com.robotsquid.squidhub 0.5.4 → 0.5.6

package/CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 0.5.6
+
+⚠️ **Fixes an upload that did nothing and said nothing.** `SquidHub → Upload
+Build…` in 0.5.5 ran, reported no error, and uploaded no files.
+
+`yield return SomeOtherIEnumerator()` requires the coroutine driver to DESCEND
+into the nested routine. Unity's own runner does; the hand-rolled one here did
+not — it treated the nested iterator as an ordinary yielded value, discarded it,
+and carried on. So the request that starts a build never executed, the response
+stayed null, and the routine exited quietly on a null check.
+
+The driver is now `SquidHubPump`, which has no `UnityEditor` dependency and is
+unit-tested for exactly that nesting rule, three levels deep. The JSON field
+reader moved into the tested file too, since a null that looks like an answer is
+the same failure in a different costume, and the run now logs what it is doing
+so a silent no-op cannot recur.
+
+## 0.5.5
+
+**Upload a build straight from Unity.** `SquidHub → Upload Build…` picks the
+build folder, checks it, and pushes it to SquidHub — no console, no command
+line, no repository checkout.
+
+Set it up once in `SquidHub → Upload Settings` with a key from the publisher
+console (your game → **Upload keys**).
+
+⚠️ **The key is stored in EditorPrefs, never in your project.** It is per-machine
+and per-project-path, so there is no path by which it reaches your repository —
+a better guarantee than being told not to commit it. A key can do exactly one
+thing: upload a build for the one game it was minted for. It cannot read
+anything, publish to a channel, or touch another game.
+
+⚠️ **Uploading is not publishing.** A build arrives registered and not live;
+promoting it to players stays a deliberate act in the console.
+
+The build is refused before anything uploads if it is precompressed, or has no
+`index.html` at its top level. `.DS_Store` and friends are dropped rather than
+uploaded — which is also what makes a Unity-pushed build hash identically to the
+same bytes pushed by `squidhub-release` or dragged into the console.
+
 ## 0.5.4
 
 **No functional change from 0.5.3.**

package/Editor/SquidHubBuildScan.cs

@@ -0,0 +1,188 @@
+// Turning a build folder into the file list the upload API expects.
+//
+// ⚠️ Pure System.* — no UnityEditor, no UnityEngine, no network. That is
+// deliberate: this is the only part of the uploader with real logic, so it
+// stays runnable under plain `dotnet` in tools/test. The same split is what
+// made SquidHubHtml testable.
+using System;
+using System.Collections.Generic;
+using System.IO;
+using System.Linq;
+using System.Security.Cryptography;
+
+namespace SquidHub.Editor
+{
+    internal sealed class ScannedFile
+    {
+        /// <summary>Forward-slashed path relative to the build root — the R2 key.</summary>
+        public string Path;
+        public string Sha256;
+        public long Bytes;
+        /// <summary>Absolute path, for the upload step.</summary>
+        public string FullPath;
+    }
+
+    internal sealed class BuildScan
+    {
+        public readonly List<ScannedFile> Files = new List<ScannedFile>();
+        /// <summary>Reasons this build cannot be uploaded. Non-empty means stop.</summary>
+        public readonly List<string> Refusals = new List<string>();
+        /// <summary>OS metadata dropped. Reported, never silent.</summary>
+        public readonly List<string> Skipped = new List<string>();
+        public long TotalBytes;
+        public bool HasEntryPoint;
+    }
+
+    internal static class SquidHubBuildScan
+    {
+        /// <summary>
+        /// ⚠️ Dropped, not refused — and it must match what the CLI and console do.
+        /// They hash a directory listing that never contains these, so filtering
+        /// here is what makes all three agree on a buildHash.
+        /// </summary>
+        private static bool IsJunk(string relativePath)
+        {
+            var name = relativePath.Split('/').Last();
+            return name == ".DS_Store" || name == "Thumbs.db" || relativePath.StartsWith("__MACOSX/");
+        }
+
+        /// <summary>
+        /// ⚠️ Precompressed builds cannot be served — Cloudflare either strips
+        /// Content-Encoding or compresses the body a second time. The server
+        /// refuses these too and is the authority; refusing here means finding
+        /// out before uploading a couple of hundred megabytes.
+        /// </summary>
+        private static string RefusalFor(string relativePath)
+        {
+            foreach (var pair in new[] { (".br", "Brotli"), (".gz", "gzip"), (".zz", "deflate") })
+            {
+                if (!relativePath.EndsWith(pair.Item1, StringComparison.OrdinalIgnoreCase)) continue;
+                return relativePath + " is " + pair.Item2 + "-compressed. SquidHub serves build " +
+                       "assets uncompressed and Cloudflare compresses them at the edge. Set Player " +
+                       "Settings > Publishing Settings > Compression Format to Disabled and rebuild.";
+            }
+            return null;
+        }
+
+        public static BuildScan Scan(string root)
+        {
+            var scan = new BuildScan();
+            var full = System.IO.Path.GetFullPath(root);
+
+            foreach (var file in Directory.GetFiles(full, "*", SearchOption.AllDirectories).OrderBy(p => p))
+            {
+                // ⚠️ Backslashes normalised. A path hashed as `Build\x.wasm` on
+                // Windows and `Build/x.wasm` elsewhere is the same bytes producing
+                // two different buildHashes.
+                var relative = file.Substring(full.Length).TrimStart('/', '\\').Replace('\\', '/');
+
+                if (IsJunk(relative))
+                {
+                    scan.Skipped.Add(relative);
+                    continue;
+                }
+
+                var refusal = RefusalFor(relative);
+                if (refusal != null)
+                {
+                    scan.Refusals.Add(refusal);
+                    continue;
+                }
+
+                var bytes = File.ReadAllBytes(file);
+                scan.Files.Add(new ScannedFile
+                {
+                    Path = relative,
+                    Sha256 = ToHex(SHA256.Create().ComputeHash(bytes)),
+                    Bytes = bytes.LongLength,
+                    FullPath = file,
+                });
+                scan.TotalBytes += bytes.LongLength;
+            }
+
+            // ⚠️ Checked before anything uploads. The portal frames
+            // /v/<hash>/index.html, so a build without one registers perfectly
+            // and then fails to launch for every player.
+            scan.HasEntryPoint = scan.Files.Any(f => f.Path == "index.html");
+            if (!scan.HasEntryPoint)
+            {
+                scan.Refusals.Add(
+                    "No index.html at the top level of " + root + ". The game cannot launch. " +
+                    "Point this at the folder Unity built into, not at its parent.");
+            }
+
+            return scan;
+        }
+
+        private static string ToHex(byte[] bytes)
+        {
+            var chars = new char[bytes.Length * 2];
+            for (var i = 0; i < bytes.Length; i++)
+            {
+                chars[i * 2] = "0123456789abcdef"[bytes[i] >> 4];
+                chars[i * 2 + 1] = "0123456789abcdef"[bytes[i] & 0xF];
+            }
+            return new string(chars);
+        }
+
+        /// <summary>
+        /// The `files` array for the start request.
+        ///
+        /// ⚠️ Hand-built rather than via a JSON library, for the same reason the
+        /// generated wrapper writes its own: a Unity project already carries one
+        /// and shipping a second is a second parser to maintain.
+        /// </summary>
+        public static string FilesJson(IEnumerable<ScannedFile> files)
+        {
+            var parts = files.Select(f =>
+                "{\"path\":" + JsonString(f.Path) +
+                ",\"sha256\":\"" + f.Sha256 + "\"" +
+                ",\"bytes\":" + f.Bytes + "}");
+            return "[" + string.Join(",", parts) + "]";
+        }
+
+        /// <summary>
+        /// Reads one flat field out of a JSON response.
+        ///
+        /// ⚠️ A regex, not a parser, and deliberately only for the handful of
+        /// flat fields this flow reads. Shipping a parser in a package that
+        /// already asks the project to bring its own would be a second, worse
+        /// one to maintain.
+        ///
+        /// ⚠️ Returns null when absent, and the caller must treat that as a
+        /// failure rather than a value. Every silent no-op in this uploader has
+        /// come from a null that looked like an answer.
+        /// </summary>
+        public static string JsonField(string json, string name)
+        {
+            if (string.IsNullOrEmpty(json)) return null;
+            var match = System.Text.RegularExpressions.Regex.Match(
+                json,
+                "\"" + System.Text.RegularExpressions.Regex.Escape(name) +
+                    "\"\\s*:\\s*(?:\"([^\"]*)\"|(true|false|-?[0-9.]+))");
+            if (!match.Success) return null;
+            return match.Groups[1].Success ? match.Groups[1].Value : match.Groups[2].Value;
+        }
+
+        internal static string JsonString(string value)
+        {
+            var sb = new System.Text.StringBuilder("\"");
+            foreach (var c in value)
+            {
+                switch (c)
+                {
+                    case '"': sb.Append("\\\""); break;
+                    case '\\': sb.Append("\\\\"); break;
+                    case '\n': sb.Append("\\n"); break;
+                    case '\r': sb.Append("\\r"); break;
+                    case '\t': sb.Append("\\t"); break;
+                    default:
+                        if (c < ' ') sb.Append("\\u").Append(((int)c).ToString("x4"));
+                        else sb.Append(c);
+                        break;
+                }
+            }
+            return sb.Append('"').ToString();
+        }
+    }
+}

package/Editor/SquidHubBuildScan.cs.meta

@@ -0,0 +1,11 @@
+fileFormatVersion: 2
+guid: 90a9c4481ddb3f880e468bdbe270b8a1
+MonoImporter:
+  externalObjects: {}
+  serializedVersion: 2
+  defaultReferences: []
+  executionOrder: 0
+  icon: {instanceID: 0}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

package/Editor/SquidHubPump.cs

@@ -0,0 +1,53 @@
+// Running a coroutine outside a Unity player loop.
+//
+// ⚠️ Pure System.* — no UnityEditor — so the nesting rule below is covered by
+// tests under plain dotnet. It exists because getting this wrong produced a
+// completely silent failure: the upload menu item ran, reported nothing, and
+// uploaded nothing.
+using System;
+using System.Collections;
+using System.Collections.Generic;
+
+namespace SquidHub.Editor
+{
+    /// <summary>
+    /// A coroutine driver that understands NESTED iterators.
+    ///
+    /// ⚠️ `yield return SomeOtherIEnumerator()` is the whole reason this is not
+    /// three lines. Unity's own runner descends into a yielded IEnumerator and
+    /// runs it to completion before resuming the parent. A naive driver that
+    /// only calls MoveNext() on the outer routine treats the nested one as an
+    /// ordinary value, discards it, and carries straight on — so the nested work
+    /// NEVER RUNS and nothing anywhere reports a problem.
+    /// </summary>
+    internal sealed class SquidHubPump
+    {
+        private readonly Stack<IEnumerator> _stack = new Stack<IEnumerator>();
+
+        public SquidHubPump(IEnumerator routine)
+        {
+            _stack.Push(routine);
+        }
+
+        public bool Done => _stack.Count == 0;
+
+        /// <summary>Advances by one step. Returns false once everything has finished.</summary>
+        public bool Step()
+        {
+            if (_stack.Count == 0) return false;
+
+            var current = _stack.Peek();
+            if (!current.MoveNext())
+            {
+                // ⚠️ Pop and return true, not false. The PARENT still has work
+                // left; reporting "done" because a child finished would abandon
+                // the rest of the upload silently.
+                _stack.Pop();
+                return _stack.Count > 0;
+            }
+
+            if (current.Current is IEnumerator nested) _stack.Push(nested);
+            return true;
+        }
+    }
+}

package/Editor/SquidHubPump.cs.meta

@@ -0,0 +1,11 @@
+fileFormatVersion: 2
+guid: 4950b7b2580a1a30f9940f07fe016efc
+MonoImporter:
+  externalObjects: {}
+  serializedVersion: 2
+  defaultReferences: []
+  executionOrder: 0
+  icon: {instanceID: 0}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

package/Editor/SquidHubUploadSettings.cs

@@ -0,0 +1,98 @@
+// Where the upload key lives, and where it must not.
+//
+// ⚠️ EditorPrefs, NEVER a file in the project. A key written under Assets/ ends
+// up in the publisher's git repository, and from there in anyone's clone. This
+// is per-machine and per-user by construction, so there is no path by which
+// committing it is possible — which is a better guarantee than telling people
+// not to.
+using UnityEditor;
+using UnityEngine;
+
+namespace SquidHub.Editor
+{
+    internal static class SquidHubUploadSettings
+    {
+        // ⚠️ Keyed per project path, so two games open on one machine cannot
+        // upload to each other by inheriting a key.
+        private static string Scope => "SquidHub." + Application.dataPath.GetHashCode() + ".";
+
+        private const string DefaultEndpoint = "https://publish.robotsquid.dev";
+
+        public static string Key
+        {
+            get => EditorPrefs.GetString(Scope + "uploadKey", "");
+            set => EditorPrefs.SetString(Scope + "uploadKey", value.Trim());
+        }
+
+        public static string Endpoint
+        {
+            get => EditorPrefs.GetString(Scope + "endpoint", DefaultEndpoint).TrimEnd('/');
+            set => EditorPrefs.SetString(Scope + "endpoint", value.Trim().TrimEnd('/'));
+        }
+
+        public static string BuildFolder
+        {
+            get => EditorPrefs.GetString(Scope + "buildFolder", "");
+            set => EditorPrefs.SetString(Scope + "buildFolder", value);
+        }
+
+        public static bool HasKey => Key.StartsWith("shu_");
+    }
+
+    internal sealed class SquidHubUploadSettingsWindow : EditorWindow
+    {
+        private string _key = "";
+        private string _endpoint = "";
+
+        [MenuItem("SquidHub/Upload Settings", priority = 10)]
+        private static void Open()
+        {
+            var window = GetWindow<SquidHubUploadSettingsWindow>(true, "SquidHub Upload", true);
+            window._key = SquidHubUploadSettings.Key;
+            window._endpoint = SquidHubUploadSettings.Endpoint;
+            window.minSize = new Vector2(460, 210);
+        }
+
+        private void OnGUI()
+        {
+            EditorGUILayout.HelpBox(
+                "Create a key in the publisher console under your game → Upload keys. " +
+                "It can only upload builds for that one game.\n\n" +
+                "The key is stored in EditorPrefs on this machine, never in your project, " +
+                "so it cannot reach your repository.",
+                MessageType.Info);
+
+            // ⚠️ A password field. Not because it is secret from the person
+            // typing it, but because it is pasted during screen shares and
+            // recorded tutorials more often than anyone expects.
+            _key = EditorGUILayout.PasswordField("Upload key", _key);
+            _endpoint = EditorGUILayout.TextField("Console URL", _endpoint);
+
+            EditorGUILayout.Space();
+            using (new EditorGUILayout.HorizontalScope())
+            {
+                if (GUILayout.Button("Save"))
+                {
+                    SquidHubUploadSettings.Key = _key;
+                    SquidHubUploadSettings.Endpoint = string.IsNullOrWhiteSpace(_endpoint)
+                        ? "https://publish.robotsquid.dev"
+                        : _endpoint;
+                    Close();
+                }
+                if (GUILayout.Button("Clear key"))
+                {
+                    SquidHubUploadSettings.Key = "";
+                    _key = "";
+                }
+            }
+
+            if (!string.IsNullOrEmpty(_key) && !_key.StartsWith("shu_"))
+            {
+                EditorGUILayout.HelpBox(
+                    "That does not look like an upload key — they begin with shu_. " +
+                    "A console session cookie will not work here.",
+                    MessageType.Warning);
+            }
+        }
+    }
+}

package/Editor/SquidHubUploadSettings.cs.meta

@@ -0,0 +1,11 @@
+fileFormatVersion: 2
+guid: 205543f3c7718670401e28d4a55209ec
+MonoImporter:
+  externalObjects: {}
+  serializedVersion: 2
+  defaultReferences: []
+  executionOrder: 0
+  icon: {instanceID: 0}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

package/Editor/SquidHubUploader.cs

@@ -0,0 +1,232 @@
+// SquidHub → Upload Build. The whole publish, from the Editor.
+//
+// ⚠️ Runs the same job API the console does: start, PUT each file, complete.
+// Only the authentication differs — a per-game upload key instead of a session
+// cookie — so a build pushed from here is validated by exactly the same server
+// code as one dragged into the console.
+//
+// ⚠️ Thin ON PURPOSE. Everything with real logic lives in SquidHubBuildScan,
+// which has no UnityEditor dependency and is unit-tested under plain dotnet.
+// This file is plumbing, and plumbing is what cannot be tested here.
+using System;
+using System.Collections;
+using System.IO;
+using System.Text;
+using System.Text.RegularExpressions;
+using UnityEditor;
+using UnityEngine;
+using UnityEngine.Networking;
+
+namespace SquidHub.Editor
+{
+    internal static class SquidHubUploader
+    {
+        private static SquidHubPump _pump;
+
+        [MenuItem("SquidHub/Upload Build…", priority = 11)]
+        private static void UploadBuild()
+        {
+            if (!SquidHubUploadSettings.HasKey)
+            {
+                EditorUtility.DisplayDialog("SquidHub",
+                    "No upload key set. Create one in the publisher console under your game → " +
+                    "Upload keys, then paste it into SquidHub → Upload Settings.", "OK");
+                SquidHubUploadSettingsWindow.GetWindow<SquidHubUploadSettingsWindow>();
+                return;
+            }
+
+            var start = SquidHubUploadSettings.BuildFolder;
+            var folder = EditorUtility.OpenFolderPanel(
+                "Select the WebGL build folder (containing index.html)",
+                string.IsNullOrEmpty(start) ? "" : start, "");
+            if (string.IsNullOrEmpty(folder)) return;
+            SquidHubUploadSettings.BuildFolder = folder;
+
+            BuildScan scan;
+            try
+            {
+                scan = SquidHubBuildScan.Scan(folder);
+            }
+            catch (Exception e)
+            {
+                EditorUtility.DisplayDialog("SquidHub", "Could not read that folder:\n\n" + e.Message, "OK");
+                return;
+            }
+
+            // ⚠️ Refusals stop the upload before a byte moves. Every one of them
+            // is something the server would reject anyway; finding out here
+            // saves the publisher the round trip and names the fix.
+            if (scan.Refusals.Count > 0)
+            {
+                EditorUtility.DisplayDialog("SquidHub — build not uploadable",
+                    string.Join("\n\n", scan.Refusals), "OK");
+                return;
+            }
+
+            if (!EditorUtility.DisplayDialog("SquidHub",
+                    $"Upload {scan.Files.Count} files ({scan.TotalBytes / 1024f / 1024f:F1} MB)?" +
+                    (scan.Skipped.Count > 0
+                        ? $"\n\n{scan.Skipped.Count} OS metadata file(s) will be skipped."
+                        : ""),
+                    "Upload", "Cancel"))
+            {
+                return;
+            }
+
+            Run(Upload(scan));
+        }
+
+        // ⚠️ Driven by EditorApplication.update rather than blocking. Sleeping
+        // the main thread would stop UnityWebRequest progressing at all, and the
+        // Editor would appear to hang for the length of the upload.
+        //
+        // ⚠️ SquidHubPump, not a bare MoveNext(). `yield return SomeIEnumerator()`
+        // must DESCEND into the nested routine — a driver that does not simply
+        // discards it and carries on, which made the entire upload run, report
+        // nothing and do nothing. That nesting rule is unit-tested.
+        private static void Run(IEnumerator routine)
+        {
+            _pump = new SquidHubPump(routine);
+            EditorApplication.update -= Pump;
+            EditorApplication.update += Pump;
+        }
+
+        private static void Pump()
+        {
+            try
+            {
+                if (_pump != null && _pump.Step()) return;
+            }
+            catch (Exception e)
+            {
+                EditorUtility.ClearProgressBar();
+                Debug.LogError("[SquidHub] upload failed: " + e);
+                EditorUtility.DisplayDialog("SquidHub — upload failed", e.Message, "OK");
+            }
+            _pump = null;
+            EditorApplication.update -= Pump;
+            EditorUtility.ClearProgressBar();
+            Debug.Log("[SquidHub] upload run finished.");
+        }
+
+        private static IEnumerator Upload(BuildScan scan)
+        {
+            var endpoint = SquidHubUploadSettings.Endpoint;
+            var key = SquidHubUploadSettings.Key;
+
+            Debug.Log($"[SquidHub] uploading {scan.Files.Count} file(s) to {endpoint}");
+            EditorUtility.DisplayProgressBar("SquidHub", "Registering build…", 0f);
+
+            var startBody = "{\"intent\":\"start\",\"files\":" + SquidHubBuildScan.FilesJson(scan.Files) + "}";
+            string startResponse = null;
+            yield return Post(endpoint + "/api/ingest", key, startBody, r => startResponse = r);
+
+            // ⚠️ Post reports its own failure and leaves this null. Returning
+            // quietly here is what made a failed start look like success.
+            if (startResponse == null)
+            {
+                Debug.LogError("[SquidHub] the start request returned nothing — upload abandoned.");
+                yield break;
+            }
+
+            if (SquidHubBuildScan.JsonField(startResponse, "alreadyPublished") == "true")
+            {
+                EditorUtility.ClearProgressBar();
+                EditorUtility.DisplayDialog("SquidHub",
+                    "These exact bytes are already published as " + SquidHubBuildScan.JsonField(startResponse, "buildHash") +
+                    ". Nothing to upload.", "OK");
+                yield break;
+            }
+
+            var jobId = SquidHubBuildScan.JsonField(startResponse, "jobId");
+            if (string.IsNullOrEmpty(jobId))
+            {
+                Fail("The server did not start a build job", startResponse);
+                yield break;
+            }
+
+            for (var i = 0; i < scan.Files.Count; i++)
+            {
+                var file = scan.Files[i];
+                EditorUtility.DisplayProgressBar("SquidHub",
+                    $"Uploading {i + 1}/{scan.Files.Count} — {file.Path}",
+                    (float)i / scan.Files.Count);
+
+                var request = new UnityWebRequest(endpoint + "/api/ingest/upload", "PUT");
+                request.uploadHandler = new UploadHandlerRaw(File.ReadAllBytes(file.FullPath));
+                request.downloadHandler = new DownloadHandlerBuffer();
+                request.SetRequestHeader("authorization", "Bearer " + key);
+                request.SetRequestHeader("x-squidhub-job", jobId);
+                request.SetRequestHeader("x-squidhub-path", file.Path);
+                request.SetRequestHeader("x-squidhub-sha256", file.Sha256);
+
+                var op = request.SendWebRequest();
+                while (!op.isDone) yield return null;
+
+                if (request.result != UnityWebRequest.Result.Success)
+                {
+                    Fail("Upload failed on " + file.Path, request.downloadHandler.text);
+                    yield break;
+                }
+            }
+
+            EditorUtility.DisplayProgressBar("SquidHub", "Verifying and registering…", 0.99f);
+
+            string doneResponse = null;
+            yield return Post(endpoint + "/api/ingest",
+                key,
+                "{\"intent\":\"complete\",\"jobId\":" + SquidHubBuildScan.JsonString(jobId) + "}",
+                r => doneResponse = r);
+
+            EditorUtility.ClearProgressBar();
+            if (doneResponse == null) yield break;
+
+            if (SquidHubBuildScan.JsonField(doneResponse, "ok") != "true")
+            {
+                Fail("The server refused the build", doneResponse);
+                yield break;
+            }
+
+            // ⚠️ Registered, NOT live. Promoting a build to players is a separate,
+            // deliberate act in the console — saying "uploaded" without saying
+            // that invites someone to assume their players already have it.
+            EditorUtility.DisplayDialog("SquidHub",
+                "Registered " + SquidHubBuildScan.JsonField(doneResponse, "buildHash") + ".\n\n" +
+                "It is not live yet — promote it in the publisher console when you are ready.",
+                "OK");
+        }
+
+        private static IEnumerator Post(string url, string key, string body, Action<string> onOk)
+        {
+            var request = new UnityWebRequest(url, "POST");
+            request.uploadHandler = new UploadHandlerRaw(Encoding.UTF8.GetBytes(body));
+            request.downloadHandler = new DownloadHandlerBuffer();
+            request.SetRequestHeader("authorization", "Bearer " + key);
+            request.SetRequestHeader("content-type", "application/json");
+
+            var op = request.SendWebRequest();
+            while (!op.isDone) yield return null;
+
+            if (request.responseCode == 401)
+            {
+                Fail("The upload key was refused",
+                    "Check it in SquidHub → Upload Settings, and that it has not been revoked.");
+                yield break;
+            }
+            if (request.result != UnityWebRequest.Result.Success)
+            {
+                Fail("Request failed", request.error + "\n" + request.downloadHandler.text);
+                yield break;
+            }
+            onOk(request.downloadHandler.text);
+        }
+
+        private static void Fail(string title, string detail)
+        {
+            EditorUtility.ClearProgressBar();
+            Debug.LogError("[SquidHub] " + title + ": " + detail);
+            EditorUtility.DisplayDialog("SquidHub — " + title, detail, "OK");
+        }
+
+    }
+}

package/Editor/SquidHubUploader.cs.meta

@@ -0,0 +1,11 @@
+fileFormatVersion: 2
+guid: c34878fbb310a03e1c5ddc1aefe730ac
+MonoImporter:
+  externalObjects: {}
+  serializedVersion: 2
+  defaultReferences: []
+  executionOrder: 0
+  icon: {instanceID: 0}
+  userData: 
+  assetBundleName: 
+  assetBundleVariant: 

package/README.md

@@ -82,6 +82,29 @@ Then push the folder:
 node src/cli.mjs push --game <slug> --dir <BuildFolder> --env=dev --verify
 ```
 
+## Uploading from Unity
+
+`SquidHub → Upload Build…` does the whole publish — no console, no command line,
+no repository checkout.
+
+**Once:** in the publisher console open your game → **Upload keys** → create one,
+then paste it into `SquidHub → Upload Settings`.
+
+⚠️ **The key never enters your project.** It lives in EditorPrefs, per machine
+and per project path, so it cannot reach your repository. It can do exactly one
+thing: upload a build for the one game it was minted for — it cannot read
+anything, publish to a channel, or touch another game. If it leaks, revoke it in
+the console; the worst it could have done is leave an unwanted build somewhere
+no player can see.
+
+⚠️ **Uploading is not publishing.** The build arrives registered and not live.
+Promoting it to players stays a deliberate act in the console.
+
+The upload is refused before a byte moves if the build is precompressed or has
+no `index.html` at its top level, and OS metadata is dropped rather than sent —
+which is also what makes a build pushed from Unity hash identically to the same
+bytes dragged into the console.
+
 ## In the Editor
 
 `Sdk` compiles on every platform and reports `Status() == "failed"` anywhere

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "com.robotsquid.squidhub",
-  "version": "0.5.4",
+  "version": "0.5.6",
   "displayName": "SquidHub",
   "description": "Cloud saves, analytics and the coin economy for Unity WebGL games published on SquidHub. Installs the C# wrapper, the .jslib half and the page bridge, and rewrites the exported index.html so it survives the platform's CSP.",
   "unity": "2021.3",