); q.appendChild(document.createTextNode(line)); });
+    return q;
+  }
+
+  function editor(card, sc) {
+    var n = sc.note || {};
+    if (ui.kind === null) { ui.kind = n.kind || 'idea'; ui.text = n.text || ''; ui.email = n.email || ''; }
+    var kinds = C.el('div', 'kinds'); kinds.setAttribute('role', 'radiogroup'); kinds.setAttribute('aria-label', 'What kind of note');
+    KINDS.forEach(function (k) {
+      var b = C.btn(k[1], 'small ' + (ui.kind === k[0] ? '' : 'ghost'), function () { ui.kind = k[0]; C.render(); });
+      b.setAttribute('role', 'radio'); b.setAttribute('aria-checked', ui.kind === k[0] ? 'true' : 'false');
+      kinds.appendChild(b);
+    });
+    card.appendChild(kinds);
+    var area = C.el('textarea'); area.value = ui.text; area.rows = 5; area.maxLength = 1500; area.setAttribute('aria-label', 'Your note, in your words');
+    area.oninput = function () { ui.text = area.value; };
+    card.appendChild(area);
+    var mail = C.el('input'); mail.type = 'email'; mail.placeholder = 'Your email, if you want a reply (optional)'; mail.value = ui.email; mail.setAttribute('aria-label', 'Reply address (optional)');
+    mail.oninput = function () { ui.email = mail.value; };
+    card.appendChild(mail);
+    var acts = C.el('div', 'actions');
+    acts.appendChild(C.btn(ui.busy ? 'Saving…' : 'Use this', '', function () {
+      var f = fieldsOf(sc);
+      act(sc, { action: 'draft', kind: ui.kind, text: ui.text, step: f.step, email: (ui.email || '').trim() || undefined, offered: f.offered, studioVersion: f.studioVersion, pluginVersion: f.pluginVersion, app: f.app, studio: f.studio, by: 'card' }, function (res) {
+        ui.editing = false; ui.kind = null;
+        var d = res && res.structuredContent;
+        if (d && d.state === 'draft') C.tell('edit:' + d.draft, 'The person reworded the note on the Tell Homie card. Nothing is sent yet; the card shows the new text (draft ' + d.draft + ') with Send. Do not send it yourself unless they say yes.');
+      });
+    }));
+    acts.appendChild(C.btn('Cancel', 'ghost', function () { ui.editing = false; ui.kind = null; C.render(); }));
+    card.appendChild(acts);
+  }
+
+  function render(sc) {
+    var card = C.el('main', 'card');
+    var state = sc.state;
+    var head = state === 'sent' ? C.pill('Sent', 'ok') : state === 'declined' ? C.pill('Not sent', '') : state === 'draft' ? C.pill('Not sent yet', 'warn') : C.pill('Not sent', 'bad');
+    C.add(card, C.top('Note', head));
+    card.appendChild(C.el('h1', '', state === 'sent' ? 'Sent to Homie. Thank you.' : state === 'declined' ? 'Not sent' : 'A note to the people who make Homie'));
+    var n = sc.note;
+    if (state === 'draft' && ui.editing) { editor(card, sc); }
+    else if (n) {
+      card.appendChild(C.el('p', 'sub', state === 'sent' ? 'This is what they got:' : state === 'declined' ? 'Nothing left this computer. This was the note:' : 'This is exactly what would go:'));
+      card.appendChild(C.add(C.el('div', 'chips'), C.pill(LABEL[n.kind] || n.kind, 'live')));
+      card.appendChild(quote(n.text));
+      if (sc.with) card.appendChild(C.el('p', 'fine', 'With it: ' + sc.with));
+      if (sc.taken && sc.taken.length) card.appendChild(C.el('p', 'fine', 'Homie took out ' + sc.taken.join(', ') + ' before showing it here.'));
+    }
+    if (ui.why) card.appendChild(C.el('p', 'note bad', ui.why));
+    if (state === 'draft' && !ui.editing) {
+      var acts = C.el('div', 'actions send');
+      var send = C.btn(ui.busy ? 'Sending…' : 'Send', '', function () {
+        act(sc, Object.assign({ action: 'send', draft: sc.draft, by: 'card' }, fieldsOf(sc)), function (res) {
+          var d = res && res.structuredContent;
+          if (d && d.state === 'sent') C.tell('sent:' + sc.draft, 'The person pressed Send on the Tell Homie card: the note went to Homie (reference ' + String(d.reference || '').slice(0, 8) + '). Thank them in one line, and do not offer another note in this session.');
+        });
+      });
+      send.disabled = ui.busy;
+      acts.appendChild(send);
+      var edit = C.btn('Edit', 'ghost', function () { ui.editing = true; ui.kind = null; C.render(); }); edit.disabled = ui.busy;
+      acts.appendChild(edit);
+      var no = C.btn('Don’t send', 'ghost', function () {
+        act(sc, { action: 'decline', draft: sc.draft, by: 'card' }, function () {
+          C.tell('declined:' + sc.draft, 'The person pressed Don’t send on the Tell Homie card. Nothing was sent. Do not offer to send a note again in this session.');
+        });
+      });
+      no.disabled = ui.busy;
+      acts.appendChild(no);
+      card.appendChild(acts);
+    }
+    if (state === 'sent' && sc.reference) card.appendChild(C.el('p', 'fine', 'Reference ' + String(sc.reference).slice(0, 8) + '. Notes are private: only the people who make Homie read them.'));
+    var foot = C.el('div', 'foot');
+    foot.appendChild(C.el('span', 'when', state === 'sent' ? 'Sent to ' + (sc.to || 'homie.rocks') : state === 'declined' ? 'Nothing was sent.' : 'Nothing is sent until you press Send. Goes to ' + (sc.to || 'homie.rocks') + ', privately.'));
+    card.appendChild(foot);
+    return card;
+  }
+
+  C.start({ kind: 'feedback', label: 'Note', render: render, poll: null });
+})();

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homie-rocks/studio",
-  "version": "0.27.0",
+  "version": "0.28.0",
   "description": "A studio for games, music and video on its own Cloudflare: scaffold, multiplayer starters on the netplay contract, a port toolkit that makes existing single-player web games multiplayer, the site Worker with public rooms (Table/Lobby Durable Objects and D1, all on the free Workers plan, no payment method), a site with the hub's sections (Home, Games, Music, Videos, Rooms, Posts with feeds) in the studio's own look, an epic landing page for every game, big songs and videos in the studio's own R2 once it has storage (uploaded, checked by SHA-256, served at the same addresses), deploy, and the homie.rocks directory.",
   "type": "module",
   "license": "Apache-2.0",

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.27.0';
+export const STUDIO_VERSION_TAG = '0.28.0';