@looop-games/cli 0.1.2 → 0.1.4

package/lib/create.test.mjs

@@ -8,20 +8,64 @@
 // covered by packed-install.smoke.mjs.
 import { test, after } from 'node:test';
 import assert from 'node:assert/strict';
-import { mkdtempSync, rmSync, readFileSync, existsSync } from 'node:fs';
+import { execFileSync } from 'node:child_process';
+import { mkdtempSync, rmSync, readFileSync, existsSync, readdirSync, lstatSync } from 'node:fs';
 import { tmpdir } from 'node:os';
-import { join } from 'node:path';
-import { create } from './create.mjs';
+import { join, relative } from 'node:path';
+import { create, TEMPLATE_DIR } from './create.mjs';
 
 const base = mkdtempSync(join(tmpdir(), 'looop-create-'));
 after(() => rmSync(base, { recursive: true, force: true }));
 
+// Hermetic: create() now resolves the engine pin from the platform — point
+// every test at a dead port (instant refusal → the warn-fallback path).
+// Tests that exercise the pin itself pass an explicit mock apiBase.
+process.env.LOOOP_API_BASE = 'http://127.0.0.1:1';
+
+// The scaffold is an on-disk template FOLDER (cuqfzo creator-harness Slice 1),
+// not template strings in code — Fran edits it as normal files. `create`
+// copies it with a {{name}} substitution pass; `gitignore` is stored dot-less
+// (npm pack silently strips .gitignore files) and renamed on copy.
+test('the scaffold is a faithful copy of the on-disk template folder', async () => {
+  const { dir } = await create({ name: 'from-template', cwd: base, install: false, log: () => {} });
+
+  const walk = (d) =>
+    readdirSync(d, { withFileTypes: true, recursive: true })
+      .filter((e) => e.isFile())
+      .map((e) => relative(d, join(e.parentPath, e.name)));
+
+  for (const file of walk(TEMPLATE_DIR)) {
+    const dest = file === 'gitignore' ? '.gitignore' : file;
+    assert.ok(existsSync(join(dir, dest)), `template file ${file} lands in the scaffold as ${dest}`);
+    const rendered = readFileSync(join(dir, dest), 'utf8');
+    assert.ok(!rendered.includes('{{name}}'), `${dest} has no unsubstituted {{name}} placeholders`);
+    const source = readFileSync(join(TEMPLATE_DIR, file), 'utf8');
+    assert.equal(rendered, source.replaceAll('{{name}}', 'from-template'), `${dest} is the template modulo substitution`);
+  }
+  // No stray dot-less gitignore in the scaffold.
+  assert.ok(!existsSync(join(dir, 'gitignore')));
+});
+
+test('the template folder ships in the npm package (files list)', () => {
+  const pkg = JSON.parse(readFileSync(join(TEMPLATE_DIR, '..', 'package.json'), 'utf8'));
+  assert.ok(pkg.files.includes('template'), 'npm pack must carry template/ or the published CLI scaffolds nothing');
+});
+
 test('scaffolds a complete standalone game folder', async () => {
   const { dir } = await create({ name: 'tower-jump', cwd: base, install: false, log: () => {} });
   assert.equal(dir, join(base, 'tower-jump'));
 
   const html = readFileSync(join(dir, 'index.html'), 'utf8');
   assert.match(html, /<title>tower-jump<\/title>/);
+
+  // The mobile baseline (architecture.md "Mobile baseline (every game)") is
+  // REQUIRED boilerplate the template must carry — without it every phone
+  // build double-tap-zooms and finger-drag-selects the HUD. All four items:
+  assert.match(html, /maximum-scale=1\.0, user-scalable=no, viewport-fit=cover/, '1: locked viewport');
+  assert.match(html, /touch-action: manipulation/, '2: no double-tap zoom on the chrome');
+  assert.match(html, /gesturestart/, '3: iOS gesture-zoom blocked in JS');
+  assert.match(html, /\*\s*\{[^}]*user-select: none/, '4: text selection killed on every element');
+  assert.match(html, /input, textarea[^}]*user-select: text/, '4b: typeable fields stay selectable');
   const js = readFileSync(join(dir, 'game.js'), 'utf8');
   assert.match(js, /from '\/shared\/ui\/room\/client\.js'/); // real multiplayer from minute one
 
@@ -33,9 +77,28 @@ test('scaffolds a complete standalone game folder', async () => {
   // the `looop.engine` pin then.
   assert.equal(pkg.dependencies, undefined);
   assert.ok(pkg.devDependencies['@looop-games/cli']);
+  // Smokes need a real browser: playwright ships with every scaffold and
+  // create pre-fetches Chromium — never a surprise mid-build install
+  // (caught in Fran's manual e2e, 2026-07-10).
+  assert.ok(pkg.devDependencies.playwright, 'playwright is a scaffold devDependency');
   assert.match(pkg.scripts.dev, /looop dev/);
   assert.match(pkg.scripts.publish, /looop publish/);
 
+  // npm is moving install scripts to opt-in (npm 11 warns, npm 12 SKIPS them
+  // by default). esbuild and workerd download their native binaries in a
+  // postinstall — skip those and `looop dev` cannot start, with no obvious
+  // cause. The scaffold ships the approval so a stranger's first install is
+  // clean on any npm. Name-only (unpinned) entries: partykit moves its
+  // esbuild/workerd pins between releases, and a version-pinned approval
+  // would silently stop covering them. Reported by a Windows creator with a
+  // strict npm, 2026-07-11.
+  assert.equal(pkg.allowScripts.esbuild, true, 'esbuild postinstall pre-approved (native binary)');
+  assert.equal(pkg.allowScripts.workerd, true, 'workerd postinstall pre-approved (native binary)');
+  // macOS-only optional dep of the watchers; unused on Windows. Verified
+  // against a real npm 11 install of the published scaffold: with these three
+  // the install is warning-free on every platform.
+  assert.equal(pkg.allowScripts.fsevents, true, 'fsevents postinstall pre-approved (mac watcher)');
+
   // The agent-facing surface: instructions + a pointer at the practices docs
   // that ship inside the installed engine bundle.
   const agents = readFileSync(join(dir, 'AGENTS.md'), 'utf8');
@@ -58,20 +121,241 @@ test('scaffolds the agent surface for every vendor (no plugin needed — Q4 adde
     assert.match(text, /read .*AGENTS\.md/i, `${pointer} has the fallback instruction`);
   }
 
-  // The looop skill ships with the scaffold (Claude Code picks up
-  // .claude/skills/ per project) — same knowledge the plugin used to carry,
-  // now versioned with the CLI that scaffolded it.
-  const skill = readFileSync(join(dir, '.claude', 'skills', 'looop', 'SKILL.md'), 'utf8');
-  assert.match(skill, /^---\nname: looop\n/, 'skill frontmatter');
-  assert.match(skill, /npx looop publish --slug/, 'documents the CLI surface');
-  assert.match(skill, /overrides\/shared\//, 'documents the override mechanism');
-  assert.match(skill, /multiplayer/i);
-
   // The scaffold's .gitignore must NOT swallow the agent files.
   const ignore = readFileSync(join(dir, '.gitignore'), 'utf8');
   assert.ok(!/\.claude/.test(ignore), '.claude/skills travels with the repo');
 });
 
+// The creator harness (cuqfzo creator-harness Slice 1, decisions Q2–Q7):
+// Layer 0 AGENTS.md with managed-section markers + routing table, the SIX
+// skills, and the handbook/ seed. This is the product surface a creator's
+// agent runs on — the contract below is what the Slice-2 updater and the
+// friends' cutover depend on.
+test('Layer 0: AGENTS.md has managed-section markers and the routing table', async () => {
+  const { dir } = await create({ name: 'layer-zero', cwd: base, install: false, log: () => {} });
+  const agents = readFileSync(join(dir, 'AGENTS.md'), 'utf8');
+
+  // The exact marker tokens the Slice-2 updater rewrites between — a
+  // creator's own additions outside them must never be clobbered.
+  assert.ok(agents.includes('<!-- looop:managed:start -->'), 'managed-block start marker');
+  assert.ok(agents.includes('<!-- looop:managed:end -->'), 'managed-block end marker');
+  assert.ok(
+    agents.indexOf('<!-- looop:managed:start -->') < agents.indexOf('<!-- looop:managed:end -->'),
+    'markers in order',
+  );
+
+  // Routing lines for the demoted skills (Q6): save, update, feel/tweaks,
+  // overrides — capabilities without a skill MUST be reachable from Layer 0.
+  assert.match(agents, /save/i, 'save routing line');
+  assert.match(agents, /looop\.engine/, 'engine-update routing mentions the version pin');
+  assert.match(agents, /tweaks/, 'feel-tuning routes at the tweaks library');
+  assert.match(agents, /overrides\/shared\//, 'override mechanism reachable from Layer 0');
+
+  // Layer 0 must NOT re-list the skills' triggers — every major agent CLI has
+  // a native skill system and the frontmatter `description` IS the routing
+  // (a second copy in AGENTS.md drifts). One orientation mention of the
+  // skills directory is all that's allowed.
+  assert.ok(!agents.includes('skills/build/SKILL.md'), 'no per-skill routing rows');
+  assert.match(agents, /\.claude\/skills/, 'orientation line names the skills directory');
+});
+
+test('.agents/skills aliases .claude/skills for non-Claude agent CLIs', async () => {
+  // Codex, Gemini/Antigravity, Cursor, and opencode discover project skills
+  // at .agents/skills/ — the scaffold aliases it to the same SKILL.md files
+  // (created at scaffold time; npm pack cannot ship symlinks).
+  const { dir } = await create({ name: 'vendor-skills', cwd: base, install: false, log: () => {} });
+  const link = join(dir, '.agents', 'skills');
+  assert.ok(lstatSync(link).isSymbolicLink(), '.agents/skills is a symlink');
+  assert.deepEqual(
+    readdirSync(link).sort(),
+    readdirSync(join(dir, '.claude', 'skills')).sort(),
+    'both paths expose the same skills',
+  );
+});
+
+test('the six skills ship, correctly named, no more no fewer (Q6 roster)', async () => {
+  const { dir } = await create({ name: 'six-skills', cwd: base, install: false, log: () => {} });
+  const skillsDir = join(dir, '.claude', 'skills');
+  const roster = ['build', 'engine', 'feedback', 'qa', 'todo', 'update-handbook'];
+  assert.deepEqual(readdirSync(skillsDir).sort(), roster, 'exactly the six-skill roster');
+  for (const name of roster) {
+    const text = readFileSync(join(skillsDir, name, 'SKILL.md'), 'utf8');
+    assert.match(text, new RegExp(`^---\\nname: ${name}\\n`), `${name} frontmatter name matches its folder`);
+    assert.match(text, /\ndescription: .+/, `${name} has a trigger description`);
+  }
+});
+
+test('the build loop encodes the locked mechanics (Q3/Q5/Q8)', async () => {
+  const { dir } = await create({ name: 'build-loop', cwd: base, install: false, log: () => {} });
+  const build = readFileSync(join(dir, '.claude', 'skills', 'build', 'SKILL.md'), 'utf8');
+
+  assert.match(build, /plan/i, 'note-anchored: the plan is the spine');
+  assert.match(build, /milestone/i, 'milestone vocabulary');
+  assert.match(build, /step/i, 'step vocabulary');
+  // Save-on-accept / revert-to-last-save — and NO invented git ceremony: the
+  // pre-milestone "checkpoint" commit was struck by Fran (2026-07-10).
+  assert.match(build, /last save/i, 'reject reverts to the last save');
+  assert.ok(!/checkpoint/i.test(build), 'no checkpoint mechanic');
+  assert.match(build, /never publish/i, 'publish is offered, never automatic');
+  assert.match(build, /worktree/i, 'parallel lanes section (Q8)');
+  assert.match(build, /consequence/i, 'PM-register discussion (Q5)');
+  // The discussion is a HARD gate on plan creation, ported from the studio
+  // loop's design-then-execute split (design settles decisions one at a time
+  // with a stated lean and visible lock-in; execution runs only from a
+  // settled plan). Caught in Fran's manual e2e 2026-07-10: a whole plan +
+  // code landed with zero discussion.
+  assert.match(build, /only from a plan whose decisions are settled/i, 'building requires a settled plan');
+  assert.match(build, /one decision per turn/i, 'decisions are posed one at a time');
+  assert.match(build, /problem before the options/i, 'problem explained before options');
+  assert.match(build, /your lean/i, 'a lean is stated with the options');
+  assert.match(build, /locking in/i, 'decisions are locked in visibly');
+  assert.match(build, /never applies when there is no plan yet/i, 'ceremony collapse cannot skip plan creation');
+  // Parity-audit fixes (2026-07-10): the remaining /discuss reflexes + the
+  // scope/lifecycle/lanes gaps the independent audit found.
+  assert.match(build, /re-explain the\s+underlying problem/i, '"I don\'t understand" → back up, not louder');
+  assert.match(build, /case for the other option/i, 'the lean is easy to override');
+  assert.match(build, /## Out of scope/m, 'plan template has a durable Out-of-scope home');
+  assert.match(build, /paused \| abandoned/, 'a plan can be abandoned, distinct from done');
+  assert.match(build, /never auto-resolve/i, 'lane merge conflicts stop for the creator');
+
+  const todo = readFileSync(join(dir, '.claude', 'skills', 'todo', 'SKILL.md'), 'utf8');
+  assert.match(todo, /promoted \| abandoned/, 'todos distinguish won\'t-do from did-it');
+  assert.match(todo, /one-line why/i, 'abandoning requires the why');
+
+  // Review cadence (Fran, 2026-07-10): AUTOMATED steps — including the
+  // review sub-agents — run after EVERY step; only the playtest is
+  // per-milestone. "Milestone-sized reviews" was drift, not a decision.
+  assert.match(build, /step's diff/, 'review sub-agents run on each step\'s diff');
+  assert.match(build, /only the playtest is per-milestone/i, 'the manual gate is the only per-milestone check');
+
+  // Seamless-UX handback (Fran, 2026-07-10): the AGENT runs the dev server;
+  // the creator gets a link to click, never a command to paste.
+  assert.match(build, /you run the server,\s+never the creator/i, 'agent starts/reuses the dev stack itself');
+  assert.match(build, /link to click/i, 'the creator receives a URL, not a command');
+  const qaSkill = readFileSync(join(dir, '.claude', 'skills', 'qa', 'SKILL.md'), 'utf8');
+  assert.match(qaSkill, /already\s+running/i, '/qa manual items run against a live game the agent started');
+});
+
+// The harness core that makes the monorepo loop effective must survive the
+// port IN FULL — the parity gate is the whole point of the workstream. The
+// framework itself (automated-vs-manual, the ratchet, the master steps list
+// incl. the review rows and the generative verdict-mix row) has ONE source of
+// truth: the engine's shared/practices/qa.md, shipped inside the artifact.
+// The skills REFERENCE it — they never restate it (that scatter is exactly
+// what qa.md was created to end). These rows pin the reference shape plus the
+// point-of-use pointers that were once silently dropped.
+test('the harness core survives the port: single source referenced, pointers intact', async () => {
+  const { dir } = await create({ name: 'harness-core', cwd: base, install: false, log: () => {} });
+  const build = readFileSync(join(dir, '.claude', 'skills', 'build', 'SKILL.md'), 'utf8');
+  const qa = readFileSync(join(dir, '.claude', 'skills', 'qa', 'SKILL.md'), 'utf8');
+
+  // Both loop skills anchor on the ONE master doc inside the engine artifact.
+  for (const [name, text] of [['build', build], ['qa', qa]]) {
+    assert.match(text, /engine\/shared\/practices\/qa\.md/, `${name} points at the master QA doc`);
+  }
+  assert.match(qa, /steps live there|never restate/i, '/qa declares the single-source rule');
+  assert.match(qa, /`npx looop test`/, '/qa names the real test gate');
+
+  // Point-of-use pointers in the loop (the rows themselves live in qa.md):
+  // independent review sub-agents + red→green findings + verdict mix.
+  assert.match(build, /sub-agent/i, 'milestone close spawns reviewers');
+  assert.match(build, /code.quality/i, 'names the code-quality review row');
+  assert.match(build, /coverage|test.opportunit|test.thoroughness/i, 'names the test-coverage review row');
+  assert.match(build, /red.*green|failing test.*(first|before)/i, 'findings fixed red→green');
+  assert.match(build, /verdict/i, 'generative verdict-mix pointer at milestone close');
+  assert.match(build, /diagnose/i, 'diagnose before second-guessing a failed fix');
+  assert.match(qa, /sub-agent/i, '/qa maps the review skills to sub-agents');
+});
+
+test('handbook/ seeds ship and /qa + /update-handbook wire the three QA sources (Q7)', async () => {
+  const { dir } = await create({ name: 'handbook-game', cwd: base, install: false, log: () => {} });
+  for (const f of ['qa.md', 'feel.md', 'design.md']) {
+    assert.ok(existsSync(join(dir, 'handbook', f)), `handbook/${f} seeded`);
+  }
+
+  const qa = readFileSync(join(dir, '.claude', 'skills', 'qa', 'SKILL.md'), 'utf8');
+  assert.match(qa, /looop test/, 'source 1: executable files via looop test');
+  assert.match(qa, /handbook\/qa\.md/, 'source 2: the game handbook');
+  assert.match(qa, /engine\/shared\/practices\/qa\.md/, 'source 3: the engine master list');
+
+  const ratchet = readFileSync(join(dir, '.claude', 'skills', 'update-handbook', 'SKILL.md'), 'utf8');
+  assert.match(ratchet, /handbook\/qa\.md/, 'ratchet writes game QA steps');
+  assert.match(ratchet, /feedback/i, 'generic holes route upstream via /feedback');
+  // The handbook is the CREATOR's truth — writes are proposed and approved,
+  // never slipped in as a side effect (Fran, 2026-07-10).
+  assert.match(ratchet, /approval first/i, 'handbook writes gated on creator approval');
+});
+
+// /feedback has a REAL transport (`looop feedback` → /api/creator/feedback),
+// and the report is agent-authored: maximal detail, verbatim output, and the
+// conversation transcript — the Looop team can't ask the session follow-ups.
+test('the feedback skill sends via looop feedback and demands the full evidence', async () => {
+  const { dir } = await create({ name: 'feedback-game', cwd: base, install: false, log: () => {} });
+  const fb = readFileSync(join(dir, '.claude', 'skills', 'feedback', 'SKILL.md'), 'utf8');
+
+  assert.match(fb, /npx looop feedback/, 'sends through the real CLI transport');
+  assert.ok(!/however they normally reach them/.test(fb), 'the interim manual transport is gone');
+  assert.match(fb, /## Transcript/m, 'the report carries the conversation transcript');
+  assert.match(fb, /verbatim/i, 'output is pasted verbatim, never summarized');
+  assert.match(fb, /sent:/, 'documents the sent-stamp so reports never ship twice');
+});
+
+// Every notes/ file is datetime-prefixed so the tree lists in creation order
+// and "the latest plan" is findable at a glance (Fran, 2026-07-10 — a flat
+// slug like iso-view.md is unsortable once notes accumulate).
+test('note-writing skills mandate the datetime filename prefix', async () => {
+  const { dir } = await create({ name: 'ordered-notes', cwd: base, install: false, log: () => {} });
+  for (const [skill, tree] of [['build', 'plans'], ['todo', 'todos'], ['feedback', 'feedback']]) {
+    const text = readFileSync(join(dir, '.claude', 'skills', skill, 'SKILL.md'), 'utf8');
+    assert.match(
+      text,
+      new RegExp(`notes/${tree}/<YYYY-MM-DD-HHMM>-`),
+      `${skill} names its notes/${tree} files datetime-first`,
+    );
+  }
+});
+
+// The engine pin is resolved AT CREATE TIME from the public version-list
+// endpoint and lands INSIDE the initial commit — the milestone-1 revert
+// baseline. Without this, first dev wrote the pin after the baseline: fresh
+// repos started dirty, and a milestone-1 reject deleted the pin so the next
+// dev could silently resolve a NEWER engine (caught in Fran's manual e2e,
+// 2026-07-10).
+test('create resolves the engine pin into the initial commit; reverts keep it', async (t) => {
+  const http = await import('node:http');
+  const server = http.createServer((req, res) => {
+    res.writeHead(200, { 'Content-Type': 'application/json' });
+    res.end(JSON.stringify(req.url === '/api/creator/engine' ? { versions: ['0.7.3'], latest: '0.7.3' } : {}));
+  });
+  await new Promise((r) => server.listen(0, r));
+  t.after(() => server.close());
+
+  const { dir } = await create({
+    name: 'pinned-game',
+    cwd: base,
+    install: false,
+    apiBase: `http://localhost:${server.address().port}`,
+    log: () => {},
+  });
+  const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
+  assert.equal(pkg.looop.engine, '0.7.3', 'pin written at create');
+
+  // The pin is IN the baseline commit, so reset --hard can never drop it.
+  const shown = execFileSync('git', ['show', 'HEAD:package.json'], { cwd: dir, encoding: 'utf8' });
+  assert.match(shown, /"engine": "0\.7\.3"/, 'initial commit carries the pin');
+  execFileSync('git', ['reset', '--hard', 'HEAD'], { cwd: dir });
+  const after = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
+  assert.equal(after.looop.engine, '0.7.3', 'revert-to-baseline preserves the pin');
+});
+
+test('an unreachable platform degrades to the old pin-at-first-dev behavior', async () => {
+  const logs = [];
+  const { dir } = await create({ name: 'offline-game', cwd: base, install: false, log: (m) => logs.push(m) });
+  const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
+  assert.equal(pkg.looop, undefined, 'no pin when the lookup fails');
+  assert.match(logs.join('\n'), /Could not resolve the engine version/, 'the fallback is loud');
+});
+
 test('the CLI dependency spec is overridable for tarball installs (the smoke path)', async () => {
   const { dir } = await create({
     name: 'spec-game',
@@ -84,6 +368,63 @@ test('the CLI dependency spec is overridable for tarball installs (the smoke pat
   assert.equal(pkg.devDependencies['@looop-games/cli'], 'file:../cli.tgz');
 });
 
+// The initial commit is the revert baseline: reject-milestone-1 resets to it,
+// and `git worktree add` (parallel lanes) needs a commit to exist — on a
+// never-committed repo it silently creates an empty orphan lane.
+test('create leaves the scaffold fully committed (the first revert baseline)', async () => {
+  const { dir } = await create({ name: 'baseline', cwd: base, install: false, log: () => {} });
+  const log = execFileSync('git', ['log', '--oneline'], { cwd: dir }).toString().trim().split('\n');
+  assert.equal(log.length, 1, 'exactly one commit');
+  const status = execFileSync('git', ['status', '--porcelain'], { cwd: dir }).toString().trim();
+  assert.equal(status, '', 'nothing left uncommitted');
+});
+
+// A stranger who runs `npx looop create` gets the template AND the practices
+// docs inside the engine artifact. They have never heard of the studio, its
+// monorepo, its CLI, its games, or its people — any mention is a leak (Fran,
+// 2026-07-10: "if they read about the monorepo, it's an issue"). Studio-side
+// content lives in shared/notes/guides/ (never shipped), not here.
+test('no studio leaks in any surface a stranger receives', () => {
+  const engineRoot = join(TEMPLATE_DIR, '..', '..', '..');
+  const shipped = [];
+  const collect = (d) => {
+    for (const e of readdirSync(d, { withFileTypes: true, recursive: true })) {
+      if (e.isFile()) shipped.push(join(e.parentPath, e.name));
+    }
+  };
+  collect(TEMPLATE_DIR);
+  collect(join(engineRoot, 'shared', 'practices'));
+  shipped.push(join(engineRoot, 'shared', 'ui', 'INDEX.md'));
+
+  const FORBIDDEN = [
+    /`gamedev|gamedev </i, // the studio's internal CLI ("gamedev literature" prose is fine)
+    /\bFran\b/,            // the studio's human
+    /monorepo/i,           // the workspace the reader must never learn exists
+    /studio/i,             // "the studio" / "studio-only" dual-world framing
+    /harness-improvement/, // studio-only skills
+    /import-game/,
+    /`\/primitives`/,
+    /looop-ugc|looop-boxeo/, // studio partykit deploy names
+    /looop-core|looop-games\/games\//, // sibling-repo paths (@looop-games/* npm scope is fine)
+    /new_game\.py|catalog_publish\.py/, // studio tool paths
+    /shared\/notes\//,     // the studio notes tree (not in the artifact)
+  ];
+  // Studio game names: banned in the practices docs (there they were
+  // references the reader can't open); allowed as plain DATA elsewhere —
+  // INDEX.md's used_by column, and template game.js's generic "a tiny
+  // multiplayer plaza".
+  const PRACTICES_ONLY = [/mp-lab|escaleras|piso-20|booox|wordsmith|survivors|amnesia|\bagora\b|\bplaza\b/];
+
+  for (const file of shipped) {
+    const text = readFileSync(file, 'utf8');
+    const extra = file.includes(`${join('shared', 'practices')}`) ? PRACTICES_ONLY : [];
+    for (const re of [...FORBIDDEN, ...extra]) {
+      const m = text.match(re);
+      assert.ok(!m, `${relative(engineRoot, file)} leaks "${m?.[0]}" (${re})`);
+    }
+  }
+});
+
 test('rejects slug-unsafe names and existing folders', async () => {
   await assert.rejects(() => create({ name: 'My Game!', cwd: base, install: false, log: () => {} }), /letters/);
   await create({ name: 'dupe', cwd: base, install: false, log: () => {} });

package/lib/dev.mjs

@@ -37,6 +37,29 @@ export function partykitBin() {
   }
 }
 
+// Per-game server parity (cuqfzo Phase 4): a game shipping its own
+// `partykit.json` runs its OWN server in dev — partykit gets the game folder
+// as cwd, resolving the game's `main` entry (which imports the room server
+// from the installed engine). Without one, the bundle's shared room server
+// runs, exactly as before. Mirrors the monorepo dev.sh detection so a
+// vendor-flipped game behaves identically standalone. A config whose `main`
+// doesn't exist is ignored LOUDLY — a dead file must not take dev's
+// multiplayer down with it.
+export function partykitCwdFor(project, engine, warn = console.warn) {
+  const configPath = join(project.dir, 'partykit.json');
+  if (existsSync(configPath)) {
+    try {
+      const config = JSON.parse(readFileSync(configPath, 'utf8'));
+      const main = config?.main ?? 'server.js';
+      if (existsSync(join(project.dir, main))) return project.dir;
+      warn(`partykit.json found but its main (${main}) doesn't exist — running the shared room server instead`);
+    } catch (err) {
+      warn(`partykit.json is unreadable (${err.message}) — running the shared room server instead`);
+    }
+  }
+  return engine.roomServerDir;
+}
+
 export async function dev({ cwd = process.cwd(), port, noMp = process.env.NO_MP === '1', log = console.log } = {}) {
   const project = findProject(cwd);
   // Q4 revision: the engine is not an npm dependency — install/refresh it from
@@ -92,10 +115,12 @@ export async function dev({ cwd = process.cwd(), port, noMp = process.env.NO_MP
       log(`→ multiplayer :${ports.mp}  (in use — killing to take over)`);
       await killPort(ports.mp);
     }
+    const pkCwd = partykitCwdFor(project, engine, (m) => log(`[partykit] ${m}`));
+    const ownServer = pkCwd === project.dir;
     const pk = spawn(
       process.execPath,
       [partykitBin(), 'dev', '--port', String(ports.mp), '--persist', join(tmpdir(), `looop-partykit-${ports.mp}`)],
-      { cwd: engine.roomServerDir, stdio: ['ignore', 'pipe', 'pipe'], detached: true },
+      { cwd: pkCwd, stdio: ['ignore', 'pipe', 'pipe'], detached: true },
     );
     pk.stdout.on('data', () => {});
     pk.stderr.on('data', (d) => {
@@ -103,7 +128,7 @@ export async function dev({ cwd = process.cwd(), port, noMp = process.env.NO_MP
       if (/error/i.test(s)) log(`[partykit] ${s.trim()}`);
     });
     children.push(pk);
-    log(`→ multiplayer :${ports.mp}  (partykit on the bundle's room-server, pid ${pk.pid})`);
+    log(`→ multiplayer :${ports.mp}  (partykit on ${ownServer ? "this game's OWN server" : "the bundle's room-server"}, pid ${pk.pid})`);
   }
 
   // ─── platform services shim ───

package/lib/dev.test.mjs

@@ -0,0 +1,52 @@
+// Per-game server parity (cuqfzo Phase 4, dev half): a game that ships its
+// own `partykit.json` gets its OWN server in `looop dev` — partykit runs with
+// the game folder as cwd (resolving the game's `main` entry, which imports
+// the room server from the installed engine). A game without one rides the
+// bundle's shared room server, exactly as before. This mirrors the monorepo's
+// dev.sh detection, so a vendor-flipped game behaves identically standalone.
+
+import { test } from 'node:test';
+import assert from 'node:assert/strict';
+import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
+import { join } from 'node:path';
+import { tmpdir } from 'node:os';
+import { partykitCwdFor } from './dev.mjs';
+
+function tempGameDir(withPartykit) {
+  const dir = mkdtempSync(join(tmpdir(), 'looop-devtest-'));
+  writeFileSync(join(dir, 'index.html'), '<canvas></canvas>');
+  if (withPartykit) {
+    writeFileSync(join(dir, 'partykit.json'), JSON.stringify({ name: 'mygame', main: 'server.js' }));
+    writeFileSync(join(dir, 'server.js'), 'export { default } from "@looop-games/engine/shared/ui/room/server.js";');
+  }
+  return dir;
+}
+
+test('game WITHOUT partykit.json → partykit runs on the bundle room server', () => {
+  const dir = tempGameDir(false);
+  try {
+    const cwd = partykitCwdFor({ dir }, { roomServerDir: '/engine/room' });
+    assert.equal(cwd, '/engine/room');
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('game WITH partykit.json → partykit runs on the GAME folder (its own server)', () => {
+  const dir = tempGameDir(true);
+  try {
+    const cwd = partykitCwdFor({ dir }, { roomServerDir: '/engine/room' });
+    assert.equal(cwd, dir);
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});
+
+test('a partykit.json without a resolvable main is IGNORED (falls back to the bundle, loudly)', () => {
+  // A dead config must not silently break dev — the room server the game
+  // actually reaches should still exist.
+  const dir = tempGameDir(false);
+  writeFileSync(join(dir, 'partykit.json'), JSON.stringify({ name: 'mygame', main: 'missing.js' }));
+  try {
+    const warnings = [];
+    const cwd = partykitCwdFor({ dir }, { roomServerDir: '/engine/room' }, (m) => warnings.push(m));
+    assert.equal(cwd, '/engine/room');
+    assert.ok(warnings.some((w) => /missing\.js/.test(w)), 'warns about the dead entry');
+  } finally { rmSync(dir, { recursive: true, force: true }); }
+});

package/lib/engine.mjs

@@ -16,9 +16,9 @@
 //
 // LOOOP_ENGINE_TARBALL=<path> short-circuits the network — the offline/smoke
 // lane (packed-install smoke, air-gapped work against a local build).
-import { execFileSync } from 'node:child_process';
 import { existsSync, mkdirSync, readFileSync, renameSync, writeFileSync } from 'node:fs';
 import { join, resolve } from 'node:path';
+import { runNpm } from './npm.mjs';
 import { resolveEngine } from './project.mjs';
 import { getToken, getApiBase, cacheDir } from './config.mjs';
 import { login } from './login.mjs';
@@ -52,7 +52,7 @@ function installedEngine(projectDir) {
 // node_modules/@looop-games/engine AND installs its runtime dependencies
 // (the room server's bare imports), without touching package.json.
 function npmInstallTarball(projectDir, tgzPath) {
-  execFileSync('npm', ['install', '--no-save', '--no-audit', '--no-fund', resolve(tgzPath)], {
+  runNpm(['install', '--no-save', '--no-audit', '--no-fund', resolve(tgzPath)], {
     cwd: projectDir,
     stdio: 'pipe',
   });

package/lib/feedback.mjs

@@ -0,0 +1,87 @@
+// `looop feedback` — send the reports under notes/feedback/ to the Looop team
+// (cuqfzo; the transport behind the template's /feedback skill).
+//
+// Target: /api/creator/feedback — the token-authenticated intake beside
+// creator/publish. Each unsent notes/feedback/*.md ships VERBATIM as the
+// report body (frontmatter, transcript excerpt and all — the agent authors
+// it rich on purpose), with the repo's identity attached: slug, the
+// looop.engine pin, and this CLI's version. A delivered file is stamped
+// `sent:` + `id:` in its frontmatter so it never ships twice; a failed send
+// leaves the file unstamped and is retried on the next run.
+import { readdirSync, readFileSync, writeFileSync, existsSync } from 'node:fs';
+import { basename, join } from 'node:path';
+import { findProject } from './project.mjs';
+import { getToken, getApiBase } from './config.mjs';
+import { DEFAULT_API_BASE } from './llm-shim.mjs';
+
+const CLI_VERSION = JSON.parse(readFileSync(new URL('../package.json', import.meta.url), 'utf8')).version;
+
+// A report is "sent" when its frontmatter carries a `sent:` stamp.
+function isSent(text) {
+  const fm = /^---\n([\s\S]*?)\n---/.exec(text);
+  return fm ? /^sent:\s*\S/m.test(fm[1]) : false;
+}
+
+function titleOf(text, path) {
+  const h1 = /^#\s+(.+)$/m.exec(text);
+  return h1 ? h1[1].trim() : basename(path, '.md');
+}
+
+function stamp(text, id) {
+  const lines = `sent: ${new Date().toISOString()}\nid: ${id}`;
+  if (/^---\n/.test(text)) return text.replace(/^---\n/, `---\n${lines}\n`);
+  return `---\n${lines}\n---\n${text}`;
+}
+
+export function discoverUnsent(projectDir) {
+  const dir = join(projectDir, 'notes', 'feedback');
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir)
+    .filter((name) => name.endsWith('.md'))
+    .map((name) => join(dir, name))
+    .filter((path) => !isSent(readFileSync(path, 'utf8')))
+    .sort();
+}
+
+export async function sendFeedback({
+  cwd = process.cwd(),
+  apiBase = getApiBase(DEFAULT_API_BASE),
+  log = console.log,
+} = {}) {
+  const project = findProject(cwd);
+  const unsent = discoverUnsent(project.dir);
+  if (unsent.length === 0) {
+    log('Nothing to send — no unsent reports under notes/feedback/.');
+    return { sent: [] };
+  }
+
+  const token = getToken();
+  if (!token) throw new Error('sending feedback requires login — run `looop login` first.');
+
+  const sent = [];
+  for (const path of unsent) {
+    const body = readFileSync(path, 'utf8');
+    const report = {
+      title: titleOf(body, path),
+      body,
+      slug: project.slug,
+      engine: project.pkg?.looop?.engine,
+      cli: CLI_VERSION,
+    };
+    const res = await fetch(`${apiBase}/api/creator/feedback`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+      body: JSON.stringify(report),
+    });
+    if (!res.ok) {
+      const detail = await res.text().catch(() => '');
+      throw new Error(`feedback send failed for ${basename(path)} (HTTP ${res.status}): ${detail.slice(0, 300)}`);
+    }
+    const { id } = await res.json();
+    writeFileSync(path, stamp(body, id));
+    log(`✅ Sent ${basename(path)} → ${id}`);
+    sent.push({ file: path, id });
+  }
+  log(`${sent.length} report${sent.length === 1 ? '' : 's'} delivered to the Looop team.`);
+  return { sent };
+}