@looop-games/cli 0.1.4 → 0.1.5

package/lib/create.test.mjs

@@ -1,433 +0,0 @@
-// `looop create <name>` — the create-next-app gesture (cuqfzo Slice 4): one
-// command produces a standalone game folder where `dev` immediately serves a
-// working multiplayer game. Pins the scaffold contract: a real MP template
-// (imports the room client), a package.json depending on @looop-games/cli
-// (the engine is NOT an npm dependency — Q4 revision: `looop dev` installs it
-// from the platform's login-gated registry via ensureEngine), agent
-// instructions, and a slug-safe name. The full install-and-boot path is
-// covered by packed-install.smoke.mjs.
-import { test, after } from 'node:test';
-import assert from 'node:assert/strict';
-import { execFileSync } from 'node:child_process';
-import { mkdtempSync, rmSync, readFileSync, existsSync, readdirSync, lstatSync } from 'node:fs';
-import { tmpdir } from 'node:os';
-import { join, relative } from 'node:path';
-import { create, TEMPLATE_DIR } from './create.mjs';
-
-const base = mkdtempSync(join(tmpdir(), 'looop-create-'));
-after(() => rmSync(base, { recursive: true, force: true }));
-
-// Hermetic: create() now resolves the engine pin from the platform — point
-// every test at a dead port (instant refusal → the warn-fallback path).
-// Tests that exercise the pin itself pass an explicit mock apiBase.
-process.env.LOOOP_API_BASE = 'http://127.0.0.1:1';
-
-// The scaffold is an on-disk template FOLDER (cuqfzo creator-harness Slice 1),
-// not template strings in code — Fran edits it as normal files. `create`
-// copies it with a {{name}} substitution pass; `gitignore` is stored dot-less
-// (npm pack silently strips .gitignore files) and renamed on copy.
-test('the scaffold is a faithful copy of the on-disk template folder', async () => {
-  const { dir } = await create({ name: 'from-template', cwd: base, install: false, log: () => {} });
-
-  const walk = (d) =>
-    readdirSync(d, { withFileTypes: true, recursive: true })
-      .filter((e) => e.isFile())
-      .map((e) => relative(d, join(e.parentPath, e.name)));
-
-  for (const file of walk(TEMPLATE_DIR)) {
-    const dest = file === 'gitignore' ? '.gitignore' : file;
-    assert.ok(existsSync(join(dir, dest)), `template file ${file} lands in the scaffold as ${dest}`);
-    const rendered = readFileSync(join(dir, dest), 'utf8');
-    assert.ok(!rendered.includes('{{name}}'), `${dest} has no unsubstituted {{name}} placeholders`);
-    const source = readFileSync(join(TEMPLATE_DIR, file), 'utf8');
-    assert.equal(rendered, source.replaceAll('{{name}}', 'from-template'), `${dest} is the template modulo substitution`);
-  }
-  // No stray dot-less gitignore in the scaffold.
-  assert.ok(!existsSync(join(dir, 'gitignore')));
-});
-
-test('the template folder ships in the npm package (files list)', () => {
-  const pkg = JSON.parse(readFileSync(join(TEMPLATE_DIR, '..', 'package.json'), 'utf8'));
-  assert.ok(pkg.files.includes('template'), 'npm pack must carry template/ or the published CLI scaffolds nothing');
-});
-
-test('scaffolds a complete standalone game folder', async () => {
-  const { dir } = await create({ name: 'tower-jump', cwd: base, install: false, log: () => {} });
-  assert.equal(dir, join(base, 'tower-jump'));
-
-  const html = readFileSync(join(dir, 'index.html'), 'utf8');
-  assert.match(html, /<title>tower-jump<\/title>/);
-
-  // The mobile baseline (architecture.md "Mobile baseline (every game)") is
-  // REQUIRED boilerplate the template must carry — without it every phone
-  // build double-tap-zooms and finger-drag-selects the HUD. All four items:
-  assert.match(html, /maximum-scale=1\.0, user-scalable=no, viewport-fit=cover/, '1: locked viewport');
-  assert.match(html, /touch-action: manipulation/, '2: no double-tap zoom on the chrome');
-  assert.match(html, /gesturestart/, '3: iOS gesture-zoom blocked in JS');
-  assert.match(html, /\*\s*\{[^}]*user-select: none/, '4: text selection killed on every element');
-  assert.match(html, /input, textarea[^}]*user-select: text/, '4b: typeable fields stay selectable');
-  const js = readFileSync(join(dir, 'game.js'), 'utf8');
-  assert.match(js, /from '\/shared\/ui\/room\/client\.js'/); // real multiplayer from minute one
-
-  const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
-  assert.equal(pkg.name, 'tower-jump');
-  assert.equal(pkg.private, true);
-  // Q4 revision: the engine is not an npm package — no dependency on it.
-  // ensureEngine() installs it at first `looop dev` (login-gated) and writes
-  // the `looop.engine` pin then.
-  assert.equal(pkg.dependencies, undefined);
-  assert.ok(pkg.devDependencies['@looop-games/cli']);
-  // Smokes need a real browser: playwright ships with every scaffold and
-  // create pre-fetches Chromium — never a surprise mid-build install
-  // (caught in Fran's manual e2e, 2026-07-10).
-  assert.ok(pkg.devDependencies.playwright, 'playwright is a scaffold devDependency');
-  assert.match(pkg.scripts.dev, /looop dev/);
-  assert.match(pkg.scripts.publish, /looop publish/);
-
-  // npm is moving install scripts to opt-in (npm 11 warns, npm 12 SKIPS them
-  // by default). esbuild and workerd download their native binaries in a
-  // postinstall — skip those and `looop dev` cannot start, with no obvious
-  // cause. The scaffold ships the approval so a stranger's first install is
-  // clean on any npm. Name-only (unpinned) entries: partykit moves its
-  // esbuild/workerd pins between releases, and a version-pinned approval
-  // would silently stop covering them. Reported by a Windows creator with a
-  // strict npm, 2026-07-11.
-  assert.equal(pkg.allowScripts.esbuild, true, 'esbuild postinstall pre-approved (native binary)');
-  assert.equal(pkg.allowScripts.workerd, true, 'workerd postinstall pre-approved (native binary)');
-  // macOS-only optional dep of the watchers; unused on Windows. Verified
-  // against a real npm 11 install of the published scaffold: with these three
-  // the install is warning-free on every platform.
-  assert.equal(pkg.allowScripts.fsevents, true, 'fsevents postinstall pre-approved (mac watcher)');
-
-  // The agent-facing surface: instructions + a pointer at the practices docs
-  // that ship inside the installed engine bundle.
-  const agents = readFileSync(join(dir, 'AGENTS.md'), 'utf8');
-  assert.match(agents, /looop dev/);
-  assert.match(agents, /overrides\/shared\//);
-  assert.match(agents, /node_modules\/@looop-games\/engine\/shared\/practices/);
-
-  assert.match(readFileSync(join(dir, '.gitignore'), 'utf8'), /node_modules/);
-});
-
-test('scaffolds the agent surface for every vendor (no plugin needed — Q4 addendum)', async () => {
-  const { dir } = await create({ name: 'multi-agent', cwd: base, install: false, log: () => {} });
-
-  // AGENTS.md is canonical; CLAUDE.md and GEMINI.md are thin pointers that
-  // inline it (@import) with a plain-text fallback line for tools without
-  // import support.
-  for (const pointer of ['CLAUDE.md', 'GEMINI.md']) {
-    const text = readFileSync(join(dir, pointer), 'utf8');
-    assert.match(text, /^@AGENTS\.md$/m, `${pointer} imports AGENTS.md`);
-    assert.match(text, /read .*AGENTS\.md/i, `${pointer} has the fallback instruction`);
-  }
-
-  // The scaffold's .gitignore must NOT swallow the agent files.
-  const ignore = readFileSync(join(dir, '.gitignore'), 'utf8');
-  assert.ok(!/\.claude/.test(ignore), '.claude/skills travels with the repo');
-});
-
-// The creator harness (cuqfzo creator-harness Slice 1, decisions Q2–Q7):
-// Layer 0 AGENTS.md with managed-section markers + routing table, the SIX
-// skills, and the handbook/ seed. This is the product surface a creator's
-// agent runs on — the contract below is what the Slice-2 updater and the
-// friends' cutover depend on.
-test('Layer 0: AGENTS.md has managed-section markers and the routing table', async () => {
-  const { dir } = await create({ name: 'layer-zero', cwd: base, install: false, log: () => {} });
-  const agents = readFileSync(join(dir, 'AGENTS.md'), 'utf8');
-
-  // The exact marker tokens the Slice-2 updater rewrites between — a
-  // creator's own additions outside them must never be clobbered.
-  assert.ok(agents.includes('<!-- looop:managed:start -->'), 'managed-block start marker');
-  assert.ok(agents.includes('<!-- looop:managed:end -->'), 'managed-block end marker');
-  assert.ok(
-    agents.indexOf('<!-- looop:managed:start -->') < agents.indexOf('<!-- looop:managed:end -->'),
-    'markers in order',
-  );
-
-  // Routing lines for the demoted skills (Q6): save, update, feel/tweaks,
-  // overrides — capabilities without a skill MUST be reachable from Layer 0.
-  assert.match(agents, /save/i, 'save routing line');
-  assert.match(agents, /looop\.engine/, 'engine-update routing mentions the version pin');
-  assert.match(agents, /tweaks/, 'feel-tuning routes at the tweaks library');
-  assert.match(agents, /overrides\/shared\//, 'override mechanism reachable from Layer 0');
-
-  // Layer 0 must NOT re-list the skills' triggers — every major agent CLI has
-  // a native skill system and the frontmatter `description` IS the routing
-  // (a second copy in AGENTS.md drifts). One orientation mention of the
-  // skills directory is all that's allowed.
-  assert.ok(!agents.includes('skills/build/SKILL.md'), 'no per-skill routing rows');
-  assert.match(agents, /\.claude\/skills/, 'orientation line names the skills directory');
-});
-
-test('.agents/skills aliases .claude/skills for non-Claude agent CLIs', async () => {
-  // Codex, Gemini/Antigravity, Cursor, and opencode discover project skills
-  // at .agents/skills/ — the scaffold aliases it to the same SKILL.md files
-  // (created at scaffold time; npm pack cannot ship symlinks).
-  const { dir } = await create({ name: 'vendor-skills', cwd: base, install: false, log: () => {} });
-  const link = join(dir, '.agents', 'skills');
-  assert.ok(lstatSync(link).isSymbolicLink(), '.agents/skills is a symlink');
-  assert.deepEqual(
-    readdirSync(link).sort(),
-    readdirSync(join(dir, '.claude', 'skills')).sort(),
-    'both paths expose the same skills',
-  );
-});
-
-test('the six skills ship, correctly named, no more no fewer (Q6 roster)', async () => {
-  const { dir } = await create({ name: 'six-skills', cwd: base, install: false, log: () => {} });
-  const skillsDir = join(dir, '.claude', 'skills');
-  const roster = ['build', 'engine', 'feedback', 'qa', 'todo', 'update-handbook'];
-  assert.deepEqual(readdirSync(skillsDir).sort(), roster, 'exactly the six-skill roster');
-  for (const name of roster) {
-    const text = readFileSync(join(skillsDir, name, 'SKILL.md'), 'utf8');
-    assert.match(text, new RegExp(`^---\\nname: ${name}\\n`), `${name} frontmatter name matches its folder`);
-    assert.match(text, /\ndescription: .+/, `${name} has a trigger description`);
-  }
-});
-
-test('the build loop encodes the locked mechanics (Q3/Q5/Q8)', async () => {
-  const { dir } = await create({ name: 'build-loop', cwd: base, install: false, log: () => {} });
-  const build = readFileSync(join(dir, '.claude', 'skills', 'build', 'SKILL.md'), 'utf8');
-
-  assert.match(build, /plan/i, 'note-anchored: the plan is the spine');
-  assert.match(build, /milestone/i, 'milestone vocabulary');
-  assert.match(build, /step/i, 'step vocabulary');
-  // Save-on-accept / revert-to-last-save — and NO invented git ceremony: the
-  // pre-milestone "checkpoint" commit was struck by Fran (2026-07-10).
-  assert.match(build, /last save/i, 'reject reverts to the last save');
-  assert.ok(!/checkpoint/i.test(build), 'no checkpoint mechanic');
-  assert.match(build, /never publish/i, 'publish is offered, never automatic');
-  assert.match(build, /worktree/i, 'parallel lanes section (Q8)');
-  assert.match(build, /consequence/i, 'PM-register discussion (Q5)');
-  // The discussion is a HARD gate on plan creation, ported from the studio
-  // loop's design-then-execute split (design settles decisions one at a time
-  // with a stated lean and visible lock-in; execution runs only from a
-  // settled plan). Caught in Fran's manual e2e 2026-07-10: a whole plan +
-  // code landed with zero discussion.
-  assert.match(build, /only from a plan whose decisions are settled/i, 'building requires a settled plan');
-  assert.match(build, /one decision per turn/i, 'decisions are posed one at a time');
-  assert.match(build, /problem before the options/i, 'problem explained before options');
-  assert.match(build, /your lean/i, 'a lean is stated with the options');
-  assert.match(build, /locking in/i, 'decisions are locked in visibly');
-  assert.match(build, /never applies when there is no plan yet/i, 'ceremony collapse cannot skip plan creation');
-  // Parity-audit fixes (2026-07-10): the remaining /discuss reflexes + the
-  // scope/lifecycle/lanes gaps the independent audit found.
-  assert.match(build, /re-explain the\s+underlying problem/i, '"I don\'t understand" → back up, not louder');
-  assert.match(build, /case for the other option/i, 'the lean is easy to override');
-  assert.match(build, /## Out of scope/m, 'plan template has a durable Out-of-scope home');
-  assert.match(build, /paused \| abandoned/, 'a plan can be abandoned, distinct from done');
-  assert.match(build, /never auto-resolve/i, 'lane merge conflicts stop for the creator');
-
-  const todo = readFileSync(join(dir, '.claude', 'skills', 'todo', 'SKILL.md'), 'utf8');
-  assert.match(todo, /promoted \| abandoned/, 'todos distinguish won\'t-do from did-it');
-  assert.match(todo, /one-line why/i, 'abandoning requires the why');
-
-  // Review cadence (Fran, 2026-07-10): AUTOMATED steps — including the
-  // review sub-agents — run after EVERY step; only the playtest is
-  // per-milestone. "Milestone-sized reviews" was drift, not a decision.
-  assert.match(build, /step's diff/, 'review sub-agents run on each step\'s diff');
-  assert.match(build, /only the playtest is per-milestone/i, 'the manual gate is the only per-milestone check');
-
-  // Seamless-UX handback (Fran, 2026-07-10): the AGENT runs the dev server;
-  // the creator gets a link to click, never a command to paste.
-  assert.match(build, /you run the server,\s+never the creator/i, 'agent starts/reuses the dev stack itself');
-  assert.match(build, /link to click/i, 'the creator receives a URL, not a command');
-  const qaSkill = readFileSync(join(dir, '.claude', 'skills', 'qa', 'SKILL.md'), 'utf8');
-  assert.match(qaSkill, /already\s+running/i, '/qa manual items run against a live game the agent started');
-});
-
-// The harness core that makes the monorepo loop effective must survive the
-// port IN FULL — the parity gate is the whole point of the workstream. The
-// framework itself (automated-vs-manual, the ratchet, the master steps list
-// incl. the review rows and the generative verdict-mix row) has ONE source of
-// truth: the engine's shared/practices/qa.md, shipped inside the artifact.
-// The skills REFERENCE it — they never restate it (that scatter is exactly
-// what qa.md was created to end). These rows pin the reference shape plus the
-// point-of-use pointers that were once silently dropped.
-test('the harness core survives the port: single source referenced, pointers intact', async () => {
-  const { dir } = await create({ name: 'harness-core', cwd: base, install: false, log: () => {} });
-  const build = readFileSync(join(dir, '.claude', 'skills', 'build', 'SKILL.md'), 'utf8');
-  const qa = readFileSync(join(dir, '.claude', 'skills', 'qa', 'SKILL.md'), 'utf8');
-
-  // Both loop skills anchor on the ONE master doc inside the engine artifact.
-  for (const [name, text] of [['build', build], ['qa', qa]]) {
-    assert.match(text, /engine\/shared\/practices\/qa\.md/, `${name} points at the master QA doc`);
-  }
-  assert.match(qa, /steps live there|never restate/i, '/qa declares the single-source rule');
-  assert.match(qa, /`npx looop test`/, '/qa names the real test gate');
-
-  // Point-of-use pointers in the loop (the rows themselves live in qa.md):
-  // independent review sub-agents + red→green findings + verdict mix.
-  assert.match(build, /sub-agent/i, 'milestone close spawns reviewers');
-  assert.match(build, /code.quality/i, 'names the code-quality review row');
-  assert.match(build, /coverage|test.opportunit|test.thoroughness/i, 'names the test-coverage review row');
-  assert.match(build, /red.*green|failing test.*(first|before)/i, 'findings fixed red→green');
-  assert.match(build, /verdict/i, 'generative verdict-mix pointer at milestone close');
-  assert.match(build, /diagnose/i, 'diagnose before second-guessing a failed fix');
-  assert.match(qa, /sub-agent/i, '/qa maps the review skills to sub-agents');
-});
-
-test('handbook/ seeds ship and /qa + /update-handbook wire the three QA sources (Q7)', async () => {
-  const { dir } = await create({ name: 'handbook-game', cwd: base, install: false, log: () => {} });
-  for (const f of ['qa.md', 'feel.md', 'design.md']) {
-    assert.ok(existsSync(join(dir, 'handbook', f)), `handbook/${f} seeded`);
-  }
-
-  const qa = readFileSync(join(dir, '.claude', 'skills', 'qa', 'SKILL.md'), 'utf8');
-  assert.match(qa, /looop test/, 'source 1: executable files via looop test');
-  assert.match(qa, /handbook\/qa\.md/, 'source 2: the game handbook');
-  assert.match(qa, /engine\/shared\/practices\/qa\.md/, 'source 3: the engine master list');
-
-  const ratchet = readFileSync(join(dir, '.claude', 'skills', 'update-handbook', 'SKILL.md'), 'utf8');
-  assert.match(ratchet, /handbook\/qa\.md/, 'ratchet writes game QA steps');
-  assert.match(ratchet, /feedback/i, 'generic holes route upstream via /feedback');
-  // The handbook is the CREATOR's truth — writes are proposed and approved,
-  // never slipped in as a side effect (Fran, 2026-07-10).
-  assert.match(ratchet, /approval first/i, 'handbook writes gated on creator approval');
-});
-
-// /feedback has a REAL transport (`looop feedback` → /api/creator/feedback),
-// and the report is agent-authored: maximal detail, verbatim output, and the
-// conversation transcript — the Looop team can't ask the session follow-ups.
-test('the feedback skill sends via looop feedback and demands the full evidence', async () => {
-  const { dir } = await create({ name: 'feedback-game', cwd: base, install: false, log: () => {} });
-  const fb = readFileSync(join(dir, '.claude', 'skills', 'feedback', 'SKILL.md'), 'utf8');
-
-  assert.match(fb, /npx looop feedback/, 'sends through the real CLI transport');
-  assert.ok(!/however they normally reach them/.test(fb), 'the interim manual transport is gone');
-  assert.match(fb, /## Transcript/m, 'the report carries the conversation transcript');
-  assert.match(fb, /verbatim/i, 'output is pasted verbatim, never summarized');
-  assert.match(fb, /sent:/, 'documents the sent-stamp so reports never ship twice');
-});
-
-// Every notes/ file is datetime-prefixed so the tree lists in creation order
-// and "the latest plan" is findable at a glance (Fran, 2026-07-10 — a flat
-// slug like iso-view.md is unsortable once notes accumulate).
-test('note-writing skills mandate the datetime filename prefix', async () => {
-  const { dir } = await create({ name: 'ordered-notes', cwd: base, install: false, log: () => {} });
-  for (const [skill, tree] of [['build', 'plans'], ['todo', 'todos'], ['feedback', 'feedback']]) {
-    const text = readFileSync(join(dir, '.claude', 'skills', skill, 'SKILL.md'), 'utf8');
-    assert.match(
-      text,
-      new RegExp(`notes/${tree}/<YYYY-MM-DD-HHMM>-`),
-      `${skill} names its notes/${tree} files datetime-first`,
-    );
-  }
-});
-
-// The engine pin is resolved AT CREATE TIME from the public version-list
-// endpoint and lands INSIDE the initial commit — the milestone-1 revert
-// baseline. Without this, first dev wrote the pin after the baseline: fresh
-// repos started dirty, and a milestone-1 reject deleted the pin so the next
-// dev could silently resolve a NEWER engine (caught in Fran's manual e2e,
-// 2026-07-10).
-test('create resolves the engine pin into the initial commit; reverts keep it', async (t) => {
-  const http = await import('node:http');
-  const server = http.createServer((req, res) => {
-    res.writeHead(200, { 'Content-Type': 'application/json' });
-    res.end(JSON.stringify(req.url === '/api/creator/engine' ? { versions: ['0.7.3'], latest: '0.7.3' } : {}));
-  });
-  await new Promise((r) => server.listen(0, r));
-  t.after(() => server.close());
-
-  const { dir } = await create({
-    name: 'pinned-game',
-    cwd: base,
-    install: false,
-    apiBase: `http://localhost:${server.address().port}`,
-    log: () => {},
-  });
-  const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
-  assert.equal(pkg.looop.engine, '0.7.3', 'pin written at create');
-
-  // The pin is IN the baseline commit, so reset --hard can never drop it.
-  const shown = execFileSync('git', ['show', 'HEAD:package.json'], { cwd: dir, encoding: 'utf8' });
-  assert.match(shown, /"engine": "0\.7\.3"/, 'initial commit carries the pin');
-  execFileSync('git', ['reset', '--hard', 'HEAD'], { cwd: dir });
-  const after = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
-  assert.equal(after.looop.engine, '0.7.3', 'revert-to-baseline preserves the pin');
-});
-
-test('an unreachable platform degrades to the old pin-at-first-dev behavior', async () => {
-  const logs = [];
-  const { dir } = await create({ name: 'offline-game', cwd: base, install: false, log: (m) => logs.push(m) });
-  const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
-  assert.equal(pkg.looop, undefined, 'no pin when the lookup fails');
-  assert.match(logs.join('\n'), /Could not resolve the engine version/, 'the fallback is loud');
-});
-
-test('the CLI dependency spec is overridable for tarball installs (the smoke path)', async () => {
-  const { dir } = await create({
-    name: 'spec-game',
-    cwd: base,
-    install: false,
-    cliSpec: 'file:../cli.tgz',
-    log: () => {},
-  });
-  const pkg = JSON.parse(readFileSync(join(dir, 'package.json'), 'utf8'));
-  assert.equal(pkg.devDependencies['@looop-games/cli'], 'file:../cli.tgz');
-});
-
-// The initial commit is the revert baseline: reject-milestone-1 resets to it,
-// and `git worktree add` (parallel lanes) needs a commit to exist — on a
-// never-committed repo it silently creates an empty orphan lane.
-test('create leaves the scaffold fully committed (the first revert baseline)', async () => {
-  const { dir } = await create({ name: 'baseline', cwd: base, install: false, log: () => {} });
-  const log = execFileSync('git', ['log', '--oneline'], { cwd: dir }).toString().trim().split('\n');
-  assert.equal(log.length, 1, 'exactly one commit');
-  const status = execFileSync('git', ['status', '--porcelain'], { cwd: dir }).toString().trim();
-  assert.equal(status, '', 'nothing left uncommitted');
-});
-
-// A stranger who runs `npx looop create` gets the template AND the practices
-// docs inside the engine artifact. They have never heard of the studio, its
-// monorepo, its CLI, its games, or its people — any mention is a leak (Fran,
-// 2026-07-10: "if they read about the monorepo, it's an issue"). Studio-side
-// content lives in shared/notes/guides/ (never shipped), not here.
-test('no studio leaks in any surface a stranger receives', () => {
-  const engineRoot = join(TEMPLATE_DIR, '..', '..', '..');
-  const shipped = [];
-  const collect = (d) => {
-    for (const e of readdirSync(d, { withFileTypes: true, recursive: true })) {
-      if (e.isFile()) shipped.push(join(e.parentPath, e.name));
-    }
-  };
-  collect(TEMPLATE_DIR);
-  collect(join(engineRoot, 'shared', 'practices'));
-  shipped.push(join(engineRoot, 'shared', 'ui', 'INDEX.md'));
-
-  const FORBIDDEN = [
-    /`gamedev|gamedev </i, // the studio's internal CLI ("gamedev literature" prose is fine)
-    /\bFran\b/,            // the studio's human
-    /monorepo/i,           // the workspace the reader must never learn exists
-    /studio/i,             // "the studio" / "studio-only" dual-world framing
-    /harness-improvement/, // studio-only skills
-    /import-game/,
-    /`\/primitives`/,
-    /looop-ugc|looop-boxeo/, // studio partykit deploy names
-    /looop-core|looop-games\/games\//, // sibling-repo paths (@looop-games/* npm scope is fine)
-    /new_game\.py|catalog_publish\.py/, // studio tool paths
-    /shared\/notes\//,     // the studio notes tree (not in the artifact)
-  ];
-  // Studio game names: banned in the practices docs (there they were
-  // references the reader can't open); allowed as plain DATA elsewhere —
-  // INDEX.md's used_by column, and template game.js's generic "a tiny
-  // multiplayer plaza".
-  const PRACTICES_ONLY = [/mp-lab|escaleras|piso-20|booox|wordsmith|survivors|amnesia|\bagora\b|\bplaza\b/];
-
-  for (const file of shipped) {
-    const text = readFileSync(file, 'utf8');
-    const extra = file.includes(`${join('shared', 'practices')}`) ? PRACTICES_ONLY : [];
-    for (const re of [...FORBIDDEN, ...extra]) {
-      const m = text.match(re);
-      assert.ok(!m, `${relative(engineRoot, file)} leaks "${m?.[0]}" (${re})`);
-    }
-  }
-});
-
-test('rejects slug-unsafe names and existing folders', async () => {
-  await assert.rejects(() => create({ name: 'My Game!', cwd: base, install: false, log: () => {} }), /letters/);
-  await create({ name: 'dupe', cwd: base, install: false, log: () => {} });
-  await assert.rejects(() => create({ name: 'dupe', cwd: base, install: false, log: () => {} }), /exists/);
-  assert.ok(existsSync(join(base, 'dupe')));
-});

package/lib/dev.test.mjs

@@ -1,52 +0,0 @@
-// Per-game server parity (cuqfzo Phase 4, dev half): a game that ships its
-// own `partykit.json` gets its OWN server in `looop dev` — partykit runs with
-// the game folder as cwd (resolving the game's `main` entry, which imports
-// the room server from the installed engine). A game without one rides the
-// bundle's shared room server, exactly as before. This mirrors the monorepo's
-// dev.sh detection, so a vendor-flipped game behaves identically standalone.
-
-import { test } from 'node:test';
-import assert from 'node:assert/strict';
-import { mkdtempSync, writeFileSync, rmSync } from 'node:fs';
-import { join } from 'node:path';
-import { tmpdir } from 'node:os';
-import { partykitCwdFor } from './dev.mjs';
-
-function tempGameDir(withPartykit) {
-  const dir = mkdtempSync(join(tmpdir(), 'looop-devtest-'));
-  writeFileSync(join(dir, 'index.html'), '<canvas></canvas>');
-  if (withPartykit) {
-    writeFileSync(join(dir, 'partykit.json'), JSON.stringify({ name: 'mygame', main: 'server.js' }));
-    writeFileSync(join(dir, 'server.js'), 'export { default } from "@looop-games/engine/shared/ui/room/server.js";');
-  }
-  return dir;
-}
-
-test('game WITHOUT partykit.json → partykit runs on the bundle room server', () => {
-  const dir = tempGameDir(false);
-  try {
-    const cwd = partykitCwdFor({ dir }, { roomServerDir: '/engine/room' });
-    assert.equal(cwd, '/engine/room');
-  } finally { rmSync(dir, { recursive: true, force: true }); }
-});
-
-test('game WITH partykit.json → partykit runs on the GAME folder (its own server)', () => {
-  const dir = tempGameDir(true);
-  try {
-    const cwd = partykitCwdFor({ dir }, { roomServerDir: '/engine/room' });
-    assert.equal(cwd, dir);
-  } finally { rmSync(dir, { recursive: true, force: true }); }
-});
-
-test('a partykit.json without a resolvable main is IGNORED (falls back to the bundle, loudly)', () => {
-  // A dead config must not silently break dev — the room server the game
-  // actually reaches should still exist.
-  const dir = tempGameDir(false);
-  writeFileSync(join(dir, 'partykit.json'), JSON.stringify({ name: 'mygame', main: 'missing.js' }));
-  try {
-    const warnings = [];
-    const cwd = partykitCwdFor({ dir }, { roomServerDir: '/engine/room' }, (m) => warnings.push(m));
-    assert.equal(cwd, '/engine/room');
-    assert.ok(warnings.some((w) => /missing\.js/.test(w)), 'warns about the dead entry');
-  } finally { rmSync(dir, { recursive: true, force: true }); }
-});