@homie-rocks/studio 0.51.0 → 0.51.2

package/CHANGELOG.md

@@ -17,6 +17,38 @@ To bring a studio up to date, tell Claude: "Upgrade my studio to the newest Homi
 `npx -y @homie-rocks/studio@latest upgrade`, which shows what's new since the version your studio pins (from this
 file) and what the upgrade would change, and changes nothing until you agree.
 
+## [0.51.2] - 2026-10-14
+
+**Plugin 0.51.2** · Deploying and listing do what the studio chose, under one address.
+
+Your studio follows your listing choice, shares one public address, and keeps its apps and tools working after deploy and upgrade.
+
+### Fixed
+
+- Your studio only joins the directory when you choose to list it. Existing claims remain honoured, and you can publish a listing after an unlisted deploy.
+- Your custom domain is the shared address for pages and app links. Visitors arriving at the workers.dev address reach that domain, while app APIs, multiplayer connections and AI tools keep working.
+- Deploy shows your app, game and wall links without guessing your bill. Local database tools keep working after deploy, interrupted setup can resume, and office sign-in takes you straight to the page you requested.
+- Upgrades refresh untouched app presets and defaults while preserving your edits, including giving choices. App walls use the app's own join wording.
+- Decorative app hero frames let visitors scroll the page; apps can share and download files while keeping their sandbox protection.
+- Signed-in AI connectors can discover how to connect through `/mcp/auth`; public tools remain available through `/mcp`.
+
+### Upgrade notes
+
+- Ask Homie to upgrade your studio, install dependencies and rebuild. Existing directory claims remain honoured. To list a new studio, choose `homie.directory: true` or a directory URL before deploy.
+- Use `/mcp/auth` for staff AI connectors and `/mcp` for public connectors.
+
+## [0.51.1] - 2026-10-14
+
+**Plugin 0.51.1** · A player's own runner never jumps across the screen.
+
+Your platformer keeps a player's runner moving smoothly through network corrections and reconnects, with less work per frame on slower phones.
+
+### Fixed
+
+- In server-rules platformers, a player's own box-shaped 2D runner now moves smoothly through network corrections, even after a delayed frame. It goes around blocking platforms without being pulled backwards against the player's held direction, and normal jumps keep their shape.
+- After a dropped connection, the runner glides from its last visible position to where the server moved it. Real respawns and other deliberate placements still happen immediately; games can identify placements made during an outage with `respawned`.
+- Rules games do less repeated movement, collision and drawing preparation each frame, helping play stay smooth on slower phones. These changes preserve the server's movement, hits and scoring.
+
 ## [0.51.0] - 2026-10-14
 
 **Plugin 0.51.0** · Take the money through your own Stripe, keyless by default.

package/README.md

@@ -110,10 +110,21 @@ is put in a studio unless the person asks for one), and its Home has a
 In the session that works in the repository, `homie-studio setup attach <hs_…> [--client claude|codex|grok]` then gives the studio
 the name chosen in the chat and removes the band.
 
-**The site claims itself in the directory.** The homie.rocks directory lists a studio only when its site serves
-the claim the directory handed out for that address. From 0.10.0 the site asks for it the first time its
-`/.well-known/homie-studio.json` is read (by `studio_publish`, or by `deploy` reading it once) and keeps it in
-its D1; nothing is stored by hand. studio.json `homie.directory: false` keeps a studio out.
+**Listing is the studio’s choice.** Set `homie.directory: true` for homie.rocks or a
+chosen directory URL before deploying. Omitted, null or false makes no new claim;
+existing stored claims remain honoured. An explicit `publish` also records the choice
+and stores the directory claim without requiring a second deploy. The manifest and
+publish use the custom domain when configured. Workers.dev browser pages redirect to
+it; discovery and tool routes remain accessible on both addresses.
+
+Deploy prints `/<id>/open` for apps, `/<id>/play` for games and `/<id>/tv` for walls.
+It reports no unmeasured Cloudflare plan. Local tools retain their dev database binding
+after the first deploy. Rerunning an interrupted `new` fills missing files without
+overwriting the matching studio’s edits. Office links sign in directly and retain
+`--to` destinations, including app and connection pages.
+
+For signed-in staff AI connectors use `/mcp/auth`; it returns a 401 OAuth discovery
+challenge without a token. `/mcp` continues to serve public tools anonymously.
 
 ## The site: the hub's shape, and a landing for every game
 

package/bin/homie-studio.mjs

@@ -507,25 +507,25 @@ function print(result) {
       lines.push(JSON.stringify(result.result, null, 2));
       break;
     case 'deploy':
-      if (result.mcp) lines.push(`Connect your AI: ${result.mcp} (approve in your studio's browser page; no key)`);
+      if (result.mcp) lines.push(`Connect your AI: ${result.mcp}/auth (approve in your studio's browser page; no key)`);
       if (result.ci) {
-        lines.push(`Live: ${result.url ?? '(Wrangler printed no address)'}${result.commit ? ` (commit ${result.commit.slice(0, 7)}${result.branch ? ` on ${result.branch}` : ''})` : ''}`, ...result.steps.map((x) => `  ${x.what}`), ...result.games.map((g) => `  ${g.id}: ${g.play}${g.hash ? `  [${deployWords(g)}]` : ''}`));
+        lines.push(`Live: ${result.url ?? '(Wrangler printed no address)'}${result.commit ? ` (commit ${result.commit.slice(0, 7)}${result.branch ? ` on ${result.branch}` : ''})` : ''}`, ...result.steps.map((x) => `  ${x.what}`), ...result.games.map((g) => `  ${g.id}: ${g.open ?? g.play}${g.hash ? `  [${deployWords(g)}]` : ''}${g.wall ? `  wall: ${g.wall}` : ''}`));
         break;
       }
       lines.push(`Live: ${result.url}`, ...(result.workersDev && result.workersDev !== result.url ? [`  also at ${result.workersDev}`] : []),
         ...(result.local ? [`  (the workers.dev address names your Cloudflare account, so it is kept in ${result.local} on this computer, never in studio.json)`] : []),
         // Which games this deploy changed since the last deploy from here, and each one's build hash
         // (lib/deploy-state.mjs): the hash `build` printed and the one the live site's manifest answers with.
-        ...result.games.map((g) => `  ${g.id}: ${g.play}${g.hash ? `  [${deployWords(g)}]` : ''}`), ...(result.removed?.length ? [`  no longer on the site: ${result.removed.join(', ')}`] : []), ...(result.notes ?? []).map((n) => `  Note: ${n}`), ...(result.songs ?? []).map((m) => `  song ${m.slug}: ${m.page}`), ...(result.videos ?? []).map((m) => `  video ${m.slug}: ${m.page}`),
-        ...(result.media?.moved ?? []).map((m) => `  moved to R2 (checked by SHA-256): ${m.path}, still at ${m.url}`), ...(result.media?.failed ?? []).map((m) => `  not moved to R2: ${m.path}: ${m.why}`), '', `Cloudflare: Worker ${result.worker}, D1 ${result.d1}, Durable Objects Table + Lobby${result.r2 ? `, R2 ${result.r2}` : ' (no storage: none needed; `homie-studio storage add` adds it for large media)'}. All on the free Workers plan${result.r2 ? ' plus R2' : ''}.`,
-        result.claim ? 'The site claimed itself in the directory: list the games with the Homie MCP tool studio_publish, or: npx --no-install homie-studio publish' : 'No directory claim yet (the site claims itself when the directory first reads it; publish does).',
+        ...result.games.map((g) => `  ${g.id}: ${g.open ?? g.play}${g.hash ? `  [${deployWords(g)}]` : ''}${g.wall ? `  wall: ${g.wall}` : ''}`), ...(result.removed?.length ? [`  no longer on the site: ${result.removed.join(', ')}`] : []), ...(result.notes ?? []).map((n) => `  Note: ${n}`), ...(result.songs ?? []).map((m) => `  song ${m.slug}: ${m.page}`), ...(result.videos ?? []).map((m) => `  video ${m.slug}: ${m.page}`),
+        ...(result.media?.moved ?? []).map((m) => `  moved to R2 (checked by SHA-256): ${m.path}, still at ${m.url}`), ...(result.media?.failed ?? []).map((m) => `  not moved to R2: ${m.path}: ${m.why}`), '', `Cloudflare: Worker ${result.worker}, D1 ${result.d1}, Durable Objects Table + Lobby${result.r2 ? `, R2 ${result.r2}` : ' (no storage: none needed; `homie-studio storage add` adds it for large media)'}.`,
+        result.claim ? 'The site claimed itself in the directory: list the games with the Homie MCP tool studio_publish, or: npx --no-install homie-studio publish' : 'No directory claim. Listing is the studio’s choice: set homie.directory to true or a directory URL before deploying to request one.',
         ...(result.standalone?.length ? ['', ...result.standalone] : []));
       break;
     case 'deploy plan':
       lines.push(`What \`npm run deploy\` does for ${result.studio}, on the Cloudflare account the person approves:`, '',
         ...result.cloudflare.map((r) => `  ${r.kind}${r.name ? ` ${r.name}` : ''}: ${r.what} [${r.state}${r.plan ? `; ${r.plan}` : ''}]`), '',
-        `Cost: ${result.cost}`, `Sign-in: ${result.login}`, `Address: ${result.address}`,
-        `The directory (${result.directory.site}) stores: ${result.directory.stores}`, result.never,
+        ...(result.cost ? [`Cost: ${result.cost}`] : []), `Sign-in: ${result.login}`, `Address: ${result.address}`,
+        result.directory.choice, ...(result.directory.site ? [`The directory (${result.directory.site}) stores: ${result.directory.stores}`] : []), result.never,
         ...(result.zone?.warning ? ['', `Warning: ${result.zone.warning}`] : result.zone?.why ? ['', result.zone.why] : []),
         ...(result.parts && partsPlanLines(result.parts).length ? ['', ...partsPlanLines(result.parts)] : []),
         ...(result.standalone?.length ? ['', ...result.standalone] : []));

package/guides/app/SKILL.md

@@ -268,3 +268,17 @@ Use the Manage my gifts link for the buyer-owned Stripe portal in the shop.
 For a records-only booking app, use `createShop({target: parent})` inside its
 sandboxed view. The shell includes the authenticated shop bridge; do not add a
 room simulation merely to make a payment button work.
+
+## Frames and upgrades (0.51.1)
+
+App frames permit Web Share and downloads, while keeping their opaque-origin
+sandbox. Share still requires the guest’s click and browser support; offer a download
+or copy link too. Both the iframe permissions and the served frame’s CSP matter.
+Use `.hero-media` for a decorative iframe in a site hero: it lets scroll gestures
+reach the page. An intentionally interactive hero frame opts in with `data-interactive`.
+App shells allow normal touch scrolling and selection.
+
+Upgrade compares copied app presets with recorded toolkit versions. Unchanged
+preset files and default values take the new version; custom scene files, names and
+edited labels remain the studio’s. An app wall uses its join label rather than game
+instructions. Rebuild after upgrade and inspect both the wall and giving page.

package/guides/game/RULES.md

@@ -1443,3 +1443,29 @@ catch-up path. It resumes live prediction at once and carries the drawn pose int
 the normal correction blend, so a counter-dash or jump does not wait for the
 unseen impulse's history to finish. This changes drawing only; authority, input
 timestamps, cooldowns and replay rules are unchanged.
+
+Own box-bodied 2D presentation also sweeps from its last displayed position. Reconciliation
+cannot switch sides of a solid merely because the new predicted origin is on
+the other side. Travel is limited by elapsed time plus a body-sized blend. Horizontal travel uses the adjacent
+actual velocities; vertical travel uses the recorded substeps with interpolation headroom, so an apex or landing is not trimmed.
+A stationary correction spends only blend speed, not the declared terminal falling speed.
+A large falling-speed limit cannot accelerate a horizontal correction. If sliding cannot reach a correction, a bounded
+incremental route searches collision-tested edges around the obstruction. No
+route means holding the last valid position, never crossing a solid. Explicit
+placements and epoch changes reset presentation immediately. These positions
+never feed movement, hits, scoring, input timestamps, or authority.
+
+A platformer can supply `openRoom({ correctionDirection: input => Number(input.r || 0) - Number(input.l || 0) })`
+for box-bodied 2D presentation. This is horizontal control intent (-1, 0, +1), not authority or a second movement loop.
+It prevents a visual correction from reversing held controls even when contact sets velocity to zero; neutral input
+allows convergence in either direction. Actual predicted braking against a newly reversed control remains allowed.
+
+After a delayed render, box-bodied 2D presentation spends at most 1.4 body widths per drawn frame,
+then continues toward prediction. This affects drawing only; an explicit placement remains immediate.
+
+When a player's connection comes back, the server hands the body back where it has it, with a new placement
+revision. Within three seconds of the link coming back online, box-bodied 2D presentation treats that revision as the
+same body and draws on from where it was shown, gliding and routing around solids as for any correction. A body that
+was really placed while the player was away (a respawn, a new round) should still be drawn at once: say so with
+`openRoom({ respawned: (before, after) => after.diedAt !== before.diedAt })`, where `before` and `after` are the own
+body as the server last had it before and after the outage.

package/guides/office/SKILL.md

@@ -147,3 +147,12 @@ Before Stripe is connected, both live and local shop/giving pages show items and
 amounts with checkout disabled and clear not-taking-payment wording. A fresh studio
 has an empty `/shop/` preview. `dev` watches authoring HTML/CSS/JS; check reports
 accepted dialogs and precise waits, and reacquires frames during rebuilds.
+
+## Direct sign-in links (0.51.1)
+
+`office link --to /<app>/open` and `--to /_studio/office/connections` retain the
+same-site destination, including its query string. Opening the link signs the browser
+in and continues there. A plain link-preview GET spends nothing; the loaded page
+submits the same-origin sign-in form. Keep the link private.
+Local office and role commands reuse the running dev server’s D1 configuration even
+after deploy records the production database id.

package/guides/studio-setup/SKILL.md

@@ -338,7 +338,7 @@ existing Cloudflare sign-in to create DNS and TLS. Never ask the person for a zo
 or wildcard route already on that domain belongs to another site there, and the deploy's warning gives the
 one line to add instead (the `publish` skill has the rest).
 
-**The directory, only when asked.** Going online never lists a studio: listing in the homie.rocks directory
+**The directory, only when asked.** A deploy never opts a studio in by itself: listing in the homie.rocks directory
 is its own step, it is public, and it is the person's to ask for. When they asked to be listed (in their first
 message or now), or say yes when you offer it once the site is live, call the Homie MCP tool `studio_publish`
 with the live site address (without the connector, `npx --no-install homie-studio publish`). It lists the
@@ -417,3 +417,11 @@ there (checked by SHA-256, at the same addresses); `homie-studio media move --dr
 Every studio serves its own MCP at `<site>/mcp`. Use the `tools` skill for studio-defined business actions, signed integrations and staff AI access. Reuse office and app-record built-ins first. After an authorized deploy, hand over the MCP address and `<site>/_studio/office/connections`: the person approves with the studio account they already have, with no key to copy. Staff connect their own account and retain only their app grants. Client connector setup is separate from the studio approval. Never deploy merely to set up a local tool test.
 
 For a business or cause, use `studio_scaffold {name, kind:"business"}` or `homie-studio new <folder> --kind cause`. Continue directly with the app skill and the appropriate `app new --from` starter; no game demo or planning interview unless requested.
+
+## Resuming setup (0.51.1)
+
+If `homie-studio new` was interrupted, rerun it in the same folder with the same name
+and slug. It fills missing generated files and retries installation, preserving files
+already there. A different studio or unrelated nonempty folder is still refused.
+New studios do not request a directory listing by default; set `homie.directory: true`
+or a directory URL only when the person chooses listing.