@looop-games/cli 0.1.26 → 0.1.27

package/CHANGELOG.md

@@ -14,6 +14,23 @@ Versions: [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.27] - 2026-08-09
+
+### Added
+- `looop dev` now injects the **dev toolbox** into every game it serves — the
+  looop chip / `Ctrl/Cmd+Shift+L` overlay with the Inspector, your tweaks, and
+  a link to the Assets page (see the engine changelog for what is inside). The
+  tag is added only when your pinned engine actually ships the toolbox, so an
+  older engine just keeps working until you `looop update`. `?_toolbox=off`
+  hides it for a session. Published games are untouched — this exists only on
+  your dev server.
+
+### Changed
+- **BREAKING** `looop inspect` is now `looop assets`.
+  Migration: same command, same arguments — `looop assets [<id>]` opens the
+  dev stack on the Assets page (the renamed asset inspector). The old verb is
+  gone; "Inspector" now names the toolbox's live-world tool instead.
+
 ## [0.1.26] - 2026-08-07
 
 ### Added

package/bin/looop.mjs

@@ -28,7 +28,7 @@ const HELP = `looop — build and run Looop games
 Usage:
   looop create <name>        Bootstrap a new game folder (multiplayer works out of the box)
   looop dev [--port <n>]     Run the full dev stack (game + multiplayer + services)
-  looop inspect [<id>]       Browse and drive your models, sounds and assets on their own
+  looop assets [<id>]       Browse and drive your models, sounds and assets on their own
   looop lane <name>          Open an isolated copy of the game to experiment in, safely
   looop test                 Run the game's tests (*.test.mjs) and smokes (*.smoke.mjs)
   looop lint [--fix]         Check the game against the Looop rules (runs inside 'looop test')
@@ -61,14 +61,14 @@ try {
       // Keep the process alive; servers + children hold the loop open.
       break;
     }
-    case 'inspect': {
-      // The same dev stack `looop dev` runs, opened on the inspector. Not a
-      // second server: the inspector is a page under /shared/, which this one
+    case 'assets': {
+      // The same dev stack `looop dev` runs, opened on the assets page. Not a
+      // second server: the assets page is a page under /shared/, which this one
       // already mounts.
-      const { inspectorUrl, openBrowser, itemArg } = await import('../lib/inspect.mjs');
+      const { assetsPageUrl, openBrowser, itemArg } = await import('../lib/assets-page.mjs');
       const handle = await dev({ port: flag('port') ? Number(flag('port')) : undefined });
-      const target = inspectorUrl(handle.url, { item: itemArg(rest) });
-      console.log(`\n  🔎 Inspector → ${target}\n`);
+      const target = assetsPageUrl(handle.url, { item: itemArg(rest) });
+      console.log(`\n  🔎 Assets → ${target}\n`);
       if (!rest.includes('--no-open')) openBrowser(target);
       const shutdown = () => {
         handle.stop();

package/lib/{inspect.mjs → assets-page.mjs}

@@ -1,9 +1,9 @@
-// `looop inspect` — the dev stack, opened on the asset inspector instead of the
+// `looop assets` — the dev stack, opened on the Assets page instead of the
 // game.
 //
-// The inspector is a served page under /shared/, not a separate server: the dev
+// the assets page is a served page under /shared/, not a separate server: the dev
 // server already mounts the engine's shared tree, so there is nothing new to
-// start and nothing to keep in sync. That also means the inspector still works
+// start and nothing to keep in sync. That also means the assets page still works
 // when the game itself is broken, which is when it is most wanted.
 //
 // It finds the game on its own — the page asks the dev server what it is serving
@@ -13,18 +13,18 @@ import { spawn } from 'node:child_process';
 import { existsSync } from 'node:fs';
 import { join } from 'node:path';
 
-export const INSPECTOR_PATH = '/shared/ui/inspector/';
+export const ASSETS_PAGE_PATH = '/shared/ui/assets/';
 
 // Built from the dev server's OWN url rather than an assumed localhost:8000: a
 // lane runs on its own port base and 8000 may belong to somebody else's server,
-// and an inspector opened on the wrong port inspects the wrong game — or none.
-export function inspectorUrl(gameUrl, { item } = {}) {
+// and an assets page opened on the wrong port inspects the wrong game — or none.
+export function assetsPageUrl(gameUrl, { item } = {}) {
   const base = new URL(gameUrl);
   const q = item ? `?_item=${encodeURIComponent(item)}` : '';
-  return `${base.origin}${INSPECTOR_PATH}${q}`;
+  return `${base.origin}${ASSETS_PAGE_PATH}${q}`;
 }
 
-// Does this game have anything for the inspector to show?
+// Does this game have anything for the assets page to show?
 //
 // The whole answer is `assets.js`, because the list IS the declaration — nothing
 // walks the folder looking for files any more. So this is the same question as
@@ -33,15 +33,15 @@ export function inspectorUrl(gameUrl, { item } = {}) {
 // points at is then invisible exactly when it would have helped.
 //
 // The file's CONTENTS are not read. A registry that declares nothing, or one
-// that throws on import, is a case the inspector page itself reports far better
+// that throws on import, is a case the assets page itself reports far better
 // than a banner line could — and reading it here would mean the dev server
 // evaluating game code to decide how to print a URL.
-export function hasInspectableAssets(projectDir) {
+export function hasDeclaredAssets(projectDir) {
   return !!projectDir && existsSync(join(projectDir, 'assets.js'));
 }
 
 // Flags that take a VALUE, so the value is not mistaken for the asset name.
-// `looop inspect --port 8210` is two argv entries, and reading "the first
+// `looop assets --port 8210` is two argv entries, and reading "the first
 // argument that is not a flag" turns 8210 into the thing to open — on the one
 // command whose entire job is opening the right asset.
 const VALUED_FLAGS = new Set(['--port']);

package/lib/dev.mjs

@@ -20,7 +20,7 @@ import { resolvePorts, portInUse, killPort, lanIp } from './ports.mjs';
 import { assertNoInertOverride, scanPrimitives } from './primitives.mjs';
 import { buildDevRoomServer, DEV_OVERRIDES_DIR } from './room-server.mjs';
 import { createFileWatcher, createRoomReloader } from './room-reload.mjs';
-import { hasInspectableAssets, inspectorUrl } from './inspect.mjs';
+import { hasDeclaredAssets, assetsPageUrl } from './assets-page.mjs';
 
 // Resolve the partykit CLI entry from OUR dependencies (the game never
 // declares partykit; it rides @looop-games/cli). partykit's `exports` map hides
@@ -287,8 +287,8 @@ export async function dev({ cwd = process.cwd(), port, noMp = process.env.NO_MP
   // Only when this game declares assets (inspect.mjs). A line printed on every
   // single boot is a line nobody reads by the third one, and the tool it points
   // at is then invisible exactly when it would have helped.
-  if (hasInspectableAssets(project.dir)) {
-    log(`   🔍  ${inspectorUrl(url)}   (your models, sounds and assets, one at a time)`);
+  if (hasDeclaredAssets(project.dir)) {
+    log(`   🔍  ${assetsPageUrl(url)}   (your models, sounds and assets, one at a time)`);
   }
   log('────────────────────────────────────────────────────────────');
 

package/lib/inject.mjs

@@ -14,6 +14,11 @@ import { dirname } from 'node:path';
 export const DEV_IDENTITY = { userId: 'dev-local-user', name: 'Dev', color: '#38bdf8' };
 
 export const PLATFORM_URL = '/shared/platform/platform.js';
+// The dev toolbox — injected ONLY here, never by the production serve path
+// (builder/functions/_shared/serve-identity.ts). That separation is the gate
+// that keeps a dev surface off published pages: the production injector never
+// names this module, so there is nothing to strip and nothing to trust.
+export const TOOLBOX_URL = '/shared/ui/toolbox/toolbox.js';
 
 // JSON safe for an inline <script>: `<` → < so a value containing
 // "</script>" can't terminate the script early.
@@ -21,13 +26,22 @@ function jsJson(value) {
   return JSON.stringify(value).replaceAll('<', '\\u003c');
 }
 
-export function injectHeadTags(html, slug, { identity = DEV_IDENTITY, platformUrl = PLATFORM_URL } = {}) {
+export function injectHeadTags(html, slug, { identity = DEV_IDENTITY, platformUrl = PLATFORM_URL, toolbox = false, toolboxUrl = TOOLBOX_URL } = {}) {
   const parts = [];
   if (slug) parts.push(`<script>window.GAME_SLUG = ${jsJson(slug)};</script>`);
   parts.push(`<script>window.LOOOP_IDENTITY = ${jsJson(identity)};</script>`);
   parts.push(
     `<script type="module">import { installPlatform } from "${platformUrl}"; installPlatform();</script>`,
   );
+  // Dev-only, opt-in per request: the server sets `toolbox` only when the
+  // resolved engine bundle carries the module (inject-if-present), so an older
+  // pinned engine under a newer CLI never gets a 404ing tag. Behind the
+  // platform tag — the boot gate's error handlers come up first.
+  if (toolbox) {
+    parts.push(
+      `<script type="module">import { ensureToolbox } from "${toolboxUrl}"; ensureToolbox();</script>`,
+    );
+  }
   const inject = '\n  ' + parts.join('\n  ');
   const m = /<head[^>]*>/i.exec(html);
   if (m) return html.slice(0, m.index + m[0].length) + inject + html.slice(m.index + m[0].length);

package/lib/static-server.mjs

@@ -12,7 +12,7 @@ import http from 'node:http';
 import { EventEmitter } from 'node:events';
 import { readdirSync, readFileSync, statSync, existsSync } from 'node:fs';
 import { extname, join, normalize, sep } from 'node:path';
-import { injectHeadTags, rewriteHtmlScripts, rewriteJsImports, PLATFORM_URL } from './inject.mjs';
+import { injectHeadTags, rewriteHtmlScripts, rewriteJsImports, PLATFORM_URL, TOOLBOX_URL } from './inject.mjs';
 import { WHOAMI_PATH } from './ports.mjs';
 
 const RELOAD_CLIENT = `<script>
@@ -158,7 +158,7 @@ export function createStaticServer({
     // the only page that gets the platform layer there. Injecting it into every
     // HTML file the dev server happens to serve puts the boot gate, the loading
     // curtain and the M-key menu on top of pages that are not games and cannot
-    // satisfy them — the shared inspector page (/shared/ui/inspector/) renders
+    // satisfy them — the shared inspector page (/shared/ui/assets/) renders
     // its stage underneath a curtain waiting for an identity it never asked for.
     const m = /^\/games\/([^/]+)\//.exec(urlPath);
     if (m && resolveUrl(PLATFORM_URL)) {
@@ -171,7 +171,11 @@ export function createStaticServer({
       const tabIdentity = as
         ? { userId: `dev-local-${as}`, name: as, color: '#f472b6' }
         : identity;
-      html = injectHeadTags(html, m[1], tabIdentity ? { identity: tabIdentity } : {});
+      // The toolbox rides only when the resolved engine carries it — an older
+      // pinned engine gets no 404ing tag (it gains the toolbox at `looop
+      // update`). Per-request, so a bundle swap mid-session is honoured.
+      const toolbox = !!resolveUrl(TOOLBOX_URL);
+      html = injectHeadTags(html, m[1], { ...(tabIdentity ? { identity: tabIdentity } : {}), toolbox });
     }
     if (injectReload) {
       html = html.includes('</body>') ? html.replace('</body>', RELOAD_CLIENT + '</body>') : html + RELOAD_CLIENT;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@looop-games/cli",
-  "version": "0.1.26",
+  "version": "0.1.27",
   "description": "Looop game development CLI — dev server, login, and publishing for standalone Looop games.",
   "type": "module",
   "license": "Apache-2.0",