@looop-games/cli 0.1.32 → 0.1.34

package/CHANGELOG.md

@@ -14,6 +14,27 @@ Versions: [Semantic Versioning](https://semver.org/spec/v2.0.0.html).
 
 ## [Unreleased]
 
+## [0.1.34] - 2026-09-02
+
+### Fixed
+
+- `looop test` on Windows no longer discovers and runs the engine's own scaffold smokes from `node_modules` (or anything under `overrides/` and dot-folders). The gate could never go green there because those smokes always failed; it now runs only your game's tests, as on macOS and Linux. A test filter typed as `sub/depth` also matches on Windows now.
+- `looop dev`, `looop test` and `looop publish` on Windows no longer fail with `Could not resolve "./entitiessaucer.js"` when a game has entity kinds: the generated room module now writes import paths with forward slashes whichever engine version produced them.
+
+## [0.1.33] - 2026-08-27
+
+### Added
+- **The dev server now carries an agent inbox** — `POST /__looop/agent-inbox`.
+  Dev tools in the running game (starting with the Performance tool's "Send to
+  agent" button) can ship a JSON report out of the browser; it lands as one
+  file under your game's `.looop/agent-inbox/` and prints one line in the
+  `looop dev` terminal. That folder is where your agent looks when you send it
+  something from inside the game — it ignores itself in git, so reports never
+  clutter `git status`. Only pages served by your own dev server can write to
+  it (cross-origin posts from other websites are refused), and single reports
+  are capped at 2 MB. There's no cleanup/rotation yet — reports are small and
+  yours to delete.
+
 ## [0.1.32] - 2026-08-23
 
 ### Fixed

package/lib/dev.mjs

@@ -145,6 +145,7 @@ export async function dev({ cwd = process.cwd(), port, noMp = process.env.NO_MP
   const staticServer = createStaticServer({
     slug: project.slug,
     projectDir: project.dir, // answers /__looop/whoami — see ports.mjs
+    log, // agent-inbox report lines ride the dev logger
     mounts: [
       { url: `/games/${project.slug}/`, dir: project.dir },
       { url: '/shared/', dir: generatedOverridesDir },

package/lib/room-server.mjs

@@ -155,7 +155,19 @@ export function renderEntityComponents(components) {
 // generated entry to wrap. Kept as one function so the kind-aliasing, the
 // `./world.js` root convention, and the assemble→lower call can never drift
 // between the dev and publish builds.
-function renderV2Preamble(skeleton) {
+// A relative path with forward slashes whichever host produced it.
+const posixPath = (p) => p.split('\\').join('/');
+
+function renderV2Preamble(raw) {
+  // Kind modules are game-relative paths the engine relativized on the
+  // creator's machine. An engine whose framework build predates the
+  // forward-slash fix emits them with the host separator, so on Windows they
+  // arrive as `entities\saucer.js`. Dropped raw into a string literal, `\s` is
+  // an escape sequence and esbuild looks for `./entitiessaucer.js`. The CLI and
+  // the engine ship separately, so a fixed CLI on an unfixed engine is a real
+  // pairing; import specifiers and the URLs the client's kind loader builds
+  // from the embedded skeleton are always forward-slash, so normalize both.
+  const skeleton = { ...raw, kinds: raw.kinds.map((k) => ({ ...k, module: posixPath(k.module) })) };
   const imports = skeleton.kinds.map(
     (k, i) => `import { ${k.name} as K${i} } from './${k.module}';`,
   );

package/lib/static-server.mjs

@@ -10,7 +10,7 @@
 // overrides dir mounts at /shared/ ahead of the bundle.
 import http from 'node:http';
 import { EventEmitter } from 'node:events';
-import { readdirSync, readFileSync, statSync, existsSync } from 'node:fs';
+import { readdirSync, readFileSync, statSync, existsSync, mkdirSync, writeFileSync } from 'node:fs';
 import { extname, join, normalize, sep } from 'node:path';
 import { injectHeadTags, rewriteHtmlScripts, rewriteJsImports, PLATFORM_URL, TOOLBOX_URL } from './inject.mjs';
 import { WHOAMI_PATH } from './ports.mjs';
@@ -34,6 +34,12 @@ const RELOAD_CLIENT = `<script>
 
 const WATCH_EXTS = new Set(['.html', '.css', '.js', '.mjs', '.json', '.svg', '.png', '.jpg', '.jpeg', '.gif', '.webp']);
 
+// The toolbox → agent report channel (see handleAgentInbox below). The path is
+// a contract with the toolbox shell's ctx.toAgent(); the cap keeps a runaway
+// payload from filling the disk — reports are small JSON summaries.
+export const AGENT_INBOX_PATH = '/__looop/agent-inbox';
+const AGENT_INBOX_MAX_BYTES = 2 * 1024 * 1024;
+
 const MIME = {
   '.html': 'text/html; charset=utf-8',
   '.js': 'text/javascript; charset=utf-8',
@@ -102,6 +108,7 @@ export function createStaticServer({
   injectReload = true,
   watchIntervalMs = 400,
   identity,
+  log = console.log,
   // A framework-v2 game's lowered skeleton — injected into the entry HTML as an
   // import map + globalThis.__LOOOP_SKELETON__ so startGame() can boot. Null for
   // a v1 game (no bare `looop` import, no skeleton).
@@ -234,10 +241,91 @@ export function createStaticServer({
     });
   }
 
+  // The agent inbox — the write half of the toolbox → agent channel (project
+  // note nf7zwa). A dev tool in the running game POSTs an envelope
+  // ({ tool, at, payload }, stamped by the toolbox shell); it lands as ONE file
+  // in <projectDir>/.looop/agent-inbox/ and prints one summary line. The file
+  // is the load-bearing sink: the agent working on this game usually does NOT
+  // hold the dev-server terminal, so stdout alone would be invisible to it.
+  // The mailbox dir ignores itself (a `.gitignore` of `*` inside it), so
+  // reports never show up in the creator's `git status` whatever repo shape
+  // the game has.
+  function handleAgentInbox(req, res) {
+    if (req.method !== 'POST') {
+      res.writeHead(405, { 'Content-Type': 'text/plain', Allow: 'POST' });
+      return res.end('POST only');
+    }
+    // Only the page this server itself served may write. A hostile website in
+    // the creator's browser can fire a no-preflight POST at localhost (a CORS
+    // "simple" content-type skips the preflight, and CORS only gates reading
+    // the response, never the server-side write) — and these files are later
+    // read by an AI agent as trusted tool reports, so a foreign page must not
+    // be able to author them. Browsers send Origin on every POST; the real
+    // client is served from this server, so its Origin equals our host.
+    // Non-browser callers (curl, node) send no Origin and pass — same trust
+    // level as anything else already running on the creator's machine/LAN.
+    const origin = req.headers.origin;
+    if (origin && origin !== `http://${req.headers.host}`) {
+      res.writeHead(403, { 'Content-Type': 'text/plain' });
+      return res.end('cross-origin post rejected');
+    }
+    const chunks = [];
+    let size = 0;
+    let overflowed = false;
+    req.on('data', (chunk) => {
+      if (overflowed) return; // draining the rest so the client can read the 413
+      size += chunk.length;
+      if (size > AGENT_INBOX_MAX_BYTES) {
+        overflowed = true;
+        chunks.length = 0;
+        res.writeHead(413, { 'Content-Type': 'text/plain', Connection: 'close' });
+        res.end(`report too large (max ${AGENT_INBOX_MAX_BYTES} bytes)`);
+        return;
+      }
+      chunks.push(chunk);
+    });
+    req.on('end', () => {
+      if (overflowed) return;
+      let envelope;
+      try {
+        envelope = JSON.parse(Buffer.concat(chunks).toString('utf8'));
+      } catch {
+        res.writeHead(400, { 'Content-Type': 'text/plain' });
+        return res.end('body must be JSON');
+      }
+      // The tool id names the file — it must be a plain slug, never a path.
+      const tool = envelope?.tool;
+      if (typeof tool !== 'string' || !/^[a-z0-9][a-z0-9-]{0,39}$/i.test(tool)) {
+        res.writeHead(400, { 'Content-Type': 'text/plain' });
+        return res.end('envelope needs a tool id ([a-z0-9-])');
+      }
+      try {
+        const inboxDir = join(projectDir, '.looop', 'agent-inbox');
+        mkdirSync(inboxDir, { recursive: true });
+        const selfIgnore = join(inboxDir, '.gitignore');
+        if (!existsSync(selfIgnore)) writeFileSync(selfIgnore, '*\n');
+        const d = new Date();
+        const p = (n, w = 2) => String(n).padStart(w, '0');
+        const stamp = `${d.getFullYear()}-${p(d.getMonth() + 1)}-${p(d.getDate())}-${p(d.getHours())}-${p(d.getMinutes())}-${p(d.getSeconds())}-${p(d.getMilliseconds(), 3)}`;
+        let file = join(inboxDir, `${stamp}-${tool}.json`);
+        for (let n = 2; existsSync(file); n += 1) file = join(inboxDir, `${stamp}-${tool}-${n}.json`);
+        writeFileSync(file, JSON.stringify(envelope, null, 2) + '\n');
+        log(`agent-inbox: ${tool} (${(size / 1024).toFixed(1)} KB) → ${file}`);
+        sendBody(res, 200, JSON.stringify({ ok: true, file }), 'application/json');
+      } catch (err) {
+        res.writeHead(500, { 'Content-Type': 'text/plain' });
+        res.end(`agent-inbox write failed: ${err?.message ?? err}`);
+      }
+    });
+  }
+
   const server = http.createServer((req, res) => {
     const reqUrl = new URL(req.url, 'http://x');
     const urlPath = reqUrl.pathname;
     if (urlPath === '/__reload') return handleSse(res);
+    // Without a projectDir there is nowhere to land a report — the route
+    // simply doesn't exist (falls through to 404), same as any unknown path.
+    if (urlPath === AGENT_INBOX_PATH && projectDir) return handleAgentInbox(req, res);
     // Ownership probe (ports.mjs): "whose dev server is this?". It is what lets
     // another `looop dev` — a lane, another game — tell OUR stale server (kill
     // and reclaim) from a live one that belongs to somebody else (step around,

package/lib/test-cmd.mjs

@@ -10,7 +10,7 @@
 import { spawn } from 'node:child_process';
 import { existsSync, readdirSync, readFileSync } from 'node:fs';
 import { createRequire } from 'node:module';
-import { join, relative, dirname } from 'node:path';
+import nodePath, { join, relative, dirname } from 'node:path';
 import { pathToFileURL } from 'node:url';
 import { findProject, resolveEngine } from './project.mjs';
 import { dev } from './dev.mjs';
@@ -19,16 +19,31 @@ import { portsFor, portInUse } from './ports.mjs';
 
 const SKIP_DIRS = new Set(['node_modules', 'overrides']);
 
-export function discoverTestFiles(dir) {
+// Whether a game-relative path lies under a directory discovery must ignore:
+// dependencies (the engine ships its own scaffold smokes under node_modules),
+// engine-override copies, and dot-directories. `path.relative()` returns
+// backslash-separated paths on Windows, so the split accepts both separators —
+// splitting on '/' alone yields one giant segment there and skips nothing.
+export function isSkippedPath(rel) {
+  return rel.split(/[\\/]/).some((p) => SKIP_DIRS.has(p) || p.startsWith('.'));
+}
+
+// The game-relative path with forward slashes on every platform, so a filter
+// the creator types as `sub/depth` matches on Windows too. The path module is
+// injectable so the Windows form can be produced on any host.
+export const posixRelative = (dir, file, p = nodePath) => p.relative(dir, file).split('\\').join('/');
+
+// The path module is injectable for the same reason: with `path.win32` the
+// real readdir → join → relative → skip chain runs with Windows semantics
+// against real files, on any host.
+export function discoverTestFiles(dir, { path: p = nodePath } = {}) {
   const unit = [];
   const smokes = [];
   const entries = readdirSync(dir, { withFileTypes: true, recursive: true });
   for (const entry of entries) {
     if (!entry.isFile()) continue;
-    const path = join(entry.parentPath, entry.name);
-    const rel = relative(dir, path);
-    const parts = rel.split('/');
-    if (parts.some((p) => SKIP_DIRS.has(p) || p.startsWith('.'))) continue;
+    const path = p.join(entry.parentPath, entry.name);
+    if (isSkippedPath(p.relative(dir, path))) continue;
     if (entry.name.endsWith('.test.mjs')) unit.push(path);
     else if (entry.name.endsWith('.smoke.mjs')) smokes.push(path);
   }
@@ -98,7 +113,7 @@ export async function testCmd({ cwd = process.cwd(), log = console.log, devFn =
   // milestone close and before publish (qa.md T3). With no pattern, everything
   // runs, exactly as before.
   const scoped = patterns.length > 0;
-  const matches = (f) => patterns.some((p) => relative(project.dir, f).includes(p));
+  const matches = (f) => patterns.some((p) => posixRelative(project.dir, f).includes(p));
   const unit = scoped ? all.unit.filter(matches) : all.unit;
   const smokes = scoped ? all.smokes.filter(matches) : all.smokes;
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@looop-games/cli",
-  "version": "0.1.32",
+  "version": "0.1.34",
   "description": "Looop game development CLI — dev server, login, and publishing for standalone Looop games.",
   "type": "module",
   "license": "Apache-2.0",