@looop-games/cli 0.1.21 → 0.1.23

package/CHANGELOG.md

@@ -14,6 +14,32 @@ Versions: [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.23] - 2026-08-01
+
+### Changed
+
+- When the platform refuses an engine download because the Engine License has
+  been updated, `looop dev` and `looop update` now explain why and open the
+  sign-in flow for you — review and accept in the browser, and the download
+  continues by itself. No more bare HTTP status codes, no manual
+  `looop login`.
+
+## [0.1.22] - 2026-08-01
+
+### Added
+- `looop feedback` now brings the conversation back: after sending your unsent
+  reports, it pulls each report's outcome from the Looop team and stamps it into
+  the report file itself — `status:` / `resolved-in:` in the frontmatter, team
+  messages appended under `## Updates`. The file under `notes/feedback/` is the
+  whole thread, readable offline.
+- You can reply on a report: add a `## Reply (unsent)` section to a sent report
+  file and run `looop feedback` — the reply joins the same thread, and a closed
+  report you reply to is automatically reopened on the Looop side. Reply when
+  something still needs doing; a new problem is a new report.
+- `looop update` now tells you when a report you filed was resolved in one of
+  the versions you just crossed ("Feedback you filed landed in this update"),
+  next to the changelog it already prints.
+
 ## [0.1.21] - 2026-07-30
 
 ### Added

package/bin/looop.mjs

@@ -13,6 +13,7 @@ import { lintCmd } from '../lib/lint.mjs';
 import { update } from '../lib/update.mjs';
 import { changelog } from '../lib/changelog.mjs';
 import { sendFeedback } from '../lib/feedback.mjs';
+import { syncFeedback } from '../lib/feedback-sync.mjs';
 import { clearToken } from '../lib/config.mjs';
 
 const [, , cmd, ...rest] = process.argv;
@@ -34,7 +35,7 @@ Usage:
   looop update               Move this game to the latest engine release (re-pins looop.engine)
   looop model bake <glb>     Re-bake a 3D model's server-side hit data now (normally automatic)
   looop publish [--slug <s>]  Publish this game to play.looop.games (--slug for an A/B copy)
-  looop feedback             Send the unsent reports under notes/feedback/ to the Looop team
+  looop feedback             Send reports + replies under notes/feedback/; pull outcomes back in
   looop login                Authenticate this machine as your Looop player account
   looop logout               Forget the stored token
   looop whoami               Show who this machine publishes as
@@ -103,7 +104,10 @@ try {
       await publish({ slug: flag('slug') });
       break;
     case 'feedback':
+      // Send first, then sync: a report filed this run is already stamped with
+      // its id, so the same invocation can pull any outcome waiting for it.
       await sendFeedback();
+      await syncFeedback();
       break;
     case 'login':
       await login();

package/lib/changelog.mjs

@@ -1,4 +1,4 @@
-// `looop changelog` — what changed in the engine (project note azlqm2).
+// `looop changelog` — what changed in the engine.
 //
 // The gap this closes: `looop update` used to say "Engine updated: 0.1.10 →
 // 0.1.12" and then list the SKILL FILES it rewrote. It said nothing about what

package/lib/engine.mjs

@@ -112,7 +112,26 @@ export async function ensureEngine(
   const cached = join(cache, `engine-${pin}.tgz`);
   if (!existsSync(cached)) {
     log(`Downloading engine ${pin} from ${apiBase}…`);
-    const res = await fetchImpl(`${apiBase}/api/creator/engine/${pin}`, { headers: auth });
+    const dlUrl = `${apiBase}/api/creator/engine/${pin}`;
+    let res = await fetchImpl(dlUrl, { headers: auth });
+    // 403 = the token is fine but the platform refuses with a reason the
+    // human must act on — today, an updated Engine License that needs
+    // re-accepting. The acceptance IS the browser approval step of the device
+    // flow, so run the flow right here instead of asking the human to type
+    // `looop login` themselves (the click in the browser is still theirs to
+    // make), then retry once with the fresh token. If the platform still says
+    // no, surface its words — never loop.
+    if (res.status === 403) {
+      const reason = (await res.json().catch(() => null))?.error;
+      log(reason || 'The platform refused the engine download — your sign-in needs a refresh.');
+      log('Opening the sign-in flow to sort that out…');
+      await loginFn({ apiBase, log });
+      res = await fetchImpl(dlUrl, { headers: { Authorization: `Bearer ${getToken()}` } });
+      if (res.status === 403) {
+        const still = (await res.json().catch(() => null))?.error;
+        throw new Error(still || reason || 'the platform refused the engine download (HTTP 403).');
+      }
+    }
     if (res.status === 401) throw new Error('the platform rejected this machine’s token — run `looop login` again.');
     if (res.status === 404) throw new Error(`engine ${pin} is not downloadable — check the \`looop.engine\` pin in package.json.`);
     if (!res.ok) throw new Error(`engine download failed (HTTP ${res.status})`);

package/lib/feedback-sync.mjs

@@ -0,0 +1,232 @@
+// `looop feedback` — the back-channel half. The send half
+// (feedback.mjs) ships reports OUT; this module brings the conversation BACK:
+//
+//   1. Push replies. A report file can carry a `## Reply (unsent)` section —
+//      the agent writes one when something about the outcome still needs
+//      doing. It ships to /api/creator/feedback/reply and the heading is
+//      stamped with the returned fu_ id, so it never ships twice.
+//   2. Fetch outcomes. /api/creator/feedback/status returns, for every report
+//      this account filed: its status (read / done / discarded), the engine
+//      version a fix landed in, and the update thread. Everything is stamped
+//      back INTO the report file — `status:` / `resolved-in:` in frontmatter,
+//      unseen updates appended under `## Updates` — so the file under
+//      notes/feedback/ IS the thread, readable offline by any agent.
+//
+// Idempotency is by fu_ id: every update written into the file carries its
+// `fu_<16 hex>` marker (in an HTML comment, or on a sent-reply heading), and
+// anything whose id already appears in the file is never appended again.
+import { readFileSync, writeFileSync } from 'node:fs';
+import { basename } from 'node:path';
+import { findProject } from './project.mjs';
+import { getToken, getApiBase } from './config.mjs';
+import { DEFAULT_API_BASE } from './llm-shim.mjs';
+import { discoverSent } from './feedback.mjs';
+import { compareVersions } from './changelog.mjs';
+
+const UPDATE_ID = /fu_[0-9a-f]{16}/g;
+const UNSENT_REPLY = /^## Reply \(unsent\)\s*$/m;
+
+// Every unsent reply section: the text between a `## Reply (unsent)` heading
+// and the next `## ` heading (or EOF). A `## ` line inside a ``` / ~~~ fence
+// is CONTENT, not a boundary — replies quote markdown evidence, and stopping
+// at a fenced heading would ship half the reply and strand the rest under an
+// already-stamped heading where it can never be sent.
+export function extractUnsentReplies(text) {
+  const out = [];
+  const lines = text.split('\n');
+  for (let i = 0; i < lines.length; i++) {
+    if (!/^## Reply \(unsent\)\s*$/.test(lines[i])) continue;
+    const body = [];
+    let fenced = false;
+    for (let j = i + 1; j < lines.length; j++) {
+      if (/^(```|~~~)/.test(lines[j])) fenced = !fenced;
+      else if (!fenced && /^## /.test(lines[j])) break;
+      body.push(lines[j]);
+    }
+    out.push({ body: body.join('\n').trim() });
+  }
+  return out;
+}
+
+export function knownUpdateIds(text) {
+  return new Set(text.match(UPDATE_ID) ?? []);
+}
+
+// Upsert `status:` / `resolved-in:` into the frontmatter block. The report was
+// stamped `sent:` + `id:` when it shipped, so a synced file always has
+// frontmatter; a file without one is left alone. CRLF files (a Windows clone
+// with autocrlf) get their line endings preserved.
+export function applyStatus(text, { status, resolved_in }) {
+  const fm = /^---\r?\n([\s\S]*?)\r?\n---/.exec(text);
+  if (!fm) return text;
+  const eol = text.includes('\r\n') ? '\r\n' : '\n';
+  let block = fm[1];
+  const upsert = (key, value) => {
+    if (value == null) return;
+    const line = `${key}: ${value}`;
+    if (new RegExp(`^${key}:.*$`, 'm').test(block)) block = block.replace(new RegExp(`^${key}:[^\\r\\n]*`, 'm'), line);
+    else block = `${block}${eol}${line}`;
+  };
+  upsert('status', status);
+  upsert('resolved-in', resolved_in);
+  return text.slice(0, fm.index) + `---${eol}${block}${eol}---` + text.slice(fm.index + fm[0].length);
+}
+
+// Append unseen thread updates under `## Updates` (created at EOF if missing).
+// Each entry carries its fu_ marker; `knownIds` is what makes re-runs no-ops.
+//
+// The body is written as a BLOCKQUOTE, not raw markdown. That is a protocol
+// necessity, not styling: this file is re-parsed by the reply/section regexes
+// on every sync, so a message that merely QUOTES a heading like "## Reply
+// (unsent)" must not become one — raw injection would ship the team's own
+// words back as a creator reply (reopening the report it arrived on).
+export function appendUpdates(text, updates, knownIds) {
+  const fresh = updates.filter((u) => !knownIds.has(u.id));
+  if (fresh.length === 0) return { text, appended: 0 };
+
+  let entries = '';
+  for (const u of fresh) {
+    const who = u.author === 'creator' ? 'You' : 'Looop';
+    const when = new Date(u.created_at * 1000).toISOString().slice(0, 10);
+    const quoted = u.body.split('\n').map((l) => (l.trim() ? `> ${l}` : '>')).join('\n');
+    entries += `\n### ${who} — ${when} <!-- ${u.id} -->\n\n${quoted}\n`;
+  }
+
+  // New entries go at the END OF THE SECTION, not the end of the file: once a
+  // reply section exists below `## Updates`, appending at EOF would interleave
+  // platform messages under the creator's reply and the thread stops reading
+  // in order.
+  const lines = text.split('\n');
+  const head = lines.findIndex((l) => /^## Updates\s*$/.test(l));
+  if (head === -1) {
+    return { text: `${text.trimEnd()}\n\n## Updates\n${entries}`, appended: fresh.length };
+  }
+  let end = lines.length;
+  for (let j = head + 1; j < lines.length; j++) {
+    if (/^## /.test(lines[j])) { end = j; break; }
+  }
+  const section = lines.slice(0, end).join('\n').trimEnd();
+  const rest = lines.slice(end).join('\n');
+  return {
+    text: `${section}\n${entries}${rest ? `\n${rest}` : ''}`,
+    appended: fresh.length,
+  };
+}
+
+// Which reports landed in the versions an engine update just crossed:
+// (from, to], or everything at/below `to` when no previous pin exists.
+// `status` must still be done — a report reopened after its fix shipped keeps
+// the resolved_in stamp as history, but announcing it as "landed" would claim
+// a fix the reply just said didn't hold.
+export function landedIn(reports, { from, to }) {
+  return reports.filter(
+    (r) =>
+      r.status === 'done' &&
+      r.resolved_in &&
+      compareVersions(r.resolved_in, to) <= 0 &&
+      (!from || compareVersions(r.resolved_in, from) > 0),
+  );
+}
+
+export async function fetchStatus({ apiBase, fetchImpl = fetch }) {
+  const token = getToken();
+  if (!token) throw new Error('reading feedback status requires login — run `looop login` first.');
+  const res = await fetchImpl(`${apiBase}/api/creator/feedback/status`, {
+    headers: { Authorization: `Bearer ${token}` },
+  });
+  if (!res.ok) throw new Error(`feedback status fetch failed (HTTP ${res.status})`);
+  const { reports } = await res.json();
+  return Array.isArray(reports) ? reports : [];
+}
+
+async function pushReplies({ path, id, apiBase, fetchImpl, log }) {
+  let text = readFileSync(path, 'utf8');
+  let sent = 0;
+  // One at a time: each stamp rewrites the first unsent heading, so the next
+  // loop iteration sees the next reply (if any) as the new first.
+  while (UNSENT_REPLY.test(text)) {
+    const [reply] = extractUnsentReplies(text);
+    if (!reply?.body) {
+      log(`⚠️  ${basename(path)} has an empty "## Reply (unsent)" section — write the reply, then rerun.`);
+      break;
+    }
+    const token = getToken();
+    const res = await fetchImpl(`${apiBase}/api/creator/feedback/reply`, {
+      method: 'POST',
+      headers: { 'Content-Type': 'application/json', Authorization: `Bearer ${token}` },
+      body: JSON.stringify({ id, body: reply.body }),
+    });
+    if (!res.ok) {
+      const detail = await res.text().catch(() => '');
+      throw new Error(`reply send failed for ${basename(path)} (HTTP ${res.status}): ${detail.slice(0, 300)}`);
+    }
+    const { id: updateId } = await res.json();
+    text = text.replace(UNSENT_REPLY, `## Reply (sent ${new Date().toISOString()}, ${updateId})`);
+    writeFileSync(path, text);
+    sent += 1;
+    log(`↩️  Sent your reply on ${basename(path)} → ${updateId}`);
+  }
+  return sent;
+}
+
+// The whole sync: replies out, outcomes in. Fails soft on nothing-to-do (no
+// sent reports → silent no-op, no login needed); fails LOUD on a send error,
+// leaving the reply unsent so the next run retries it.
+export async function syncFeedback({
+  cwd = process.cwd(),
+  apiBase = getApiBase(DEFAULT_API_BASE),
+  log = console.log,
+  fetchImpl = fetch,
+} = {}) {
+  const project = findProject(cwd);
+  const sentFiles = discoverSent(project.dir);
+  if (sentFiles.length === 0) return { replies: 0, updated: [] };
+
+  if (!getToken()) throw new Error('syncing feedback requires login — run `looop login` first.');
+
+  // A failing reply must not rob the OTHER reports of their outcomes: push
+  // everything, stamp everything, and only THEN re-throw the first failure —
+  // loud (so the run is visibly not clean) but after the useful work. The
+  // failed reply's heading is still `(unsent)`, so the next run retries it.
+  let replies = 0;
+  let replyError = null;
+  for (const f of sentFiles) {
+    try {
+      replies += await pushReplies({ ...f, apiBase, fetchImpl, log });
+    } catch (err) {
+      replyError ??= err;
+    }
+  }
+
+  // Fetch-and-stamp is best-effort: the send half already succeeded, and a
+  // platform without the endpoint (or a transient failure) must not turn a
+  // delivered report into an apparent failure. The replies stay loud.
+  let reports;
+  try {
+    reports = await fetchStatus({ apiBase, fetchImpl });
+  } catch (err) {
+    log(`(could not check your reports' outcomes right now — ${err.message} They'll sync on the next run.)`);
+    if (replyError) throw replyError;
+    return { replies, updated: [] };
+  }
+  const byId = new Map(reports.map((r) => [r.id, r]));
+
+  const updated = [];
+  for (const { path, id } of sentFiles) {
+    const report = byId.get(id);
+    if (!report) continue;
+    const before = readFileSync(path, 'utf8');
+    let text = applyStatus(before, report);
+    const { text: withUpdates, appended } = appendUpdates(text, report.updates ?? [], knownUpdateIds(text));
+    text = withUpdates;
+    if (text === before) continue;
+    writeFileSync(path, text);
+    updated.push({ file: path, id, status: report.status, resolved_in: report.resolved_in, newUpdates: appended });
+
+    const landed = report.resolved_in ? ` — landed in ${report.resolved_in}` : '';
+    const news = appended ? ` (+${appended} update${appended === 1 ? '' : 's'})` : '';
+    log(`📬 ${basename(path)}: ${report.status}${landed}${news}`);
+  }
+  if (replyError) throw replyError;
+  return { replies, updated };
+}

package/lib/feedback.mjs

@@ -25,7 +25,10 @@ export const MAX_ATTACHMENTS = 20;
 export const MAX_ATTACHMENT_BYTES = 256 * 1024; // per file
 export const MAX_ATTACHMENTS_BYTES = 1024 * 1024; // all of them together
 
-const frontmatter = (text) => /^---\n([\s\S]*?)\n---/.exec(text)?.[1] ?? '';
+// CRLF-tolerant: a Windows clone with autocrlf rewrites these files, and a
+// frontmatter that stops matching means a sent report reads as unsent and is
+// re-filed on every run.
+const frontmatter = (text) => /^---\r?\n([\s\S]*?)\r?\n---/.exec(text)?.[1] ?? '';
 
 // A report is "sent" when its frontmatter carries a `sent:` stamp.
 function isSent(text) {
@@ -128,7 +131,7 @@ function titleOf(text, path) {
 
 function stamp(text, id) {
   const lines = `sent: ${new Date().toISOString()}\nid: ${id}`;
-  if (/^---\n/.test(text)) return text.replace(/^---\n/, `---\n${lines}\n`);
+  if (/^---\r?\n/.test(text)) return text.replace(/^---\r?\n/, (m) => `${m}${lines}\n`);
   return `---\n${lines}\n---\n${text}`;
 }
 
@@ -142,6 +145,21 @@ export function discoverUnsent(projectDir) {
     .sort();
 }
 
+// Delivered reports, with the id the platform stamped into each — what the
+// back-channel (feedback-sync.mjs) replies on and fetches outcomes for.
+export function discoverSent(projectDir) {
+  const dir = join(projectDir, 'notes', 'feedback');
+  if (!existsSync(dir)) return [];
+  return readdirSync(dir)
+    .filter((name) => name.endsWith('.md'))
+    .map((name) => join(dir, name))
+    .sort()
+    .flatMap((path) => {
+      const id = /^id:\s*(fb_[0-9a-f]{16})\s*$/m.exec(frontmatter(readFileSync(path, 'utf8')))?.[1];
+      return id ? [{ path, id }] : [];
+    });
+}
+
 export async function sendFeedback({
   cwd = process.cwd(),
   apiBase = getApiBase(DEFAULT_API_BASE),

package/lib/update.mjs

@@ -17,6 +17,7 @@ import { login } from './login.mjs';
 import { DEFAULT_API_BASE } from './llm-shim.mjs';
 import { compareVersions, renderReleases } from './changelog.mjs';
 import { syncCli, reportCli } from './self-update.mjs';
+import { fetchStatus, landedIn } from './feedback-sync.mjs';
 
 // The report is the point. A creator reading this must be able to answer, with
 // no further digging: what changed, was any of it mine, and what do I do now.
@@ -78,7 +79,7 @@ export async function update({
   const { latest, releases } = await res.json();
   if (!latest) throw new Error('the platform has no downloadable engine releases yet.');
 
-  // What the update is about to change UNDER the game (project note azlqm2).
+  // What the update is about to change UNDER the game.
   // Reporting the skill files we rewrote and nothing about the engine was the
   // whole gap: an agent crossed two versions of the shared library blind.
   //
@@ -172,6 +173,19 @@ export async function update({
     reportCli(log, cli);
   }
 
+  // Feedback this repo filed that a crossed release resolved. Best-effort on
+  // purpose: the back-channel must never block or fail an engine update, so
+  // any error here (an older platform without the endpoint, offline after the
+  // download, a bad response) reduces to "no landings to report".
+  let landed = [];
+  if (updated) {
+    try {
+      landed = landedIn(await fetchStatus({ apiBase, fetchImpl }), { from, to: latest });
+    } catch {
+      landed = [];
+    }
+  }
+
   if (updated) {
     log('');
     if (crossed === null) {
@@ -180,8 +194,14 @@ export async function update({
     } else if (crossed.length) {
       log(renderReleases(crossed, { pinned: from, latest }));
     }
+    if (landed.length) {
+      log('');
+      log('   Feedback you filed landed in this update:');
+      for (const r of landed) log(`   • "${r.title}" — resolved in ${r.resolved_in}`);
+      log('   Run `npx looop feedback` to pull the details into notes/feedback/.');
+    }
     log('');
     log('   Republish (`npx looop publish`) when you want the live game on it.');
   }
-  return { from, to: latest, updated, surface, crossed, cli };
+  return { from, to: latest, updated, surface, crossed, cli, landed };
 }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@looop-games/cli",
-  "version": "0.1.21",
+  "version": "0.1.23",
   "description": "Looop game development CLI — dev server, login, and publishing for standalone Looop games.",
   "type": "module",
   "license": "Apache-2.0",