Harden Workspace-first games flow by removing standalone bypass, propagating hostContextId for hosted game sessions, and eliminating remaining direct standalone debug launch affordances from Games Hub cards (batches 40–41 PASS).

Author: DavidQ

docs/dev/reports/samples2tools_batch_40_summary.txt

@@ -0,0 +1,12 @@
+Samples2Tools batch 40 summary
+Generated: 2026-04-24T22:28:28.115Z
+Purpose: remove remaining standalone bypass risk and make hosted game sessions context-aware.
+
+Completed this batch:
+- Removed standalone bypass parameter from game launch guard
+- Added Workspace Manager shared host context write/remove around hosted game mount lifecycle
+- Propagated hostContextId into hosted game iframe URLs
+- Revalidated guard coverage across all launchable game pages
+
+Primary validation artifact:
+- docs/dev/reports/samples2tools_batch_40_validation.txt (PASS)

docs/dev/reports/samples2tools_batch_40_validation.txt

@@ -0,0 +1,14 @@
+Samples2Tools batch 40 validation
+Generated: 2026-04-24T22:28:28.115Z
+Scope: Workspace-only game execution hardening (no bypass + hosted context propagation).
+
+- [PASS] Game launch guard has no standalone bypass flag :: games/shared/workspaceGameLaunchGuard.js
+- [PASS] Game launch guard allows only Workspace-hosted mode :: games/shared/workspaceGameLaunchGuard.js
+- [PASS] Workspace Manager writes shared host context for game mounts :: tools/Workspace Manager/main.js
+- [PASS] Workspace Manager passes hostContextId to game frame URL :: tools/Workspace Manager/main.js
+- [PASS] Workspace Manager removes game host context on unmount :: tools/Workspace Manager/main.js
+- [PASS] All launchable game pages include workspace launch guard :: launchable=11, guardIssues=0, missingFiles=0
+
+Checks: 6
+Failures: 0
+Result: PASS

docs/dev/reports/samples2tools_batch_41_summary.txt

@@ -0,0 +1,10 @@
+Samples2Tools batch 41 summary
+Generated: 2026-04-24T22:29:21.567Z
+Purpose: ensure primary Games Hub no longer exposes direct standalone debug launch affordances.
+
+Completed this batch:
+- Removed Asteroids direct standalone debug link from game cards
+- Kept Workspace Manager as the only explicit card-level launch action
+
+Primary validation artifact:
+- docs/dev/reports/samples2tools_batch_41_validation.txt (PASS)

docs/dev/reports/samples2tools_batch_41_validation.txt

@@ -0,0 +1,11 @@
+Samples2Tools batch 41 validation
+Generated: 2026-04-24T22:29:21.567Z
+Scope: remove remaining direct standalone launch affordances from primary Games Hub cards.
+
+- [PASS] Removed Asteroids direct debug standalone link :: games/index.render.js
+- [PASS] Primary game card launch action is Workspace Manager only :: games/index.render.js
+- [PASS] Game card title launch uses workspaceHref-or-href fallback path :: games/index.render.js
+
+Checks: 3
+Failures: 0
+Result: PASS

games/index.render.js

@@ -183,9 +183,6 @@ function renderCard(row, instanceKey = "main") {
 
   const classText = row.classValues.length > 0 ? row.classValues.map((value) => value.split("/").at(-1) || value).join(", ") : "none";
   const tagText = row.tags.length > 0 ? row.tags.join(", ") : "none";
-  const asteroidDebugLink = row.id === "Asteroids"
-    ? '<p><a class="game-title-link" href="/games/Asteroids/index.html?debug=1">Debug Mode</a></p>'
-    : "";
   const launchActions = row.workspaceHref
     ? `<p class="game-launch-actions"><a class="game-title-link" href="${escapeHtml(row.workspaceHref)}">Open In Workspace Manager</a></p>`
     : "";
@@ -196,7 +193,6 @@ function renderCard(row, instanceKey = "main") {
     ${previewHtml}
     <p>${escapeHtml(row.description)}</p>
     ${launchActions}
-    ${asteroidDebugLink}
     <p>Classes: ${escapeHtml(classText)}</p>
     <p>Tags: ${escapeHtml(tagText)}</p>
     ${row.requiresService ? '<p class="game-service-note">Requires background service.</p>' : ""}

games/shared/workspaceGameLaunchGuard.js

@@ -15,9 +15,7 @@ export function enforceWorkspaceGameLaunch(gameId) {
   const params = url.searchParams;
   const hosted = params.get("hosted") === "1";
   const hostToolId = (params.get("hostToolId") || "").trim().toLowerCase();
-  const allowStandalone = params.get("allowStandalone") === "1";
-
-  if (allowStandalone || (hosted && hostToolId === "workspace-manager")) {
+  if (hosted && hostToolId === "workspace-manager") {
     return;
   }
 

tools/Workspace Manager/main.js

@@ -1,5 +1,9 @@
 import { createToolHostManifest, getToolHostEntryById } from "../../tools/shared/toolHostManifest.js";
 import { createToolHostRuntime } from "../../tools/shared/toolHostRuntime.js";
+import {
+  removeToolHostSharedContextById,
+  writeToolHostSharedContext
+} from "../../tools/shared/toolHostSharedContext.js";
 
 const GAMES_METADATA_PATH = "/games/metadata/games.index.metadata.json";
 
@@ -21,6 +25,7 @@ const manifest = createToolHostManifest();
 const toolIds = manifest.tools.map((tool) => tool.id);
 const hasAvailableTools = toolIds.length > 0;
 let currentGameFrame = null;
+let currentGameHostContextId = "";
 
 function decodeSamplePresetPayload(encoded) {
   if (typeof encoded !== "string" || !encoded.trim()) {
@@ -184,13 +189,21 @@ async function readGameEntryById(gameId) {
 
 function unmountGameFrame() {
   if (!currentGameFrame) {
+    if (currentGameHostContextId) {
+      removeToolHostSharedContextById(currentGameHostContextId);
+      currentGameHostContextId = "";
+    }
     return;
   }
   if (currentGameFrame.parentElement === refs.mountContainer) {
     currentGameFrame.removeAttribute("src");
     refs.mountContainer.removeChild(currentGameFrame);
   }
   currentGameFrame = null;
+  if (currentGameHostContextId) {
+    removeToolHostSharedContextById(currentGameHostContextId);
+    currentGameHostContextId = "";
+  }
 }
 
 function mountGameFrame(gameEntry) {
@@ -201,6 +214,24 @@ function mountGameFrame(gameEntry) {
   runtime.unmountCurrentTool("switch-to-game");
   unmountGameFrame();
 
+  const hostContext = writeToolHostSharedContext({
+    toolId: "workspace-manager",
+    source: "game-host",
+    requestedAt: new Date().toISOString(),
+    sharedContext: {
+      hostMode: "game",
+      gameId: gameEntry.id,
+      gameTitle: gameEntry.title
+    },
+    state: {
+      game: {
+        id: gameEntry.id,
+        title: gameEntry.title,
+        href: gameEntry.href
+      }
+    }
+  });
+
   const frame = document.createElement("iframe");
   frame.setAttribute("data-game-host-frame", gameEntry.id);
   frame.setAttribute("title", `${gameEntry.title} Workspace Frame`);
@@ -209,6 +240,12 @@ function mountGameFrame(gameEntry) {
   gameUrl.searchParams.set("hosted", "1");
   gameUrl.searchParams.set("hostToolId", "workspace-manager");
   gameUrl.searchParams.set("hostGameId", gameEntry.id);
+  if (hostContext?.contextId) {
+    currentGameHostContextId = hostContext.contextId;
+    gameUrl.searchParams.set("hostContextId", hostContext.contextId);
+  } else {
+    currentGameHostContextId = "";
+  }
   frame.src = gameUrl.toString();
   refs.mountContainer.replaceChildren(frame);
   currentGameFrame = frame;
@@ -348,6 +385,17 @@ function bindEvents() {
   }
 
   window.addEventListener("popstate", () => {
+    const gameId = readInitialGameId();
+    if (gameId) {
+      void readGameEntryById(gameId).then((gameEntry) => {
+        if (!gameEntry) {
+          writeStatus(`Game "${gameId}" is not available for Workspace Manager launch.`);
+          return;
+        }
+        mountGameFrame(gameEntry);
+      });
+      return;
+    }
     const toolId = readInitialToolId();
     if (refs.toolSelect instanceof HTMLSelectElement) {
       refs.toolSelect.value = toolId;
@@ -357,6 +405,10 @@ function bindEvents() {
     mountSelectedTool("popstate");
     syncControlState();
   });
+
+  window.addEventListener("beforeunload", () => {
+    unmountGameFrame();
+  });
 }
 
 async function init() {