@inneranimalmedia/agentsam-sdk 2.4.1 → 2.6.0

package/src/cloudflare/wrangler.js

@@ -0,0 +1,132 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { runProcess } from '../security/process.js';
+import { AgentSamDiagnosticError, redactDiagnosticValue } from '../errors/index.js';
+
+function clean(value) { return value == null ? '' : String(value).trim(); }
+function positiveInteger(value, fallback) { const n = Number(value); return Number.isInteger(n) && n > 0 ? n : fallback; }
+
+export const WRANGLER_NATIVE_COMMANDS = Object.freeze([
+  Object.freeze({ id: 'whoami', argv: ['whoami', '--json'], risk: 'read', output: 'json', description: 'Read authenticated Cloudflare user/account membership without exposing the auth token.' }),
+  Object.freeze({ id: 'deployments.list', argv: ['deployments', 'list', '--json'], risk: 'read', output: 'json', description: 'List recent Worker deployments.' }),
+  Object.freeze({ id: 'versions.list', argv: ['versions', 'list', '--json'], risk: 'read', output: 'json', description: 'List recent Worker versions.' }),
+  Object.freeze({ id: 'types.check', argv: ['types', '--check'], risk: 'read', output: 'text', description: 'Check generated Worker binding/runtime types without rewriting them.' }),
+  Object.freeze({ id: 'queues.list', argv: ['queues', 'list'], risk: 'read', output: 'text', description: 'List Workers Queues visible to the active Cloudflare identity.' }),
+]);
+
+export const WRANGLER_OPERATION_FAMILIES = Object.freeze([
+  Object.freeze({ family: 'identity', examples: ['whoami', 'auth list', 'auth activate'], default_risk: 'read/config' }),
+  Object.freeze({ family: 'development', examples: ['dev', 'types --check'], default_risk: 'local-runtime' }),
+  Object.freeze({ family: 'observability', examples: ['tail --format json', 'deployments list', 'versions list'], default_risk: 'read/stream' }),
+  Object.freeze({ family: 'delivery', examples: ['deploy', 'versions deploy', 'rollback'], default_risk: 'remote-write' }),
+  Object.freeze({ family: 'data', examples: ['d1', 'r2', 'kv', 'queues', 'hyperdrive', 'vectorize'], default_risk: 'read-or-remote-write' }),
+  Object.freeze({ family: 'compute', examples: ['containers', 'browser', 'ai', 'workflows'], default_risk: 'read-or-remote-write' }),
+]);
+
+export function listWranglerNativeCommands() { return WRANGLER_NATIVE_COMMANDS.map((row) => ({ ...row, argv: [...row.argv] })); }
+
+function descriptor(id) {
+  const row = WRANGLER_NATIVE_COMMANDS.find((item) => item.id === clean(id));
+  if (!row) throw new RangeError(`unsupported_wrangler_native_command:${id}`);
+  return row;
+}
+
+function resolveConfig(cwd, explicit = '') {
+  if (clean(explicit)) {
+    const file = path.resolve(cwd, explicit);
+    if (!file.startsWith(`${cwd}${path.sep}`) && file !== cwd) throw new Error('cloudflare_config_outside_cwd');
+    if (!fs.existsSync(file)) throw new Error(`cloudflare_config_not_found:${explicit}`);
+    return file;
+  }
+  for (const name of ['wrangler.jsonc', 'wrangler.json', 'wrangler.toml']) {
+    const file = path.join(cwd, name);
+    if (fs.existsSync(file)) return file;
+  }
+  return '';
+}
+
+export function buildWranglerInvocation(id, input = {}) {
+  const row = descriptor(id);
+  const cwd = path.resolve(input.cwd || process.cwd());
+  const args = [...row.argv];
+  if (id === 'whoami' && clean(input.account)) args.push('--account', clean(input.account));
+  if ((id === 'deployments.list' || id === 'versions.list') && clean(input.name)) args.push('--name', clean(input.name));
+  if (id === 'types.check' && clean(input.path)) args.splice(1, 0, clean(input.path));
+  if (id === 'queues.list' && input.page != null) args.push('--page', String(positiveInteger(input.page, 1)));
+  const config = resolveConfig(cwd, input.config);
+  if (config) args.push('--config', config);
+  if (clean(input.env)) args.push('--env', clean(input.env));
+  if (clean(input.profile)) args.push('--profile', clean(input.profile));
+  return Object.freeze({ command_id: row.id, command: 'wrangler', args: Object.freeze(args), cwd, risk: row.risk, output: row.output });
+}
+
+function parseJsonOutput(text) {
+  const source = clean(text);
+  if (!source) return null;
+  try { return JSON.parse(source); } catch { return null; }
+}
+
+function stripAnsi(value) { return String(value || '').replace(/\x1b\[[0-?]*[ -\/]*[@-~]/g, ''); }
+function nestedError(payload) {
+  if (!payload || typeof payload !== 'object') return null;
+  const rows = [payload.error, ...(Array.isArray(payload.errors) ? payload.errors : [])].filter((row) => row && typeof row === 'object');
+  return rows[0] || payload;
+}
+
+export function parseWranglerErrorEvidence(stderr = '', stdout = '') {
+  const errorText = stripAnsi(stderr);
+  const outputText = stripAnsi(stdout);
+  let payload = parseJsonOutput(outputText) || parseJsonOutput(errorText);
+  const error = nestedError(payload);
+  const combined = `${errorText}\n${outputText}`;
+  const regexCode = combined.match(/\[code:\s*([A-Za-z0-9_.:-]+)\]/i)?.[1] || combined.match(/\bcode[:=\s]+([A-Za-z0-9_.:-]+)/i)?.[1] || '';
+  const code = clean(error?.code || regexCode) || null;
+  const requestId = clean(error?.request_id || error?.requestId || combined.match(/\brequest[_ -]?id[:=\s]+([A-Za-z0-9_-]+)/i)?.[1]) || null;
+  const rayId = clean(error?.ray_id || error?.rayId || combined.match(/\b(?:cf[- ]?ray|ray id)[:=\s]+([A-Za-z0-9-]+)/i)?.[1]) || null;
+  const message = clean(error?.message || error?.error || errorText.split('\n').find((line) => clean(line)) || outputText.split('\n').find((line) => clean(line))) || 'Wrangler operation failed';
+  return Object.freeze({ code, request_id: requestId, ray_id: rayId, message, details: payload ? redactDiagnosticValue(payload) : null });
+}
+
+export async function runWranglerNative(id, input = {}, options = {}) {
+  const plan = buildWranglerInvocation(id, input);
+  const runner = options.run || runProcess;
+  const timeoutMs = Number.isFinite(options.timeoutMs) ? options.timeoutMs : 30_000;
+  const result = await runner(options.bin || 'npx', ['--yes', 'wrangler', ...plan.args], {
+    cwd: plan.cwd,
+    timeoutMs,
+    signal: options.signal,
+    maxBytes: options.maxBytes || 2 * 1024 * 1024,
+  });
+  if (result.code !== 0) {
+    const evidence = parseWranglerErrorEvidence(result.stderr, result.stdout);
+    throw new AgentSamDiagnosticError({
+      source: 'cloudflare',
+      kind: 'wrangler_error',
+      code: evidence.code || 'wrangler_exit_nonzero',
+      message: evidence.message || `Wrangler ${plan.command_id} exited ${result.code}`,
+      retriable: false,
+      retry_strategy: 'inspect_error',
+      operation: plan.command_id,
+      exit_code: result.code,
+      request_id: evidence.request_id,
+      ray_id: evidence.ray_id,
+      cwd: plan.cwd,
+      stderr: redactDiagnosticValue(String(result.stderr || '').slice(0, 12_000)) || null,
+      stdout: redactDiagnosticValue(String(result.stdout || '').slice(0, 4_000)) || null,
+      details: evidence.details,
+    });
+  }
+  const parsed = plan.output === 'json' ? parseJsonOutput(result.stdout) : null;
+  return Object.freeze({
+    ok: true,
+    schema_version: 1,
+    command_id: plan.command_id,
+    risk: plan.risk,
+    cwd: plan.cwd,
+    exit_code: result.code,
+    format: parsed == null ? 'text' : 'json',
+    data: parsed == null ? undefined : redactDiagnosticValue(parsed),
+    stdout: parsed == null ? String(result.stdout || '').slice(0, 24_000) : undefined,
+    stderr: String(result.stderr || '').slice(0, 8_000) || undefined,
+  });
+}

package/src/commands/account-auth.js

@@ -0,0 +1,47 @@
+import { authenticateViaBrowser } from '../lib/auth.js';
+import { clearAccountSession, readAccountSession, saveAccountSession } from '../lib/account-session.js';
+import { collectWhoami, renderWhoami } from './whoami.js';
+
+function writeLine(write, value = '') { write(`${value}\n`); }
+
+export async function runLogin(argv = [], options = {}) {
+  const allowed = new Set(['--json']);
+  const unknown = argv.filter((arg) => !allowed.has(arg));
+  if (unknown.length) throw new Error(`unknown login option: ${unknown[0]}`);
+  const write = options.write || ((text) => process.stdout.write(text));
+  const authenticate = options.authenticateImpl || authenticateViaBrowser;
+  const session = await authenticate();
+  if (!String(session?.access_token || '').trim().startsWith('sdk_')) throw new Error('Agent Sam login did not return a valid SDK session');
+  // authenticateViaBrowser persists by default. Keep injected transports/test flows equivalent.
+  if (!readAccountSession({ home: options.home })) saveAccountSession(session, { home: options.home });
+  const status = await collectWhoami({ home: options.home, env: options.env || process.env, contextLoader: options.contextLoader });
+  if (argv.includes('--json')) writeLine(write, JSON.stringify(status, null, 2));
+  else {
+    writeLine(write, '');
+    writeLine(write, '  Agent Sam login complete.');
+    write(renderWhoami(status));
+  }
+  return status;
+}
+
+export function runLogout(argv = [], options = {}) {
+  const allowed = new Set(['--json']);
+  const unknown = argv.filter((arg) => !allowed.has(arg));
+  if (unknown.length) throw new Error(`unknown logout option: ${unknown[0]}`);
+  const write = options.write || ((text) => process.stdout.write(text));
+  const removed = clearAccountSession({ home: options.home });
+  const result = {
+    schema_version: 1,
+    local_session_removed: removed,
+    provider_credentials_unchanged: true,
+    note: 'Local IAM session removed. Provider credentials were not deleted or revoked.',
+  };
+  if (argv.includes('--json')) writeLine(write, JSON.stringify(result, null, 2));
+  else {
+    writeLine(write, '');
+    writeLine(write, removed ? '  Signed out of the local Agent Sam IAM session.' : '  No local Agent Sam IAM session was stored.');
+    writeLine(write, '  Provider credentials were not deleted or revoked.');
+    writeLine(write, '');
+  }
+  return result;
+}

package/src/commands/cloudflare.js

@@ -0,0 +1,58 @@
+import path from 'node:path';
+import { listWranglerNativeCommands, runWranglerNative, summarizeCloudflareCpuProfileFile, WRANGLER_OPERATION_FAMILIES } from '../cloudflare/index.js';
+import { renderDiagnosticError } from '../errors/index.js';
+
+function parse(argv = []) {
+  const subcommand = argv[0] || 'status';
+  const takesAction = subcommand === 'run' || subcommand === 'cpu';
+  const out = { subcommand, action: takesAction ? (argv[1] || '') : '', cwd: process.cwd(), json: false, name: '', account: '', config: '', env: '', profile: '', path: '', page: null, file: '' };
+  for (let i = takesAction ? 2 : 1; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (arg === '--json') out.json = true;
+    else if (arg === '--cwd') out.cwd = argv[++i] || out.cwd;
+    else if (arg === '--name') out.name = argv[++i] || '';
+    else if (arg === '--account') out.account = argv[++i] || '';
+    else if (arg === '--config') out.config = argv[++i] || '';
+    else if (arg === '--env') out.env = argv[++i] || '';
+    else if (arg === '--profile') out.profile = argv[++i] || '';
+    else if (arg === '--path') out.path = argv[++i] || '';
+    else if (arg === '--page') out.page = Number(argv[++i] || 1);
+    else if (arg === '--file') out.file = argv[++i] || '';
+    else if (arg === '--help' || arg === '-h') out.help = true;
+    else if (out.subcommand === 'cpu' && out.action === 'analyze' && !out.file) out.file = arg;
+    else throw new Error(`unknown cloudflare option: ${arg}`);
+  }
+  return out;
+}
+
+const help = `Agent Sam · Cloudflare\n\n  agentsam cloudflare status [--cwd PATH] [--json]\n  agentsam cloudflare commands [--json]\n  agentsam cloudflare run <whoami|deployments.list|versions.list|types.check|queues.list> [options] [--json]\n  agentsam cloudflare cpu analyze <profile.cpuprofile> [--cwd PATH] [--json]\n\nSafe native runner is read-only. Deploy, rollback, secret reads, D1 mutation, R2 writes, and long-running tail/dev sessions remain explicit operator actions.\n`;
+
+export async function runCloudflare(argv = [], options = {}) {
+  const args = parse(argv);
+  if (options.cwd && !argv.includes('--cwd')) args.cwd = path.resolve(options.cwd);
+  const write = options.write || ((value) => process.stdout.write(value));
+  if (args.help) { write(help); return null; }
+  try {
+    let result;
+    if (args.subcommand === 'status') {
+      result = await runWranglerNative('whoami', args, options);
+    } else if (args.subcommand === 'commands') {
+      result = { schema_version: 1, native: listWranglerNativeCommands(), families: WRANGLER_OPERATION_FAMILIES };
+    } else if (args.subcommand === 'run') {
+      if (!args.action) throw new Error('cloudflare native command id required');
+      result = await runWranglerNative(args.action, args, options);
+    } else if (args.subcommand === 'cpu' && args.action === 'analyze') {
+      result = summarizeCloudflareCpuProfileFile({ cwd: path.resolve(args.cwd), file: args.file });
+    } else {
+      write(help);
+      return null;
+    }
+    write(args.json ? `${JSON.stringify(result)}\n` : `${JSON.stringify(result, null, 2)}\n`);
+    return result;
+  } catch (error) {
+    if (args.json) write(`${JSON.stringify({ ok: false, error: error?.diagnostic || { code: error?.code || 'cloudflare_operation_failed', message: error?.message || String(error) } })}\n`);
+    else write(`${renderDiagnosticError(error)}\n`);
+    error.reported = true;
+    throw error;
+  }
+}

package/src/commands/connections.js

@@ -0,0 +1,93 @@
+/**
+ * Operator diagnostics for AgentSam connections (Cloudflare account grant).
+ * Identity (who is this user?) is separate from the Cloudflare connector.
+ */
+import {
+  CLOUDFLARE_CALLBACK_PATH,
+  CLOUDFLARE_FIXTURE_CLIENT_ID,
+  cloudflareConnectionSafeStatus,
+  resolveCloudflareOAuthClient,
+} from '../../packages/connectors/cloudflare/src/index.js';
+import { resolveIamIssuer } from '../../packages/identity/src/contracts/auth-config.js';
+
+const PRODUCTION_CALLBACK = `https://agentsam.inneranimalmedia.com${CLOUDFLARE_CALLBACK_PATH}`;
+
+function doctor(env = process.env) {
+  const iam = {
+    issuer: resolveIamIssuer(env),
+    clientId: Boolean(String(env.IAM_CLIENT_ID || '').trim()),
+    serverSecret: Boolean(String(env.IAM_CLIENT_SECRET || '').trim()),
+    originAlias: Boolean(String(env.IAM_ORIGIN || '').trim()),
+  };
+  const cf = cloudflareConnectionSafeStatus(env);
+  const client = resolveCloudflareOAuthClient(env);
+  return { identity: iam, cloudflare: cf, client };
+}
+
+function printSetup(env = process.env) {
+  const client = resolveCloudflareOAuthClient(env);
+  console.log('Cloudflare connector setup');
+  console.log('');
+  console.log(`  callback: ${PRODUCTION_CALLBACK}`);
+  console.log('  authorize: https://dash.cloudflare.com/oauth2/auth');
+  console.log('  token:     https://dash.cloudflare.com/oauth2/token');
+  console.log('  revoke:    https://dash.cloudflare.com/oauth2/revoke');
+  console.log('');
+  console.log('This CLI does not mint a real Cloudflare OAuth client.');
+  console.log('Fixture client id ' + CLOUDFLARE_FIXTURE_CLIENT_ID + ' is local-only and must never be installed on production.');
+  if (client.fixture) {
+    console.log('STOP: fixture credentials are loaded. OAuth start will return 503.');
+  } else if (client.status === 'not_configured') {
+    console.log('status: not_configured — production may deploy; connector stays optional.');
+  } else {
+    console.log(`status: ${client.status}`);
+  }
+  return 0;
+}
+
+export async function runConnections(args = []) {
+  const argv = args.filter((a) => a !== '--json');
+  const jsonMode = args.includes('--json');
+  const env = process.env;
+  if (argv[0] === 'cloudflare' && argv[1] === 'setup') {
+    if (jsonMode) {
+      console.log(JSON.stringify({
+        callback: PRODUCTION_CALLBACK,
+        authorize: 'https://dash.cloudflare.com/oauth2/auth',
+        token: 'https://dash.cloudflare.com/oauth2/token',
+        revoke: 'https://dash.cloudflare.com/oauth2/revoke',
+        mintsRealClient: false,
+        client: resolveCloudflareOAuthClient(env),
+      }, null, 2));
+      return 0;
+    }
+    return printSetup(env);
+  }
+  const report = doctor(env);
+  if (jsonMode) {
+    console.log(JSON.stringify({ identity: report.identity, cloudflare: report.cloudflare }, null, 2));
+    return 0;
+  }
+  const iam = report.identity;
+  const cf = report.cloudflare;
+  const client = report.client;
+  console.log('AgentSam Identity');
+  console.log('');
+  console.log('IAM client');
+  console.log(`  ${iam.clientId ? '✓' : '•'} client id`);
+  console.log(`  ✓ issuer ${iam.issuer}`);
+  console.log(`  ${iam.serverSecret ? '✓' : '•'} server secret configured`);
+  if (iam.originAlias) console.log('Compatibility\n  IAM_ORIGIN -> deprecated alias');
+  console.log('');
+  console.log('Cloudflare connection');
+  console.log('');
+  console.log('OAuth client');
+  console.log(`  client id: ${cf.clientId}`);
+  console.log(`  secret: ${cf.secret}`);
+  console.log(`  status: ${client.status}`);
+  if (client.fixture) {
+    console.log('  OAuth client fixture configured');
+    console.log('  real Cloudflare OAuth client still required');
+  }
+  return 0;
+}

package/src/commands/context-economics.js

@@ -0,0 +1,114 @@
+import { createContextBudget, assessContextUsage } from '../context/index.js';
+import { getModelRecord } from '../models/index.js';
+import { readCliPreferences } from '../lib/cli-preferences.js';
+
+function formatInteger(value) {
+  return Number(value).toLocaleString('en-US');
+}
+
+function percent(value) {
+  return `${(Number(value) * 100).toFixed(1)}%`;
+}
+
+export function buildContextEconomicsReport(cwd, options = {}) {
+  const preferences = options.preferences || readCliPreferences(cwd) || {};
+  const model = getModelRecord(preferences.modelPreference);
+  if (!model) {
+    return Object.freeze({
+      model: preferences.modelPreference || 'auto',
+      resolved: false,
+      reason: 'Select an exact catalog model with /model before Agent Sam can calculate model-specific context economics.',
+      reasoning_effort: preferences.reasoningEffort || 'auto',
+      service_tier: preferences.serviceTier || 'default',
+      active_input_tokens: null,
+    });
+  }
+
+  const policy = model.context_policy || {};
+  const budget = createContextBudget({
+    windowTokens: model.context_window,
+    targetInputTokens: policy.target_input_tokens,
+    compactAtTokens: policy.compact_at_tokens,
+    interveneAtTokens: policy.intervene_at_tokens,
+    maxNormalInputTokens: policy.max_normal_input_tokens,
+    pricingThresholdTokens: policy.pricing_threshold_tokens,
+    safetyMarginTokens: policy.safety_margin_tokens,
+  });
+  const active = Number.isFinite(options.activeInputTokens) && options.activeInputTokens >= 0
+    ? Math.floor(options.activeInputTokens)
+    : null;
+  const pressure = active == null ? null : assessContextUsage(active, budget);
+
+  return Object.freeze({
+    model: model.provider_model_id,
+    model_key: model.model_key,
+    resolved: true,
+    reasoning_effort: preferences.reasoningEffort || 'auto',
+    service_tier: preferences.serviceTier || 'default',
+    active_input_tokens: active,
+    estimate_kind: options.estimateKind === 'provider' ? 'provider' : active == null ? null : 'local',
+    window_tokens: budget.windowTokens,
+    utilization_ratio: pressure?.utilizationRatio ?? null,
+    target_input_tokens: budget.targetInputTokens,
+    compact_at_tokens: budget.compactAtTokens,
+    intervene_at_tokens: budget.interveneAtTokens,
+    max_normal_input_tokens: budget.maxNormalInputTokens,
+    pricing_threshold_tokens: budget.pricingThresholdTokens,
+    tokens_until_pricing_threshold: pressure?.tokensUntilPricingThreshold ?? null,
+    pressure: pressure?.stage ?? 'unknown',
+    should_compact: pressure?.shouldCompact ?? false,
+    should_intervene: pressure?.shouldIntervene ?? false,
+    pricing_threshold_crossed: pressure?.pricingThresholdCrossed ?? false,
+    batch: model.batch,
+    pricing_source: model.pricing?.source || null,
+    pricing_as_of: model.pricing?.as_of || null,
+  });
+}
+
+export function renderContextEconomics(report) {
+  if (!report.resolved) {
+    return [
+      '',
+      '  Agent Sam · context',
+      `  model            ${report.model}`,
+      `  reasoning        ${report.reasoning_effort}`,
+      `  processing       ${report.service_tier}`,
+      '',
+      `  ${report.reason}`,
+      '',
+    ].join('\n');
+  }
+
+  const active = report.active_input_tokens == null
+    ? 'unavailable · no provider/local usage snapshot yet'
+    : `${report.estimate_kind === 'provider' ? '' : '~'}${formatInteger(report.active_input_tokens)}${report.utilization_ratio == null ? '' : ` · ${percent(report.utilization_ratio)} of window`}`;
+  const remaining = report.tokens_until_pricing_threshold == null
+    ? 'unavailable until active usage is known'
+    : `${report.tokens_until_pricing_threshold < 0 ? '-' : ''}${formatInteger(Math.abs(report.tokens_until_pricing_threshold))}`;
+  return [
+    '',
+    '  Agent Sam · context',
+    `  model            ${report.model}`,
+    `  reasoning        ${report.reasoning_effort}`,
+    `  processing       ${report.service_tier}`,
+    '',
+    '  Context',
+    `    active          ${active}`,
+    `    window          ${formatInteger(report.window_tokens)}`,
+    '',
+    '  Working-set policy',
+    `    target          ${formatInteger(report.target_input_tokens)}`,
+    `    compact at      ${formatInteger(report.compact_at_tokens)}`,
+    `    intervene at    ${formatInteger(report.intervene_at_tokens)}`,
+    `    max normal      ${formatInteger(report.max_normal_input_tokens)}`,
+    '',
+    '  Economics',
+    `    price threshold ${formatInteger(report.pricing_threshold_tokens)}`,
+    `    remaining       ${remaining}`,
+    `    pricing as-of   ${report.pricing_as_of || 'unknown'}`,
+    '',
+    '  Batch is a separate asynchronous execution lane; it is not an interactive service tier.',
+    '  Use `/context repo` for repository/Git bridge context.',
+    '',
+  ].join('\n');
+}

package/src/commands/context.js

@@ -1,5 +1,6 @@
 import { tryResolveGitContext } from '../lib/git-context.js';
 import { resolveAgentSamBaseUrl, resolveBridgeKey } from '../lib/bridge-client.js';
+import { loadProjectRules } from '../lib/project-rules.js';
 
 function parseArgs(argv = []) {
   const options = { json: false, cwd: process.cwd(), remote: 'origin' };
@@ -15,10 +16,20 @@ function parseArgs(argv = []) {
 
 export function buildContextReport(options = {}) {
   const env = options.env || process.env;
-  const git = tryResolveGitContext({ cwd: options.cwd || process.cwd(), remote: options.remote || 'origin' });
+  const cwd = options.cwd || process.cwd();
+  const git = tryResolveGitContext({ cwd, remote: options.remote || 'origin' });
+  const rules = loadProjectRules(cwd);
   return {
-    schemaVersion: 'agentsam-context-v1',
+    schemaVersion: 'agentsam-context-v2',
     git,
+    rules: {
+      found: rules.found,
+      path: rules.path,
+      chars: rules.chars,
+      source_chars: rules.source_chars || 0,
+      truncated: rules.truncated,
+      hash: rules.hash,
+    },
     bridge: {
       baseUrl: resolveAgentSamBaseUrl(env),
       configured: Boolean(resolveBridgeKey(env)),
@@ -46,6 +57,7 @@ export async function runContext(argv = []) {
   } else {
     console.log('  repo       not inside a Git repository');
   }
+  console.log(`  rules      ${report.rules.found ? `${report.rules.path} · ${report.rules.chars} chars` : 'none'}`);
   console.log(`  core       ${report.bridge.baseUrl}`);
   console.log(`  bridge     ${report.bridge.configured ? 'configured' : 'AGENTSAM_BRIDGE_KEY not set'}`);
   console.log('');

package/src/commands/db.js

@@ -1,6 +1,7 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { initializeLocalSqlite, inspectLocalSqlite } from '../local/sqlite.js';
+import { getLocalDatabasePath, getLocalSchemaPath, readProjectConfig } from '../lib/project-config.js';
 
 function findProjectRoot(startDir) {
   let dir = path.resolve(startDir);
@@ -13,14 +14,10 @@ function findProjectRoot(startDir) {
   throw new Error('Not an Agent Sam project — run `agentsam init` first.');
 }
 
-function readConfig(root) {
-  return JSON.parse(fs.readFileSync(path.join(root, '.agentsam', 'config.json'), 'utf8'));
-}
-
 function resolveDb(root, config) {
   return {
-    dbPath: path.resolve(root, config.db_path || '.agentsam/data/agentsam.sqlite'),
-    schemaPath: path.resolve(root, config.db_schema || 'db/schema.sql'),
+    dbPath: path.resolve(root, getLocalDatabasePath(config)),
+    schemaPath: path.resolve(root, getLocalSchemaPath(config)),
   };
 }
 
@@ -31,7 +28,7 @@ export async function runDb(argv = [], opts = {}) {
   }
 
   const root = findProjectRoot(opts.cwd || process.cwd());
-  const config = readConfig(root);
+  const config = readProjectConfig(root);
   const paths = resolveDb(root, config);
 
   if (sub === 'init') {

package/src/commands/deploy.js

@@ -6,26 +6,17 @@ import path from 'node:path';
 import readline from 'node:readline';
 import { authenticateViaBrowser } from '../lib/auth.js';
 import { getJson, streamScaffold } from '../lib/core-client.js';
-
-function readConfig(cwd) {
-  const configPath = path.join(cwd, '.agentsam', 'config.json');
-  if (!fs.existsSync(configPath)) {
-    throw new Error('Not an Agent Sam project — run agentsam init first.');
-  }
-  return JSON.parse(fs.readFileSync(configPath, 'utf8'));
-}
-
-function writeConfig(cwd, config) {
-  const configPath = path.join(cwd, '.agentsam', 'config.json');
-  fs.writeFileSync(configPath, `${JSON.stringify(config, null, 2)}\n`, 'utf8');
-}
+import { resolveAccountSdkKey } from '../lib/account-session.js';
+import { getDefaultProfile, getDeployTarget, getLocalSchemaPath, getProjectName, getProjectPreset, readProjectConfig, setDeployTarget, writeProjectConfig } from '../lib/project-config.js';
+import { isLocalStudioCheckout, runLocalStudioDeploy } from '../lib/deploy/local-studio.js';
 
 function writeCloudflareAdapter(cwd, config, cf) {
-  const workerName = cf.worker_name || config.project;
+  const projectName = getProjectName(config, path.basename(cwd));
+  const workerName = cf.worker_name || projectName;
   const adapterPath = path.join(cwd, 'src', 'cloudflare-worker.js');
   const migrationDir = path.join(cwd, 'migrations');
   const migrationPath = path.join(migrationDir, '0001_agentsam_core.sql');
-  const localSchemaPath = path.join(cwd, config.db_schema || 'db/schema.sql');
+  const localSchemaPath = path.join(cwd, getLocalSchemaPath(config));
   const tomlPath = path.join(cwd, 'wrangler.toml');
 
   fs.mkdirSync(path.dirname(adapterPath), { recursive: true });
@@ -33,7 +24,7 @@ function writeCloudflareAdapter(cwd, config, cf) {
 
   fs.writeFileSync(
     adapterPath,
-    `import { createAgent } from './agent.js';\n\nexport default {\n  async fetch(request, env) {\n    const app = createAgent({\n      env,\n      project: ${JSON.stringify(config.project)},\n      lane: ${JSON.stringify(config.lane)},\n      agent: ${JSON.stringify(config.agent)},\n    });\n    return app.handle(request);\n  },\n};\n`,
+    `import { createAgent } from './agent.js';\n\nexport default {\n  async fetch(request, env) {\n    const app = createAgent({\n      env,\n      project: ${JSON.stringify(projectName)},\n      lane: ${JSON.stringify(getProjectPreset(config))},\n      agent: ${JSON.stringify(getDefaultProfile(config))},\n    });\n    return app.handle(request);\n  },\n};\n`,
     'utf8',
   );
 
@@ -51,7 +42,7 @@ function writeCloudflareAdapter(cwd, config, cf) {
   if (cf.d1_database_id) {
     lines.push('', '[[d1_databases]]');
     lines.push('binding = "DB"');
-    lines.push(`database_name = ${JSON.stringify(cf.d1_database_name || `${config.project}-db`)}`);
+    lines.push(`database_name = ${JSON.stringify(cf.d1_database_name || `${projectName}-db`)}`);
     lines.push(`database_id = ${JSON.stringify(cf.d1_database_id)}`);
   }
   if (cf.kv_namespace_id) {
@@ -77,7 +68,7 @@ function ask(question) {
 async function runCloudflareDeploy(cwd, config, accountId) {
   console.log('\n  Cloudflare deploy — browser sign-in + resource provisioning…\n');
 
-  let token = process.env.AGENTSAM_SDK_TOKEN || '';
+  let token = resolveAccountSdkKey({ env: process.env }).value;
   if (!token) {
     const session = await authenticateViaBrowser();
     token = session.access_token;
@@ -92,8 +83,8 @@ async function runCloudflareDeploy(cwd, config, accountId) {
   let complete = null;
   await streamScaffold(
     {
-      project_name: config.project,
-      lane: config.lane,
+      project_name: getProjectName(config, path.basename(cwd)),
+      lane: getProjectPreset(config),
       hosting: 'cloudflare',
       provision_only: true,
       account_id: accountId || undefined,
@@ -114,13 +105,8 @@ async function runCloudflareDeploy(cwd, config, accountId) {
   if (!complete?.cloudflare) throw new Error('deploy incomplete — no cloudflare ids returned');
 
   const adapter = writeCloudflareAdapter(cwd, config, complete.cloudflare);
-  writeConfig(cwd, {
-    ...config,
-    deploy_target: 'cloudflare',
-    cloudflare: complete.cloudflare,
-    cloud_adapter: path.relative(cwd, adapter.adapterPath),
-    deployed_at: new Date().toISOString(),
-  });
+  setDeployTarget(config, 'cloudflare');
+  writeProjectConfig(cwd, config);
 
   console.log(`
   ✓ Cloudflare resources provisioned in YOUR account
@@ -137,14 +123,49 @@ async function runCloudflareDeploy(cwd, config, accountId) {
 }
 
 /**
- * @param {{ cwd?: string, target?: string, accountId?: string }} [opts]
+ * @param {{ cwd?: string, target?: string, accountId?: string, dryRun?: boolean, plan?: boolean }} [opts]
  */
 export async function runDeploy(opts = {}) {
   const cwd = path.resolve(opts.cwd || process.cwd());
-  const config = readConfig(cwd);
 
-  let target = opts.target || config.deploy_target || 'cloudflare';
-  if (!opts.target && !config.deploy_target) {
+  if (isLocalStudioCheckout(cwd)) {
+    const result = await runLocalStudioDeploy({
+      cwd,
+      dryRun: Boolean(opts.dryRun),
+      planOnly: Boolean(opts.plan),
+      execute: !opts.plan,
+    });
+    const payload = {
+      provider: result.plan.provider,
+      app: result.plan.app,
+      wranglerConfig: result.plan.wranglerConfig,
+      wranglerArgs: result.plan.wranglerArgs,
+      cwd: result.plan.cwd,
+      envLoaded: result.plan.envLoaded,
+      fingerprint: result.plan.fingerprint,
+      skip: result.plan.skip,
+      dryRun: Boolean(opts.dryRun),
+      plan: Boolean(opts.plan),
+      genericRootDeploy: false,
+      receipt: result.receipt,
+    };
+    console.log(JSON.stringify(payload, null, 2));
+    if (result.plan.skip) {
+      console.log('skip: unchanged deploy fingerprint');
+    } else if (opts.plan) {
+      console.log('plan only — no wrangler deploy');
+    } else if (opts.dryRun) {
+      console.log('wrangler dry-run complete');
+    } else {
+      console.log('local-studio deploy complete');
+    }
+    return result;
+  }
+
+  const config = readProjectConfig(cwd);
+
+  let target = opts.target || getDeployTarget(config) || 'cloudflare';
+  if (!opts.target && !getDeployTarget(config)) {
     console.log(`
   Where do you want to deploy?
 
@@ -166,7 +187,8 @@ export async function runDeploy(opts = {}) {
   Your local project keeps running with npm run dev.
   Container/Worker deploy scripts are project-specific — add when ready.
   `);
-    writeConfig(cwd, { ...config, deploy_target: 'gcp' });
+    setDeployTarget(config, 'gcp');
+    writeProjectConfig(cwd, config);
     return;
   }