@homie-rocks/studio 0.58.3 → 0.58.5

package/CHANGELOG.md

@@ -17,6 +17,38 @@ To bring a studio up to date, tell Claude: "Upgrade my studio to the newest Homi
 `npx -y @homie-rocks/studio@latest upgrade`, which shows what's new since the version your studio pins (from this
 file) and what the upgrade would change, and changes nothing until you agree.
 
+## [0.58.5] - 2026-10-18
+
+**Plugin 0.58.2**
+
+A signed-in app gets its live socket. Leaving that page open no longer wakes the records object.
+
+### Fixed
+
+- The live upgrade is returned as the records object sent it. Writing the role cookie onto that response threw, so the browser never received the socket and tried again about every two minutes.
+- When the stored role cookie no longer works, the socket closes and the page opens a new one with the cookie it renewed. The page does not give up.
+- Someone who opens the app is counted with the people whose sockets are already asleep.
+
+### Upgrade notes
+
+- Upgrade the studio to pick this up.
+
+## [0.58.4] - 2026-10-18
+
+**Plugin 0.58.2**
+
+An open app rests while nobody is changing it. The live connection sleeps with the records object, and a studio MCP client no longer holds an event stream open.
+
+### Fixed
+
+- The open app keeps a hibernating WebSocket. The page renews its role cookie on the Worker every four minutes, so an idle app does not keep the records object awake.
+- A GET of the studio MCP endpoint answers 405. The client treats that as no event stream and does not reconnect. Asking for `events/stream` still works for that one request, and it no longer sends a heartbeat that would wake the object again.
+- 0.58.3 stopped the 15 second heartbeat. The open stream itself still held the object awake for as long as the page was open. This version closes that hold.
+
+### Upgrade notes
+
+- Upgrade the studio to pick this up. A page left open on the older app shell keeps asking for the old stream. The Worker answers 426 and does not wake the records object. Reload the page to open the socket.
+
 ## [0.58.3] - 2026-10-18
 
 **Plugin 0.58.2**

package/lib/template-history.json

@@ -4302,6 +4302,90 @@
      }
     }
    }
+  },
+  "0.58.4": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "1dbdf22c03a1e505",
+    "site/src/worker.mjs": "6cc5c6131eaf6fd0"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "af7f2f732505d379",
+     "## Version-matched authoring guides": "f6261a0e5801b96b",
+     "## Layout": "f3a280b8c96cd068",
+     "## Apps: one screen, roles and parts": "c10aa0441ea89702",
+     "## Commands (all through the pinned CLI in node_modules)": "c20d90de21cde0c7",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "bb715272fd1a615b",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "1ccfd549d2369a60",
+     "## Selling things (the shop)": "0df5a5fe1833c624",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "b2234d80f6cbe71d",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "8364e05cebefcba4"
+      }
+     }
+    }
+   }
+  },
+  "0.58.5": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "1dbdf22c03a1e505",
+    "site/src/worker.mjs": "6cc5c6131eaf6fd0"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "af7f2f732505d379",
+     "## Version-matched authoring guides": "f6261a0e5801b96b",
+     "## Layout": "f3a280b8c96cd068",
+     "## Apps: one screen, roles and parts": "c10aa0441ea89702",
+     "## Commands (all through the pinned CLI in node_modules)": "c20d90de21cde0c7",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "bb715272fd1a615b",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "1ccfd549d2369a60",
+     "## Selling things (the shop)": "0df5a5fe1833c624",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "b2234d80f6cbe71d",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "8364e05cebefcba4"
+      }
+     }
+    }
+   }
   }
  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homie-rocks/studio",
-  "version": "0.58.3",
+  "version": "0.58.5",
   "description": "A studio for games, music and video on its own Cloudflare: scaffold, multiplayer starters on the netplay contract, a port toolkit that makes existing single-player web games multiplayer, the site Worker with public rooms (Table/Lobby Durable Objects and D1, all on the free Workers plan, no payment method), a site with the hub's sections (Home, Games, Music, Videos, Rooms, Posts with feeds) in the studio's own look, an epic landing page for every game, big songs and videos in the studio's own R2 once it has storage (uploaded, checked by SHA-256, served at the same addresses), deploy, and the homie.rocks directory.",
   "type": "module",
   "license": "Apache-2.0",

package/worker/app-shell.mjs

@@ -49,14 +49,22 @@ export const APP_SHELL_JS = String.raw`(function () {
   }
   function context() {var room=new URLSearchParams(location.search).get('room');return {app:boot.game,origin:location.origin,url:location.origin+'/'+boot.game+'/open'+(room&&/^[A-Za-z0-9_-]{1,32}$/.test(room)?'?room='+encodeURIComponent(room):''),presence:presence,now:clock};}
   function sendContext(){frame?.contentWindow?.postMessage({type:'homie-app-context',context:context()},'*');}
+  var delay=5000,stopped=false,renewTimer=null;
   function connect(){
-    live?.close();
+    if(stopped)return;
+    try{if(live){live.onclose=null;live.close();}}catch(e){}
     var q=query();collections.forEach(function(c){q.append('collection',c);});
-    live=new EventSource((boot.site||'')+'/'+boot.game+'/api/app/live?'+q);
+    var origin=boot.site||location.origin||'';
+    var http=(origin?origin:'')+'/'+boot.game+'/api/app/live?'+q;
+    // A hibernating socket. An idle page does not poll this object. The role cookie is renewed by an ordinary request.
+    live=new WebSocket(/^https?:/.test(http)?http.replace(/^http/,'ws'):http);
+    live.onopen=function(){delay=5000;};
     live.onmessage=function(e){var value=JSON.parse(e.data);if(presence!==value.presence){presence=value.presence;sendContext();}if(value.collections?.length){share({invalidate:true});Promise.allSettled([...pending.values()]).then(function(){share({invalidate:true});frame?.contentWindow?.postMessage({type:'homie-app-changed',collections:value.collections},'*');});}};
+    live.onclose=function(e){if(stopped||(e&&e.code===4403))return;if(typeof setTimeout==='function'){setTimeout(connect,delay);delay=Math.min(delay*2,120000);}};
+    if(!renewTimer&&typeof setInterval==='function')renewTimer=setInterval(function(){fetch((boot.site||'')+'/'+boot.game+'/api/app/live?renew=1&'+query()).catch(function(){});},240000);
   }
   window.homieApp=Object.freeze({get context(){return context();},setTestClock:function(value){if(!boot.test)throw new Error('Local proof session required');if(value!==null&&!Number.isFinite(value))throw new Error('Invalid clock');clock=value;sendContext();}});
-  addEventListener('pagehide',function(){live?.close();});
+  addEventListener('pagehide',function(){stopped=true;if(renewTimer)clearInterval(renewTimer);try{live&&live.close();}catch(e){}});
   addEventListener('message', async function (e) {
     var m = e.data;
     if(frame&&e.source===frame.contentWindow&&m?.type==='homie-app-context'){sendContext();return;}

package/worker/app-streams.mjs

@@ -32,10 +32,22 @@ export async function pushAppRecords(env,cat){
 export class AppRecordStreams {
  constructor(env,ctx){this.env=env;this.ctx=ctx;this.streams=new Set();}
  dispose(){for(const s of [...this.streams])this.close(s);}
- close(s){if(!this.streams.delete(s))return;clearTimeout(s.timer);clearTimeout(s.reconnect);try{s.controller.close();}catch{/* The reader already cancelled or the stream already closed. */}this.presence();}
+ close(s){if(!s||s.closed||!this.streams.delete(s))return;s.closed=true;clearTimeout(s.timer);clearTimeout(s.reconnect);try{s.controller?.close();}catch{/* The reader already cancelled or the stream already closed. */}try{if(s.socket&&s.socket.readyState!==3)s.socket.close(s.deny?4403:1000,'closed');}catch{/* already closed */}if(s.id)void this.ctx.storage?.delete?.('app-live:'+s.id);this.presence();}
+ async closeSocket(socket){await this.attachHibernated();const id=socket?.deserializeAttachment?.()?.id;const s=[...this.streams].find(x=>x.socket===socket||(id&&x.id===id));if(s)this.close(s);else if(id){void this.ctx.storage?.delete?.('app-live:'+id);this.presence();}}
  count(s){return [...this.streams].filter(x=>x.app===s.app&&x.room===s.room).length;}
- send(s,data){if(s.controller.desiredSize<=0){this.close(s);return;}try{s.controller.enqueue(frame(data));}catch{this.close(s);}}
+ send(s,data){const text=JSON.stringify(data);if(s.socket){try{s.socket.send(text);}catch{this.close(s);}return;}if(!s.controller||s.controller.desiredSize<=0){this.close(s);return;}try{s.controller.enqueue(frame(data));}catch{this.close(s);}}
  presence(){for(const s of this.streams)this.send(s,{presence:this.count(s)});}
+ async attachHibernated(){
+  if(!this.ctx.getWebSockets)return;
+  for(const socket of this.ctx.getWebSockets()){
+   const attachment=socket.deserializeAttachment?.();
+   if(!attachment||attachment.v!==1||[...this.streams].some(s=>s.id===attachment.id))continue;
+   const saved=await this.ctx.storage?.get?.('app-live:'+attachment.id);
+   if(!saved){try{socket.close(1011,'missing');}catch{/* already closed */}continue;}
+   const headers=saved.headers??{};
+   this.streams.add({...saved,seen:new Map(saved.seen??[]),socket,id:attachment.id,url:new URL(saved.url),request:new Request(saved.url,{headers}),meta:saved.meta});
+  }
+ }
  async authorized(s){
   const access=await appAccess(s.request,this.env,s.meta,s.url);
   if(!access.ok||s.collections.some(c=>!access.can.includes('read:'+c)))return false;
@@ -45,19 +57,24 @@ export class AppRecordStreams {
  async revisions(s){return (await this.env.DB.prepare("SELECT collection,revision FROM app_record_revisions WHERE app=?1 UNION ALL SELECT '*',COALESCE(SUM(r.revision),0) FROM app_tool_namespaces a JOIN tool_data_revisions r ON r.namespace=a.namespace WHERE a.app=?1").bind(s.app).all()).results;}
  async open({meta,url,headers,collections=[]}){
   if(!Array.isArray(collections)||collections.some(c=>typeof c!=='string'||!Object.hasOwn(meta.records?.collections??{},c)))return new Response('unknown collection',{status:400});
-  const s={meta,url:new URL(url),request:new Request(url,{headers}),collections,seen:new Map()};
+  const s={id:crypto.randomUUID(),meta,url:new URL(url),request:new Request(url,{headers}),collections,seen:new Map()};
   if(!await this.authorized(s))return new Response('role cannot read collections',{status:403});
   const session=await localSession(s.request,this.env);
   s.app=session?.app===meta.id&&session.scope?`${meta.id}:check:${session.scope}`:meta.id;
   s.room=s.url.searchParams.get('room')??'main';
   for(const row of await this.revisions(s))s.seen.set(row.collection,row.revision);
+  const cookie=headers?.cookie??headers?.Cookie;
+  if(this.ctx.storage?.put)await this.ctx.storage.put('app-live:'+s.id,{app:s.app,room:s.room,collections:s.collections,seen:[...s.seen],url:String(s.url),headers:cookie?{cookie}:{},meta});
+  await this.attachHibernated();
+  const hello=()=>{this.streams.add(s);this.send(s,{collections:s.collections,presence:this.count(s),reset:true});for(const other of this.streams)if(other!==s)this.send(other,{presence:this.count(other)});};
+  // A hibernating socket sleeps while the page is open. The browser renews the short role cookie on its own request, not from this object.
+  if(typeof WebSocketPair!=='undefined'&&this.ctx.acceptWebSocket){
+   const pair=new WebSocketPair(),client=pair[0]??Object.values(pair)[0],server=pair[1]??Object.values(pair)[1];
+   s.socket=server;server.serializeAttachment?.({v:1,id:s.id});this.ctx.acceptWebSocket(server);hello();
+   return new Response(null,{status:101,webSocket:client,headers:{'cache-control':'no-store'}});
+  }
   const body=new ReadableStream({start:controller=>{s.controller=controller;},cancel:()=>this.close(s)});
-  this.streams.add(s);this.send(s,{collections:s.collections,presence:this.count(s),reset:true});
-  for(const other of this.streams)if(other!==s)this.send(other,{presence:this.count(other)});
-  // A fresh HTTP response renews the role cookie; SSE frames cannot set cookies.
-  s.reconnect=setTimeout(()=>this.close(s),240000);
-  // One recovery check, past eviction, so an open app does not pin its object. The screen reconnects after the cap below.
-  s.timer=setTimeout(()=>this.ctx.waitUntil(this.pump(s,true)),180000);
+  hello();
   return new Response(body,{headers:{'content-type':'text/event-stream','cache-control':'no-store'}});
  }
  async pump(s,recheck=false){
@@ -66,9 +83,10 @@ export class AppRecordStreams {
    const changed=new Set();
    for(const row of await this.revisions(s)){if(s.seen.get(row.collection)!==row.revision){if(row.collection==='*')for(const c of s.collections)changed.add(c);else if(s.collections.includes(row.collection))changed.add(row.collection);}s.seen.set(row.collection,row.revision);}
    if(!changed.size&&!recheck)return;
+   // 1000, not 4403. The stored handoff expires; the page opens a new socket with the cookie it just renewed.
    if(!await this.authorized(s)){this.close(s);return;}
    this.send(s,{collections:[...changed],presence:this.count(s)});
   }catch{this.close(s);}finally{s.busy=false;if(s.dirty){s.dirty=false;await this.pump(s);}}
  }
- async wake(meta){for(const s of this.streams)if(meta)s.meta=meta;await Promise.all([...this.streams].map(s=>this.pump(s)));return new Response('ok');}
+ async wake(meta){await this.attachHibernated();for(const s of this.streams)if(meta)s.meta=meta;await Promise.all([...this.streams].map(s=>this.pump(s)));return new Response('ok');}
 }

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.58.3","sha256":"e8ea8077d2bad80f19cf3fc5f7a69f0d8ea458f20a880b28442ed23a756944e6"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.58.5","sha256":"1af6197dc4435458f1241b39c4cc1d26031baaa88e5258fa6ead03f73f5750fe"});

package/worker/event-resources.mjs

@@ -93,8 +93,7 @@ export class EventStreams {
       stream.toolSignature=await this.toolSignature(input.tools??[],caller);
       stream.eventSignature=JSON.stringify(await listEvents(this.env,input.cat,caller));
       await this.env.DB.prepare('INSERT INTO mcp_kv(key,value,expires) VALUES(?1,?2,?3) ON CONFLICT(key) DO UPDATE SET value=excluded.value,expires=excluded.expires').bind('tools-stream:'+connection,JSON.stringify({connection}),Math.floor(Date.now()/1000)+300).run();
-      stream.reconnect=setTimeout(()=>this.close(stream),240000);
-      stream.reconnect?.unref?.();
+      // No timer. Production MCP GET never opens this. A caller that does is holding its own request.
       // Replay and later wakes share one ordered pump. Backpressure must not
       // hold up the writer's request or a function handler.
       this.background(input);

package/worker/lazy-objects.mjs

@@ -16,6 +16,9 @@ export class Lobby {
   }
   async fetch(request) {await this.ready;return this.lobby.fetch(request);}
   async alarm() {await this.ready;return this.lobby.alarm();}
+  async webSocketMessage(...args) {await this.ready;return this.lobby.webSocketMessage(...args);}
+  async webSocketClose(...args) {await this.ready;return this.lobby.webSocketClose(...args);}
+  async webSocketError(...args) {await this.ready;return this.lobby.webSocketError(...args);}
 }
 
 export class Gate {
@@ -34,6 +37,9 @@ export class AppRecordHub {
     this.ready=ctx.blockConcurrencyWhile(async()=>{this.hub=new (await import('./stream-objects.mjs')).AppRecordHub(ctx,env);});
   }
   async fetch(request) {await this.ready;return this.hub.fetch(request);}
+  async webSocketMessage(...args) {await this.ready;return this.hub.webSocketMessage(...args);}
+  async webSocketClose(...args) {await this.ready;return this.hub.webSocketClose(...args);}
+  async webSocketError(...args) {await this.ready;return this.hub.webSocketError(...args);}
 }
 export class EventHub {
   constructor(ctx,env) {

package/worker/lobby.mjs

@@ -88,10 +88,14 @@ export class Lobby {
     if(new URL(request.url).pathname==='/peak')return (this.peakStore??=new LobbyPeak(this.ctx,this.env)).fetch(request);
     if(['/match','/match-policy'].includes(new URL(request.url).pathname))return (this.matchRouter??=new MatchRouter(this.ctx,this.env)).fetch(request);
     if(new URL(request.url).pathname==='/__app_records') {
-      const {AppRecordStreams}=await import('./app-streams.mjs');
-      this.appStreams??=new AppRecordStreams(this.env,this.ctx);
+      const streams=await this.liveStreams();
+      if(request.headers.get('upgrade')?.toLowerCase()==='websocket'){
+        const meta=JSON.parse(request.headers.get('x-homie-app-meta')||'{}');
+        const page=request.headers.get('x-homie-live-page')||request.url;
+        return streams.open({meta,url:page,headers:Object.fromEntries(request.headers),collections:new URL(request.url).searchParams.getAll('collection')});
+      }
       const input=await request.json();
-      return input.op==='open'?this.appStreams.open(input):this.appStreams.wake(input.meta);
+      return input.op==='open'?streams.open(input):streams.wake(input.meta);
     }
     if(new URL(request.url).pathname==='/__studio_events') {
       const {EventStreams}=await import('./event-resources.mjs');
@@ -121,6 +125,10 @@ export class Lobby {
     for(const [name,until] of this.closed)if(until>at&&!rooms.some(r=>r.name===name))rooms.push({name,players:0,agents:0,ai:0,server:roomServer(name),at,closedUntil:until});
     await this.env.BACKGROUND.send({v:1,type:'lobby.snapshot',game,shard,at,rooms});
   }
+  async liveStreams(){const {AppRecordStreams}=await import('./app-streams.mjs');return this.appStreams??=new AppRecordStreams(this.env,this.ctx);}
+  webSocketMessage(){}
+  async webSocketClose(socket){return (await this.liveStreams()).closeSocket(socket);}
+  async webSocketError(socket){return (await this.liveStreams()).closeSocket(socket);}
   async alarm() {
     if(this.matchRouter)return this.matchRouter.alarm();
     if((await this.ctx.storage.list?.({prefix:'match:',limit:1}))?.size)return (this.matchRouter??=new MatchRouter(this.ctx,this.env)).alarm();

package/worker/mcp-event-streams.mjs

@@ -23,8 +23,7 @@ export class McpEventStreams {
       const stream={...input,registryKey,source:eventSource(feed),cursor:cursorOf(input.params.name,start.after),closed:false,busy:false};
       const body=new ReadableStream({start:controller=>{stream.controller=controller;controller.enqueue(sseFrame(notification('active',{cursor:stream.cursor,truncated:start.truncated},stream.id)));},pull:()=>{const resume=stream.resume;stream.resume=null;resume?.();},cancel:()=>this.close(stream)});
       this.streams.add(stream);
-      // One heartbeat is enough to recheck authorization. A repeating timer, shorter than eviction, pins this lobby for as long as the page holds the stream.
-      stream.timer=setTimeout(()=>this.pump(stream),180000);
+      // The open body is this request. Cap it so a client that never cancels cannot hold the object past five minutes, and do not wake it again to write heartbeats.
       stream.life=setTimeout(()=>this.close(stream),300000);
       this.pump(stream);
       return new Response(body,{headers:{'content-type':'text/event-stream','cache-control':'no-store'}});

package/worker/mcp.mjs

@@ -9,7 +9,7 @@ function freshErrorMessage(error,env,caller) {
   return message;
 }
 import {localCaller} from './local-test.mjs';
-import {eventFeeds,feedUri,readableFeed,feedEvents,matchesFeed,subscribeFeed,eventHub,pushToolList} from './event-resources.mjs';
+import {eventFeeds,feedUri,readableFeed,feedEvents,matchesFeed,subscribeFeed,pushToolList} from './event-resources.mjs';
 import { selling } from './extensions.mjs';
 import OAuthProvider from '@cloudflare/workers-oauth-provider';
 import { createMcpHandler } from 'agents/mcp/server';
@@ -73,11 +73,9 @@ export async function remoteMcp(request,env,ctx,{catalogueOf,definitions=[]}) {
     const refresh=pushToolList(env,cat,tools,origin);
     if(ctx?.waitUntil)ctx.waitUntil(refresh);
     else await refresh;
-    if(request.method==='GET'&&env.LOBBY) {
-      if(!request.headers.get('accept')?.includes('text/event-stream'))return json({error:'Accept text/event-stream required'},406);
-      const connection=caller.connection??'public:'+crypto.randomUUID();
-      return eventHub(env,connection).fetch('https://events/__studio_events',{method:'POST',body:JSON.stringify({op:'stream',connection,lastId:request.headers.get('last-event-id'),cat,origin,tools:tools.map(({name,description,inputSchema,audience,kind})=>({name,description,inputSchema,audience,kind}))})});
-    }
+    // A standing GET is the MCP SSE stream. Holding it pins the event object for as long as the client stays connected.
+    // 405 tells the client there is no stream, and it does not reconnect. Events stay on resources/read and events/poll.
+    if(request.method==='GET')return new Response(null,{status:405,headers:{allow:'POST, DELETE','cache-control':'no-store'}});
     if(request.method==='POST') {
       const body=await request.clone().json().catch(()=>null);
       if(eventMethods.has(body?.method))return eventsRequest(request,env,ctx,cat,caller,body);

package/worker/office.mjs

@@ -1469,10 +1469,13 @@ export async function appRoleSession(response,request,env,meta,launch) {
  const handoff=cookieValues(request,`studio_app_${meta.id}_${role}`)[0];
  const ticket=(handoff&&await appAssetTicket(env,meta.id,handoff,{request,meta,launch,purpose:'handoff',expectedRole:role,renew:true}))||await appAssetTicket(env,meta.id,undefined,{request,meta,launch,purpose:'handoff'});
  if(ticket) {
-  response=new Response(response.body,{status:response.status,statusText:response.statusText,headers:response.headers});
-  // LAN dev uses HTTP: a Secure cookie is discarded before the shell removes access.
   const secure=new URL(request.url).protocol==='https:'?'; Secure':'';
-  response.headers.append('set-cookie',`studio_app_${meta.id}_${role}=${ticket}; Path=/${meta.id}/; Max-Age=300; HttpOnly${secure}; SameSite=Strict`);
+  const cookie=`studio_app_${meta.id}_${role}=${ticket}; Path=/${meta.id}/; Max-Age=300; HttpOnly${secure}; SameSite=Strict`;
+  // The upgrade response's headers are immutable, and appending throws before the browser receives the socket.
+  // The document and the renew request already set this cookie. Return the socket unchanged.
+  if(response.status===101&&response.webSocket)return response;
+  response=new Response(response.body,{status:response.status,statusText:response.statusText,headers:response.headers});
+  response.headers.append('set-cookie',cookie);
  }
  return response;
 }

package/worker/routes.mjs

@@ -325,7 +325,18 @@ export default async function route(request, env, ctx) {
       };
       if(sub==='api/app/live') {
         if(request.method!=='GET')return new Response('GET required',{status:405});
+        // Cookie renewal is a Worker response. It must not wake the records object.
+        if(url.searchParams.get('renew')==='1')return apiSession(new Response(null,{status:204,headers:{'cache-control':'no-store'}}));
         const {appHub}=await import('./app-streams.mjs');
+        if(typeof WebSocketPair!=='undefined'){
+          if(request.headers.get('upgrade')?.toLowerCase()!=='websocket')return new Response('websocket required',{status:426,headers:{'cache-control':'no-store'}});
+          // The object has to answer the upgrade itself. A JSON subrequest cannot carry the socket back.
+          const headers=new Headers(request.headers);
+          headers.set('x-homie-live-page',request.url);
+          headers.set('x-homie-app-meta',JSON.stringify({id:meta.id,kind:meta.kind,roles:meta.roles,records:meta.records,surfaces:meta.surfaces,launch:meta.launch}));
+          const target=new URL('https://app/__app_records');target.search=new URL(request.url).search;
+          return apiSession(await appHub(env,meta.id).fetch(new Request(target,{headers})));
+        }
         return apiSession(await appHub(env,meta.id).fetch('https://app/__app_records',{method:'POST',body:JSON.stringify({op:'open',meta,url:request.url,headers:Object.fromEntries(request.headers),collections:url.searchParams.getAll('collection')})}));
       }
       if(sub==='api/app/tools')return apiSession(await (await import('./app-tools.mjs')).appToolsRoute(request,env,meta,url,cat,await studioTools()));

package/worker/stream-objects.mjs

@@ -1,12 +1,20 @@
 /** Streams use independent namespaces so subscribers never warm matchmaking state. */
 export class AppRecordHub {
   constructor(ctx, env) { this.ctx=ctx; this.env=env; }
+  async records(){const {AppRecordStreams}=await import('./app-streams.mjs');return this.streams??=new AppRecordStreams(this.env,this.ctx);}
   async fetch(request) {
-    const {AppRecordStreams}=await import('./app-streams.mjs');
-    this.streams??=new AppRecordStreams(this.env,this.ctx);
+    const streams=await this.records();
+    if(request.headers.get('upgrade')?.toLowerCase()==='websocket'){
+      const meta=JSON.parse(request.headers.get('x-homie-app-meta')||'{}');
+      const page=request.headers.get('x-homie-live-page')||request.url;
+      return streams.open({meta,url:page,headers:Object.fromEntries(request.headers),collections:new URL(request.url).searchParams.getAll('collection')});
+    }
     const input=await request.json();
-    return input.op==='open'?this.streams.open(input):this.streams.wake(input.meta);
+    return input.op==='open'?streams.open(input):streams.wake(input.meta);
   }
+  webSocketMessage(){}
+  async webSocketClose(socket){return (await this.records()).closeSocket(socket);}
+  async webSocketError(socket){return (await this.records()).closeSocket(socket);}
 }
 export class EventHub {
   constructor(ctx, env) { this.ctx=ctx; this.env=env; }

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.58.3';
+export const STUDIO_VERSION_TAG = '0.58.5';