@looop-games/cli 0.1.3 → 0.1.4

package/lib/create.mjs

@@ -35,7 +35,11 @@ const NAME_OK = /^[a-z0-9][a-z0-9-]{0,40}$/;
 // esbuild/workerd pins between releases, and a version-pinned approval would
 // quietly stop covering them on the next bump — the same silent breakage,
 // later. Caught by our first Windows creator, 2026-07-11.
-const ALLOW_SCRIPTS = { esbuild: true, workerd: true };
+// fsevents is macOS-only (an optional dep of the file watchers) — it never
+// installs on Windows, so the entry is simply unused there. Approving it
+// keeps a Mac creator's first install warning-free, and under npm 12 keeps
+// the watcher on native FSEvents instead of silently degrading to polling.
+const ALLOW_SCRIPTS = { esbuild: true, workerd: true, fsevents: true };
 
 // Smokes drive a real browser, so playwright ships in every scaffold's
 // devDependencies and the Chromium binary is fetched at create time — a

package/lib/create.test.mjs

@@ -94,6 +94,10 @@ test('scaffolds a complete standalone game folder', async () => {
   // strict npm, 2026-07-11.
   assert.equal(pkg.allowScripts.esbuild, true, 'esbuild postinstall pre-approved (native binary)');
   assert.equal(pkg.allowScripts.workerd, true, 'workerd postinstall pre-approved (native binary)');
+  // macOS-only optional dep of the watchers; unused on Windows. Verified
+  // against a real npm 11 install of the published scaffold: with these three
+  // the install is warning-free on every platform.
+  assert.equal(pkg.allowScripts.fsevents, true, 'fsevents postinstall pre-approved (mac watcher)');
 
   // The agent-facing surface: instructions + a pointer at the practices docs
   // that ship inside the installed engine bundle.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@looop-games/cli",
-  "version": "0.1.3",
+  "version": "0.1.4",
   "description": "Looop game development CLI — dev server, login, and publishing for standalone Looop games.",
   "type": "module",
   "license": "Apache-2.0",

package/template/AGENTS.md

@@ -28,13 +28,19 @@ applies. This table routes only what has no skill:
 - `npx looop dev` — the full local stack: the game at
   http://localhost:8000/games/{{name}}/index.html, multiplayer on :1999,
   platform services (LLM etc.) on :8788. Leave it running; edits hot-reload.
+  **On a new machine the first `dev` signs the creator in: a browser window
+  opens, they log in and click Approve (~30 seconds, once per machine). Tell
+  them it's coming BEFORE you run it** — an unexplained browser popup mid-build
+  reads as something going wrong.
 - `npx looop test` — the per-change gate: runs every `*.test.mjs` (unit, under
   node) and every `*.smoke.mjs` (against a real dev stack it boots itself on
   free ports) in this folder.
 - `npx looop login` — connect this machine to the creator's Looop account
   (once per machine; the first `looop dev` runs it automatically).
 - `npx looop publish` — ship to https://play.looop.games/g/{{name}}.
-  `--slug <alt>` publishes an A/B copy without touching the live game.
+  **The first publish permanently claims the name `{{name}}` for the creator's
+  account** — from then on only they can update it. `--slug <alt>` publishes an
+  A/B copy without touching the live game.
 
 ## The rules that are physics (not preference)