@lotics/cli 0.30.0 → 0.30.2

package/dist/src/app_commands.d.ts

@@ -78,6 +78,14 @@ export declare function appCreate(client: LoticsClient, args: {
  *   6. (TODO) Generate `.lotics/types.ts` with workspace tables augmentation —
  *      pending a `client.getWorkspaceSchema()` endpoint.
  */
+/**
+ * `lotics app subdomain <new>` — rename the current app's public address.
+ * The app_id comes from the local `package.json` manifest. The old
+ * `<slug>.lotics.app` stops resolving once the change lands.
+ */
+export declare function appSetSubdomain(client: LoticsClient, args: {
+    subdomain: string;
+}): Promise<void>;
 export declare function appPull(client: LoticsClient, args: {
     app_id: string;
     targetPath?: string;

package/dist/src/app_commands.js

@@ -189,6 +189,16 @@ export async function appCreate(client, args) {
  *   6. (TODO) Generate `.lotics/types.ts` with workspace tables augmentation —
  *      pending a `client.getWorkspaceSchema()` endpoint.
  */
+/**
+ * `lotics app subdomain <new>` — rename the current app's public address.
+ * The app_id comes from the local `package.json` manifest. The old
+ * `<slug>.lotics.app` stops resolving once the change lands.
+ */
+export async function appSetSubdomain(client, args) {
+    const meta = readAppMeta(process.cwd());
+    const result = await client.setAppSubdomain(meta.app_id, args.subdomain);
+    console.error(`Public address set: https://${result.public_subdomain}.lotics.app`);
+}
 export async function appPull(client, args) {
     const app = await client.getApp(args.app_id);
     if (!app.current_version_id) {

package/dist/src/cli.js

@@ -5,7 +5,7 @@ import readline from "node:readline";
 import { LoticsClient, API_BASE_URL } from "./client.js";
 import { resolveAuth, loadConfig, saveConfig, deleteConfig, getConfigPath, checkForUpdate } from "./config.js";
 import { VERSION } from "./version.js";
-import { appCreate, appPull, appDeploy, appDev } from "./app_commands.js";
+import { appCreate, appPull, appDeploy, appDev, appSetSubdomain } from "./app_commands.js";
 import { parseArgs } from "./args.js";
 function printHelp() {
     console.log(`Lotics CLI v${VERSION} — AI agent interface for Lotics
@@ -51,6 +51,7 @@ COMMANDS
                                        Build + upload current dir as a new version
                                        (--force-workflow-sync wipes server-only
                                        workflow aliases; default refuses)
+  lotics app subdomain <new-subdomain> Rename the app's public <slug>.lotics.app address
   lotics app dev [path]                Run the app locally with HMR (RPC forwarded to prod)
 
 FLAGS
@@ -359,6 +360,7 @@ async function main() {
         console.error("  lotics app pull <app_id> [path]      Pull an existing app for local editing");
         console.error("  lotics app deploy [-m <message>] [--force-workflow-sync]");
         console.error("                                       Build + upload the current directory");
+        console.error("  lotics app subdomain <new-subdomain> Rename the app's public <slug>.lotics.app address");
         console.error("  lotics app dev [path]                Run the app locally with HMR + RPC forwarding");
         process.exit(1);
     }
@@ -481,6 +483,16 @@ async function main() {
             await appDeploy(client, { message, forceWorkflowSync: flags.forceWorkflowSync });
             return;
         }
+        if (subcommand === "subdomain") {
+            const newSubdomain = toolArgs;
+            if (!newSubdomain) {
+                console.error("Usage: lotics app subdomain <new-subdomain>");
+                console.error("Renames the app's public address — https://<slug>.lotics.app");
+                process.exit(1);
+            }
+            await appSetSubdomain(client, { subdomain: newSubdomain });
+            return;
+        }
         if (subcommand === "dev") {
             // First positional is an optional project path (defaults to cwd).
             // --port and --vite-port can override the wrapper / Vite ports.

package/dist/src/client.d.ts

@@ -105,6 +105,15 @@ export declare class LoticsClient {
         workspace_id: string;
         current_version_id: string | null;
     }>;
+    /**
+     * Rename an app's public subdomain — its `<slug>.lotics.app` address.
+     * Mirrors PUT /v1/apps/{app_id}/subdomain. The old subdomain stops
+     * resolving once the change lands.
+     */
+    setAppSubdomain(app_id: string, public_subdomain: string): Promise<{
+        app_id: string;
+        public_subdomain: string;
+    }>;
     getAppVersion(app_id: string, version_id: string): Promise<{
         id: string;
         app_id: string;

package/dist/src/client.js

@@ -149,6 +149,14 @@ export class LoticsClient {
     async createApp(body) {
         return this.request("POST", "/v1/apps", { ...body, ui: { type: "custom_code" } });
     }
+    /**
+     * Rename an app's public subdomain — its `<slug>.lotics.app` address.
+     * Mirrors PUT /v1/apps/{app_id}/subdomain. The old subdomain stops
+     * resolving once the change lands.
+     */
+    async setAppSubdomain(app_id, public_subdomain) {
+        return this.request("PUT", `/v1/apps/${encodeURIComponent(app_id)}/subdomain`, { public_subdomain });
+    }
     async getAppVersion(app_id, version_id) {
         return this.request("GET", `/v1/apps/${encodeURIComponent(app_id)}/versions/${encodeURIComponent(version_id)}`);
     }

package/dist/src/dev/server.js

@@ -31,10 +31,19 @@ export async function startDevServer(args) {
     });
     // ── Vite child ──────────────────────────────────────────────────────────
     // `npx vite` resolves to the project's installed Vite (devDependency in
-    // the starter). Inherit stdio so the dev sees Vite's own banner + HMR logs.
+    // the starter). stdout/stderr are inherited so the dev sees Vite's banner
+    // + HMR logs.
+    //
+    // stdin is inherited ONLY under a TTY. Vite's dev server quits when a
+    // non-interactive stdin (a backgrounded launch, `</dev/null`, a closing
+    // pipe) reaches EOF — so inheriting it would kill the dev server the moment
+    // `lotics app dev` runs under an agent, CI, or `nohup`. A non-TTY launch
+    // gets `/dev/null` (`"ignore"`) instead, decoupling Vite's lifetime from
+    // however the wrapper was started. Vite's CLI shortcuts (`r`/`q`/`u`) are
+    // only meaningful under a TTY anyway.
     const viteChild = spawn("npx", ["vite", "--port", String(vitePort), "--strictPort"], {
         cwd: args.projectDir,
-        stdio: "inherit",
+        stdio: [process.stdin.isTTY ? "inherit" : "ignore", "inherit", "inherit"],
         env: { ...process.env, FORCE_COLOR: "1" },
     });
     let stopped = false;

package/dist/src/dev/wrapper_page.d.ts

@@ -2,11 +2,16 @@
  * Builds the wrapper HTML for `lotics app dev`.
  *
  * The wrapper page is served at http://localhost:<port>/ and embeds the
- * project's Vite dev server in a sandboxed iframe with the same
- * sandbox="allow-scripts" attribute production uses. The iframe sends
- * postMessage RPCs to this wrapper, which forwards them to the local
- * /_rpc endpoint, which dispatches to api.lotics.ai with the CLI's API
- * key.
+ * project's Vite dev server in an iframe with the same
+ * sandbox="allow-scripts allow-same-origin" attribute production uses —
+ * safe because the Vite iframe is cross-origin to this wrapper (different
+ * port), so the app gets its own real origin (and Web Storage) without
+ * being able to reach the wrapper. The iframe sends postMessage RPCs to
+ * this wrapper, which forwards them to the local /_rpc endpoint, which
+ * dispatches to api.lotics.ai with the CLI's API key.
+ *
+ * postMessage is origin-locked both ways — the wrapper passes its origin
+ * via `?lotics_host=` and talks only to the Vite origin.
  *
  * Protocol matches `frontend/features/app_ui/app_iframe_host.tsx` exactly:
  *   iframe → wrapper: { id: number, op: string, payload: unknown }

package/dist/src/dev/wrapper_page.js

@@ -2,11 +2,16 @@
  * Builds the wrapper HTML for `lotics app dev`.
  *
  * The wrapper page is served at http://localhost:<port>/ and embeds the
- * project's Vite dev server in a sandboxed iframe with the same
- * sandbox="allow-scripts" attribute production uses. The iframe sends
- * postMessage RPCs to this wrapper, which forwards them to the local
- * /_rpc endpoint, which dispatches to api.lotics.ai with the CLI's API
- * key.
+ * project's Vite dev server in an iframe with the same
+ * sandbox="allow-scripts allow-same-origin" attribute production uses —
+ * safe because the Vite iframe is cross-origin to this wrapper (different
+ * port), so the app gets its own real origin (and Web Storage) without
+ * being able to reach the wrapper. The iframe sends postMessage RPCs to
+ * this wrapper, which forwards them to the local /_rpc endpoint, which
+ * dispatches to api.lotics.ai with the CLI's API key.
+ *
+ * postMessage is origin-locked both ways — the wrapper passes its origin
+ * via `?lotics_host=` and talks only to the Vite origin.
  *
  * Protocol matches `frontend/features/app_ui/app_iframe_host.tsx` exactly:
  *   iframe → wrapper: { id: number, op: string, payload: unknown }
@@ -53,12 +58,19 @@ export function buildWrapperPage(args) {
     <span>workspace <code>${escapeHtml(workspace_id)}</code></span>
     <span>RPC → <code>${escapeHtml(api_url)}</code></span>
   </header>
-  <iframe id="app" sandbox="allow-scripts" allow="clipboard-write" src="${escapeAttr(vite_url)}"></iframe>
+  <iframe id="app" sandbox="allow-scripts allow-same-origin" allow="clipboard-write"></iframe>
   <script>
     (function () {
       const APP_ID = ${JSON.stringify(app_id)};
+      const VITE_URL = ${JSON.stringify(vite_url)};
+      const VITE_ORIGIN = new URL(VITE_URL).origin;
       const iframe = document.getElementById("app");
 
+      // Pass the wrapper's own origin to the app via ?lotics_host= so the app
+      // SDK can origin-lock its postMessage bridge.
+      iframe.src = VITE_URL + (VITE_URL.indexOf("?") >= 0 ? "&" : "?")
+        + "lotics_host=" + encodeURIComponent(window.location.origin);
+
       async function rpc(op, payload) {
         const res = await fetch("/_rpc", {
           method: "POST",
@@ -104,7 +116,7 @@ export function buildWrapperPage(args) {
       }
 
       window.addEventListener("message", async function (event) {
-        if (event.source !== iframe.contentWindow) return;
+        if (event.source !== iframe.contentWindow || event.origin !== VITE_ORIGIN) return;
         const msg = event.data;
         if (!msg || typeof msg.id !== "number" || typeof msg.op !== "string") return;
         const startedAt = performance.now();
@@ -114,13 +126,16 @@ export function buildWrapperPage(args) {
             : await rpc(msg.op, msg.payload);
           const ms = Math.round(performance.now() - startedAt);
           console.debug("[lotics-dev] " + msg.op + " " + ms + "ms", data);
-          iframe.contentWindow.postMessage({ id: msg.id, type: "result", data: data }, "*");
+          iframe.contentWindow.postMessage(
+            { id: msg.id, type: "result", data: data },
+            VITE_ORIGIN
+          );
         } catch (err) {
           const message = err && err.message ? err.message : String(err);
           console.error("[lotics-dev] " + msg.op + " failed:", message);
           iframe.contentWindow.postMessage(
             { id: msg.id, type: "error", message: message },
-            "*"
+            VITE_ORIGIN
           );
         }
       });
@@ -136,6 +151,3 @@ function escapeHtml(s) {
         .replace(/</g, "&lt;")
         .replace(/>/g, "&gt;");
 }
-function escapeAttr(s) {
-    return escapeHtml(s).replace(/"/g, "&quot;");
-}

package/dist/src/starter_template.js

@@ -50,7 +50,7 @@ export function buildStarterTemplate(args) {
                     test: "vitest run",
                 },
                 dependencies: {
-                    "@lotics/app-sdk": "^0.6.0",
+                    "@lotics/app-sdk": "^0.7.0",
                     "@lotics/ui": "^1.3.0",
                     "@react-native-picker/picker": "^2.7.0",
                     "expo-image": "~3.0.9",
@@ -155,6 +155,11 @@ export default defineConfig({
     // iframe loads modules from api.lotics.ai which already permits null
     // origin via CORS.
     cors: { origin: "*" },
+    // @lotics/ui/fonts.css references the API's /iframe/fonts/*.woff2 files
+    // by root-relative URL. A deployed app is served from the API origin so
+    // they resolve directly; under \`lotics app dev\` the app runs on
+    // localhost, so proxy /iframe to the API to load the real fonts.
+    proxy: { "/iframe": { target: "https://api.lotics.ai", changeOrigin: true } },
   },
   test: {
     environment: "jsdom",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lotics/cli",
-  "version": "0.30.0",
+  "version": "0.30.2",
   "description": "Lotics SDK and CLI for AI agents",
   "type": "module",
   "bin": {