@unoverse-platform/studio 0.1.23 → 0.1.24

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unoverse-platform/studio",
-  "version": "0.1.23",
+  "version": "0.1.24",
   "type": "module",
   "description": "Unoverse Studio: the local authoring app. Reads your own rx/ folder, no backend.",
   "scripts": {

package/screens/TemplatesView.tsx

@@ -41,16 +41,18 @@ const chatIdFor = (app: string) => `demo-${app.toLowerCase()}-${SESSION_NONCE}`;
 // it opens the Gravity data plane (WS component stream + REST execute) against the
 // configured server/workflow/node; in MOCK mode it seeds a fake conversation.
 // These are editable in the toolbar (LIVE mode) and persisted across refreshes.
-// Dev workbench serves /api + /ws/gravity + /stream on the merged uWS at :4205
-// (the retired gateway was :4100). Prod uses the page origin.
-const CONN_DEFAULTS = { server: "localhost:4205", workflowId: "wf-r4jzo7", triggerNode: "inputtrigger1", token: "" };
+// The dev universe serves /mcp + /api + /ws/gravity + /stream on the merged uWS at
+// :4105 — since the workbench retired, uWS binds the public port DIRECTLY in dev, same
+// as prod (the retired workbench was :4205, the retired gateway :4100). Prod uses the
+// page origin.
+const CONN_DEFAULTS = { server: "localhost:4105", workflowId: "wf-r4jzo7", triggerNode: "inputtrigger1", token: "" };
 const CONN_KEY = "unoverse.workbench.conn";
 
 function loadConn(): typeof CONN_DEFAULTS {
   try {
     const saved = JSON.parse(localStorage.getItem(CONN_KEY) ?? "{}");
-    // Migration: drop the retired gateway port so the new default applies.
-    if (saved.server === "localhost:4100") delete saved.server;
+    // Migration: drop retired ports (gateway :4100, workbench :4205) so the new default applies.
+    if (saved.server === "localhost:4100" || saved.server === "localhost:4205") delete saved.server;
     return { ...CONN_DEFAULTS, ...saved };
   } catch {
     return { ...CONN_DEFAULTS };

package/vendor/sdk/main.tsx

@@ -12,6 +12,12 @@ type HostConfig = Omit<AppConfig, "getAccessToken"> & { token?: string };
 let root: Root | null = null;
 let current: HostConfig | null = null;
 
+// Stable identity, module-level: the connection hook keys its lifecycle on the
+// `getAccessToken` reference (connection.tsx effect deps), and the host re-posts
+// config on every iframe load — an inline closure here would recycle the live
+// /stream session on each repost.
+const readToken = () => current?.token ?? null;
+
 function render() {
   if (!current) return;
   const el = document.getElementById("root")!;
@@ -23,15 +29,21 @@ function render() {
       templateId={current.templateId}
       userId={current.userId}
       conversationId={current.conversationId}
-      getAccessToken={() => current?.token ?? null}
+      // Only claim auth when the host actually sent a token. A fabricated accessor on a
+      // tokenless boot made the SDK skip its guest-id substitution (connection.tsx), so
+      // the session registered a non-guest id and the public-entry gate refused it.
+      // No token ⇒ no accessor ⇒ the SDK mints/persists `guest-<uuid>` per the contract
+      // (UNOVERSE_MCP_TEMPLATE_PROTOCOL §5, AUTH_TOKEN_FLOW Run Authorization).
+      getAccessToken={current.token ? readToken : undefined}
     />,
   );
 }
 
 function apply(cfg: HostConfig) {
-  const first = !current;
   current = { ...current, ...cfg };
-  if (first) render(); // mount once; token refresh just updates `current` (getAccessToken reads it)
+  // Re-render on every apply so a token appearing/disappearing takes effect; a same-token
+  // refresh changes nothing (readToken is stable, values equal), so no connection churn.
+  render();
 }
 
 declare global {