@homie-rocks/studio 0.58.5 → 0.58.6

package/CHANGELOG.md

@@ -17,6 +17,21 @@ To bring a studio up to date, tell Claude: "Upgrade my studio to the newest Homi
 `npx -y @homie-rocks/studio@latest upgrade`, which shows what's new since the version your studio pins (from this
 file) and what the upgrade would change, and changes nothing until you agree.
 
+## [0.58.6] - 2026-10-18
+
+**Plugin 0.58.2**
+
+A page that no longer has access stops. It does not keep waking the records object.
+
+### Fixed
+
+- A live upgrade that is not allowed closes with 4403, and the page stops. A bare refusal was not a socket, so the page tried again about every two minutes and the records object stayed awake.
+- When the role itself is refused, that close happens before the records object is woken.
+
+### Upgrade notes
+
+- Upgrade the studio to pick this up.
+
 ## [0.58.5] - 2026-10-18
 
 **Plugin 0.58.2**

package/lib/template-history.json

@@ -4386,6 +4386,48 @@
      }
     }
    }
+  },
+  "0.58.6": {
+   "files": {
+    "CLAUDE.md": "ddf2b2a0376202f6",
+    "README.md": "684b3cca8001673c",
+    "HANDOFF.md": "29337e2ace95b2e7",
+    "games/README.md": "5ad32fe80c61f117",
+    "music/README.md": "a3dc042dadd39df8",
+    "videos/README.md": "16babc3437d5545b",
+    "posts/README.md": "37841aae476bd540",
+    "site/README.md": "1dbdf22c03a1e505",
+    "site/src/worker.mjs": "6cc5c6131eaf6fd0"
+   },
+   "sections": {
+    "AGENTS.md": {
+     "(intro)": "af7f2f732505d379",
+     "## Version-matched authoring guides": "f6261a0e5801b96b",
+     "## Layout": "f3a280b8c96cd068",
+     "## Apps: one screen, roles and parts": "c10aa0441ea89702",
+     "## Commands (all through the pinned CLI in node_modules)": "c20d90de21cde0c7",
+     "## The site": "0cb8dd9a6f8a0096",
+     "## Making games": "bb715272fd1a615b",
+     "## The Game Codex and progress": "0738ef719cef3a4c",
+     "## Art direction and models": "a48fff7bf0a5f2fc",
+     "## Running live games (the back office)": "51ebf2ab756f6e4d",
+     "## Servers and AI seats": "1ccfd549d2369a60",
+     "## Selling things (the shop)": "0df5a5fe1833c624",
+     "## Continuing a build from the Claude app": "0d68081e924ca419",
+     "## Rules": "b2234d80f6cbe71d",
+     "## Telling Homie": "80b46fdd9e578db8",
+     "## Beta": "9d02638207a26e73"
+    }
+   },
+   "named": {
+    "Homie Arcade": {
+     "sections": {
+      "AGENTS.md": {
+       "## Commands (all through the pinned CLI in node_modules)": "8364e05cebefcba4"
+      }
+     }
+    }
+   }
   }
  }
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@homie-rocks/studio",
-  "version": "0.58.5",
+  "version": "0.58.6",
   "description": "A studio for games, music and video on its own Cloudflare: scaffold, multiplayer starters on the netplay contract, a port toolkit that makes existing single-player web games multiplayer, the site Worker with public rooms (Table/Lobby Durable Objects and D1, all on the free Workers plan, no payment method), a site with the hub's sections (Home, Games, Music, Videos, Rooms, Posts with feeds) in the studio's own look, an epic landing page for every game, big songs and videos in the studio's own R2 once it has storage (uploaded, checked by SHA-256, served at the same addresses), deploy, and the homie.rocks directory.",
   "type": "module",
   "license": "Apache-2.0",

package/worker/app-streams.mjs

@@ -11,6 +11,14 @@ END;`;}).join('\n')}
 `;
 const frame=value=>new TextEncoder().encode('data: '+JSON.stringify(value)+'\n\n');
 export const appHub=(env,app)=>{const ns=env.APP_RECORDS??env.LOBBY;return ns.get(ns.idFromName('@app-records/'+app));};
+/** A refused upgrade must be a socket the page can see close with 4403. A bare 403 never becomes one, so the page retries inside the eviction window and the records object stays awake. accept() plus an immediate close ends with the response. acceptWebSocket would keep a hibernating socket whose close the browser does not see. */
+export function deniedLiveSocket(){
+ if(typeof WebSocketPair==='undefined')return new Response('role cannot read collections',{status:403});
+ const pair=new WebSocketPair(),client=pair[0]??Object.values(pair)[0],server=pair[1]??Object.values(pair)[1];
+ server.accept();
+ try{server.close(4403,'closed');}catch{/* already closed */}
+ return new Response(null,{status:101,webSocket:client,headers:{'cache-control':'no-store'}});
+}
 const pushedRevisions=new WeakMap();
 export async function pushAppRecords(env,cat){
  const apps=(cat.games??[]).filter(g=>g.kind==='app');
@@ -58,7 +66,7 @@ export class AppRecordStreams {
  async open({meta,url,headers,collections=[]}){
   if(!Array.isArray(collections)||collections.some(c=>typeof c!=='string'||!Object.hasOwn(meta.records?.collections??{},c)))return new Response('unknown collection',{status:400});
   const s={id:crypto.randomUUID(),meta,url:new URL(url),request:new Request(url,{headers}),collections,seen:new Map()};
-  if(!await this.authorized(s))return new Response('role cannot read collections',{status:403});
+  if(!await this.authorized(s))return deniedLiveSocket();
   const session=await localSession(s.request,this.env);
   s.app=session?.app===meta.id&&session.scope?`${meta.id}:check:${session.scope}`:meta.id;
   s.room=s.url.searchParams.get('room')??'main';

package/worker/build-id.mjs

@@ -1,2 +1,2 @@
 // Generated by lib/build-identity.mjs; identifies the bundled runtime sources.
-export const STUDIO_BUILD = Object.freeze({"version":"0.58.5","sha256":"1af6197dc4435458f1241b39c4cc1d26031baaa88e5258fa6ead03f73f5750fe"});
+export const STUDIO_BUILD = Object.freeze({"version":"0.58.6","sha256":"ffc278d1a25f0d09dfaa8c76a38f4d325971dec38e75e08b6b7fb4d7c6aad504"});

package/worker/routes.mjs

@@ -327,9 +327,12 @@ export default async function route(request, env, ctx) {
         if(request.method!=='GET')return new Response('GET required',{status:405});
         // Cookie renewal is a Worker response. It must not wake the records object.
         if(url.searchParams.get('renew')==='1')return apiSession(new Response(null,{status:204,headers:{'cache-control':'no-store'}}));
-        const {appHub}=await import('./app-streams.mjs');
+        const {appHub,deniedLiveSocket}=await import('./app-streams.mjs');
         if(typeof WebSocketPair!=='undefined'){
           if(request.headers.get('upgrade')?.toLowerCase()!=='websocket')return new Response('websocket required',{status:426,headers:{'cache-control':'no-store'}});
+          // Check before the records object. A refused upgrade is one Worker socket, closed 4403, and the page stops.
+          const access=await appAccess(request,env,meta,url);
+          if(!access.ok)return deniedLiveSocket();
           // The object has to answer the upgrade itself. A JSON subrequest cannot carry the socket back.
           const headers=new Headers(request.headers);
           headers.set('x-homie-live-page',request.url);

package/worker/version.mjs

@@ -1,2 +1,2 @@
 /** The @homie-rocks/studio version this Worker code is (package.json's; a test keeps them equal). Cache-busts /_homie/site.js. */
-export const STUDIO_VERSION_TAG = '0.58.5';
+export const STUDIO_VERSION_TAG = '0.58.6';