Twungeon · Devlog
Twungeon reaches a live Twitch concept milestone
Twungeon moved from a local proof of concept to a live Twitch-connected deployment with broadcaster OAuth, Extension identity sharing, Channel Points resurrection, a focused viewer control panel, and an authenticated spawn button.
Twungeon is now running as a live Twitch-connected concept on the
Labyricorn Twitch channel. The deployed
service connects Twurple chat and EventSub to the broadcaster account, verifies
Twitch Extension identity on the server, and serves the Extension through the
public Cloudflare tunnel at https://twungeon.labyricorn.com.
The authentication path required more than supplying a static token. Twungeon now provides a confidential OAuth authorization-code flow with state validation, checks that Twitch returned the configured broadcaster and required scopes, stores access and refresh credentials outside the repository with restricted permissions, and persists refreshed credentials atomically. The Extension exchanges its signed Twitch JWT for a short-lived Twungeon session; the shared Extension secret remains server-side.
The first setup attempt exposed several integration mismatches. The original
Twitch application had been registered as a public client before the callback
endpoint existed, so live server authorization required a new confidential
application and the exact HTTPS /oauth/callback redirect. Enabling identity
linking also made a privacy notice mandatory before the Extension version could
advance. Both requirements are now reflected in the implementation and operator
documentation.
The first live Extension view rendered the complete broadcast game instead of
a compact control surface. The shared frontend now switches to a controller-only
layout at /extension, while / remains the full game view used by the stream.
Cloudflare also continued serving an older JavaScript bundle during testing;
static responses now use Cache-Control: no-store, and the Extension loads a
versioned script URL to force the current controller code.
Spawning revealed one final usability gap. Chat !spawn was not sufficient for
the broadcaster because a channel owner cannot follow their own channel, and
the Extension offered no direct alternative. The control panel now includes a
Spawn character button backed by an authenticated server endpoint. It uses
the verified Twitch viewer ID, applies the normal follower rule, and treats the
configured broadcaster as eligible. The same eligibility correction also
allows broadcaster chat spawning.
The current deployment reports healthy with the Twitch adapter ready. Viewers can authorize their identity, spawn from the Extension, and use the movement, attack, heal, and pass controls for their own character. The configured custom Channel Points reward drives resurrection through EventSub. The final automated run passed linting, strict type checking, 24 domain tests, 10 integration and multi-viewer tests, and the production build.
This establishes the live interaction concept, but it is not a claim that every MVP acceptance gate is complete. Broader real-viewer, multi-viewer, usability, fault-injection, soak, and independent-operator evidence remains to be recorded. Game state is still intentionally in memory, so restarting the service starts a new run.
The live Twitch integration and spawn-control milestone are recorded in
commit df984690cedf84fc58d3eb6e2000d2df567a8d5d.