@homie-rocks/studio 0.24.2 → 0.24.4

package/CHANGELOG.md

@@ -17,9 +17,64 @@ To bring a studio up to date, tell Claude: "Upgrade my studio to the newest Homi
 `npx -y @homie-rocks/studio@latest upgrade`, which shows what's new since the version your studio pins (from this
 file) and what the upgrade would change, and changes nothing until you agree.
 
+## [0.24.4] - 2026-10-03
+
+**Plugin 0.25.4** · [#37](https://github.com/homie-rocks/homie/pull/37)
+
+Your AI guides think with Cloudflare's Clef decision model, which does what a player asks; Clef runs on your own computer while you build; and your games can ask it for their own decisions (tactics, a director's call, a turn) in about a quarter of a second.
+
+### Added
+
+- **Clef thinks for your AI guides.** On a server whose guides use Workers AI, the default model is now `@cf/cloudflare/clef-flash`, Cloudflare's open-source decision model (Apache 2.0). It never writes text: each decision is asked as typed Choices of your `agents.json` (which goal, which quest or place or player, which line or none), and its answer is checked by the same rules as before. On 64 recorded Ember Vale moments it did what an open ask asked 36 times out of 40 by itself (the old Llama 3.1 8B: 0 of 40), and blind judges preferred its decisions in 51 of 64 (Llama's in none). In a live room it answered all 9 asks itself.
+- `homie-studio agents try <game> --view <file.json> [--ask ask_help:quest=king-slime --from 0] [--model <id>]`: what your guides' brain would decide in one moment, with no seat taken: the decision, the brain's own pick before the fixed rules, how sure it was, how long it took and what it cost. Use it to test an `agents.json` or to compare a model before setting it.
+- **Clef on your own computer.** With [Ollama](https://ollama.com) 0.35.1 or later and `clef-flash` on this computer, `homie-studio dev` runs the guides, chat review and your game's decisions on it: free, nothing sent to Cloudflare (`--no-local-ai` turns it off). `homie-studio agents sit <game> --brain local` (the MCP's `agent_sit { brain: "local" }`) seats a guide that thinks on your computer every few seconds. `setup status` has a "Clef on this computer" row. Nothing ever downloads the model by itself: `ollama pull clef-flash` is about 11 GB, and it is your call.
+- **Your game's own decisions** (NETPLAY.md section 20): `net.decide(state, questions, { floor })` on the host, for a game whose `game.json` says `"decide": true`. Ask a Choice (2 to 26 options), a yes/no or a Score about your game's state; the room asks Clef and answers with option ids and numbers, within the same daily budget as the guides, at most one ask every 3 s per room. It always answers: with your own floor when there is no AI, no budget, or no answer in time. Measured: about a quarter of a second there and back, about 4 neurons for three questions. Ask per beat or per turn, never per frame.
+- Ember Vale's slimes can think (opt-in: set `"decide": true` in its `game.json`): every 6 s the slimes' director picks how they hunt (rush, surround, gang up on the most hurt, regroup at the King), whether a wave comes and how hard to push, and every screen shows what the slimes are up to. On a kids server they never gang up on the most hurt and never push past steady.
+- The office shows each room's game decisions (how many, who answered, the model's time, the neurons), and each guide decision's model, how sure it was and, when a rule overruled it, what the brain itself chose.
+
+### Changed
+
+- A player's ask is now answered with the values they asked for: a brain that picks the asked goal with another quest or place is overruled, like one that picks another goal.
+- House guides remember the lines they said and who is new to them: they greet a newcomer once and otherwise stay quiet unless asked or something changes.
+- Clef costs more neurons a decision than Llama (about 9 against 4: it reads its questions and answers, and writes nothing), so the default 8,000 a day is about 900 guide decisions. Set `HOMIE_BRAIN_MODEL` to `@cf/meta/llama-3.1-8b-instruct-fp8-fast` in `wrangler.jsonc` to keep the old model.
+- The doctor's Workers AI check asks Clef one yes/no question (it does not take a chat message).
+
+### Upgrade notes
+
+- `npm run deploy` after upgrading: guides on Workers AI switch to Clef at their next decision. Nothing else to do.
+- To try local Clef, install Ollama (0.35.1 or later), say yes to the download, and run `ollama pull clef-flash`; then `npm run dev`.
+
+## [0.24.3] - 2026-10-03
+
+**Plugin 0.25.3** · [#36](https://github.com/homie-rocks/homie/pull/36) · [release-2026-10-03-studio-0.24.3](https://github.com/homie-rocks/homie/releases/tag/release-2026-10-03-studio-0.24.3)
+
+Set up your shop with Stripe's own tools for AI: your AI makes the products, checks tax, makes the webhook and answers "how are sales?"; you make the account, approve Stripe's pages and paste one key.
+
+### Added
+
+- Stripe's agent plugin is how your AI works with your Stripe (`npm install -g @stripe/cli@latest && stripe agent setup`: Stripe's own MCP server and skills for Claude Code and Codex, or Stripe's connector in the Claude app). It is set up when your studio starts selling, never before: `setup status` shows a Stripe row once `shop.json` exists. You sign in once on Stripe's page and give it a sandbox first.
+- `homie-studio shop catalog`: your items as Products in Stripe, made by your AI through Stripe's MCP. It names the one read to make, then (`--have <Stripe's answer>`) exactly the writes still needed: a Product per item with a tax code eligible for Managed Payments and a default Price of `shop.json`'s amount. A new price becomes a new default Price; an item you removed is archived, never deleted; products you made yourself are never touched. In sync, `shop.json` records `"catalog": ["test"]` and checkouts name each item's Product, so Stripe's Dashboard and reports see sales by product. `shop.json`'s price is still what is charged.
+- `homie-studio shop connect` now makes the webhook itself: you paste one restricted key (with Webhook Endpoints: Write added to its permissions), the page makes the endpoint with it, and Stripe's signing secret goes straight to your Worker without anyone seeing it. An older endpoint the kit made for the same address is turned off, not deleted. A key without that permission still works with a webhook secret you made yourself.
+- With Managed Payments chosen in test mode, the connect page tries one test checkout with it (expired at once) and tells you whether Stripe has it on for your account.
+- A refund Stripe holds for approval (when the shop's key is an Agent key) is shown as held, not failed: approve it in Stripe and the item leaves the player's account when Stripe refunds. Refunds made in Stripe's Dashboard or through Stripe's MCP take the item back the same way.
+- `homie-studio setup --via stripe-projects [--with elevenlabs]` (a prototype): for a creator with no Cloudflare account, Stripe Projects makes or links one (and ElevenLabs) on their own Stripe sign-in, on free plans. It stops at each step that is yours (Stripe's sign-in, the providers' terms, Cloudflare's approval page), puts the account id in `studio.json`, keeps the token in Projects' vault and its git-ignored `.env`, and every Wrangler run in the studio uses it. `npx wrangler login` stays the default.
+- The plugin's shop skill now walks a creator with a fresh Stripe account through it: what you click, what to tell your AI, and what stays yours. The studio-setup skill has the Stripe Projects option.
+
+### Changed
+
+- The Homie mod refuses a write through Stripe's MCP that would make a webhook endpoint (or an event destination with its secret): Stripe answers the signing secret in that call, and it would land in the conversation. The connect page makes the webhook instead.
+- The Homie mod now takes Stripe webhook signing secrets (`whsec_…`) out of tool output, as it does Stripe keys.
+- `providers.json` lists Stripe: its agent plugin and MCP server for the shop skill, and Stripe Projects for studio-setup. The shop skill declares Stripe's MCP server for Codex. The Homie mod holds `stripe projects upgrade`, `billing add` / `billing update` and anything with `--confirm-paid-service` as paid calls whose cost cannot be read first.
+- A new studio's `.gitignore` also keeps `.env.*`, `.projects/vault/` and `.projects/cache/` out of git; `upgrade` adds them to yours.
+
+### Upgrade notes
+
+- Stripe's MCP accepts only its sign-in page (OAuth) or keys tagged "Agent" from 2026-10-31. If you gave an AI a plain Stripe key for the MCP, replace it with an Agent key or sign in again. The shop's own key in your Worker is not affected, and must stay a plain restricted key.
+- To have the connect page make your webhook, add Webhook Endpoints: Write to the shop's restricted key (or make a new key) and run `homie-studio shop connect` again. Afterwards you can set that permission back to None.
+
 ## [0.24.2] - 2026-10-03
 
-**Plugin 0.25.2** · [#35](https://github.com/homie-rocks/homie/pull/35)
+**Plugin 0.25.2** · [#35](https://github.com/homie-rocks/homie/pull/35) · [release-2026-10-03-studio-0.24.2](https://github.com/homie-rocks/homie/releases/tag/release-2026-10-03-studio-0.24.2)
 
 Homie's skills work through each provider's own CLI, plugin and MCP server, declared so they load only when a skill needs them, and the Homie mod holds the paid calls and Cloudflare changes those tools can make.
 

package/README.md

@@ -284,8 +284,21 @@ npx homie-studio agents pass night-rush --label Claude
   day); with none, the game's scripted floor. The local MCP's `agent_sit` puts the owner's own Claude in a guide's
   seat. The AI never types: it picks ids; the room drops anything else.
   [agents/GUIDES.md](agents/GUIDES.md) is the short path for an existing RPG.
+- **Clef thinks for the guides** (0.24.4): Workers AI's default for them is Cloudflare's decision model
+  (`@cf/cloudflare/clef-flash`), which answers a decision as typed Choices (goal, values, line or none) and never
+  writes text. On 64 recorded Ember Vale moments it answered 36 of 40 open asks itself (Llama 3.1 8B: none) and blind
+  judges preferred it in 51 of 64, at about 9 neurons a decision (Llama: 4). `HOMIE_BRAIN_MODEL` still picks Llama or
+  the 27B Clef; `agents try <game> --view <file> [--ask …] [--model …]` shows what the brain would decide in a moment.
+- **Clef on your own computer** (0.24.4): with Ollama and `clef-flash` here, `dev` runs the guides, chat review and
+  game decisions on it, free and with no Cloudflare, and `agents sit --brain local` (the MCP's `agent_sit { brain:
+  "local" }`) seats a guide that thinks here. Nothing downloads it: `ollama pull clef-flash` is about 11 GB, the
+  person's choice (doctor's "Clef on this computer" row says what is there).
+- **A game's own decisions** (0.24.4, NETPLAY.md section 20): `net.decide(state, questions, { floor })` on the host,
+  for a game whose game.json says `"decide": true`: tactics for its opponents, an NPC's reaction, a director's call,
+  a turn's move, answered by Clef in the room in about a quarter of a second, per beat (never per frame), within the
+  AI brains' day; the floor answers whenever it cannot. Ember Vale's slimes pick their tactics this way (opt-in).
 - Everything is in the studio's own Worker and D1 (migration `0006_studio_servers.sql`). The site's side is in
-  [site/SITE.md](site/SITE.md); the room's in [netplay/NETPLAY.md](netplay/NETPLAY.md) sections 17 and 18.
+  [site/SITE.md](site/SITE.md); the room's in [netplay/NETPLAY.md](netplay/NETPLAY.md) sections 17, 18 and 20.
 
 ## Room chat
 
@@ -314,7 +327,8 @@ npx homie-studio chat words                                             # the bu
 - **Moderation, in the studio's own Worker, before anyone sees a typed line:** a built-in word list and patterns
   (slurs, sexual words, self-harm, personal questions and contact details, links, swears, your own words), then
   Cloudflare's **Clef** decision model on the studio's own Workers AI (`@cf/cloudflare/clef-flash`, about 2.3
-  neurons a message measured, 2,000 a day by default: inside the free allocation). Emoji and quick lines are never reviewed.
+  neurons a message measured, 2,000 a day by default: inside the free allocation; under `dev`, Clef on this computer
+  when Ollama has it, free). Emoji and quick lines are never reviewed.
 - **The owner:** every live room's last minutes in the office with Remove, Mute and Kick (from a line, with their
   lines taken down), the same in the owner's own game, the reports players make, and Announce (a studio line).
 - **Speech bubbles:** `net.on('say')` and the port kit's `createBubbles` / `paintBubbles`; Gem Rush, Ember Vale and
@@ -325,7 +339,7 @@ npx homie-studio chat words                                             # the bu
 
 ## Selling things: the shop
 
-A studio sells items for its games (0.24.0) with **its own Stripe account**: the studio is the seller, money goes
+A studio sells items for its games (0.24.0; Stripe's own agent tools since 0.24.3) with **its own Stripe account**: the studio is the seller, money goes
 straight from players to its Stripe, and homie.rocks never sees, holds or moves it (Homie takes no cut; no shared
 currency; not a Connect platform). Real-money prices only, nothing random, the kids rules built in (no shop on a kids
 server, spending off until a neutral age question says adult, nothing for under-13s, 13-17 through a parent's own
@@ -334,11 +348,20 @@ checkout, a monthly cap), and the television only shows a code to buy on a phone
 ```sh
 npx homie-studio shop init --supporter        # shop.json with a US$5 Supporter pack, and SELLING.md (the owner's plain words)
 npx homie-studio shop check                   # the kit's rules; every build checks them too
-npx homie-studio shop connect                 # a page on THIS computer: the owner pastes a restricted key and the webhook secret
+npx homie-studio shop catalog [--have <file>] # the items as Products in Stripe: the read, then the exact writes (Stripe's MCP)
+npx homie-studio shop connect                 # a page on THIS computer: the owner pastes one restricted key; it makes the webhook
 npx homie-studio shop                         # open (test or live) or what is missing
 npx homie-studio shop refund ord_…            # an ASK: the owner taps once (or Refund in /_studio/office/shop)
 ```
 
+Since 0.24.3 the owner's AI sets it up with **Stripe's own agent tools** (`npm install -g @stripe/cli@latest && stripe
+agent setup`: Stripe's MCP server and skills; the owner signs in once on Stripe's page, a sandbox first): it makes the
+catalog through the MCP (`shop catalog` says exactly what to write), reads the tax settings, and answers "how are
+sales?" read-only. The owner makes the account, approves Stripe's pages and pastes **one** restricted key on the
+connect page, which makes the webhook with it, so its signing secret goes straight to the Worker and never through a
+chat. A webhook is never made through Stripe's MCP (its answer carries the secret). From 2026-10-31 Stripe's MCP takes
+only OAuth or Agent-tagged keys; the shop's own key is a plain restricted key and is not affected.
+
 In a game: `createShop()` from `@homie-rocks/studio/shop` (`has`, `entitlements`, `on('change')`, `open`, `used`); a
 supporter's badge rides on their seat (`peer.badge`). Stripe Checkout (hosted), Stripe Tax on, or Stripe Managed
 Payments (Stripe as seller of record, 3.5% more) as one switch; a signed, idempotent webhook; refunds from the
@@ -356,7 +379,9 @@ One checklist of what this computer and the person's accounts have for a studio:
 connector (the AI says whether its Homie tools are there; the directory is reached), Cloudflare (signed in
 with the studio's own Wrangler, and the account's email verified: a deploy that went through proves it, a
 deploy refused for it is remembered), Chrome for the checks, ffmpeg, and the optional GitHub, ElevenLabs and
-fal (and, in Claude Code, the status line). Each row is green, missing or "do this now", says what it
+fal (and, in Claude Code, the status line); in a studio that sells (shop.json), a Stripe row: whether Stripe's own
+agent plugin (its MCP server) is set up for this AI, with `stripe agent setup` as the fix (0.24.3); and in a studio, whether Clef is on this
+computer (Ollama with `clef-flash`, optional, never downloaded without the person's yes) (0.24.4). Each row is green, missing or "do this now", says what it
 unlocks, and gives the exact fix: a command the AI runs or a page the person taps. It only reads, answers in
 seconds, and never prints a key, a token or an account's name or id. A studio the Claude app's setup card made
 (`setup attach`) counts as connected to Cloudflare and GitHub there. `--json` gives the rows.
@@ -613,6 +638,27 @@ the home folder's `.cache/homie-studio` (from storage.googleapis.com, which a cl
 renders with SwiftShader. `check` reports how fast each browser drew the game and on what renderer; on SwiftShader
 it says the frame rate is not a person's, and judges only seats, rooms and rounds.
 
+## Another way to Cloudflare: Stripe Projects (a prototype, 0.24.3)
+
+`npx wrangler login` stays the way. For a creator with no Cloudflare account (and no ElevenLabs), Stripe Projects
+(Stripe's CLI plugin, docs.stripe.com/projects) can make or link both on the person's own Stripe sign-in, on free
+plans, and hand the credentials to the studio folder:
+
+```sh
+npx homie-studio setup --via stripe-projects [--with elevenlabs] --dry-run   # what it would do; changes nothing
+npx homie-studio setup --via stripe-projects [--with elevenlabs] --accept-tos  # after the person accepted the providers' terms
+```
+
+It stops with a `needs` step at each thing that is the person's (the Stripe CLI and its Projects plugin, Stripe's
+sign-in, the providers' terms, Cloudflare's own approval page for an existing account); it never adds a paid plan or
+a payment method. The Cloudflare account id goes in studio.json with `"auth": "stripe-projects"`; the token stays in
+Projects' vault and the git-ignored `.env` it syncs, and every Wrangler run in the studio takes it from there
+(`deploy`, `dev`, secrets, the office). It checks read-only what the token can do (Wrangler signed in, D1, Workers AI;
+R2 is optional) and that `.gitignore` keeps `.env`, `.env.*`, `.projects/vault/` and `.projects/cache/` out of git.
+With `--with elevenlabs` the music skill finds the ElevenLabs key there too (ElevenLabs' free plan has no commercial
+licence). Unverified until a real run: the exact JSON of the Projects commands, and the Cloudflare token's permission
+groups, which the checks measure instead of assuming.
+
 ## No payment method needed
 
 `deploy` creates only what Cloudflare's free Workers plan gives a new account with no

package/agents/GUIDES.md

@@ -10,8 +10,8 @@ Vale (`homie-studio game new <id> --from ember-vale`) is the worked example.
 - A beginner server whose AI guide seats (always marked "· AI") follow new heroes, lead them to places, take on a
   quest with them, and pull back when asked.
 - **Hands** are your game's own bot code, every frame, at the party's skill dial. **The brain** picks a goal every
-  few seconds: the studio's own Workers AI, the owner's own key, or the owner's Claude in a seat. With none of them
-  (or over the day's budget) your scripted `decide` plays.
+  few seconds: the studio's own Workers AI (Clef), the owner's own key, or the owner's Claude in a seat. With none
+  of them (or over the day's budget) your scripted `decide` plays.
 - The AI never types. It chooses ids from your `agents.json`; your game draws your own words.
 
 ## 1. Upgrade
@@ -86,10 +86,17 @@ const agents = useAgents(room.net, vocab as unknown as Vocabulary, {
 
 1. `homie-studio servers new <id> "First Steps" --policy beginner --guides 2` (add `--kids` for children).
 2. `homie-studio agents brain <id> first-steps workers-ai`: the first time is an ASK the owner taps; then
-   `npm run deploy` once (it binds Workers AI). The free allocation (10,000 neurons a day) gives about six busy
-   guide-hours; the default budget is 8,000. Or `owner-key` with `agents brain key` on the owner's own computer.
-3. Try it: two browsers on the server's page, walk up to a guide, tap "Help me with ...". In a terminal or the
-   local MCP, `agent_sit { game: "<id>", server: "first-steps" }` puts your own Claude in a guide's seat.
+   `npm run deploy` once (it binds Workers AI). The guides think with Cloudflare's Clef decision model
+   (`@cf/cloudflare/clef-flash`, the default since 0.24.4): it answers each decision as typed Choices of your
+   goals, values and lines, so it does what an ask asks far more often than a chat model did. About 9 neurons a
+   decision: the default budget of 8,000 a day is about 900 decisions (the free allocation is 10,000). Or
+   `owner-key` with `agents brain key` on the owner's own computer.
+3. Try it: `homie-studio agents try <id> --view view.json --ask ask_help:quest=<quest> --from 0` shows what the
+   brain would decide in that moment (with `--model` to compare one). Then two browsers on the server's page, walk
+   up to a guide, tap "Help me with ...". In a terminal or the local MCP, `agent_sit { game: "<id>", server:
+   "first-steps" }` puts your own Claude in a guide's seat; `brain: "local"` lets Clef on your computer decide.
+   Under `npm run dev` the guides think with Clef on your own computer when Ollama has `clef-flash` (free; it is
+   about 11 GB and only ever downloaded when you say so: `ollama pull clef-flash`).
 
 ## 5. Do not
 

package/bin/homie-studio.mjs

@@ -18,8 +18,10 @@
  *   homie-studio games
  *   homie-studio build [<id>] [--maps]   (--maps: also keep each bundle's source map and module sizes in .studio/maps/<id>/,
  *                                          never in site/dist: what `perf` reads a CPU profile through)
- *   homie-studio dev [--port 8787] [--remote-ai]   (--stop: stop exactly this studio's dev server, nothing else;
- *                                         AI guides think scripted here unless --remote-ai: real Workers AI, billed)
+ *   homie-studio dev [--port 8787] [--remote-ai] [--no-local-ai]   (--stop: stop exactly this studio's dev server, nothing else;
+ *                                         AI guides, chat review and game decisions think with Clef on this computer
+ *                                         when Ollama has clef-flash (free; dev never downloads it), else scripted;
+ *                                         --remote-ai: the real Workers AI, billed)
  *   homie-studio check <id> [--url <site>] [--shots <dir>]
  *   homie-studio perf <id> [--url <site>] [--device computer,phone] [--runs 1] [--seconds 15] [--warm 3] [--profile]
  *                     [--cpu 4] [--out <dir>] [--max-load 0.8] [--pair <label>]
@@ -121,12 +123,21 @@
  *                                          time AI guides may talk are ASKED for, like office kick; --budget is
  *                                          Workers AI neurons a day, or dollars a day for the owner's key)
  *   homie-studio agents brain key [--remove]   (the owner's AI key, typed into a page on this computer only)
+ *   homie-studio agents sit <game> [--server <id>] [--brain local]   (a guide's seat from this terminal; --brain local:
+ *                                          Clef on this computer decides every few seconds, free; never downloads it)
+ *   homie-studio agents try <game> --view <file.json> [--ask <ask>[:<arg>=<value>] --from <seat>] [--model <id>]
+ *                                         (what the guides' brain would decide in that moment, with no seat taken;
+ *                                          spent from the guides' day; --model compares a model before setting it)
  *   homie-studio shop                     is the studio's shop selling (its own Stripe), and if not, what is missing
  *   homie-studio shop init [--supporter] [--currency usd] [--price 500] [--managed]   shop.json and SELLING.md
  *   homie-studio shop check               shop.json against the kit's rules (real money, nothing random, the kids rules)
  *   homie-studio shop connect [--managed] [--live]   a page on THIS computer where the owner pastes the studio's
- *                                         restricted Stripe key and webhook secret: straight to the Worker secrets,
- *                                         never a chat or a file (test keys only unless --live)
+ *                                         restricted Stripe key; with it this makes the webhook (0.24.3), and the key
+ *                                         and the webhook's secret go straight to the Worker secrets, never a chat or a
+ *                                         file (test keys only unless --live)
+ *   homie-studio shop catalog [--have <file>|-] [--mode test|live]   the items as Products in the studio's Stripe,
+ *                                         made by the AI through Stripe's own MCP: the read first, then (with what it
+ *                                         answered) the exact writes; in sync, shop.json "catalog" records the mode
  *   homie-studio shop disconnect          both secrets gone: the shop closes
  *   homie-studio shop orders              the latest orders (never a card or an email)
  *   homie-studio shop refund <order> [--reason …] [--note "<why>"]   ASKS the owner (a one-tap link)
@@ -162,6 +173,13 @@
  *                                          the build so the chat's card follows it, and print the steps; HANDOFF.md)
  *   homie-studio setup attach <hs_…>      (this repository is the studio the Claude app's setup card is making: say so, once,
  *                                          learn its live address, and give a template copy its real name)
+ *   homie-studio setup --via stripe-projects [--with elevenlabs] [--accept-tos] [--dry-run]
+ *                                         (a prototype, 0.24.3: Cloudflare, and ElevenLabs with --with, made or linked
+ *                                          through Stripe Projects on their free plans; the person accepts the providers'
+ *                                          terms (then --accept-tos) and signs in on Stripe's and the provider's own
+ *                                          pages; the account id goes into studio.json, the token stays in Projects'
+ *                                          vault and its git-ignored .env, and Wrangler runs with it here. The usual
+ *                                          way, npx wrangler login, stays the default. lib/projects.mjs)
  *   homie-studio setup status [--connector yes|no]   (also: homie-studio doctor)
  *                                         what this computer and the person's accounts have for a studio: Node, the Homie
  *                                         connector, Cloudflare (signed in, email verified), Chrome, ffmpeg, GitHub,
@@ -234,9 +252,13 @@ import { statsKey, statsLink, statsRevoke, statsShare, statsShow } from '../lib/
 import { playersOwner, playersShow } from '../lib/players.mjs';
 import { officeAnnounce, officeClose, officeInvite, officeKey, officeKick, officeLaunch, officeLines, officeLink, officeMute, officeRevoke, officeShow } from '../lib/office.mjs';
 import { chatBudget, chatLines, chatRemove, chatRulesSet, chatShow, chatWords } from '../lib/chat-cli.mjs';
-import { agentsBrain, agentsBrainKey, agentsPass, agentsPasses, agentsRevoke, serversClose, serversLevel, serversLines, serversList, serversMember, serversNew, serversSet } from '../lib/servers.mjs';
+import { detectLocalAi, localAiVars } from '../lib/local-ai.mjs';
+import { agentsBrain, agentsBrainKey, agentsPass, agentsPasses, agentsRevoke, agentsTry, serversClose, serversLevel, serversLines, serversList, serversMember, serversNew, serversSet } from '../lib/servers.mjs';
 import { AgentSeat } from '../lib/agent-seat.mjs';
 import { shopCheck, shopConnect, shopDisconnect, shopInit, shopLines, shopOrders, shopRefund, shopStatements, shopStatus } from '../lib/shop.mjs';
+import { catalogLines, catalogPlan } from '../lib/shop-catalog.mjs';
+import { projectsLines, setupViaProjects } from '../lib/projects.mjs';
+import { projectsCloudflareEnv } from '../lib/projects-env.mjs';
 import { Feed, currentFeed, currentId, flushProgress, publicFeed, readFeed, recordChange, startProgress } from '../lib/progress.mjs';
 import { formatStatus, setupStatus } from '../lib/doctor.mjs';
 import { codexTarget, newCodex, writeCodexPage } from '../lib/codex.mjs';
@@ -249,7 +271,7 @@ import { formatHandoff, handoff } from '../lib/handoff.mjs';
 
 const argv = process.argv.slice(2);
 const flags = new Map();
-const BOOL_FLAGS = ['off', 'revoke', 'json', 'yes', 'detach', 'no-install', 'plan', 'stop', 'share', 'apply', 'diff', 'template', 'ci', 'fresh', 'install', 'remove', 'replace', 'artifact', 'open', 'reopen', 'kids', 'remote-ai', 'dry-run', 'verify', 'maps', 'profile', 'hands-on', 'automatic', 'unlock', 'confirm', 'no-library', 'no-validate', 'rigged', 'supporter', 'managed', 'live', 'send'];
+const BOOL_FLAGS = ['off', 'revoke', 'json', 'yes', 'detach', 'no-install', 'plan', 'stop', 'share', 'apply', 'diff', 'template', 'ci', 'fresh', 'install', 'remove', 'replace', 'artifact', 'open', 'reopen', 'kids', 'remote-ai', 'dry-run', 'verify', 'maps', 'profile', 'hands-on', 'automatic', 'unlock', 'confirm', 'no-library', 'no-validate', 'rigged', 'supporter', 'managed', 'live', 'send', 'accept-tos', 'quiet', 'no-local-ai'];
 const positional = [];
 for (let i = 0; i < argv.length; i++) {
   const a = argv[i];
@@ -461,6 +483,12 @@ function print(result) {
     case 'shop disconnect':
       lines.push(...shopLines(result));
       break;
+    case 'shop catalog':
+      lines.push(...catalogLines(result));
+      break;
+    case 'setup':
+      lines.push(...projectsLines(result));
+      break;
     case 'chat rules':
     case 'chat budget':
     case 'shop refund':
@@ -662,6 +690,12 @@ async function main() {
   if (cmd === 'codex') return codexCommand(root, sub);
   if (cmd === 'progress') return progressCommand(root, sub);
   if (cmd === 'setup' && sub === 'attach') return setupAttach(root, positional[2], { homie: flags.get('homie') });
+  if (cmd === 'setup' && flags.has('via')) {
+    if (flags.get('via') !== 'stripe-projects') return { ok: false, command: 'setup', why: '--via stripe-projects is the one other way this version knows (the default is npx wrangler login)' };
+    const extra = String(flags.get('with') ?? '').split(',').map((x) => x.trim()).filter(Boolean);
+    if (extra.some((x) => x !== 'elevenlabs')) return { ok: false, command: 'setup', why: '--with takes elevenlabs (Cloudflare is always set up)' };
+    return setupViaProjects(root, { withElevenlabs: extra.includes('elevenlabs'), acceptTos: flags.has('accept-tos'), dryRun: flags.has('dry-run'), log });
+  }
   if (cmd === 'handoff') return handoff(root, sub, { homie: flags.get('homie') });
   if (cmd === 'port' && sub === 'import') return importPort(root, positional[2], flags.get('id'), { name: flags.get('name'), mode: flags.get('mode') });
   if (cmd === 'port' && sub === 'check') {
@@ -775,10 +809,22 @@ async function main() {
     if (sub === 'check') return shopCheck(root);
     if (sub === 'connect') return shopConnect(root, { managed: flags.has('managed') ? true : null, live: flags.has('live'), log });
     if (sub === 'disconnect') return shopDisconnect(root);
+    if (sub === 'catalog') {
+      const from = flags.get('have');
+      let have = null;
+      if (from === '-' || from === true) have = readFileSync(0, 'utf8');
+      else if (typeof from === 'string') {
+        if (!existsSync(from)) return { ok: false, command: 'shop catalog', why: `no such file: ${from}` };
+        have = readFileSync(from, 'utf8');
+      }
+      const mode = flags.get('mode');
+      if (mode !== undefined && mode !== 'test' && mode !== 'live') return { ok: false, command: 'shop catalog', why: '--mode is test or live' };
+      return catalogPlan(root, { have, mode: mode ?? null });
+    }
     if (sub === 'orders') return shopOrders(root, { url });
     if (sub === 'refund') return shopRefund(root, positional[2], { url, reason: flags.get('reason'), note: flags.get('note') });
     if (sub === 'statements') return shopStatements(root, { url, period: flags.get('period'), send: flags.has('send') });
-    return { ok: false, command: 'shop', why: `unknown: shop ${sub} (init, check, connect, disconnect, orders, refund, statements)` };
+    return { ok: false, command: 'shop', why: `unknown: shop ${sub} (init, check, connect, disconnect, catalog, orders, refund, statements)` };
   }
   if (cmd === 'agents') {
     const url = flags.get('url');
@@ -787,8 +833,9 @@ async function main() {
     if (sub === 'revoke') return agentsRevoke(root, positional[2], { url });
     if (sub === 'brain' && positional[2] === 'key') return agentsBrainKey(root, { remove: flags.has('remove'), log });
     if (sub === 'brain') return agentsBrain(root, positional[2], positional[3], positional[4], { url, budget: flags.get('budget') });
-    if (sub === 'sit') return agentsSit(root, positional[2], { url, server: flags.get('server'), pass: flags.get('pass'), label: flags.get('label') });
-    return { ok: false, command: 'agents', why: `unknown: agents ${sub ?? ''} (pass, passes, revoke, brain, brain key, sit)` };
+    if (sub === 'sit') return agentsSit(root, positional[2], { url, server: flags.get('server'), pass: flags.get('pass'), label: flags.get('label'), brain: flags.get('brain') });
+    if (sub === 'try') return agentsTry(root, positional[2], { url, view: flags.get('view'), ask: flags.get('ask'), from: flags.get('from'), model: flags.get('model'), mode: flags.get('mode'), quiet: flags.has('quiet'), avoid: flags.get('avoid'), players: flags.get('players'), readFile: (f) => readFileSync(resolve(f), 'utf8') });
+    return { ok: false, command: 'agents', why: `unknown: agents ${sub ?? ''} (pass, passes, revoke, brain, brain key, sit, try)` };
   }
   if (cmd === 'media' && sub === 'put') return mediaPut(root, positional[2], flags.get('as'));
   if (cmd === 'media' && sub === 'move') return mediaMove(root, { paths: positional.slice(2), dryRun: flags.has('dry-run') || flags.has('plan'), verify: flags.has('verify'), log });
@@ -983,7 +1030,7 @@ async function dev(root) {
   const bin = wranglerBin(root);
   if (!bin) return { ok: false, command: 'dev', why: 'run npm install in the studio first' };
   const studio = readStudio(root);
-  const env = { ...process.env, WRANGLER_SEND_METRICS: 'false', CI: '1' };
+  const env = { ...process.env, ...projectsCloudflareEnv(root), WRANGLER_SEND_METRICS: 'false', CI: '1' };
   for (const added of ensureMigrations(root)) log(`added ${added} (${migrationWord(added)})`);
   await new Promise((done) => {
     const m = spawn(bin, ['d1', 'migrations', 'apply', 'DB', '--local'], { cwd: workerDir(root), env, stdio: ['ignore', 'ignore', 'inherit'] });
@@ -992,9 +1039,17 @@ async function dev(root) {
   log(`Local site: http://127.0.0.1:${port}/  (each game: http://127.0.0.1:${port}/<id>/play — open it in two browsers)`);
   const ai = devConfig(root, flags.has('remote-ai'));
   if (ai.note) log(ai.note);
+  // The person's own Clef (0.24.4, lib/local-ai.mjs): with Ollama and clef-flash on this computer, the local Worker's
+  // guides, chat review and game decisions think here, free. Never a download: dev only says what one would cost.
+  let localVars = [];
+  if (!flags.has('remote-ai') && !flags.has('no-local-ai')) {
+    const found = await detectLocalAi();
+    localVars = localAiVars(found);
+    log(found.ok ? `AI guides, chat review and game decisions think with ${found.model} on this computer (Ollama ${found.version}): free, nothing sent to Cloudflare.` : found.say);
+  }
   // --remote-ai: Wrangler's --local turns every remote binding off ("not supported"), so a dev with the real Workers AI
   // (the guides' brains, room chat's review) runs without it; everything else stays local all the same.
-  const child = spawn(bin, ['dev', ...(flags.has('remote-ai') ? [] : ['--local']), '--ip', '127.0.0.1', '--port', port, ...ai.args], { cwd: workerDir(root), env, stdio: 'inherit' });
+  const child = spawn(bin, ['dev', ...(flags.has('remote-ai') ? [] : ['--local']), '--ip', '127.0.0.1', '--port', port, ...ai.args, ...localVars], { cwd: workerDir(root), env, stdio: 'inherit' });
   mkdirSync(dirname(devFile(root)), { recursive: true });
   writeFileSync(devFile(root), `${JSON.stringify({ pid: process.pid, child: child.pid, port: Number(port), at: new Date().toISOString() })}\n`);
   log(`Stop it with: npx --no-install homie-studio dev --stop   (this studio's dev server only)`);
@@ -1025,13 +1080,20 @@ function devConfig(root, remoteAi) {
   const copy = join(base, '.wrangler', 'homie-dev.wrangler.json');
   mkdirSync(dirname(copy), { recursive: true });
   writeFileSync(copy, `${JSON.stringify(json, null, 2)}\n`);
-  return { args: ['--config', copy, '--persist-to', join(base, '.wrangler', 'state')], note: remoteAi ? 'AI guides think with Workers AI (remote, billed to the signed-in account).' : 'AI guides think scripted here (no Workers AI under dev; --remote-ai for the real one).' };
+  return { args: ['--config', copy, '--persist-to', join(base, '.wrangler', 'state')], note: remoteAi ? 'AI guides think with Workers AI (remote, billed to the signed-in account).' : 'No Workers AI under dev (--remote-ai for the real one, billed): AI guides think with Clef on this computer when Ollama has it, else scripted.' };
 }
 
 /** `agents sit`: an AI guide's seat from this terminal, for a demo or a test of a vocabulary. Lines on stdin act. */
-async function agentsSit(root, game, { url, server, pass, label }) {
+async function agentsSit(root, game, { url, server, pass, label, brain }) {
   const site = url ?? siteUrl(root);
-  const seat = new AgentSeat({ site, game, server: server ?? null, pass: pass ?? null, label: label ?? 'Claude', root });
+  // --brain local: Clef on this computer decides (lib/local-ai.mjs); never a download, only what one would cost.
+  let local = null;
+  if (brain === 'local') {
+    local = await detectLocalAi();
+    if (!local.ok) return { ok: false, command: 'agents sit', why: local.say };
+    log(`This seat thinks with ${local.model} on this computer (Ollama ${local.version}) every few seconds. Type stand to leave.`);
+  } else if (brain !== undefined) return { ok: false, command: 'agents sit', why: '--brain is local (Clef on this computer), or leave it out to choose yourself' };
+  const seat = new AgentSeat({ site, game, server: server ?? null, pass: pass ?? null, label: label ?? (local ? 'Clef' : 'Claude'), root, brain: local ? 'local' : null, local });
   const r = await seat.sit();
   if (!r.ok) return { ok: false, command: 'agents sit', why: r.why };
   log(`Seated as ${r.name} in ${r.room} (seat ${r.seat}). Type: look | do <goal> {"arg":…} | say <line> {"arg":…} with a goal | stand`);
@@ -1065,7 +1127,7 @@ function mediaPut(root, file, as) {
   const key = as ?? (/^(music|videos)\//.test(rel) && !rel.includes('..') ? rel : `${folder}/${basename(file)}`);
   const bin = wranglerBin(root);
   return new Promise((done) => {
-    const p = spawn(bin, ['r2', 'object', 'put', `${r2}/${key}`, '--file', resolve(file), '--content-type', typeOf(file), '--remote'], { cwd: workerDir(root), env: { ...process.env, CI: '1' }, stdio: ['ignore', 'ignore', 'inherit'] });
+    const p = spawn(bin, ['r2', 'object', 'put', `${r2}/${key}`, '--file', resolve(file), '--content-type', typeOf(file), '--remote'], { cwd: workerDir(root), env: { ...process.env, ...projectsCloudflareEnv(root), CI: '1' }, stdio: ['ignore', 'ignore', 'inherit'] });
     p.on('close', (code) => {
       if (code !== 0) return done({ ok: false, command: 'media put', why: 'wrangler r2 object put failed' });
       // The manifest is committed: it names the file by its path on the site, never the workers.dev address.

package/chat/CHAT.md

@@ -90,6 +90,8 @@ accuracy numbers for it, and the message it reads is a player's, so a player can
 (less of a risk than with a model that writes, since it only scores fixed answers). That is why
 **the word list always runs first and decides alone** whenever the review cannot (no binding, the
 day's budget used, an error, a slow answer). `HOMIE_CHAT_MODEL` switches to Clef or Llama Guard.
+Under `homie-studio dev` with no Workers AI binding, the same question goes to Clef on the person's
+own computer when Ollama has `clef-flash` (0.24.4): free, nothing sent to Cloudflare.
 Firewall for AI (now "AI Security for Apps") was ruled out: it reads HTTP requests at the zone, not
 messages inside a Durable Object, and its detections are an Enterprise add-on.
 

package/lib/agent-seat.mjs

@@ -8,8 +8,13 @@
  *
  * The pass: one the owner gave (`hap_…`), or, from a studio folder, a one-day guide pass minted with the owner's office
  * key and revoked when the AI stands. The secret stays in this process; it is never printed or returned.
+ *
+ * BRAIN 'local' (0.24.4): instead of an AI's turns, Cloudflare's Clef decision model on this computer (Ollama with
+ * clef-flash, lib/local-ai.mjs) decides every few seconds, the way a house guide does (worker/agents.mjs think: the same
+ * questions, the same fixed rules), for free and with nothing sent to Cloudflare. agent_do still overrides it.
  */
-import { parseDecision, renderLine, vocabularyOf } from '../worker/brain.mjs';
+import { clefDecide, parseDecision, renderLine, vocabularyOf } from '../worker/brain.mjs';
+import { think } from '../worker/agents.mjs';
 import { withKey } from './office.mjs';
 
 const GAME = /^[a-z0-9][a-z0-9-]{0,39}$/;
@@ -26,7 +31,7 @@ export class AgentSeat {
    * @param {string} [o.pass]   an agent pass (hap_…); else one is minted from `root` with the office key
    * @param {string} [o.root]   the studio folder (for a pass of its own)
    */
-  constructor({ site, game, server = null, pass = null, label = 'Claude', root = null, WebSocketImpl = globalThis.WebSocket, fetchImpl = globalThis.fetch }) {
+  constructor({ site, game, server = null, pass = null, label = 'Claude', root = null, WebSocketImpl = globalThis.WebSocket, fetchImpl = globalThis.fetch, brain = null, local = null }) {
     this.site = String(site ?? '').replace(/\/+$/, '');
     this.game = game;
     this.server = server;
@@ -52,6 +57,10 @@ export class AgentSeat {
     this.errors = [];
     this.vocab = null;
     this.ping = null;
+    /** brain 'local': Clef on this computer ({ base, model }) decides; its last decisions, and who said no thanks. */
+    this.brain = brain === 'local' && local ? 'local' : null;
+    this.local = local;
+    this.auto = { timer: null, busy: false, at: 0, decisions: [], avoid: new Map(), said: [], goalState: null };
   }
 
   async sit() {
@@ -101,9 +110,56 @@ export class AgentSeat {
     this.ping = setInterval(() => { try { ws.send(JSON.stringify({ t: 'ping', c: Date.now() })); } catch { /* closed */ } }, 2000);
     // The host shows a guide the game every 2 s: wait for the first look (up to 6 s).
     for (let i = 0; i < 30 && !this.view && !this.closed; i += 1) await wait(200);
+    if (this.brain === 'local') this.autopilot();
     return { ok: true, seat: this.seat, name: this.name, room: this.room, server: this.server, ...this.look() };
   }
 
+  /**
+   * BRAIN 'local': a decision on a new ask (at once), when the goal in force ends, else every 12 s while the room has a
+   * view; never more than one at a time, and do() keeps the 3 s pace and the 8 s quiet. No thanks holds that player off
+   * for 10 minutes.
+   */
+  autopilot() {
+    const tick = async () => {
+      if (this.closed) { this.stopAuto(); return; }
+      const now = Date.now();
+      const a = this.auto;
+      const asks = this.asks.filter((x) => now - x.at < 30_000);
+      const state = this.view?.goal && typeof this.view.goal === 'object' ? this.view.goal.state ?? null : null;
+      const ended = (state === 'done' || state === 'failed') && a.goalState !== state;
+      a.goalState = state;
+      if (a.busy || !this.view || !(asks.length || ended || now - a.at >= 12_000)) return;
+      a.busy = true;
+      a.at = now;
+      for (const [s, until] of a.avoid) if (until <= now) a.avoid.delete(s);
+      for (const x of asks) if (this.vocab?.asks?.[x.k]?.leave) a.avoid.set(x.from, now + 10 * 60_000);
+      try {
+        const party = Array.isArray(this.view.party) ? this.view.party.map((p) => p?.seat).filter(Number.isInteger) : [];
+        const ctx = {
+          view: this.view, me: { seat: this.seat }, goal: this.view.goal ?? null, asks, party: this.party.filter((p) => now - p.at < 60_000),
+          speech: this.policy?.speech ?? 'lines', kids: this.policy?.kids === true, quiet: !this.talking() || now - this.sayAt < 8000,
+          players: party, avoid: [...a.avoid.keys()], said: a.said.map((x) => ({ ...x, ago: now - x.at })),
+        };
+        const local = this.local;
+        const t = await think(this.vocab, { mode: 'local', brain: { engine: 'local', run: (args) => clefDecide({}, { vocab: args.vocab, ctx: args.ctx, model: local.model, ms: 8000, local, fetch: this.fetch }) }, ctx });
+        const d = t.decision;
+        let sent = null;
+        if (d?.goal && !this.closed) {
+          const say = d.say && this.talking() && Date.now() - this.sayAt >= 8000 ? d.say : null;
+          sent = await this.do({ goal: d.goal, args: d.args, say, sayArgs: say ? d.sayArgs : {} });
+          if (sent.ok && say) a.said = [...a.said, { line: say, args: d.sayArgs, at: Date.now() }].slice(-4);
+        }
+        a.decisions = [...a.decisions, { at: new Date(now).toISOString(), provider: t.provider, goal: d?.goal ?? null, args: d?.args ?? null, say: d?.say ?? null, ms: t.ms, ...(t.why ? { why: t.why } : {}), ...(sent && !sent.ok ? { refused: sent.why } : {}) }].slice(-20);
+      } catch (error) {
+        a.decisions = [...a.decisions, { at: new Date(now).toISOString(), provider: 'none', why: String(error?.message ?? error).slice(0, 120) }].slice(-20);
+      } finally { a.busy = false; }
+    };
+    this.auto.timer = setInterval(() => { void tick(); }, 1000);
+    void tick();
+  }
+
+  stopAuto() { if (this.auto.timer) clearInterval(this.auto.timer); this.auto.timer = null; }
+
   onFrame(m) {
     switch (m.t) {
       case 'welcome': this.seat = m.seat; this.name = m.name; this.policy = m.policy ?? null; return;
@@ -135,6 +191,7 @@ export class AgentSeat {
       asks: this.asks.filter((a) => now - a.at < 60_000).map((a) => ({ ask: a.k, args: a.args, seat: a.from, text: v ? renderLine(v, a.k, a.args, { kind: 'asks', nameOf: (s) => `seat ${s}` }) : null, secondsAgo: Math.round((now - a.at) / 1000) })),
       party: this.party.filter((p) => now - p.at < 60_000).map((p) => ({ seat: p.seat, line: p.line, args: p.args })),
       lastDo: this.lastDo,
+      ...(this.brain === 'local' ? { brain: { local: this.local.model, decisions: this.auto.decisions.slice(-5) } } : {}),
       choices: v ? { goals: describe(v.goals), lines: describe(v.lines) } : null,
       errors: this.errors.slice(-3),
     };
@@ -162,6 +219,7 @@ export class AgentSeat {
   talking() { return Boolean(this.policy && ['workers-ai', 'owner-key'].includes(this.policy.brain) && this.policy.speech !== 'off'); }
 
   close() {
+    this.stopAuto();
     if (this.ping) clearInterval(this.ping);
     this.ping = null;
     if (this.ws) { try { this.ws.send(JSON.stringify({ t: 'bye' })); } catch { /* closed */ } try { this.ws.close(1000, 'bye'); } catch { /* closed */ } }

package/lib/brain-probe.mjs

@@ -6,14 +6,14 @@
  * doctor asks once.
  *
  * The check is ONE tiny call to the model through Cloudflare's REST API (`POST /accounts/:id/ai/run/:model`, a
- * one-word prompt, max_tokens 1: about 0.1 of the 10,000 free neurons a day), with the studio's own Wrangler login
+ * one-word prompt, max_tokens 1, or for a Clef decision model one yes/no question: a few of the 10,000 free neurons a day), with the studio's own Wrangler login
  * (`wrangler auth token`, held in this process only) or CLOUDFLARE_API_TOKEN. It never prints the token, the account's
  * id or its name. A call that cannot be made (not signed in, several accounts and none named) says so and spends
  * nothing.
  */
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
-import { DEFAULT_MODEL } from '../worker/brain.mjs';
+import { CLEF, DEFAULT_MODEL } from '../worker/brain.mjs';
 import { configPath, workerDir } from './studio.mjs';
 
 const MODELS = 'https://developers.cloudflare.com/workers-ai/models/';
@@ -96,7 +96,8 @@ export async function probeModel({ model, accountId, headers, fetchFn = globalTh
     const res = await fetchFn(`${String(base).replace(/\/+$/, '')}/accounts/${encodeURIComponent(accountId)}/ai/run/${model}`, {
       method: 'POST',
       headers: { ...headers, 'content-type': 'application/json', accept: 'application/json', 'user-agent': 'homie-studio-doctor' },
-      body: JSON.stringify({ messages: [{ role: 'user', content: 'Say OK.' }], max_tokens: 1 }),
+      // A decision model (Clef) takes a state and a question, not a chat message: one yes/no, a few hundred tokens.
+      body: JSON.stringify(CLEF.models[model] ? { model: CLEF.models[model], state: 'OK', questions: { ok: { type: 'noul', instructions: 'Does the state say OK?' } } } : { messages: [{ role: 'user', content: 'Say OK.' }], max_tokens: 1 }),
       signal: AbortSignal.timeout(ms),
     });
     return { status: res.status, body: await res.json().catch(() => null) };
@@ -122,7 +123,7 @@ export async function workersAiRow({ root, studio, env = process.env, exec, fetc
   const where = set ? 'HOMIE_BRAIN_MODEL in wrangler.jsonc' : 'the toolkit\'s default';
   const pick = (lead) => ({
     who: 'ai', open: MODELS,
-    say: `${lead}Pick a model the account can run: set HOMIE_BRAIN_MODEL in wrangler.jsonc "vars" to a text-generation model from ${MODELS} that is not marked Workers Paid${set && model !== DEFAULT_MODEL ? ` (or remove it for the default, ${DEFAULT_MODEL})` : ''}, run \`${cli} doctor\` again, then \`npm run deploy\`. Until then the guides answer from the game's script.`,
+    say: `${lead}Pick a model the account can run: set HOMIE_BRAIN_MODEL in wrangler.jsonc "vars" to a model from ${MODELS} that is not marked Workers Paid (Clef, @cf/cloudflare/clef-flash, or a text-generation model)${set && model !== DEFAULT_MODEL ? ` (or remove it for the default, ${DEFAULT_MODEL})` : ''}, run \`${cli} doctor\` again, then \`npm run deploy\`. Until then the guides answer from the game's script.`,
   });
   const money = ' Moving the account to Workers Paid ($5 a month) also works, but that is the person\'s money: ask them, never decide it.';
   if (!MODEL_ID.test(model)) return { ...row, state: 'act', detail: `${where} is "${model.slice(0, 80)}", which is not a Workers AI model id (@cf/<maker>/<model>)`, fix: pick('') };
@@ -145,7 +146,7 @@ export async function workersAiRow({ root, studio, env = process.env, exec, fetc
     case 'missing': return { ...row, state: 'act', detail: `Cloudflare has no model ${model} (renamed or retired)${said}`, fix: pick('') };
     case 'not-allowed': return { ...row, state: 'act', detail: `this account may not use ${model} (a private model)${said}`, fix: pick('') };
     case 'agreement': return { ...row, state: 'act', detail: `${model} asks for its maker's licence to be agreed once before it is used${said}`, fix: pick('Agreeing to a licence is the person\'s to do, never yours; or simply: ') };
-    case 'input': return { ...row, state: 'act', detail: `${model} did not take a chat message: the guides need a text-generation model${said}`, fix: pick('') };
+    case 'input': return { ...row, state: 'act', detail: `${model} did not take a chat message: the guides need Clef or a text-generation model${said}`, fix: pick('') };
     case 'allowance': return { ...row, state: 'later', detail: `today's free Workers AI allowance (10,000 neurons for the account) is used up, so ${model} could not be checked; the guides answer from the script until 00:00 UTC`, fix: { who: 'person', say: `Nothing to do now: run doctor again after 00:00 UTC. The studio's daily budget (\`${cli} agents brain <game> <server> workers-ai --budget <neurons>\`) keeps the guides under the allowance.` } };
     case 'busy': return { ...row, state: 'unknown', detail: `Workers AI was busy just now (status ${answer.status})${said}; run doctor again in a minute`, fix: null };
     case 'auth': return { ...row, state: 'unknown', detail: `Cloudflare did not let this sign-in run Workers AI (status ${answer.status})${said}`, fix: { who: 'ai', run: 'npx wrangler login', say: 'Sign in to Cloudflare again (the login includes Workers AI), then run doctor again.' } };

package/lib/build.mjs

@@ -321,6 +321,8 @@ export async function build(root, { only = null, log = () => {}, deploy = proces
     // Room chat (NETPLAY.md section 19): game.json "chat", checked here (its quick lines pass the chat floor too).
     const chatBad = chatProblems(g.chat);
     if (chatBad.length) throw new Error(`games/${g.id}/game.json: ${chatBad.join('; ')}`);
+    // A game's own decisions (NETPLAY.md section 20): game.json "decide" is true or false (the Worker answers net.decide only then).
+    if (g.decide !== undefined && typeof g.decide !== 'boolean') throw new Error(`games/${g.id}/game.json: "decide" is true (the host may ask the studio's decision model, within the AI brains' day) or false`);
     // The game's own source, for other studios to remix (game.json "share": { "source": false } keeps it private).
     if (g.share?.source !== false) writeFileSync(join(out, 'source.json'), `${JSON.stringify(sourceOf(g.dir, g.id, { studio: studio.name ?? null, game: g.name ?? g.id, license: g.license }))}\n`);
     // Its assets' licences, and the address and SHA-256 of each one a remix may carry (`game remix` fetches them).
@@ -368,6 +370,7 @@ export async function build(root, { only = null, log = () => {}, deploy = proces
       // game.json `"chat"` (0.23.0, NETPLAY.md section 19): the room chat's defaults for this game (the owner's office
       // overrides them), or false for none.
       ...(g.chat === false ? { chat: false } : g.chat && typeof g.chat === 'object' ? { chat: g.chat } : {}),
+      ...(g.decide === true ? { decide: true } : {}),
       // Servers (0.16.0): the seeds game.json ships, the netplay revision its build speaks (the office warns when it
       // predates servers), and game.json "agents": { "vote": "game" | false } (the game draws its own vote card, or none).
       ...(seeds.length ? { servers: seeds } : {}),