@homie-rocks/studio 0.58.4 → 0.58.6

package/CHANGELOG.md

@@ -17,6 +17,37 @@ To bring a studio up to date, tell Claude: "Upgrade my studio to the newest Homi
 `npx -y @homie-rocks/studio@latest upgrade`, which shows what's new since the version your studio pins (from this
 file) and what the upgrade would change, and changes nothing until you agree.
 
+## [0.58.6] - 2026-10-18
+
+**Plugin 0.58.2**
+
+A page that no longer has access stops. It does not keep waking the records object.
+
+### Fixed
+
+- A live upgrade that is not allowed closes with 4403, and the page stops. A bare refusal was not a socket, so the page tried again about every two minutes and the records object stayed awake.
+- When the role itself is refused, that close happens before the records object is woken.
+
+### Upgrade notes
+
+- Upgrade the studio to pick this up.
+
+## [0.58.5] - 2026-10-18
+
+**Plugin 0.58.2**
+
+A signed-in app gets its live socket. Leaving that page open no longer wakes the records object.
+
+### Fixed
+
+- The live upgrade is returned as the records object sent it. Writing the role cookie onto that response threw, so the browser never received the socket and tried again about every two minutes.
+- When the stored role cookie no longer works, the socket closes and the page opens a new one with the cookie it renewed. The page does not give up.
+- Someone who opens the app is counted with the people whose sockets are already asleep.
+
+### Upgrade notes
+
+- Upgrade the studio to pick this up.
+
 ## [0.58.4] - 2026-10-18
 
 **Plugin 0.58.2**

package/lib/template-history.json

@@ -4344,6 +4344,90 @@
      }
     }
    }
+  },
+  "0.58.5": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "1dbdf22c03a1e505",
+    "site/src/worker.mjs": "6cc5c6131eaf6fd0"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "af7f2f732505d379",
+     "## Version-matched authoring guides": "f6261a0e5801b96b",
+     "## Layout": "f3a280b8c96cd068",
+     "## Apps: one screen, roles and parts": "c10aa0441ea89702",
+     "## Commands (all through the pinned CLI in node_modules)": "c20d90de21cde0c7",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "bb715272fd1a615b",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "1ccfd549d2369a60",
+     "## Selling things (the shop)": "0df5a5fe1833c624",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "b2234d80f6cbe71d",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "8364e05cebefcba4"
+      }
+     }
+    }
+   }
+  },
+  "0.58.6": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "1dbdf22c03a1e505",
+    "site/src/worker.mjs": "6cc5c6131eaf6fd0"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "af7f2f732505d379",
+     "## Version-matched authoring guides": "f6261a0e5801b96b",
+     "## Layout": "f3a280b8c96cd068",
+     "## Apps: one screen, roles and parts": "c10aa0441ea89702",
+     "## Commands (all through the pinned CLI in node_modules)": "c20d90de21cde0c7",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "bb715272fd1a615b",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "1ccfd549d2369a60",
+     "## Selling things (the shop)": "0df5a5fe1833c624",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "b2234d80f6cbe71d",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "8364e05cebefcba4"
+      }
+     }
+    }
+   }
   }
  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homie-rocks/studio",
-  "version": "0.58.4",
+  "version": "0.58.6",
   "description": "A studio for games, music and video on its own Cloudflare: scaffold, multiplayer starters on the netplay contract, a port toolkit that makes existing single-player web games multiplayer, the site Worker with public rooms (Table/Lobby Durable Objects and D1, all on the free Workers plan, no payment method), a site with the hub's sections (Home, Games, Music, Videos, Rooms, Posts with feeds) in the studio's own look, an epic landing page for every game, big songs and videos in the studio's own R2 once it has storage (uploaded, checked by SHA-256, served at the same addresses), deploy, and the homie.rocks directory.",
   "type": "module",
   "license": "Apache-2.0",

package/worker/app-streams.mjs

@@ -11,6 +11,14 @@ END;`;}).join('\n')}
 `;
 const frame=value=>new TextEncoder().encode('data: '+JSON.stringify(value)+'\n\n');
 export const appHub=(env,app)=>{const ns=env.APP_RECORDS??env.LOBBY;return ns.get(ns.idFromName('@app-records/'+app));};
+/** A refused upgrade must be a socket the page can see close with 4403. A bare 403 never becomes one, so the page retries inside the eviction window and the records object stays awake. accept() plus an immediate close ends with the response. acceptWebSocket would keep a hibernating socket whose close the browser does not see. */
+export function deniedLiveSocket(){
+ if(typeof WebSocketPair==='undefined')return new Response('role cannot read collections',{status:403});
+ const pair=new WebSocketPair(),client=pair[0]??Object.values(pair)[0],server=pair[1]??Object.values(pair)[1];
+ server.accept();
+ try{server.close(4403,'closed');}catch{/* already closed */}
+ return new Response(null,{status:101,webSocket:client,headers:{'cache-control':'no-store'}});
+}
 const pushedRevisions=new WeakMap();
 export async function pushAppRecords(env,cat){
  const apps=(cat.games??[]).filter(g=>g.kind==='app');
@@ -58,13 +66,14 @@ export class AppRecordStreams {
  async open({meta,url,headers,collections=[]}){
   if(!Array.isArray(collections)||collections.some(c=>typeof c!=='string'||!Object.hasOwn(meta.records?.collections??{},c)))return new Response('unknown collection',{status:400});
   const s={id:crypto.randomUUID(),meta,url:new URL(url),request:new Request(url,{headers}),collections,seen:new Map()};
-  if(!await this.authorized(s))return new Response('role cannot read collections',{status:403});
+  if(!await this.authorized(s))return deniedLiveSocket();
   const session=await localSession(s.request,this.env);
   s.app=session?.app===meta.id&&session.scope?`${meta.id}:check:${session.scope}`:meta.id;
   s.room=s.url.searchParams.get('room')??'main';
   for(const row of await this.revisions(s))s.seen.set(row.collection,row.revision);
   const cookie=headers?.cookie??headers?.Cookie;
   if(this.ctx.storage?.put)await this.ctx.storage.put('app-live:'+s.id,{app:s.app,room:s.room,collections:s.collections,seen:[...s.seen],url:String(s.url),headers:cookie?{cookie}:{},meta});
+  await this.attachHibernated();
   const hello=()=>{this.streams.add(s);this.send(s,{collections:s.collections,presence:this.count(s),reset:true});for(const other of this.streams)if(other!==s)this.send(other,{presence:this.count(other)});};
   // A hibernating socket sleeps while the page is open. The browser renews the short role cookie on its own request, not from this object.
   if(typeof WebSocketPair!=='undefined'&&this.ctx.acceptWebSocket){
@@ -82,7 +91,8 @@ export class AppRecordStreams {
    const changed=new Set();
    for(const row of await this.revisions(s)){if(s.seen.get(row.collection)!==row.revision){if(row.collection==='*')for(const c of s.collections)changed.add(c);else if(s.collections.includes(row.collection))changed.add(row.collection);}s.seen.set(row.collection,row.revision);}
    if(!changed.size&&!recheck)return;
-   if(!await this.authorized(s)){s.deny=true;this.close(s);return;}
+   // 1000, not 4403. The stored handoff expires; the page opens a new socket with the cookie it just renewed.
+   if(!await this.authorized(s)){this.close(s);return;}
    this.send(s,{collections:[...changed],presence:this.count(s)});
   }catch{this.close(s);}finally{s.busy=false;if(s.dirty){s.dirty=false;await this.pump(s);}}
  }

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.58.4","sha256":"b84e08e7d2231f25b1b37bde4dd66be05b02a2bc500a601740de08b15b437738"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.58.6","sha256":"ffc278d1a25f0d09dfaa8c76a38f4d325971dec38e75e08b6b7fb4d7c6aad504"});

package/worker/office.mjs

@@ -1471,8 +1471,9 @@ export async function appRoleSession(response,request,env,meta,launch) {
  if(ticket) {
   const secure=new URL(request.url).protocol==='https:'?'; Secure':'';
   const cookie=`studio_app_${meta.id}_${role}=${ticket}; Path=/${meta.id}/; Max-Age=300; HttpOnly${secure}; SameSite=Strict`;
-  // Rebuilding a 101 drops the hibernating socket. Append the cookie on the response the object returned.
-  if(response.status===101&&response.webSocket){response.headers.append('set-cookie',cookie);return response;}
+  // The upgrade response's headers are immutable, and appending throws before the browser receives the socket.
+  // The document and the renew request already set this cookie. Return the socket unchanged.
+  if(response.status===101&&response.webSocket)return response;
   response=new Response(response.body,{status:response.status,statusText:response.statusText,headers:response.headers});
   response.headers.append('set-cookie',cookie);
  }

package/worker/routes.mjs

@@ -327,9 +327,12 @@ export default async function route(request, env, ctx) {
         if(request.method!=='GET')return new Response('GET required',{status:405});
         // Cookie renewal is a Worker response. It must not wake the records object.
         if(url.searchParams.get('renew')==='1')return apiSession(new Response(null,{status:204,headers:{'cache-control':'no-store'}}));
-        const {appHub}=await import('./app-streams.mjs');
+        const {appHub,deniedLiveSocket}=await import('./app-streams.mjs');
         if(typeof WebSocketPair!=='undefined'){
           if(request.headers.get('upgrade')?.toLowerCase()!=='websocket')return new Response('websocket required',{status:426,headers:{'cache-control':'no-store'}});
+          // Check before the records object. A refused upgrade is one Worker socket, closed 4403, and the page stops.
+          const access=await appAccess(request,env,meta,url);
+          if(!access.ok)return deniedLiveSocket();
           // The object has to answer the upgrade itself. A JSON subrequest cannot carry the socket back.
           const headers=new Headers(request.headers);
           headers.set('x-homie-live-page',request.url);

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.58.4';
+export const STUDIO_VERSION_TAG = '0.58.6';