@homie-rocks/studio 0.24.2 → 0.24.4

package/lib/cloudflare.mjs

@@ -30,6 +30,7 @@ import { MAX_ASSET_BYTES, R2_COST, mediaPlan, r2OverOf, recordMove, sha256File,
 import { repoOf } from './repo.mjs';
 import { ensureLocalIgnored, ensureMigrations, migrationWord, wranglerConfig } from './scaffold.mjs';
 import { LOCAL_STATE, configPath, isWorkersDev, layoutOf, readLocal, readStudio, siteUrl, workerDir, writeLocal, writeStudio } from './studio.mjs';
+import { projectsCloudflareEnv } from './projects-env.mjs';
 
 const ANSI = /\u001b\[[0-9;]*m/g;
 
@@ -38,13 +39,17 @@ export function wranglerBin(root) {
   return existsSync(local) ? local : null;
 }
 
-/** Wrangler from the studio's own node_modules, run in site/ with the given environment. */
+/**
+ * Wrangler from the studio's own node_modules, run in site/ with the given environment. A studio whose Cloudflare came
+ * through Stripe Projects (studio.json `cloudflare.auth: "stripe-projects"`, 0.24.3) runs it with the token and account
+ * Projects synced to its git-ignored output file; every other studio with Wrangler's own sign-in.
+ */
 export function runner(root, env) {
   const bin = wranglerBin(root);
   if (!bin) throw new Error('Wrangler is not installed in this studio yet: run `npm install` in the studio folder first');
   return (args, { cwd = workerDir(root), input } = {}) => {
     const res = spawnSync(bin, args, {
-      cwd, env: { ...process.env, ...env, WRANGLER_SEND_METRICS: 'false', CI: '1' }, encoding: 'utf8',
+      cwd, env: { ...process.env, ...projectsCloudflareEnv(root), ...env, WRANGLER_SEND_METRICS: 'false', CI: '1' }, encoding: 'utf8',
       input, maxBuffer: 64 * 1024 * 1024, timeout: 10 * 60_000,
     });
     const out = `${res.stdout ?? ''}${res.stderr ?? ''}`.replace(ANSI, '');
@@ -128,6 +133,9 @@ export async function deploy(root, { log = () => {}, homie } = {}) {
   const created = new Set(cf.created ?? []);
   const who = whoami(root);
   if (!who) {
+    if (cf.auth === 'stripe-projects') {
+      return { ok: false, command: 'deploy', needs: 'cloudflare-login', why: 'Wrangler did not accept the Cloudflare token Stripe Projects keeps for this studio (studio.json "auth": "stripe-projects"). Run `stripe projects env --pull` in the studio folder (it rewrites the git-ignored .env from Projects\' vault), then `npm run deploy` again; or sign in the usual way (`npx wrangler login`) and remove "auth" from studio.json.' };
+    }
     return { ok: false, command: 'deploy', needs: 'cloudflare-login', why: 'Wrangler is not signed in to Cloudflare. Run `npx wrangler login` in the studio folder: it opens Cloudflare in the browser and the person approves once (a free account works, no payment method). Then run `npm run deploy` again.' };
   }
   const accountId = process.env.CLOUDFLARE_ACCOUNT_ID || cf.accountId || (who.accounts.length === 1 ? who.accounts[0].id : null);
@@ -274,6 +282,8 @@ export function needsWorkersAi(root, w, db) {
     // Room chat (0.23.0): a game whose players may type has its messages reviewed by the studio's own Workers AI
     // (Cloudflare's Clef decision model, within a day's budget of the free allocation) unless its game.json says no.
     if ((cat.games ?? []).some((g) => g.chat !== false && (g.chat?.mode ?? 'text') === 'text' && g.chat?.ai !== false)) return true;
+    // A game's own decisions (0.24.4): a game whose game.json says "decide": true asks the same decision model.
+    if ((cat.games ?? []).some((g) => g.decide === true)) return true;
   } catch { /* not built */ }
   const r = w(['d1', 'execute', db, '--remote', '--json', '--command', "SELECT COUNT(*) AS n FROM servers WHERE brain = 'workers-ai' AND state = 'open'"]);
   if (r.code !== 0) return false;
@@ -490,7 +500,7 @@ export async function mediaMove(root, { paths = null, dryRun = false, verify = f
   const bin = wranglerBin(root);
   if (!bin) return { ok: false, ...base, why: 'Wrangler is not installed in this studio yet: run `npm install` in the studio folder first' };
   const account = accountId || process.env.CLOUDFLARE_ACCOUNT_ID || cf.accountId || null;
-  const opts = { cwd: workerDir(root), env: { ...process.env, ...(account ? { CLOUDFLARE_ACCOUNT_ID: account } : {}), WRANGLER_SEND_METRICS: 'false', CI: '1' } };
+  const opts = { cwd: workerDir(root), env: { ...process.env, ...projectsCloudflareEnv(root), ...(account ? { CLOUDFLARE_ACCOUNT_ID: account } : {}), WRANGLER_SEND_METRICS: 'false', CI: '1' } };
   const moved = [];
   const failed = [];
   const verified = [];

package/lib/doctor.mjs

@@ -16,6 +16,10 @@
  *   GitHub             optional    a private backup, publishing by pull request, building from the Claude app
  *   ElevenLabs         optional    songs and game scores
  *   fal                optional    painted art and generated video
+ *   Stripe             for selling only in a studio with shop.json (0.24.3): Stripe's own agent plugin (its MCP server
+ *                                  and skills) for this AI, set up when the studio starts selling; the shop's key itself
+ *                                  goes in through `homie-studio shop connect`, never here
+ *   Clef locally       optional    Ollama with clef-flash: AI under dev for free (never downloaded without a yes)
  *   status line        optional    (Claude Code only) the build's progress under the prompt
  *
  * It is safe at any time, inside a studio or before one exists: it only reads (local files, `--version` of a few
@@ -28,10 +32,12 @@ import { spawn } from 'node:child_process';
 import { existsSync, readFileSync } from 'node:fs';
 import { join } from 'node:path';
 import { workersAiRow } from './brain-probe.mjs';
+import { detectLocalAi } from './local-ai.mjs';
 import { findChrome } from './chrome.mjs';
 import { whyFailed } from './net.mjs';
 import { isOurs } from './statusline.mjs';
 import { findStudio, readLocal, readStudio } from './studio.mjs';
+import { projectsCloudflareEnv, projectsElevenLabs } from './projects-env.mjs';
 import { STUDIO_VERSION } from './version.mjs';
 
 /** A command's result, never throwing: code 127 when the program is not installed, 124 when it ran out of time. */
@@ -101,7 +107,12 @@ export async function setupStatus({
       if (env.CLOUDFLARE_API_TOKEN) return { signedIn: true, how: 'an API token in the environment' };
       const bin = root ? join(root, 'node_modules', '.bin', win ? 'wrangler.cmd' : 'wrangler') : null;
       if (!bin || !existsSync(bin)) return { signedIn: null };
-      const r = await exec(bin, ['whoami', '--json'], { cwd: root, timeout: 25_000, env: { ...env, WRANGLER_SEND_METRICS: 'false', CI: '1' } });
+      // Through Stripe Projects (studio.json "auth": "stripe-projects"): Wrangler with the token Projects synced.
+      const projects = projectsCloudflareEnv(root);
+      const r = await exec(bin, ['whoami', '--json'], { cwd: root, timeout: 25_000, env: { ...env, ...projects, WRANGLER_SEND_METRICS: 'false', CI: '1' } });
+      if (projects.CLOUDFLARE_API_TOKEN && r.code === 0) {
+        try { if (JSON.parse(r.stdout.slice(Math.max(0, r.stdout.indexOf('{')))).loggedIn) return { signedIn: true, how: 'through Stripe Projects (its token, in the studio\'s git-ignored .env; never shown)', accounts: 1, accountIds: [projects.CLOUDFLARE_ACCOUNT_ID].filter(Boolean) }; } catch { /* read below */ }
+      }
       if (r.code === 124) return { signedIn: null, why: 'Wrangler did not answer in time' };
       // The accounts' ids stay in this process (the Workers AI row calls the studio's own account); never printed.
       try { const d = JSON.parse(r.stdout.slice(Math.max(0, r.stdout.indexOf('{')))); return { signedIn: Boolean(d.loggedIn), accounts: Array.isArray(d.accounts) ? d.accounts.length : null, accountIds: Array.isArray(d.accounts) ? d.accounts.map((a) => a?.id).filter(Boolean) : [] }; } catch { return { signedIn: false }; }
@@ -124,7 +135,7 @@ export async function setupStatus({
         const s = await exec(cliBin, ['auth', 'status', '--format', 'json'], { timeout: 10_000 });
         try { signedIn = Boolean(JSON.parse(s.stdout)?.schemes?.some((x) => x.logged_in)); } catch { signedIn = false; }
       }
-      return { cli: v.code === 0, signedIn, key: Boolean(env.ELEVENLABS_API_KEY) };
+      return { cli: v.code === 0, signedIn, key: Boolean(env.ELEVENLABS_API_KEY), projects: root ? projectsElevenLabs(root) : false };
     })(),
     (async () => {
       const key = String(env.FAL_KEY ?? '').trim();
@@ -219,6 +230,18 @@ export async function setupStatus({
     });
   }
 
+  // Clef on this computer (0.24.4, lib/local-ai.mjs): Ollama with clef-flash. Optional, and never downloaded here: the
+  // person says yes to the size first. In a studio only (it serves `dev`).
+  if (root) {
+    const found = await detectLocalAi({ env, fetchFn });
+    rows.push({
+      id: 'local-ai', label: 'Clef on this computer', need: 'optional', state: found.ok ? 'ok' : 'optional',
+      detail: found.ok ? `${found.model} on Ollama ${found.version}` : found.why === 'no-model' ? `Ollama ${found.version} is here, without clef-flash` : found.why === 'old-ollama' ? `Ollama ${found.version} is too old for Clef (0.35.1 or later)` : 'no Ollama running here',
+      unlocks: 'AI guides, chat review and a game\'s own decisions under `dev` with no Cloudflare and no cost, and a guide seat that thinks on this computer (agents sit --brain local)',
+      fix: found.ok ? null : { who: 'person', say: found.say, ...(found.why === 'no-ollama' ? { open: 'https://ollama.com/download' } : {}) },
+    });
+  }
+
   // GitHub.
   rows.push({
     id: 'github', label: 'GitHub', need: 'optional', state: gh.signedIn || gh.onGitHub ? 'ok' : 'optional',
@@ -231,10 +254,10 @@ export async function setupStatus({
 
   // ElevenLabs.
   rows.push({
-    id: 'elevenlabs', label: 'ElevenLabs', need: 'optional', state: eleven.signedIn || eleven.key ? 'ok' : 'optional',
-    detail: eleven.signedIn ? 'the elevenlabs CLI is signed in' : eleven.key ? 'ELEVENLABS_API_KEY is set' : eleven.cli ? 'the elevenlabs CLI is here, not signed in' : 'not connected',
+    id: 'elevenlabs', label: 'ElevenLabs', need: 'optional', state: eleven.signedIn || eleven.key || eleven.projects ? 'ok' : 'optional',
+    detail: eleven.signedIn ? 'the elevenlabs CLI is signed in' : eleven.key ? 'ELEVENLABS_API_KEY is set' : eleven.projects ? 'through Stripe Projects (its key, in the studio\'s git-ignored .env; never shown)' : eleven.cli ? 'the elevenlabs CLI is here, not signed in' : 'not connected',
     unlocks: 'songs and game scores (the music skill), billed to your own ElevenLabs plan; every render is quoted first',
-    fix: eleven.signedIn || eleven.key ? null : eleven.cli
+    fix: eleven.signedIn || eleven.key || eleven.projects ? null : eleven.cli
       ? { who: 'ai', run: 'elevenlabs auth login', say: 'ElevenLabs opens in your browser; sign in once. No key is pasted anywhere.' }
       : { who: mac ? 'ai' : 'person', run: mac ? 'brew install elevenlabs/tap/elevenlabs && elevenlabs auth login' : undefined, open: 'https://elevenlabs.io/sign-up', say: 'Make an ElevenLabs account when you want songs; your AI installs their CLI and you sign in once in the browser.' },
   });
@@ -247,6 +270,24 @@ export async function setupStatus({
     fix: fal.key && fal.valid !== false ? null : { who: 'person', open: 'https://fal.ai/dashboard/keys', say: 'Make a key, put FAL_KEY in the environment your AI runs in (for example a line in your shell profile), and start a new session. Never paste it into the chat.' },
   });
 
+  // Stripe, only in a studio that sells (shop.json): Stripe's own agent plugin, set up when selling starts (lazy, like
+  // every provider here). The shop's key never comes through here: `homie-studio shop connect` takes it on a page.
+  if (root && existsSync(join(root, 'shop.json'))) {
+    const v = await exec('stripe', ['--version']);
+    const version = v.code === 0 ? /(\d+\.\d+\.\d+)/.exec(v.stdout)?.[1] ?? null : null;
+    const mcp = stripeAgentConfigured({ root, env });
+    rows.push({
+      id: 'stripe', label: 'Stripe', need: 'for selling', state: mcp ? 'ok' : 'act',
+      detail: [mcp ? `Stripe's MCP is set up for ${mcp}` : 'Stripe\'s MCP is not set up for this AI', version ? `the Stripe CLI ${version}` : 'no Stripe CLI'].join('; '),
+      unlocks: 'the shop: your AI makes the catalog, checks tax and Managed Payments and answers "how are sales?" with Stripe\'s own tools, on your own Stripe account; you sign in on Stripe\'s page',
+      fix: mcp ? null : {
+        who: 'ai', run: 'npm install -g @stripe/cli@latest && stripe agent setup',
+        say: 'Stripe\'s own agent plugin for Claude Code and Codex (its MCP server and skills, kept up to date); you approve the install. Then sign in once on Stripe\'s page and give access to your Stripe sandbox first.',
+        open: 'https://dashboard.stripe.com/register',
+      },
+    });
+  }
+
   // The Claude Code status line (only in Claude Code, only in a studio).
   if (root && env.CLAUDECODE === '1') {
     let on = false;
@@ -270,6 +311,7 @@ export async function setupStatus({
     { feature: 'Songs and game scores', state: ready(by.elevenlabs.state), needs: ['elevenlabs'] },
     { feature: 'Painted art and generated video', state: ready(by.fal.state), needs: ['fal'] },
     ...(by['workers-ai'] ? [{ feature: 'AI guides that think (Workers AI)', state: ready(by['workers-ai'].state), needs: ['workers-ai'] }] : []),
+    ...(by.stripe ? [{ feature: 'Sell in the games (the shop, with Stripe\'s own tools)', state: ready(by.stripe.state), needs: ['stripe'] }] : []),
   ];
   const now = rows.filter((r) => ['missing', 'act'].includes(r.state) && r.fix);
   const meanwhile = rows.filter((r) => r.fix?.open && r.state !== 'ok' && (r.fix.who === 'person' || r.state === 'later'));
@@ -284,6 +326,23 @@ export async function setupStatus({
   };
 }
 
+/**
+ * Where Stripe's MCP server (https://mcp.stripe.com) is set up for this person's AI: Claude Code (the Stripe plugin,
+ * or an MCP entry in .claude.json in the home folder, or the studio's .mcp.json) or Codex (config.toml in the Codex
+ * home folder). It only looks for the address or the plugin's name in those files; it never reads a key and never
+ * prints what it found. Null when nowhere.
+ */
+export function stripeAgentConfigured({ root, env = process.env } = {}) {
+  const home = env.HOME || env.USERPROFILE || '';
+  const look = (file, re) => {
+    try { if (!file || !existsSync(file)) return false; const t = readFileSync(file, 'utf8'); return t.length < 64 * 1024 * 1024 && re.test(t); } catch { return false; }
+  };
+  const mcp = /mcp\.stripe\.com/;
+  if (look(home && join(home, '.claude', 'plugins', 'installed_plugins.json'), /"stripe@/) || look(home && join(home, '.claude.json'), mcp) || look(root && join(root, '.mcp.json'), mcp)) return 'Claude Code';
+  if (look(join(env.CODEX_HOME || (home && join(home, '.codex')) || '', 'config.toml'), /mcp\.stripe\.com|\[mcp_servers\.stripe\]|stripe@openai-curated/)) return 'Codex';
+  return null;
+}
+
 /** The checklist as a person reads it in a terminal. */
 export function formatStatus(r) {
   const lines = [`Setup status${r.studio?.name ? ` for ${r.studio.name}` : ' (before the studio exists)'}`, ''];

package/lib/local-ai.mjs

@@ -0,0 +1,66 @@
+/**
+ * THE PERSON'S OWN AI (@homie-rocks/studio 0.24.4): Cloudflare's Clef decision model on this computer, through Ollama.
+ * The same typed questions the studio's Workers AI answers, at /v1/systemone, free and offline:
+ *
+ *   homie-studio dev        finds it and hands it to the local Worker (HOMIE_LOCAL_AI), so AI guides, room chat's review
+ *                           and a game's own decisions (net.decide) need no Cloudflare while building
+ *   agents sit --brain local / the MCP's agent_sit { brain: "local" }
+ *                           a guide's seat that thinks on this computer every few seconds, with no AI turn per decision
+ *   homie-studio doctor     says what is there, and what one sentence gets the rest
+ *
+ * It never downloads a model. `ollama pull clef-flash` is about 11 GB (clef, the 27B, about 18 GB): the person says yes
+ * first, every time (the studio skill asks and names the size). It needs Ollama 0.35.1 or later (the first with Clef).
+ */
+
+export const OLLAMA_BASE = 'http://127.0.0.1:11434';
+export const OLLAMA_MIN = '0.35.1';
+/** The models Homie uses, smallest first, and what each costs the disk (ollama.com/library, 2026-10-02). */
+export const LOCAL_MODELS = Object.freeze([
+  Object.freeze({ name: 'clef-flash', size: 'about 11 GB', params: '9B' }),
+  Object.freeze({ name: 'clef', size: 'about 18 GB', params: '27B' }),
+]);
+
+const newer = (a, b) => {
+  const pa = String(a).split(/[.-]/).map((x) => parseInt(x, 10) || 0);
+  const pb = String(b).split(/[.-]/).map((x) => parseInt(x, 10) || 0);
+  for (let i = 0; i < 3; i += 1) if ((pa[i] ?? 0) !== (pb[i] ?? 0)) return (pa[i] ?? 0) > (pb[i] ?? 0);
+  return true;
+};
+
+/** Only a loopback address: Homie never sends a game's state to another machine's Ollama. */
+export const loopbackBase = (raw) => {
+  const s = String(raw ?? '').trim().replace(/\/+$/, '');
+  return /^http:\/\/(?:127\.0\.0\.1|localhost|\[::1\]):\d{2,5}$/.test(s) ? s : null;
+};
+
+/**
+ * Is Clef on this computer? `{ ok, base, model, version }`, or `{ ok: false, why, say, version?, base }` with why one of
+ * no-ollama, old-ollama, no-model. `HOMIE_OLLAMA` names another loopback port. Two quick local requests, nothing else.
+ */
+export async function detectLocalAi({ env = process.env, fetchFn = globalThis.fetch, ms = 1500 } = {}) {
+  const base = loopbackBase(env.HOMIE_OLLAMA) ?? OLLAMA_BASE;
+  const get = async (path) => {
+    const res = await fetchFn(`${base}${path}`, { signal: AbortSignal.timeout(ms) });
+    if (!res.ok) throw new Error(`${path} answered ${res.status}`);
+    return res.json();
+  };
+  let version = null;
+  try { version = String((await get('/api/version'))?.version ?? ''); } catch {
+    return { ok: false, base, why: 'no-ollama', say: `Ollama is not running on this computer (${base}). With it and clef-flash, AI guides, chat review and game decisions run here for free while building; without it they play from the game's script under dev.` };
+  }
+  if (!newer(version, OLLAMA_MIN)) return { ok: false, base, version, why: 'old-ollama', say: `Ollama ${version} is here; Clef needs ${OLLAMA_MIN} or later. Updating Ollama is the person's to do (its own app updates itself, or ollama.com/download).` };
+  let names = [];
+  try { names = ((await get('/api/tags'))?.models ?? []).map((m) => String(m?.name ?? m?.model ?? '')).filter(Boolean); } catch { names = []; }
+  for (const want of LOCAL_MODELS) {
+    const hit = names.find((n) => n === want.name || n.startsWith(`${want.name}:`));
+    if (hit) return { ok: true, base, version, model: hit };
+  }
+  const flash = LOCAL_MODELS[0];
+  return {
+    ok: false, base, version, why: 'no-model', models: names.length,
+    say: `Ollama ${version} is here without Clef. Downloading it is the person's choice: ask first. \`ollama pull ${flash.name}\` downloads ${flash.size} (the ${flash.params} model; ${LOCAL_MODELS[1].name} is ${LOCAL_MODELS[1].size}). Then run dev again.`,
+  };
+}
+
+/** The Worker variables that hand a found model to `wrangler dev` (`--var` pairs), or none. */
+export const localAiVars = (found) => (found?.ok ? ['--var', `HOMIE_LOCAL_AI:${found.base}`, '--var', `HOMIE_LOCAL_AI_MODEL:${found.model}`] : []);

package/lib/mcp-tools.mjs

@@ -33,6 +33,7 @@ import { STUDIO_VERSION } from './version.mjs';
 import { compareVersions, whatsNew, whatsNewLines } from './changelog.mjs';
 import { pinnedVersion } from './upgrade.mjs';
 import { AgentSeat } from './agent-seat.mjs';
+import { detectLocalAi } from './local-ai.mjs';
 import { LAB_PORT, runningLab } from './lab.mjs';
 import { pictureFor } from './pictures.mjs';
 import { ART_UI, artToolDefs } from './art-tools.mjs';
@@ -1050,17 +1051,24 @@ export function toolDefs(ctx, avail = {}) {
     {
       name: 'agent_sit', title: 'Sit in a game as an AI guide',
       description: 'Take a guide\'s seat in a live room of one of the studio\'s games as an AI ("Claude · AI": always marked AI, never on a humans-only server, only in a room with people in it). The game\'s own bot code moves the body every frame; you choose its goal and, when the server lets its AI talk, one of the game\'s own lines (agents.json; never free text). Returns your seat, what you see (view), the asks players made of you and your choices. Then agent_look and agent_do every 20 to 40 seconds, and agent_stand when done. Uses the site running here (preview_run) or the live site; with no pass, makes a one-day guide pass with the owner\'s office key and revokes it when you stand.',
-      inputSchema: { type: 'object', properties: { game: str('The game\'s id'), server: str('Optional: a server id (default: the pass\'s, else Quick play)'), pass: str('Optional: an agent pass (hap_…) the owner gave; never shown back'), label: str('Optional: the name you play under (default "Claude"; " · AI" is added)'), url: str('Optional: the site (default: this computer\'s preview, else the live site)'), ...STUDIO_ARG }, required: ['game'] },
+      inputSchema: { type: 'object', properties: { game: str('The game\'s id'), server: str('Optional: a server id (default: the pass\'s, else Quick play)'), pass: str('Optional: an agent pass (hap_…) the owner gave; never shown back'), label: str('Optional: the name you play under (default "Claude"; " · AI" is added)'), url: str('Optional: the site (default: this computer\'s preview, else the live site)'), brain: { type: 'string', enum: ['local'], description: 'Optional: "local" lets Cloudflare\'s Clef decision model on this computer (Ollama with clef-flash) choose every few seconds instead of you, free; agent_look shows what it chose and agent_do still overrides it. Never downloads a model: if Ollama has no clef-flash this says what the download costs, and the person decides.' }, ...STUDIO_ARG }, required: ['game'] },
       annotations: { title: 'Sit in a game as an AI guide', readOnlyHint: false, destructiveHint: false, openWorldHint: true },
       run: async (a) => {
         const root = ctx.root(a.studio);
         if (ctx.seat && !ctx.seat.closed) await ctx.seat.stand();
         const site = a.url ? String(a.url) : devOf(root)?.url ?? siteUrl(root);
         if (!site) return fail('the studio is not running here and has no live site: preview_run first, or studio_deploy');
-        const seat = new AgentSeat({ site, game: String(a.game ?? ''), server: a.server ?? null, pass: a.pass ?? null, label: a.label ? String(a.label).slice(0, 16) : 'Claude', root });
+        let local = null;
+        if (a.brain === 'local') {
+          const found = await detectLocalAi();
+          if (!found.ok) return fail(`No local brain: ${found.say}`, { kind: 'agent', ok: false, error: found.why });
+          local = found;
+        }
+        const seat = new AgentSeat({ site, game: String(a.game ?? ''), server: a.server ?? null, pass: a.pass ?? null, label: a.label ? String(a.label).slice(0, 16) : local ? 'Clef' : 'Claude', root, brain: local ? 'local' : null, local });
         const r = await seat.sit();
         if (!r.ok) return fail(`No seat: ${r.why}`, { kind: 'agent', ok: false, error: r.error ?? null });
         ctx.seat = seat;
+        if (local) return ok(`Seated as ${r.name} in ${r.room} (seat ${r.seat}), thinking with ${local.model} on this computer every few seconds (free; nothing sent to Cloudflare). agent_look shows its last decisions; agent_do overrides; agent_stand ends it.`, { kind: 'agent', ...r });
         return ok(`Seated as ${r.name} in ${r.room} (seat ${r.seat}). ${r.talking ? 'This server lets its AI talk: lines from look.choices.lines, at most one every 8 s.' : 'This server\'s AI does not talk: choose goals only (say null).'} Look again with agent_look; act with agent_do { goal, args, say?, sayArgs? }.\n${JSON.stringify({ view: r.view, asks: r.asks, choices: r.choices }, null, 1).slice(0, 6000)}`, { kind: 'agent', ...r });
       },
     },

package/lib/projects-env.mjs

@@ -0,0 +1,68 @@
+/**
+ * The credentials Stripe Projects keeps for a studio (`homie-studio setup --via stripe-projects`, 0.24.3), read only
+ * where they are used and never printed, returned to a person, or written anywhere else.
+ *
+ * Stripe Projects keeps them encrypted in its vault and syncs them to the project's output file (`.env` unless the
+ * environment names another), which it creates readable by this user only and git-ignores. Wrangler then deploys with
+ * the Cloudflare token from that file instead of a `wrangler login`; the music skill reads the ElevenLabs key the same
+ * way. studio.json says which (never a value): `cloudflare.auth: "stripe-projects"`, `providers.elevenlabs.via`.
+ */
+import { existsSync, readFileSync } from 'node:fs';
+import { isAbsolute, join, normalize, sep } from 'node:path';
+
+/** The output file inside the studio (`.env` by default); null for anything outside it. */
+export function envFileOf(root, name = '.env') {
+  const n = normalize(String(name || '.env'));
+  if (isAbsolute(n) || n === '..' || n.startsWith(`..${sep}`)) return null;
+  return join(root, n);
+}
+
+const unquote = (v) => {
+  if (v.length >= 2 && v.startsWith('"') && v.endsWith('"')) { try { return JSON.parse(v); } catch { return v.slice(1, -1); } }
+  if (v.length >= 2 && v.startsWith("'") && v.endsWith("'")) return v.slice(1, -1);
+  return v;
+};
+
+/** A dotenv file as { NAME: value } (KEY=value lines; `export ` and comments allowed). {} when absent. */
+export function readDotenv(file) {
+  const out = {};
+  if (!file || !existsSync(file)) return out;
+  let text = '';
+  try { text = readFileSync(file, 'utf8'); } catch { return out; }
+  for (const line of text.split(/\r?\n/)) {
+    const t = line.trim().replace(/^export\s+/, '');
+    if (!t || t.startsWith('#')) continue;
+    const i = t.indexOf('=');
+    if (i < 1) continue;
+    const k = t.slice(0, i).trim();
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(k)) continue;
+    out[k] = unquote(t.slice(i + 1).trim());
+  }
+  return out;
+}
+
+function studioOf(root) {
+  try { return JSON.parse(readFileSync(join(root, 'studio.json'), 'utf8')); } catch { return null; }
+}
+
+/**
+ * The environment Wrangler gets for a studio whose Cloudflare came through Stripe Projects: CLOUDFLARE_API_TOKEN and
+ * CLOUDFLARE_ACCOUNT_ID from the Projects output file. {} for every other studio (the default: `wrangler login`).
+ */
+export function projectsCloudflareEnv(root, studio = studioOf(root)) {
+  const cf = studio?.cloudflare;
+  if (!root || cf?.auth !== 'stripe-projects') return {};
+  const vars = readDotenv(envFileOf(root, cf.envFile));
+  return {
+    ...(vars.CLOUDFLARE_API_TOKEN ? { CLOUDFLARE_API_TOKEN: vars.CLOUDFLARE_API_TOKEN } : {}),
+    ...(vars.CLOUDFLARE_ACCOUNT_ID ? { CLOUDFLARE_ACCOUNT_ID: vars.CLOUDFLARE_ACCOUNT_ID } : {}),
+  };
+}
+
+/** Whether Stripe Projects holds this studio's ElevenLabs key (studio.json `providers.elevenlabs`); never the key. */
+export function projectsElevenLabs(root, studio = studioOf(root)) {
+  const p = studio?.providers?.elevenlabs;
+  if (!root || p?.via !== 'stripe-projects') return false;
+  const name = /^[A-Z][A-Z0-9_]{2,}$/.test(String(p.envKey ?? '')) ? p.envKey : 'ELEVENLABS_API_KEY';
+  return Boolean(readDotenv(envFileOf(root, p.envFile))[name]);
+}