@agentbridge1/cli 0.0.6 → 0.0.7

package/dist/build-info.json

@@ -1,6 +1,6 @@
 {
-  "builtAt": "2026-06-06T12:05:27.957Z",
-  "gitHead": "ec17ba8",
-  "sourceLatestMtime": "2026-06-06T11:59:41.649Z",
-  "sourceLatestFile": "src/commands/watch.ts"
+  "builtAt": "2026-06-07T04:20:05.843Z",
+  "gitHead": "aa4b2fb",
+  "sourceLatestMtime": "2026-06-07T04:16:53.273Z",
+  "sourceLatestFile": "src/commands/room.ts"
 }

package/dist/commands/connect.js

@@ -293,6 +293,9 @@ async function runConnect(options = {}) {
         diagnostics.bootstrapStatus = "skipped";
         diagnostics.rotateStatus = "skipped";
     }
+    if (connectionUpgraded) {
+        await verifyCredentials(projectId, effectiveApiKey, apiBaseUrl);
+    }
     if (!executionSurfaceId) {
         (0, config_1.updateConfig)({
             projectId,

package/dist/commands/doctor.js

@@ -11,9 +11,15 @@ const dist_freshness_1 = require("./dist-freshness");
 const session_state_1 = require("../session-state");
 const server_sync_1 = require("../server-sync");
 const recovery_reconcile_1 = require("../recovery-reconcile");
+const rules_sync_1 = require("../rules-sync");
 function cliRootFromCommandDir() {
     return (0, node_path_1.resolve)(__dirname, "..", "..");
 }
+function isRecoveryBaselinePendingHello(hello) {
+    return (hello.setup_required === true ||
+        hello.agentbridge_status === "recovery_baseline_pending" ||
+        hello.instruction?.recovery_status === "baseline_required");
+}
 function normalizeReasonCandidate(value) {
     if (!value)
         return undefined;
@@ -87,11 +93,9 @@ function extractHttpReason(error) {
     }
     return `http_${error.status}`;
 }
-function detectGovernanceSignals(workspaceRoot) {
-    const rulesMdcPath = (0, node_path_1.resolve)(workspaceRoot, ".cursor", "rules", "agentbridge.mdc");
-    const rulesMarkdownPath = (0, node_path_1.resolve)(workspaceRoot, "AGENTBRIDGE.md");
+function detectGovernanceSignals(workspaceRoot, expectedProjectId) {
+    const analysis = (0, rules_sync_1.analyzeRulesArtifacts)(workspaceRoot, expectedProjectId);
     const mcpConfigPath = (0, node_path_1.resolve)(workspaceRoot, ".cursor", "mcp.json");
-    const rulesInstalled = (0, node_fs_1.existsSync)(rulesMdcPath) && (0, node_fs_1.existsSync)(rulesMarkdownPath);
     let mcpConfigured = false;
     if ((0, node_fs_1.existsSync)(mcpConfigPath)) {
         try {
@@ -104,9 +108,54 @@ function detectGovernanceSignals(workspaceRoot) {
         }
     }
     return {
-        rulesInstalled,
+        rulesFilesPresent: analysis.filesPresent,
+        rulesFormat: analysis.format,
+        rulesProjectIdInRepo: analysis.projectIdInRepo,
+        rulesProjectIdMatches: analysis.projectIdMatchesConfig,
+        rulesInstalled: analysis.protocolRulesValid,
+        rulesIssues: analysis.issues,
         mcpConfigured,
-        governanceStatus: rulesInstalled && mcpConfigured ? "active" : "inactive",
+        governanceStatus: analysis.protocolRulesValid && mcpConfigured ? "active" : "inactive",
+    };
+}
+function isRouteMissingBody(body) {
+    return body.toLowerCase().includes("route not found");
+}
+function mapProjectAccessFailure(error) {
+    if (error instanceof http_1.CliHttpError) {
+        const reason = extractHttpReason(error);
+        if (reason === "not_project_member") {
+            return {
+                status: "failed",
+                reason,
+                suggestedNextAction: "use an API key/agent that is a member of this project, or add this agent to the project.",
+            };
+        }
+        if (reason === "unauthorized") {
+            return {
+                status: "failed",
+                reason,
+                suggestedNextAction: "verify AGENTBRIDGE_API_KEY is valid for this environment and has project read access.",
+            };
+        }
+        if (reason === "project_not_found") {
+            return {
+                status: "failed",
+                reason,
+                suggestedNextAction: "verify AGENTBRIDGE_PROJECT_ID points to an existing project in this API environment.",
+            };
+        }
+        return {
+            status: "failed",
+            reason,
+            suggestedNextAction: "confirm project ID, API key, and base URL are correct and that this key has project read access.",
+        };
+    }
+    const messageReason = error instanceof Error ? normalizeReasonCandidate(error.message) : undefined;
+    return {
+        status: "failed",
+        reason: messageReason ?? "network_error",
+        suggestedNextAction: "check network reachability to the API base URL and retry doctor.",
     };
 }
 async function checkProjectAccess(ctx) {
@@ -119,46 +168,33 @@ async function checkProjectAccess(ctx) {
     const projectId = ctx.projectId;
     const apiKey = ctx.apiKey;
     const apiBaseUrl = ctx.apiBaseUrl;
+    const syncCtx = { projectId, apiKey, apiBaseUrl, apiKeySource: "config" };
+    const summaryPath = `/v1/dev/projects/${encodeURIComponent(projectId)}/summary`;
+    const packetPath = `/v1/dev/projects/${encodeURIComponent(projectId)}/packet`;
     try {
-        const packet = await (0, http_1.getJson)({ projectId, apiKey, apiBaseUrl, apiKeySource: "config" }, `/v1/dev/projects/${encodeURIComponent(projectId)}/packet`);
+        await (0, http_1.getJson)(syncCtx, summaryPath);
+        let packet;
+        try {
+            packet = await (0, http_1.getJson)(syncCtx, packetPath);
+        }
+        catch {
+            // Summary proves access; packet is optional (recovery metadata only).
+        }
         return { status: "ok", packet };
     }
     catch (error) {
-        if (error instanceof http_1.CliHttpError) {
-            const reason = extractHttpReason(error);
-            if (reason === "not_project_member") {
-                return {
-                    status: "failed",
-                    reason,
-                    suggestedNextAction: "use an API key/agent that is a member of this project, or add this agent to the project.",
-                };
-            }
-            if (reason === "unauthorized") {
-                return {
-                    status: "failed",
-                    reason,
-                    suggestedNextAction: "verify AGENTBRIDGE_API_KEY is valid for this environment and has project read access.",
-                };
+        if (error instanceof http_1.CliHttpError &&
+            error.status === 404 &&
+            isRouteMissingBody(error.body ?? "")) {
+            try {
+                const packet = await (0, http_1.getJson)(syncCtx, packetPath);
+                return { status: "ok", packet };
             }
-            if (reason === "project_not_found") {
-                return {
-                    status: "failed",
-                    reason,
-                    suggestedNextAction: "verify AGENTBRIDGE_PROJECT_ID points to an existing project in this API environment.",
-                };
+            catch (packetError) {
+                return mapProjectAccessFailure(packetError);
             }
-            return {
-                status: "failed",
-                reason,
-                suggestedNextAction: "confirm project ID, API key, and base URL are correct and that this key has project read access.",
-            };
         }
-        const messageReason = error instanceof Error ? normalizeReasonCandidate(error.message) : undefined;
-        return {
-            status: "failed",
-            reason: messageReason ?? "network_error",
-            suggestedNextAction: "check network reachability to the API base URL and retry doctor.",
-        };
+        return mapProjectAccessFailure(error);
     }
 }
 async function checkIdentityAccess(ctx) {
@@ -173,7 +209,8 @@ async function checkIdentityAccess(ctx) {
     }
     const helloUrl = `${ctx.apiBaseUrl}/v1/dev/projects/${ctx.projectId}/hello`;
     let identityModel = "unknown";
-    let executionSurfaceId = null;
+    let helloExecutionSurfaceId = null;
+    let baselinePending = false;
     try {
         const helloRes = await fetch(helloUrl, {
             method: "POST",
@@ -185,18 +222,22 @@ async function checkIdentityAccess(ctx) {
         });
         if (helloRes.ok) {
             const hello = (await helloRes.json());
+            baselinePending = isRecoveryBaselinePendingHello(hello);
             if (hello.identity_model === "work_identity") {
                 identityModel = "work_identity";
             }
             else if (hello.identity_model === "legacy") {
                 identityModel = "legacy";
             }
-            executionSurfaceId = hello.execution_surface?.id?.trim() || null;
+            helloExecutionSurfaceId = hello.execution_surface?.id?.trim() || null;
         }
     }
     catch {
         // Keep default unknown/null and continue with identity resolution checks.
     }
+    const configSurfaceId = ctx.configExecutionSurfaceId?.trim() || null;
+    const executionSurfaceId = helloExecutionSurfaceId || configSurfaceId;
+    const executionSurfaceSource = helloExecutionSurfaceId ? "hello" : configSurfaceId ? "config" : undefined;
     try {
         const syncCtx = {
             projectId: ctx.projectId,
@@ -209,18 +250,28 @@ async function checkIdentityAccess(ctx) {
             (0, server_sync_1.listWorkIdentities)(syncCtx),
         ]);
         const callerId = callerPacket?.work_identity?.id ?? null;
-        const startCapable = Boolean(executionSurfaceId);
-        if (callerId) {
-            return { status: "ok", identityModel, executionSurfaceId, startCapable };
+        const callerResolvable = Boolean(callerId) || identities.length === 1;
+        if (identityModel === "unknown" &&
+            callerResolvable &&
+            (baselinePending || Boolean(configSurfaceId))) {
+            identityModel = "work_identity";
         }
-        if (identities.length === 1) {
-            return { status: "ok", identityModel, executionSurfaceId, startCapable };
+        const startCapable = Boolean(executionSurfaceId);
+        if (callerResolvable) {
+            return {
+                status: "ok",
+                identityModel,
+                executionSurfaceId,
+                executionSurfaceSource,
+                startCapable,
+            };
         }
         return {
             status: "failed",
             reason: "caller_identity_unresolved",
             identityModel,
             executionSurfaceId,
+            executionSurfaceSource,
             startCapable,
         };
     }
@@ -230,6 +281,7 @@ async function checkIdentityAccess(ctx) {
             reason: "caller_identity_unresolved",
             identityModel,
             executionSurfaceId,
+            executionSurfaceSource,
             startCapable: Boolean(executionSurfaceId),
         };
     }
@@ -256,7 +308,7 @@ async function runDoctor(cliRootOverride) {
     const projectConfigPresent = projectIdPresent && apiKeyPresent && baseUrlPresent;
     const activeSession = (0, session_state_1.readSessionState)();
     const hasActiveWork = Boolean(activeSession?.id || activeSession?.serverSessionId);
-    const governance = detectGovernanceSignals(workspaceRoot);
+    const governance = detectGovernanceSignals(workspaceRoot, resolvedProjectId ?? undefined);
     const envContributed = Boolean(process.env.AGENTBRIDGE_PROJECT_ID) ||
         Boolean(process.env.AGENTBRIDGE_API_KEY) ||
         Boolean(process.env.AGENTBRIDGE_BASE_URL) ||
@@ -290,15 +342,35 @@ async function runDoctor(cliRootOverride) {
     if (projectAccess.reason) {
         lines.push(`Project access reason: ${projectAccess.reason}`);
     }
+    lines.push(`API key accepted by server: ${projectAccess.status === "ok"
+        ? "yes"
+        : projectAccess.status === "skipped"
+            ? "skipped"
+            : "no"}`);
     const identityAccess = await checkIdentityAccess({
         projectId: resolvedProjectId,
         apiKey: resolvedApiKey,
         apiBaseUrl: resolvedBaseUrl,
-        configComplete: projectConfigPresent && projectAccess.status === "ok",
+        configComplete: projectConfigPresent,
+        configExecutionSurfaceId: cfg.executionSurfaceId,
     });
+    lines.push(`Rules files present: ${governance.rulesFilesPresent ? "yes" : "no"}`);
+    lines.push(`Rules format: ${governance.rulesFormat}`);
+    if (governance.rulesProjectIdInRepo) {
+        lines.push(`Rules project ID: ${governance.rulesProjectIdInRepo}`);
+    }
+    if (governance.rulesProjectIdMatches !== null) {
+        lines.push(`Rules project ID match: ${governance.rulesProjectIdMatches ? "yes" : "no"}`);
+    }
     lines.push(`Rules installed: ${governance.rulesInstalled ? "yes" : "no"}`);
     lines.push(`MCP configured: ${governance.mcpConfigured ? "yes" : "no"}`);
     lines.push(`Agent governance: ${governance.governanceStatus}`);
+    if (governance.rulesIssues.length > 0) {
+        for (const issue of governance.rulesIssues) {
+            lines.push(`Rules issue: ${issue}`);
+        }
+        lines.push("Rules fix: run `agentbridge install-rules`");
+    }
     lines.push(`Start capable: ${identityAccess.startCapable ? "yes" : "no"}`);
     if (projectAccess.status === "failed" && projectAccess.reason) {
         const view = (0, error_catalog_1.catalogViewForDoctorReason)(projectAccess.reason, projectAccess.suggestedNextAction);
@@ -367,7 +439,7 @@ async function runDoctor(cliRootOverride) {
         lines.push(`- Rules: ${governance.rulesInstalled ? "installed" : "missing"}`);
         lines.push(`- MCP: ${governance.mcpConfigured ? "configured" : "missing"}`);
         lines.push("- Note: Project context exists, but domains are not fully mapped yet.");
-        lines.push("- Next: run `agent recover --force` for a full domain rebuild, or `agentbridge watch` for live supervision");
+        lines.push("- Next: run `agentbridge recover --force` for a full domain rebuild, or `agentbridge watch` for live supervision");
     }
     else if (productStatus === "active_work_found") {
         const recoveryBasic = (0, recovery_reconcile_1.recoveryIsBasicPacket)(projectAccess.packet);
@@ -399,6 +471,16 @@ async function runDoctor(cliRootOverride) {
         if (!projectConfigPresent) {
             lines.push("- Note: Connection details are missing. Add credentials, then rerun agentbridge doctor.");
         }
+        else if (projectAccess.status === "failed" &&
+            (projectAccess.reason === "unauthorized" ||
+                projectAccess.reason === "forbidden" ||
+                projectAccess.reason === "not_project_member")) {
+            lines.push("- Reason: API key rejected by server.");
+            lines.push("- Next: run `agentbridge room exit`, get a fresh key from the dashboard, then `agentbridge connect`.");
+            if (identityAccess.executionSurfaceId) {
+                lines.push("- Note: Config still has a saved execution surface, but the server rejected the stored API key.");
+            }
+        }
         else if (!identityAccess.startCapable) {
             lines.push("- Reason: execution surface missing.");
             lines.push("- Next: agentbridge connect");
@@ -406,7 +488,11 @@ async function runDoctor(cliRootOverride) {
         else {
             lines.push("- Note: Connection check failed. Verify credentials/network, then rerun agentbridge doctor.");
         }
-        if (identityAccess.startCapable) {
+        if (identityAccess.startCapable &&
+            projectAccess.status === "failed" &&
+            projectAccess.reason !== "unauthorized" &&
+            projectAccess.reason !== "forbidden" &&
+            projectAccess.reason !== "not_project_member") {
             lines.push("- Next: agentbridge doctor");
         }
     }
@@ -418,6 +504,9 @@ async function runDoctor(cliRootOverride) {
     }
     lines.push(`- Caller identity model: ${identityAccess.identityModel}`);
     lines.push(`- Execution surface present: ${identityAccess.executionSurfaceId ? "yes" : "no"}`);
+    if (identityAccess.executionSurfaceSource) {
+        lines.push(`- Execution surface source: ${identityAccess.executionSurfaceSource}`);
+    }
     lines.push(`- Start capable (strict/session modes): ${identityAccess.startCapable ? "yes" : "no"}`);
     if (identityAccess.status !== "ok") {
         lines.push("- Note: internal identity mismatch affects strict/resume flows, not room-level inferred watch startup.");

package/dist/commands/install-rules.js

@@ -0,0 +1,64 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runInstallRules = runInstallRules;
+const node_path_1 = require("node:path");
+const node_process_1 = require("node:process");
+const config_1 = require("../config");
+const errors_1 = require("../errors");
+const http_1 = require("../http");
+const rules_sync_1 = require("../rules-sync");
+function resolveNetworkContext(overrides) {
+    const cfg = (0, config_1.readConfig)();
+    const projectId = overrides.projectId ?? process.env.AGENTBRIDGE_PROJECT_ID ?? cfg.projectId ?? "";
+    const apiKey = overrides.apiKey ?? process.env.AGENTBRIDGE_API_KEY ?? cfg.apiKey ?? "";
+    const apiBaseUrl = overrides.apiBaseUrl ??
+        process.env.AGENTBRIDGE_BASE_URL ??
+        cfg.apiBaseUrl ??
+        "https://agentauth-api-production.up.railway.app";
+    if (!projectId || !apiKey) {
+        throw (0, errors_1.catalogCliError)("CONFIG_INCOMPLETE");
+    }
+    return { projectId, apiKey, apiBaseUrl };
+}
+async function runInstallRules(opts = {}) {
+    const ctx = resolveNetworkContext(opts);
+    const workspaceRoot = (0, node_process_1.cwd)();
+    let rules;
+    try {
+        rules = await (0, rules_sync_1.fetchProjectRules)(ctx);
+    }
+    catch (error) {
+        if ((0, http_1.isCliHttpError)(error)) {
+            throw new errors_1.SafeCliError(`Could not fetch AgentBridge rules for project ${ctx.projectId} (${error.status}).`);
+        }
+        throw error;
+    }
+    if (!Array.isArray(rules.files) || rules.files.length === 0) {
+        throw new errors_1.SafeCliError("AgentBridge rules response did not include any files to install.");
+    }
+    (0, rules_sync_1.writeRulesFiles)(workspaceRoot, rules.files);
+    let installedAt = null;
+    try {
+        const marked = await (0, rules_sync_1.markProjectRulesInstalled)(ctx);
+        installedAt = marked.rules_installed_at ?? null;
+    }
+    catch (error) {
+        if ((0, http_1.isCliHttpError)(error)) {
+            throw new errors_1.SafeCliError(`Wrote rules files locally, but could not mark them installed on the server (${error.status}).`);
+        }
+        throw error;
+    }
+    const projectName = (0, rules_sync_1.extractProjectNameFromRulesResponse)(rules.files);
+    const lines = [
+        "Installed AgentBridge protocol rules:",
+        `  Project: ${projectName ?? "(unknown name)"} (${ctx.projectId})`,
+        `  Wrote: ${(0, node_path_1.resolve)(workspaceRoot, "AGENTBRIDGE.md")}`,
+        `  Wrote: ${(0, node_path_1.resolve)(workspaceRoot, ".cursor", "rules", "agentbridge.mdc")}`,
+    ];
+    if (installedAt) {
+        lines.push(`  Server marked installed at: ${installedAt}`);
+    }
+    lines.push("");
+    lines.push("Next: run `agentbridge doctor` to verify rules and MCP configuration.");
+    process.stdout.write(`${lines.join("\n")}\n`);
+}

package/dist/commands/recover.js

@@ -110,7 +110,7 @@ function renderBasicHint() {
         "",
         "Recovery: basic",
         "AgentBridge found only a generic project area.",
-        "Run `agent recover --force` to rebuild the domain map.",
+        "Run `agentbridge recover --force` to rebuild the domain map.",
         "",
     ].join("\n");
 }
@@ -146,7 +146,18 @@ function normalizeBootstrapError(error) {
         return (0, errors_1.catalogCliError)("CONFIG_INCOMPLETE", {
             what: `Recovery bootstrap payload was rejected by server validation${detailText}.`,
             why: "The server cannot activate recovery until required bootstrap fields pass validation.",
-            next: "Retry `agentbridge recover`. If it fails again, run with AGENTBRIDGE_DEBUG=1 and share output.",
+            next: "Retry `agentbridge recover`. If it fails again, run with AGENTBRIDGE_DEBUG_HTTP=1 and share output.",
+        });
+    }
+    if ((0, http_1.isCliHttpError)(error) && error.status >= 500) {
+        const parsed = (0, http_1.parseCliHttpErrorBody)(error);
+        const serverDetail = (0, http_1.extractHttpErrorCode)(parsed) ||
+            error.body.trim().slice(0, 240) ||
+            "no response body";
+        return (0, errors_1.catalogCliError)("SERVER_ERROR", {
+            what: `Recovery bootstrap failed with HTTP ${error.status}.`,
+            why: "The server errored while applying recovery baseline at POST /v1/dev/projects/{id}/bootstrap.",
+            next: `Retry agentbridge recover. For full request/response traces, run with AGENTBRIDGE_DEBUG_HTTP=1. Server detail: ${serverDetail}`,
         });
     }
     if (error instanceof Error) {

package/dist/commands/room.js

@@ -0,0 +1,82 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.runRoomExit = runRoomExit;
+const config_1 = require("../config");
+const session_state_1 = require("../session-state");
+function envOverridesConfig() {
+    const overrides = [];
+    if (process.env.AGENTBRIDGE_PROJECT_ID?.trim()) {
+        overrides.push("AGENTBRIDGE_PROJECT_ID");
+    }
+    if (process.env.AGENTBRIDGE_API_KEY?.trim()) {
+        overrides.push("AGENTBRIDGE_API_KEY");
+    }
+    if (process.env.AGENTBRIDGE_BASE_URL?.trim()) {
+        overrides.push("AGENTBRIDGE_BASE_URL");
+    }
+    return overrides;
+}
+function shouldClearLocalSession(keepSession) {
+    if (keepSession)
+        return false;
+    const state = (0, session_state_1.readSessionState)();
+    if (!state)
+        return false;
+    return state.status === "active" || state.status === "blocked";
+}
+function runRoomExit(options = {}) {
+    const before = (0, config_1.readConfig)();
+    const hadConnection = Boolean(before.projectId || before.apiKey || before.executionSurfaceId || before.activeAgentId);
+    const result = (0, config_1.clearRoomConnection)();
+    const clearedSession = shouldClearLocalSession(Boolean(options.keepSession));
+    if (clearedSession) {
+        (0, session_state_1.clearSessionState)();
+    }
+    const envOverrides = envOverridesConfig();
+    if (options.json) {
+        process.stdout.write(`${JSON.stringify({
+            action: "room_exit",
+            config_path: config_1.CONFIG_PATH,
+            had_connection: hadConnection,
+            cleared_keys: result.clearedKeys,
+            previous_project_id: result.previousProjectId ?? null,
+            had_api_key: result.hadApiKey,
+            cleared_local_session: clearedSession,
+            env_overrides: envOverrides,
+            preserved: ["domains", "apiBaseUrl", "precommitHookInstalled", "cliPath"],
+        }, null, 2)}\n`);
+        return;
+    }
+    process.stdout.write("AgentBridge room exit\n");
+    process.stdout.write("─────────────────────────────────────────\n");
+    if (!hadConnection && result.clearedKeys.length === 0) {
+        process.stdout.write("No saved room connection in .agentbridge/config.json.\n");
+    }
+    else {
+        process.stdout.write("Cleared saved room connection from .agentbridge/config.json.\n");
+        if (result.previousProjectId) {
+            process.stdout.write(`  Project: ${result.previousProjectId}\n`);
+        }
+        if (result.hadApiKey) {
+            process.stdout.write("  API key: removed from config\n");
+        }
+        if (result.clearedKeys.includes("executionSurfaceId")) {
+            process.stdout.write("  Execution surface: removed from config\n");
+        }
+        if (result.clearedKeys.includes("activeAgentId")) {
+            process.stdout.write("  Active agent: removed from config\n");
+        }
+    }
+    if (clearedSession) {
+        process.stdout.write("Cleared active local supervision session (.agentbridge/session.json).\n");
+    }
+    process.stdout.write("\nPreserved: domain map and other recovery data from init/recover.\n");
+    process.stdout.write("Server rules and MCP config on disk are unchanged.\n");
+    if (envOverrides.length > 0) {
+        process.stdout.write(`\nNote: ${envOverrides.join(", ")} still set in your shell — they override config until unset.\n`);
+    }
+    process.stdout.write("\nNext:\n");
+    process.stdout.write("  1. Get a fresh API key at https://agentbridge.dev/dashboard\n");
+    process.stdout.write("  2. agentbridge connect --project <id> --api-key <key>\n");
+    process.stdout.write("  3. agentbridge doctor\n");
+}

package/dist/config.js

@@ -1,9 +1,10 @@
 "use strict";
 Object.defineProperty(exports, "__esModule", { value: true });
-exports.DEFAULT_API_BASE_URL = exports.CONFIG_PATH = exports.CONFIG_DIR = void 0;
+exports.ROOM_CONNECTION_KEYS = exports.DEFAULT_API_BASE_URL = exports.CONFIG_PATH = exports.CONFIG_DIR = void 0;
 exports.readConfig = readConfig;
 exports.writeConfig = writeConfig;
 exports.updateConfig = updateConfig;
+exports.clearRoomConnection = clearRoomConnection;
 exports.contextFromConfig = contextFromConfig;
 const node_fs_1 = require("node:fs");
 const node_path_1 = require("node:path");
@@ -30,6 +31,35 @@ function updateConfig(partial) {
     writeConfig(next);
     return next;
 }
+/** Config keys that bind this repo to a cloud room / execution surface. */
+exports.ROOM_CONNECTION_KEYS = [
+    "projectId",
+    "apiKey",
+    "activeAgentId",
+    "executionSurfaceId",
+    "activeChangeRequestId",
+    "lastAcceptedSessionId",
+    "lastAcceptedAt",
+];
+function clearRoomConnection() {
+    const current = readConfig();
+    const clearedKeys = [];
+    const next = { ...current };
+    for (const key of exports.ROOM_CONNECTION_KEYS) {
+        if (next[key] !== undefined) {
+            clearedKeys.push(key);
+            delete next[key];
+        }
+    }
+    if (clearedKeys.length > 0) {
+        writeConfig(next);
+    }
+    return {
+        clearedKeys,
+        previousProjectId: current.projectId,
+        hadApiKey: Boolean(current.apiKey),
+    };
+}
 function contextFromConfig() {
     const cfg = readConfig();
     const apiBaseUrl = process.env.AGENTBRIDGE_BASE_URL ??

package/dist/error-catalog.js

@@ -20,7 +20,7 @@ const CATALOG = {
         title: "Authentication failed.",
         what: "The API key was missing, invalid, or rejected by the server.",
         why: "AgentBridge cannot reach project APIs without valid credentials.",
-        next: "Verify AGENTBRIDGE_API_KEY and rerun `agentbridge doctor`.",
+        next: "Run `agentbridge room exit`, set a fresh AGENTBRIDGE_API_KEY, then `agentbridge connect`.",
     },
     PROJECT_ACCESS_NOT_FOUND: {
         code: "PROJECT_ACCESS_NOT_FOUND",

package/dist/index.js

@@ -25,11 +25,13 @@ const memory_1 = require("./commands/memory");
 const session_1 = require("./commands/session");
 const handshake_1 = require("./commands/handshake");
 const connect_1 = require("./commands/connect");
+const room_1 = require("./commands/room");
 const setup_mcp_1 = require("./commands/setup-mcp");
 const bug_1 = require("./commands/bug");
 const autopilot_1 = require("./commands/autopilot");
 const attention_1 = require("./commands/attention");
 const recover_1 = require("./commands/recover");
+const install_rules_1 = require("./commands/install-rules");
 const proof_guidance_1 = require("./commands/proof-guidance");
 const node_path_1 = require("node:path");
 const node_child_process_1 = require("node:child_process");
@@ -41,6 +43,10 @@ const COMMAND_HELP = {
     connect: "  agentbridge connect [--project <id>] [--api-key <key>] [--api-base-url <url>] [--agent <id>]\n" +
         "    Save credentials and verify connection to your AgentBridge project.\n" +
         "    Credentials can also come from AGENTBRIDGE_PROJECT_ID / AGENTBRIDGE_API_KEY env vars.\n",
+    room: "  agentbridge room exit [--keep-session] [--json]\n" +
+        "    Clear saved room credentials from .agentbridge/config.json (no server call).\n" +
+        "    Use when API keys are rejected or you need to connect to a different project.\n" +
+        "    Preserves domain recovery data from init/recover.\n",
     recover: "  agentbridge recover [--force]\n" +
         "    Recover project context so AI agents do not start blind.\n" +
         "    Shows project name, domains, and known context.\n",
@@ -89,6 +95,9 @@ const COMMAND_HELP = {
         "    Manage domain memory packets.\n",
     version: "  agentbridge version\n    Print CLI version.\n",
     doctor: "  agentbridge doctor\n    Run config and connectivity diagnostics.\n",
+    "install-rules": "  agentbridge install-rules [--project <id>] [--api-key <key>] [--api-base-url <url>]\n" +
+        "    Fetch server protocol rules for the connected project, write AGENTBRIDGE.md and\n" +
+        "    .cursor/rules/agentbridge.mdc, and mark rules installed on the server.\n",
     "precommit-check": "  agentbridge precommit-check\n    Git pre-commit hook: block commits that violate domain boundaries.\n",
     bug: "  agentbridge bug report --title \"<text>\" --severity P0|P1|P2|P3 --category <CATEGORY> \\\n" +
         "    [--found-in dogfood,production,...] --observed \"<text>\" --expected \"<text>\" \\\n" +
@@ -118,6 +127,8 @@ function usage(command, opts) {
         "Setup:",
         "  agentbridge doctor               Check connection and repo readiness",
         "  agentbridge connect              Save credentials (cloud projects)",
+        "  agentbridge room exit            Clear stale room credentials (no server call)",
+        "  agentbridge install-rules        Install server protocol rules in this repo",
         "",
         "Advanced commands:",
         "  start --task ... --scope ...     Strict scoped session (both flags required)",
@@ -263,6 +274,27 @@ async function main() {
         });
         return;
     }
+    if (command === "room") {
+        const sub = positional[0] ?? "";
+        if (sub === "exit") {
+            (0, room_1.runRoomExit)({
+                keepSession: flags["--keep-session"] === "true",
+                json: flags["--json"] === "true",
+            });
+            return;
+        }
+        process.stderr.write("Usage: agentbridge room exit [--keep-session] [--json]\n");
+        process.exit(3);
+        return;
+    }
+    if (command === "install-rules") {
+        await (0, install_rules_1.runInstallRules)({
+            projectId,
+            apiKey,
+            apiBaseUrl,
+        });
+        return;
+    }
     if (command === "recover") {
         await (0, recover_1.runRecover)({ force: Boolean(flags["--force"]) });
         return;

package/dist/init.js

@@ -597,6 +597,16 @@ async function runBootstrapRecovery(ctx, opts = {}) {
         const existingBootstrap = refsToBootstrapDomains(opts.reconcilePlan.existingActive);
         bootstrapPayload.domains = (0, recovery_reconcile_1.mergeBootstrapDomainEntries)(opts.reconcilePlan, candidateBootstrap, existingBootstrap);
     }
+    if (process.env.AGENTBRIDGE_DEBUG_HTTP === "1") {
+        const payloadDomains = Array.isArray(bootstrapPayload.domains)
+            ? bootstrapPayload.domains
+            : [];
+        const mappedPathCount = payloadDomains.reduce((count, domain) => {
+            const paths = domain.files && domain.files.length > 0 ? domain.files : domain.pathPatterns;
+            return count + (Array.isArray(paths) ? paths.length : 0);
+        }, 0);
+        process.stderr.write(`[agentbridge:recover] bootstrap POST project=${ctx.projectId} domains=${payloadDomains.length} mapped_paths=${mappedPathCount} product_summary_len=${String(bootstrapPayload.product_summary ?? "").length}\n`);
+    }
     await (0, http_1.postJson)(ctx, `/v1/dev/projects/${encodeURIComponent(ctx.projectId)}/bootstrap`, bootstrapPayload);
     const payloadDomains = Array.isArray(bootstrapPayload.domains)
         ? bootstrapPayload.domains

package/dist/rules-sync.js

@@ -0,0 +1,138 @@
+"use strict";
+Object.defineProperty(exports, "__esModule", { value: true });
+exports.PROTOCOL_RULES_MARKER = exports.LOCAL_RULES_HEADER = void 0;
+exports.rulesArtifactPaths = rulesArtifactPaths;
+exports.extractProjectIdFromRulesText = extractProjectIdFromRulesText;
+exports.classifyRulesFormat = classifyRulesFormat;
+exports.analyzeRulesArtifacts = analyzeRulesArtifacts;
+exports.fetchProjectRules = fetchProjectRules;
+exports.writeRulesFiles = writeRulesFiles;
+exports.markProjectRulesInstalled = markProjectRulesInstalled;
+exports.extractProjectNameFromRulesResponse = extractProjectNameFromRulesResponse;
+const node_fs_1 = require("node:fs");
+const node_path_1 = require("node:path");
+const http_1 = require("./http");
+exports.LOCAL_RULES_HEADER = "# AgentBridge Local Rules";
+exports.PROTOCOL_RULES_MARKER = "This repo is coordinated through AgentBridge";
+function rulesArtifactPaths(workspaceRoot) {
+    return {
+        rulesMarkdownPath: (0, node_path_1.resolve)(workspaceRoot, "AGENTBRIDGE.md"),
+        rulesMdcPath: (0, node_path_1.resolve)(workspaceRoot, ".cursor", "rules", "agentbridge.mdc"),
+    };
+}
+function extractProjectIdFromRulesText(content) {
+    const markdownMatch = content.match(/\*\*Project ID:\*\*\s*`([^`]+)`/);
+    if (markdownMatch?.[1]) {
+        return markdownMatch[1].trim();
+    }
+    const inlineMatch = content.match(/project ID:\s*`([^`]+)`/i);
+    if (inlineMatch?.[1]) {
+        return inlineMatch[1].trim();
+    }
+    return null;
+}
+function classifyRulesFormat(markdownContent, mdcContent) {
+    const md = markdownContent ?? "";
+    const mdc = mdcContent ?? "";
+    if (!md.trim() && !mdc.trim()) {
+        return "missing";
+    }
+    if (md.startsWith(exports.LOCAL_RULES_HEADER) || mdc.includes("Recovered domains:")) {
+        return "local";
+    }
+    if (md.includes(exports.PROTOCOL_RULES_MARKER) ||
+        mdc.includes("AgentBridge Protocol Rules") ||
+        mdc.includes("AgentBridge protocol rules")) {
+        return "protocol";
+    }
+    return "unknown";
+}
+function readOptionalFile(path) {
+    if (!(0, node_fs_1.existsSync)(path))
+        return null;
+    return (0, node_fs_1.readFileSync)(path, "utf8");
+}
+function analyzeRulesArtifacts(workspaceRoot, expectedProjectId) {
+    const paths = rulesArtifactPaths(workspaceRoot);
+    const markdownContent = readOptionalFile(paths.rulesMarkdownPath);
+    const mdcContent = readOptionalFile(paths.rulesMdcPath);
+    const filesPresent = markdownContent !== null && mdcContent !== null;
+    const format = classifyRulesFormat(markdownContent, mdcContent);
+    const projectIds = new Set();
+    if (markdownContent) {
+        const id = extractProjectIdFromRulesText(markdownContent);
+        if (id)
+            projectIds.add(id);
+    }
+    if (mdcContent) {
+        const id = extractProjectIdFromRulesText(mdcContent);
+        if (id)
+            projectIds.add(id);
+    }
+    const issues = [];
+    let projectIdInRepo = null;
+    if (projectIds.size === 1) {
+        projectIdInRepo = [...projectIds][0] ?? null;
+    }
+    else if (projectIds.size > 1) {
+        issues.push("AGENTBRIDGE.md and .cursor/rules/agentbridge.mdc reference different project IDs.");
+        projectIdInRepo = [...projectIds][0] ?? null;
+    }
+    else if (filesPresent) {
+        issues.push("Rules files are present but no project ID could be parsed.");
+    }
+    let projectIdMatchesConfig = null;
+    if (expectedProjectId) {
+        if (projectIdInRepo) {
+            projectIdMatchesConfig = projectIdInRepo === expectedProjectId;
+            if (!projectIdMatchesConfig) {
+                issues.push(`Rules reference project ${projectIdInRepo}, but configured project is ${expectedProjectId}.`);
+            }
+        }
+        else if (filesPresent) {
+            projectIdMatchesConfig = false;
+        }
+    }
+    if (!filesPresent) {
+        issues.push("Missing AGENTBRIDGE.md or .cursor/rules/agentbridge.mdc.");
+    }
+    else if (format === "local") {
+        issues.push("Rules are in local watch format (from agentbridge init), not server protocol rules.");
+    }
+    else if (format === "unknown") {
+        issues.push("Rules files exist but do not match the expected AgentBridge protocol format.");
+    }
+    const protocolRulesValid = filesPresent &&
+        format === "protocol" &&
+        (projectIdMatchesConfig ?? true) &&
+        issues.length === 0;
+    return {
+        paths,
+        filesPresent,
+        format,
+        projectIdInRepo,
+        projectIdMatchesConfig,
+        protocolRulesValid,
+        issues,
+    };
+}
+async function fetchProjectRules(ctx) {
+    return (0, http_1.getJson)(ctx, `/v1/dev/projects/${encodeURIComponent(ctx.projectId)}/rules`);
+}
+function writeRulesFiles(workspaceRoot, files) {
+    for (const file of files) {
+        const fullPath = (0, node_path_1.resolve)(workspaceRoot, file.path);
+        (0, node_fs_1.mkdirSync)((0, node_path_1.dirname)(fullPath), { recursive: true });
+        (0, node_fs_1.writeFileSync)(fullPath, file.content, "utf8");
+    }
+}
+async function markProjectRulesInstalled(ctx) {
+    return (0, http_1.postJson)(ctx, `/v1/dev/projects/${encodeURIComponent(ctx.projectId)}/rules/mark-installed`, {});
+}
+function extractProjectNameFromRulesResponse(files) {
+    const markdown = files.find((file) => file.path === "AGENTBRIDGE.md")?.content;
+    if (!markdown)
+        return null;
+    const match = markdown.match(/^# AgentBridge — (.+)$/m);
+    return match?.[1]?.trim() ?? null;
+}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@agentbridge1/cli",
-  "version": "0.0.6",
+  "version": "0.0.7",
   "description": "CLI for AgentBridge — structured AI agent work sessions with domain authority and approval gates",
   "type": "commonjs",
   "bin": {