@unoverse-platform/studio 0.1.59 → 0.1.61

package/local/plugin.ts

@@ -253,6 +253,32 @@ export function localStudioHost(): Plugin {
             // runs the same base items/publish functions directly, and no token ever
             // nears the browser because the browser no longer takes part.
 
+            /**
+             * THE CLI'S SESSION, SERVED TO THE PREVIEW. `unoverse login` keeps sessions
+             * in ~/.unoverse/sessions.json keyed by universe origin (cli lib/session.mjs
+             * — that file IS the contract). Studio used to know nothing of it, so a
+             * developer who had just logged in still saw "Offline" and a blank Live
+             * preview with no hint why (observed live 2026-08-21). The preview already
+             * carries a bearer in the browser by design (the pasted-JWT field), so
+             * serving the session token here changes what the browser holds not at all —
+             * it only spares the developer pasting what the CLI already has. Expired or
+             * absent answers {}: the UI then says to run unoverse login, by name.
+             */
+            case path === "/local/session": {
+              const origin = new URL(req.url ?? "/", "http://x").searchParams.get("origin") ?? "";
+              try {
+                const { readFileSync } = await import("node:fs");
+                const { homedir } = await import("node:os");
+                const { join } = await import("node:path");
+                const all = JSON.parse(readFileSync(join(homedir(), ".unoverse", "sessions.json"), "utf8"));
+                const sess = all[origin.replace(/\/$/, "")];
+                if (sess?.access_token && (!sess.expires_at || sess.expires_at > Date.now() + 60_000)) {
+                  return json(res, { token: sess.access_token, email: sess.email ?? "" });
+                }
+              } catch { /* no file, unreadable, malformed: same answer as signed out */ }
+              return json(res, {});
+            }
+
             case path === "/dev/orgs":
               return json(res, { orgs: c.themeOrgs() });
 

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@unoverse-platform/studio",
-  "version": "0.1.59",
+  "version": "0.1.61",
   "type": "module",
   "description": "Unoverse Studio: the local authoring app. Reads your own rx/ folder, no backend.",
   "scripts": {

package/screens/NativeAppHost.tsx

@@ -80,7 +80,21 @@ export function NativeAppHost({
         if (!text) throw new Error(`${APP_UI_URI} returned no content — is the webSDK built on the universe?`);
         if (!cancelled) setHtml(text);
       } catch (e) {
-        if (!cancelled) setError(e instanceof Error ? e.message : String(e));
+        const msg = e instanceof Error ? e.message : String(e);
+        // AUTH FAILURES SAY SO, BY NAME. A 401 here rendered as a bare transport error
+        // (or worse, an eternal loading ghost), and "Offline" told the developer
+        // nothing. The fix is one terminal command; the error is the place to say it.
+        const authShaped = /401|unauthori[sz]ed|jwt|token/i.test(msg);
+        if (!cancelled)
+          setError(
+            authShaped
+              ? `This universe requires sign-in.
+
+Run:  unoverse login ${server}
+
+then come back — Studio picks the session up by itself.`
+              : msg,
+          );
       } finally {
         client.close().catch(() => {});
       }

package/screens/TemplatesView.tsx

@@ -26,7 +26,7 @@ import { ComponentStore } from "@unoverse/sdk";
 import { StreamedUnoverseTemplate, useUnoverseConnection, computeAppWidth, resolveActiveLayout, visible, type ResolvedTheme, type UseVoiceServiceConfig } from "@unoverse/sdk";
 import { NativeAppHost } from "./NativeAppHost";
 import { inArrangement, viewOfSlice } from "./states";
-import { client, authedFetch, hasAuth, UNOVERSE_BASE, liveUniverseUrl } from "studio-host";
+import { client, authedFetch, hasAuth, hasSourceAccess, UNOVERSE_BASE, liveUniverseUrl } from "studio-host";
 import { NAV, NAV_SECTION, SCREEN, navItem, navSubItem } from "./chrome";
 
 // Per-APP test conversation: each app chats in its own conversation id, so testing
@@ -243,9 +243,18 @@ export function TemplatesView({
 
   // OIDC session (undefined when no AuthProvider is mounted — env unset).
   const auth = useAuth();
-  // Token source: prefer the real OIDC access token; fall back to a pasted JWT.
+  /**
+   * THE TERMINAL LOGIN COUNTS HERE. `unoverse login` keeps the session; the local host
+   * serves its token per origin (/local/session). Without this a developer who had just
+   * logged in still saw Offline and a blank preview with no hint why. Refetched when the
+   * server changes and when the tab regains focus, so a login run in the terminal is
+   * picked up on the next glance at Studio. Empty when signed out or expired — then the
+   * UI says to run unoverse login rather than showing a mute Offline.
+   */
+  const [cliSession, setCliSession] = useState<{ token?: string; email?: string }>({});
+  // Token source: the real OIDC access token, else the terminal login, else a pasted JWT.
   const authToken = auth?.user?.access_token;
-  const token = authToken || connCfg.token;
+  const token = authToken || cliSession.token || connCfg.token;
 
   // The live server: the signed-in universe, else the local dev platform (see the
   // CONN_DEFAULTS note). A universe URL is already an https origin; the bare local
@@ -253,6 +262,21 @@ export function TemplatesView({
   const universeUrl = liveUniverseUrl();
   const liveServer = universeUrl ?? LOCAL_DEV_SERVER;
   const liveBase = liveServer.includes("://") ? liveServer : `http://${liveServer}`;
+  useEffect(() => {
+    if (!hasSourceAccess) return;
+    let live = true;
+    const read = () =>
+      authedFetch(`/local/session?origin=${encodeURIComponent(liveBase.replace(/\/$/, ""))}`)
+        .then((r) => r.json())
+        .then((d) => live && setCliSession(d ?? {}))
+        .catch(() => live && setCliSession({}));
+    read();
+    window.addEventListener("focus", read);
+    return () => {
+      live = false;
+      window.removeEventListener("focus", read);
+    };
+  }, [liveBase]);
 
   const config = useMemo(
     () => ({

package/vendor/skills/unoverse-create/SKILL.md

@@ -102,16 +102,16 @@ fetch it as raw markdown.
 ## Step 3: Deploy loop (after the artifact is written)
 
 Components and templates have NO scaffold command. Author them from the references
-(mirror the closest existing artifact). Validation lives in Studio: its publish step
+(mirror the closest existing artifact). Validation lives in the deploy lint (`unoverse deploy studio`): it
 lints every definition before anything leaves the machine (0 errors required, doc-cited
 messages; justify any warning), and the conformance checklist is
 [UNOVERSE_CONFORMANCE](https://docs.unoverse.ai/unoverse/UNOVERSE_CONFORMANCE.md).
 
 | Artifact | To see it live |
 |---|---|
-| Component / atom / template / style | Preview in Studio (`unoverse studio`), then publish from Studio: the publish lint gates it |
+| Component / atom / template / style | Preview in Studio (`unoverse studio`), then `unoverse deploy studio`: the deploy lint gates it |
 | Existing component restyle/edit only | takes effect live (the SDK reads `design/` directly) |
-| Agent skill / prompt block | publish from Studio, same gate |
+| Agent skill / prompt block | `unoverse deploy studio`, same gate |
 | Node | Studio's Nodes screen: Load sample → Run. A node is YAML; running it is the only proof (no build) |
 
 **Close the loop with the developer.** After creating something visual, tell them how

package/vendor/skills/unoverse-prompt-component/SKILL.md

@@ -32,7 +32,7 @@ It prints every part the agent can fill, its description, and its limits. Read t
 output, not the YAML. Then run the design lint
 (`node -e "import('./packages/base/src/lint/design/index.mjs').then(m=>{const r=m.lintDefinitions();console.log(r.problems.length);r.problems.forEach(p=>console.log(p.level,p.file,p.msg))})"`).
 
-In a **Studio developer workspace**, the same linter runs as Studio's publish lint; it
+In a **Studio developer workspace**, the same linter runs as the deploy lint (`unoverse deploy studio`); it
 catches two of the five traps below by name. Read what it says rather than silencing it, and always do the final proof in
 Step 6: one real fill.