unoverse 0.1.128 → 0.1.130

package/operator/docker-compose.yml

@@ -111,7 +111,17 @@ services:
       # SAME :4105 backend as api.<domain>, so default to the api host (one public entry,
       # one cert, no extra DNS). UNOVERSE_URL can still override for a dedicated MCP host.
       - VITE_UNOVERSE_SERVICE_URL=${UNOVERSE_URL:-${DOMAIN:+https://api.${DOMAIN:-}}}
-      - MEMORY_SERVICE_URL=http://memory:4114
+      # THE BROWSER'S MEMORY UPSTREAM, AND IT IS THE PUBLIC JWT LANE (:4104). Its own
+      # variable, because `MEMORY_SERVICE_URL` means the opposite thing to a server-to-
+      # server caller: the engine uses that name for the TOKENLESS platform lane (:4114),
+      # and the canvas entrypoint was reading the same name for its nginx upstream. The
+      # dashboard therefore proxied the browser at :4114, whose /api/* routes do not
+      # exist — every memory page call 404'd on every deployed universe.
+      #
+      # The 404 was the lucky part. The platform lane asserts identity instead of proving
+      # it, so a browser reaching it would read and write ANY user's memory with no token.
+      # A browser must only ever reach :4104, which authenticates every request.
+      - MEMORY_PUBLIC_URL=http://memory:4104
     depends_on:
       - unoverse
     logging: *default-logging

package/operator/lib/db-verify.sh

@@ -88,7 +88,7 @@ cmd_db_verify() {
       ],
       dictionary_need_states: [
         "universal_id", "content_hash", "title", "description", "object_type",
-        "needs", "source_url", "umap_x", "umap_y", "umap_z",
+        "needs", "source_url", "source_id", "umap_x", "umap_y", "umap_z",
         "umap_cluster_id", "color_hex", "needs_umap_update", "created_at",
         "updated_at", "workflow_id", "key_need", "metadata", "embedding_original"
       ],

package/operator/lib/deploy.sh

@@ -117,8 +117,13 @@ cmd_db_allow() {
   # this could not help. A cluster host is `<name>-do-user-...`, so the name is right there
   # in DATABASE_URL.
   if [ -z "$cluster" ]; then
+    # `-n` + `p`: print ONLY when the substitution matched. The portable way to say "extract
+    # or nothing". This was `s|…|\1|; t; d`, which is GNU: BSD sed reads everything after `t`
+    # as a LABEL, so on macOS it died with `undefined label '; d'`, printed nothing, and the
+    # command then reported "this database has no trusted-source list" — a real cluster
+    # reported as an open one, on the platform's own machine.
     cluster=$(grep -E '^DATABASE_URL=' "$ROOT/.env" 2>/dev/null | head -1 \
-      | sed -E 's|.*@([a-z0-9-]+)-do-user-[^.]*\..*|\1|; t; d')
+      | sed -nE 's|.*@([a-z0-9-]+)-do-user-[^.]*\..*|\1|p')
   fi
 
   if [ -z "$cluster" ]; then

package/operator/operator.sh

@@ -30,6 +30,22 @@ else
   exit 1
 fi
 
+# True when the CURRENT DIRECTORY sits inside the platform monorepo. Deliberately keyed to
+# $PWD and not to this script's location: the case it exists for is the INSTALLED CLI being
+# run from inside this repo, where the script lives in node_modules and only the cwd says
+# where the user actually is. The root package name is the marker, and no starter kit
+# carries it.
+_in_platform_monorepo() {
+  local d="$PWD"
+  while [ "$d" != "/" ] && [ -n "$d" ]; do
+    if [ -f "$d/package.json" ] && grep -q '"name"[[:space:]]*:[[:space:]]*"unoverse-platform"' "$d/package.json" 2>/dev/null; then
+      return 0
+    fi
+    d="$(dirname "$d")"
+  done
+  return 1
+}
+
 # ── Source all modules ──────────────────────────────────────────────
 source "$GRAVITY_LIB/find-root.sh"
 source "$GRAVITY_LIB/common.sh"
@@ -154,6 +170,25 @@ case "${1:-}" in
       shift 2; node --import tsx "$GRAVITY_LIB/publish-assets.mjs" "$@"
     elif type cmd_publish >/dev/null 2>&1; then
       shift; cmd_publish "$@"
+    elif _in_platform_monorepo; then
+      # THE INSTALLED CLI CANNOT RELEASE THE PLATFORM, and inside this repo the fallthrough
+      # below is never what anyone meant: it would start publishing rx assets to a universe
+      # while the operator believes they are shipping the platform. It used to do exactly
+      # that, silently, which is the whole reason this branch exists. Refuse and say where
+      # to go. A starter kit never reaches here (no `unoverse-platform` package above it),
+      # so the developer publish keeps working untouched.
+      echo "" >&2
+      echo "  The unoverse CLI does not release the platform." >&2
+      echo "" >&2
+      echo "  You are inside the platform monorepo, where \`publish\` would publish rx" >&2
+      echo "  ASSETS to a universe — not ship the platform. The release lives in this" >&2
+      echo "  repo's own script, which the published CLI does not carry:" >&2
+      echo "" >&2
+      echo "    scripts/operator.sh publish" >&2
+      echo "" >&2
+      echo "  See docs/architecture/DEVELOPER_GUIDE.md § Releasing." >&2
+      echo "" >&2
+      exit 1
     else
       shift; node --import tsx "$GRAVITY_LIB/publish-assets.mjs" "$@"
     fi

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "unoverse",
-  "version": "0.1.128",
+  "version": "0.1.130",
   "description": "The Unoverse front door — create a Studio project, a universe, or a client app, and launch Studio.",
   "license": "SEE LICENSE IN README.md",
   "type": "module",