@inneranimalmedia/agentsam-sdk 2.4.1 → 2.6.0

package/src/commands/ollama.js

@@ -0,0 +1,259 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawn, spawnSync } from 'node:child_process';
+import { readProjectConfig, setLocalModelCapability, writeProjectConfig } from '../lib/project-config.js';
+
+export const OLLAMA_DEFAULTS = Object.freeze({
+  baseUrl: 'http://127.0.0.1:11434',
+  model: 'qwen2.5-coder',
+  embedModel: 'mxbai-embed-large',
+});
+
+function clean(value) {
+  return value == null ? '' : String(value).trim();
+}
+
+function boolFlag(argv, name) {
+  return argv.includes(name);
+}
+
+export function parseOllamaArgs(argv = []) {
+  const first = argv[0] && !String(argv[0]).startsWith('-') ? String(argv[0]) : 'status';
+  const opts = {
+    command: first,
+    cwd: process.cwd(),
+    envFile: '',
+    baseUrl: '',
+    model: '',
+    embedModel: '',
+    install: boolFlag(argv, '--install'),
+    start: boolFlag(argv, '--start'),
+    pull: boolFlag(argv, '--pull'),
+    json: boolFlag(argv, '--json'),
+  };
+
+  for (let i = first === argv[0] ? 1 : 0; i < argv.length; i += 1) {
+    const arg = argv[i];
+    if (['--install', '--start', '--pull', '--json'].includes(arg)) continue;
+    if (arg === '--cwd') opts.cwd = argv[++i] || opts.cwd;
+    else if (arg === '--env-file') opts.envFile = argv[++i] || '';
+    else if (arg === '--base-url') opts.baseUrl = argv[++i] || '';
+    else if (arg === '--model') opts.model = argv[++i] || '';
+    else if (arg === '--embed-model') opts.embedModel = argv[++i] || '';
+    else if (!String(arg).startsWith('-') && opts.command === 'pull') {
+      opts.model = opts.model || arg;
+    } else if (arg === '--help' || arg === '-h') opts.command = 'help';
+    else throw new Error(`unknown ollama option: ${arg}`);
+  }
+  return opts;
+}
+
+export function resolveOllamaConfig(opts = {}, env = process.env) {
+  return {
+    baseUrl: clean(opts.baseUrl || env.OLLAMA_BASE_URL || OLLAMA_DEFAULTS.baseUrl).replace(/\/+$/, ''),
+    model: clean(opts.model || env.OLLAMA_MODEL || OLLAMA_DEFAULTS.model),
+    embedModel: clean(opts.embedModel || env.OLLAMA_EMBED_MODEL || OLLAMA_DEFAULTS.embedModel),
+  };
+}
+
+function replaceEnvLine(text, key, value) {
+  const escaped = key.replace(/[.*+?^${}()|[\]\\]/g, '\\$&');
+  const line = `${key}=${value}`;
+  const re = new RegExp(`^${escaped}=.*$`, 'm');
+  if (re.test(text)) return text.replace(re, line);
+  const prefix = text && !text.endsWith('\n') ? `${text}\n` : text;
+  return `${prefix}${line}\n`;
+}
+
+export function upsertOllamaEnvFile(filename, config) {
+  const target = path.resolve(filename);
+  fs.mkdirSync(path.dirname(target), { recursive: true });
+  let text = fs.existsSync(target) ? fs.readFileSync(target, 'utf8') : '';
+  text = replaceEnvLine(text, 'OLLAMA_BASE_URL', config.baseUrl);
+  text = replaceEnvLine(text, 'OLLAMA_MODEL', config.model);
+  text = replaceEnvLine(text, 'OLLAMA_EMBED_MODEL', config.embedModel);
+  fs.writeFileSync(target, text, 'utf8');
+  return target;
+}
+
+export function updateProjectOllamaConfig(cwd, config) {
+  const root = path.resolve(cwd);
+  const filename = path.join(root, '.agentsam', 'config.json');
+  if (!fs.existsSync(filename)) return null;
+  const project = readProjectConfig(root);
+  setLocalModelCapability(project, 'ollama');
+  writeProjectConfig(root, project);
+  return filename;
+}
+
+function commandResult(command, args, options = {}) {
+  return spawnSync(command, args, {
+    encoding: 'utf8',
+    stdio: options.inherit ? 'inherit' : ['ignore', 'pipe', 'pipe'],
+    timeout: options.timeout || 15_000,
+    ...options,
+  });
+}
+
+export function commandAvailable(command, spawnSyncImpl = spawnSync) {
+  const finder = process.platform === 'win32' ? 'where' : 'which';
+  const result = spawnSyncImpl(finder, [command], { encoding: 'utf8', stdio: 'ignore' });
+  return result.status === 0;
+}
+
+export function ollamaInstallPlan(platform = process.platform, available = {}) {
+  if ((platform === 'darwin' || platform === 'linux') && available.brew) {
+    return { command: 'brew', args: ['install', 'ollama'], manager: 'homebrew' };
+  }
+  if (platform === 'win32' && available.winget) {
+    return {
+      command: 'winget',
+      args: ['install', '--id', 'Ollama.Ollama', '--exact', '--accept-source-agreements', '--accept-package-agreements'],
+      manager: 'winget',
+    };
+  }
+  return null;
+}
+
+function installOllama() {
+  const available = {
+    brew: commandAvailable('brew'),
+    winget: commandAvailable('winget'),
+  };
+  const plan = ollamaInstallPlan(process.platform, available);
+  if (!plan) {
+    throw new Error('automatic Ollama install is unavailable on this host; install Ollama with your platform package manager, then rerun `agentsam ollama setup`');
+  }
+  const result = commandResult(plan.command, plan.args, { inherit: true, timeout: 20 * 60_000 });
+  if (result.status !== 0) throw new Error(`Ollama install failed via ${plan.manager}`);
+  return plan.manager;
+}
+
+function startOllama() {
+  if (process.platform === 'darwin' && commandAvailable('brew')) {
+    const result = commandResult('brew', ['services', 'start', 'ollama'], { inherit: true, timeout: 60_000 });
+    if (result.status === 0) return 'homebrew-service';
+  }
+  const child = spawn('ollama', ['serve'], { detached: true, stdio: 'ignore' });
+  child.unref();
+  return 'ollama-serve';
+}
+
+function normalizeModelName(value) {
+  return clean(value).toLowerCase().replace(/:latest$/, '');
+}
+
+function hasModel(models, desired) {
+  const want = normalizeModelName(desired);
+  return models.some((row) => normalizeModelName(row.name || row.model) === want);
+}
+
+export async function probeOllama(config, fetchImpl = fetch) {
+  const endpoint = `${config.baseUrl}/api/tags`;
+  try {
+    const response = await fetchImpl(endpoint, { signal: AbortSignal.timeout(2000) });
+    if (!response.ok) return { online: false, status: response.status, endpoint, models: [] };
+    const body = await response.json();
+    const models = Array.isArray(body?.models) ? body.models.map((row) => ({ name: row.name || row.model || '' })).filter((row) => row.name) : [];
+    return {
+      online: true,
+      status: response.status,
+      endpoint,
+      models,
+      chat_ready: hasModel(models, config.model),
+      embed_ready: hasModel(models, config.embedModel),
+    };
+  } catch (error) {
+    return { online: false, status: null, endpoint, models: [], error: error?.message || String(error) };
+  }
+}
+
+function binaryInfo() {
+  if (!commandAvailable('ollama')) return { installed: false, version: null };
+  const result = commandResult('ollama', ['--version']);
+  return {
+    installed: result.status === 0,
+    version: result.status === 0 ? clean(result.stdout || result.stderr) : null,
+  };
+}
+
+function pullModel(model) {
+  const result = commandResult('ollama', ['pull', model], { inherit: true, timeout: 60 * 60_000 });
+  if (result.status !== 0) throw new Error(`ollama pull failed for ${model}`);
+}
+
+function help() {
+  return `agentsam ollama <setup|status|list|pull> [options]\n\nLocal-only Ollama development kit. Nothing here configures an edge model.\n\n  setup                 Write OLLAMA_* values into the local project .env\n    --install           Explicitly install Ollama with a supported package manager\n    --start             Start the local Ollama service\n    --pull              Pull both configured chat + embedding models\n  status                Probe the local Ollama API and configured models\n  list                  Alias for status with model inventory\n  pull [model]          Pull one model, or both configured defaults when omitted\n\n  --base-url <url>      Default http://127.0.0.1:11434\n  --model <name>        Default qwen2.5-coder\n  --embed-model <name>  Default mxbai-embed-large\n  --cwd <path>          Project root (default current directory)\n  --env-file <path>     Env file to update (default <cwd>/.env)\n  --json                Machine-readable output\n\nRemote AgentSam sessions should use the existing user-hosted terminal tunnel to execute this CLI on the local machine; the Worker should not try to reach 127.0.0.1.\n`;
+}
+
+function printResult(result, json) {
+  if (json) {
+    process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
+    return;
+  }
+  console.log(`Ollama local development`);
+  console.log(`  base URL     ${result.config.baseUrl}`);
+  console.log(`  chat model   ${result.config.model}`);
+  console.log(`  embed model  ${result.config.embedModel}`);
+  console.log(`  binary       ${result.binary.installed ? result.binary.version || 'installed' : 'not installed'}`);
+  console.log(`  API          ${result.api.online ? 'online' : 'offline'}`);
+  if (result.env_file) console.log(`  env          ${result.env_file}`);
+  if (result.project_config) console.log(`  project      ${result.project_config}`);
+  if (result.api.online) {
+    console.log(`  chat ready   ${result.api.chat_ready ? 'yes' : 'no'}`);
+    console.log(`  embed ready  ${result.api.embed_ready ? 'yes' : 'no'}`);
+  }
+  if (!result.binary.installed) console.log(`  next         agentsam ollama setup --install --start --pull`);
+  else if (!result.api.online) console.log(`  next         agentsam ollama setup --start`);
+  else if (!result.api.chat_ready || !result.api.embed_ready) console.log(`  next         agentsam ollama pull`);
+}
+
+export async function runOllama(argv = []) {
+  const opts = parseOllamaArgs(argv);
+  if (opts.command === 'help') {
+    process.stdout.write(help());
+    return;
+  }
+  if (!['setup', 'status', 'list', 'pull'].includes(opts.command)) {
+    throw new Error(`unknown ollama command: ${opts.command}`);
+  }
+
+  const root = path.resolve(opts.cwd || process.cwd());
+  const config = resolveOllamaConfig(opts);
+  let envFile = null;
+  let projectConfig = null;
+  let installedBy = null;
+  let startedBy = null;
+
+  if (opts.command === 'setup') {
+    envFile = upsertOllamaEnvFile(opts.envFile || path.join(root, '.env'), config);
+    projectConfig = updateProjectOllamaConfig(root, config);
+    if (!commandAvailable('ollama') && opts.install) installedBy = installOllama();
+    if (commandAvailable('ollama') && opts.start) startedBy = startOllama();
+  }
+
+  if (opts.command === 'pull') {
+    if (!commandAvailable('ollama')) throw new Error('Ollama is not installed; run `agentsam ollama setup --install` first');
+    const requested = opts.model && opts.model !== OLLAMA_DEFAULTS.model ? [opts.model] : [config.model, config.embedModel];
+    for (const model of [...new Set(requested.filter(Boolean))]) pullModel(model);
+  } else if (opts.command === 'setup' && opts.pull) {
+    if (!commandAvailable('ollama')) throw new Error('Ollama is not installed; rerun setup with --install before --pull');
+    for (const model of [...new Set([config.model, config.embedModel])]) pullModel(model);
+  }
+
+  if (startedBy) await new Promise((resolve) => setTimeout(resolve, 600));
+  const result = {
+    schemaVersion: 'agentsam-ollama-local-v1',
+    local_only: true,
+    edge_model: false,
+    config,
+    env_file: envFile,
+    project_config: projectConfig,
+    installed_by: installedBy,
+    started_by: startedBy,
+    binary: binaryInfo(),
+    api: await probeOllama(config),
+  };
+  printResult(result, opts.json);
+  return result;
+}

package/src/commands/preferences.js

@@ -0,0 +1,144 @@
+import fs from 'node:fs';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { cancel, confirm, intro, isCancel, outro, select, text } from '@clack/prompts';
+import { collectModelsStatus } from './models.js';
+import { getModelRecord } from '../models/index.js';
+import { detectCliProject, readCliPreferences, writeCliPreferences } from '../lib/cli-preferences.js';
+
+function stopIfCancelled(value) {
+  if (!isCancel(value)) return value;
+  cancel('Agent Sam setup cancelled.');
+  const error = new Error('setup_cancelled');
+  error.code = 'AGENTSAM_SETUP_CANCELLED';
+  throw error;
+}
+
+function commandExists(command) {
+  const probe = process.platform === 'win32' ? ['where', [command]] : ['sh', ['-lc', `command -v ${command}`]];
+  return spawnSync(probe[0], probe[1], { stdio: 'ignore' }).status === 0;
+}
+
+export function availableShells(env = process.env) {
+  const values = [];
+  const detected = path.basename(env.SHELL || env.ComSpec || '').trim();
+  if (detected) values.push(detected);
+  for (const shell of ['zsh', 'bash', 'fish', 'pwsh']) if (!values.includes(shell) && commandExists(shell)) values.push(shell);
+  return values.length ? values : ['shell'];
+}
+
+export function modelOptions(status) {
+  const options = [{ value: 'auto', label: 'Automatic', hint: 'runtime chooses; exact economics unavailable until resolved' }];
+  for (const model of status.availableModels || []) {
+    options.push({ value: model.model_key, label: model.label, hint: `${model.provider_model_id} · provider verified` });
+  }
+  if (status.local?.online) {
+    for (const row of status.local.models || []) if (row?.name) options.push({ value: `ollama:${row.name}`, label: `Ollama · ${row.name}`, hint: 'local' });
+  }
+  for (const provider of status.providers || []) {
+    if (provider.configured && !options.some((row) => row.value.startsWith(`${provider.id}:`) && row.value !== `${provider.id}:auto`)) {
+      options.push({ value: `${provider.id}:auto`, label: `${provider.label} · automatic`, hint: 'credential proven; exact model not verified' });
+    }
+  }
+  return options;
+}
+
+function reasoningOptions(modelPreference) {
+  const record = getModelRecord(modelPreference);
+  if (!record) return [{ value: 'auto', label: 'Automatic', hint: 'runtime/provider default' }];
+  return record.reasoning_efforts.map((value) => ({
+    value,
+    label: value === 'xhigh' ? 'Extra high' : value === 'max' ? 'Max' : value[0].toUpperCase() + value.slice(1),
+    hint: value === 'low' ? 'lighter reasoning' : value === 'max' ? 'highest supported reasoning depth' : undefined,
+  }));
+}
+
+function serviceTierOptions(modelPreference) {
+  const record = getModelRecord(modelPreference);
+  if (!record) return [{ value: 'default', label: 'Standard', hint: 'default provider processing' }];
+  return record.service_tiers.map((value) => {
+    if (value === 'fast') return { value, label: 'Fast', hint: 'lower latency · 2× applicable token rates for Astra' };
+    if (value === 'flex') return { value, label: 'Flex', hint: 'slower / capacity-sensitive · 50% of Standard for Astra' };
+    return { value, label: 'Standard', hint: 'standard pricing and latency' };
+  });
+}
+
+async function promptModelPreferences(identity, existing, options = {}) {
+  let status = { providers: [], availableModels: [], local: { online: false, models: [] } };
+  try { status = await collectModelsStatus(options.modelStatusOptions || {}); } catch { /* inventory remains best-effort */ }
+  const models = modelOptions(status);
+  const initialModel = models.some((row) => row.value === existing.modelPreference) ? existing.modelPreference : 'auto';
+  const modelPreference = stopIfCancelled(await select({ message: 'Model', initialValue: initialModel, options: models }));
+
+  const reasoning = reasoningOptions(modelPreference);
+  const initialReasoning = reasoning.some((row) => row.value === existing.reasoningEffort) ? existing.reasoningEffort : reasoning[0].value;
+  const reasoningEffort = stopIfCancelled(await select({ message: 'Reasoning level', initialValue: initialReasoning, options: reasoning }));
+
+  const tiers = serviceTierOptions(modelPreference);
+  const initialTier = tiers.some((row) => row.value === existing.serviceTier) ? existing.serviceTier : tiers[0].value;
+  const serviceTier = stopIfCancelled(await select({ message: 'Processing', initialValue: initialTier, options: tiers }));
+
+  return { modelPreference, reasoningEffort, serviceTier };
+}
+
+export async function configureCliPreferences({ cwd = process.cwd(), firstRun = false, section = 'all', modelStatusOptions } = {}) {
+  let identity = detectCliProject(cwd);
+  const existing = readCliPreferences(identity.root) || {};
+  intro(firstRun ? `You are in ${identity.root}` : section === 'model' ? 'Agent Sam model' : 'Agent Sam settings');
+
+  let trustedDirectory = existing.trustedDirectory === true;
+  if (firstRun && !trustedDirectory) {
+    trustedDirectory = stopIfCancelled(await confirm({
+      message: 'Do you trust the contents of this directory? Project-local instructions, hooks, and execution policy may load.',
+      initialValue: false,
+    }));
+    if (!trustedDirectory) {
+      cancel('Directory not trusted. Agent Sam did not load project-local configuration.');
+      const error = new Error('directory_not_trusted');
+      error.code = 'AGENTSAM_SETUP_CANCELLED';
+      throw error;
+    }
+  }
+
+  let runtime = existing.runtime || 'local';
+  let terminal = existing.terminal || availableShells()[0];
+  if (!firstRun && section === 'all') {
+    const projectChoice = stopIfCancelled(await select({
+      message: 'Where should Agent Sam work?',
+      initialValue: 'current',
+      options: [
+        { value: 'current', label: `This project · ${identity.project}`, hint: identity.root },
+        { value: 'other', label: 'Choose another folder' },
+      ],
+    }));
+    if (projectChoice === 'other') {
+      const folder = stopIfCancelled(await text({
+        message: 'Project folder', placeholder: identity.root, defaultValue: identity.root,
+        validate(value) {
+          const resolved = path.resolve(String(value || ''));
+          if (!fs.existsSync(resolved)) return 'Folder does not exist';
+          if (!fs.statSync(resolved).isDirectory()) return 'Path is not a directory';
+        },
+      }));
+      identity = detectCliProject(path.resolve(String(folder)));
+    }
+    runtime = stopIfCancelled(await select({
+      message: 'Runtime', initialValue: runtime,
+      options: [
+        { value: 'local', label: 'Local machine', hint: 'real shell + filesystem' },
+        { value: 'remote', label: 'Remote', hint: 'connected remote runtime' },
+        { value: 'sandbox', label: 'Sandbox', hint: 'isolated disposable runtime' },
+      ],
+    }));
+    const shells = availableShells();
+    terminal = stopIfCancelled(await select({
+      message: 'Terminal', initialValue: terminal && shells.includes(terminal) ? terminal : shells[0],
+      options: shells.map((shell) => ({ value: shell, label: shell, hint: shell === shells[0] ? 'detected/default' : undefined })),
+    }));
+  }
+
+  const model = await promptModelPreferences(identity, existing, { modelStatusOptions });
+  const preferences = writeCliPreferences(identity.root, { trustedDirectory, runtime, terminal, ...model });
+  outro(`Ready · ${identity.project}`);
+  return { identity, preferences };
+}

package/src/commands/product.js

@@ -1,8 +1,9 @@
 import fs from 'node:fs';
 import path from 'node:path';
 import { spawn } from 'node:child_process';
-import { getCapability, getCapabilityManifest, listCapabilities, repositorySnapshot } from '../capabilities/index.js';
+import { getCapability, getCapabilityManifest, listCapabilities, projectRepositorySnapshot, repositorySnapshot } from '../capabilities/index.js';
 import { getAddon, listAddons, listPresets } from '../presets/index.js';
+import { projectConfigPath, readProjectConfig, setDeployTarget, setProductPreset, writeProjectConfig } from '../lib/project-config.js';
 
 function parseCommon(argv = []) {
   const out = { json: false, cwd: process.cwd(), positionals: [] };
@@ -18,24 +19,94 @@ function parseCommon(argv = []) {
 export async function runInspect(argv = []) {
   const opts = parseCommon(argv);
   let churnDays = 30;
+  let view = 'index';
+  let viewExplicit = false;
+  let limit = 50;
+  let facetLimit = 48;
+  let pretty = false;
+  let snapshotFile = '';
+  let saveSnapshot = '';
+  const filters = {};
+  const addFilter = (field, value) => {
+    const clean = String(value || '').trim();
+    if (!clean) throw new Error(`inspect_${field}_value_required`);
+    (filters[field] ||= []).push(clean);
+  };
+  const filterFlags = new Map([
+    ['--system', 'system'], ['--package', 'package'], ['--category', 'category'], ['--layer', 'layer'],
+    ['--kind', 'kind'], ['--language', 'language'], ['--role', 'role'], ['--execution-domain', 'execution_domain'], ['--tag', 'tag'],
+    ['--path', 'path'], ['--symbol', 'symbol'], ['--import', 'import'], ['--match', 'match'],
+  ]);
   for (let i = 0; i < opts.positionals.length; i += 1) {
-    if (opts.positionals[i] === '--churn-days') churnDays = Number(opts.positionals[++i] || 30);
-    else if (opts.positionals[i] === 'repository') continue;
-    else throw new Error(`unknown inspect option: ${opts.positionals[i]}`);
+    const arg = opts.positionals[i];
+    if (arg === '--churn-days') churnDays = Number(opts.positionals[++i] || 30);
+    else if (arg === '--view') { view = String(opts.positionals[++i] || '').trim().toLowerCase(); viewExplicit = true; }
+    else if (arg === '--limit') limit = Number(opts.positionals[++i] || 50);
+    else if (arg === '--facet-limit') facetLimit = Number(opts.positionals[++i] || 48);
+    else if (arg === '--pretty') pretty = true;
+    else if (arg === '--full') { view = 'full'; viewExplicit = true; }
+    else if (arg === '--index') { view = 'index'; viewExplicit = true; }
+    else if (arg === '--snapshot-file') snapshotFile = String(opts.positionals[++i] || '').trim();
+    else if (arg === '--save-snapshot') saveSnapshot = String(opts.positionals[++i] || '').trim();
+    else if (filterFlags.has(arg)) addFilter(filterFlags.get(arg), opts.positionals[++i]);
+    else if (arg === 'repository') continue;
+    else throw new Error(`unknown inspect option: ${arg}`);
   }
-  const result = await repositorySnapshot({ cwd: opts.cwd, churnDays });
-  if (opts.json) process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);
-  else {
+  if (!['full', 'index', 'files'].includes(view)) throw new Error(`invalid inspect view: ${view}`);
+  if (!Number.isInteger(limit) || limit < 1 || limit > 500) throw new Error('inspect limit must be an integer from 1..500');
+  if (!Number.isInteger(facetLimit) || facetLimit < 1 || facetLimit > 200) throw new Error('inspect facet limit must be an integer from 1..200');
+  if (Object.keys(filters).length && !viewExplicit) view = 'files';
+  else if (Object.keys(filters).length && view === 'full') view = 'files';
+  if (argv.includes('--snapshot-file') && !snapshotFile) throw new Error('inspect_snapshot_file_value_required');
+  if (argv.includes('--save-snapshot') && !saveSnapshot) throw new Error('inspect_save_snapshot_value_required');
+
+  const result = snapshotFile
+    ? JSON.parse(fs.readFileSync(path.resolve(opts.cwd, snapshotFile), 'utf8'))
+    : await repositorySnapshot({ cwd: opts.cwd, churnDays });
+  if (!result || result.capability !== 'repository.snapshot' || !result.snapshot_id || !result.tree) {
+    throw new Error('inspect_snapshot_file_invalid');
+  }
+  if (saveSnapshot) {
+    const filename = path.resolve(opts.cwd, saveSnapshot);
+    fs.mkdirSync(path.dirname(filename), { recursive: true });
+    fs.writeFileSync(filename, `${JSON.stringify(result)}\n`, 'utf8');
+  }
+  const output = view === 'full' ? result : projectRepositorySnapshot(result, { view, filters, limit, facetLimit });
+  if (opts.json) process.stdout.write(`${JSON.stringify(output, null, pretty ? 2 : 0)}\n`);
+  else if (view !== 'full') {
+    console.log(`\nRepository snapshot ${result.snapshot_id} · ${view}`);
+    console.log(`  repo       ${result.repository.full_name || result.repository.repository_id || '(local)'}`);
+    console.log(`  revision   ${result.repository.revision_sha}`);
+    console.log(`  merkle     ${result.tree.merkle_root}`);
+    console.log(`  metadata   ${result.tree.metadata_root}`);
+    console.log(`  matched    ${output.projection.matched}${output.projection.truncated ? ` (showing ${output.projection.returned})` : ''}`);
+    const systems = output.facets.systems.slice(0, 12).map((row) => `${row.value}:${row.count}`).join(', ');
+    if (systems) console.log(`  systems    ${systems}`);
+    const trust = output.analysis?.trust_boundary;
+    if (trust) {
+      console.log(`  trust      ${trust.status}${trust.finding_count ? ` · ${trust.finding_count} contradiction${trust.finding_count === 1 ? '' : 's'}` : ''}`);
+      for (const finding of trust.findings || []) {
+        console.log(`    ! ${finding.kind}: ${finding.source}${finding.target ? ` → ${finding.target}` : finding.specifier ? ` · ${finding.specifier}` : finding.env ? ` · ${finding.env}` : ''}`);
+        if (finding.repair_action) console.log(`      repair: ${finding.repair_action}`);
+      }
+      if (trust.findings_truncated) console.log(`    … ${trust.finding_count - trust.findings_returned} more contradiction(s); use --view full --json for full evidence`);
+    }
+    if (view === 'files') for (const file of output.files) console.log(`  ${file.path}  [${file.system || '-'} / ${file.category || '-'} / ${file.execution_domain || 'unknown'}]`);
+    console.log('');
+  } else {
     console.log(`\nRepository snapshot ${result.snapshot_id}`);
     console.log(`  repo       ${result.repository.full_name || result.repository.repository_id || '(local)'}`);
     console.log(`  revision   ${result.repository.revision_sha}`);
     console.log(`  merkle     ${result.tree.merkle_root}`);
+    console.log(`  metadata   ${result.tree.metadata_root}`);
     console.log(`  files      ${result.intelligence.summary?.file_count ?? result.tree.stats?.files ?? 'unknown'}`);
     console.log(`  knowledge  ${result.knowledge?.indexed ? result.knowledge.generation_id : result.knowledge?.configured ? 'configured / not indexed' : 'not configured'}`);
+    const trust = result.analysis?.trust_boundary;
+    if (trust) console.log(`  trust      ${trust.status}${trust.findings?.length ? ` · ${trust.findings.length} contradiction${trust.findings.length === 1 ? '' : 's'}` : ''}`);
     console.log(`  deploy     ${result.deploy?.status || 'no trusted receipt'}`);
     console.log(`  content    ${result.content_hash}\n`);
   }
-  return result;
+  return output;
 }
 
 export async function runCapabilities(argv = []) {
@@ -53,16 +124,15 @@ export async function runCapabilities(argv = []) {
   return result;
 }
 
-function projectConfigPath(cwd) { return path.join(cwd, '.agentsam', 'config.json'); }
 function featureStatePath(cwd) { return path.join(cwd, '.agentsam', 'features.json'); }
 
 export function applyPresetSelection(cwd, preset) {
   const filename = projectConfigPath(cwd);
   if (!fs.existsSync(filename)) throw new Error('not_agentsam_project');
-  const config = JSON.parse(fs.readFileSync(filename, 'utf8'));
-  const next = { ...config, preset: preset.id, features: [...preset.features], capabilities: [...preset.capabilities] };
-  fs.writeFileSync(filename, `${JSON.stringify(next, null, 2)}\n`, 'utf8');
-  return next;
+  const config = readProjectConfig(cwd);
+  setProductPreset(config, preset);
+  writeProjectConfig(cwd, config);
+  return config;
 }
 
 export async function runAdd(argv = []) {
@@ -84,9 +154,9 @@ export async function runAdd(argv = []) {
   state.features[addon.id] = { selected: true, capabilities: addon.capabilities, selected_at: new Date().toISOString() };
   fs.writeFileSync(featureStatePath(cwd), `${JSON.stringify(state, null, 2)}\n`, 'utf8');
   if (addon.id === 'deploy-cloudflare') {
-    const config = JSON.parse(fs.readFileSync(projectConfigPath(cwd), 'utf8'));
-    config.deploy_target = 'cloudflare';
-    fs.writeFileSync(projectConfigPath(cwd), `${JSON.stringify(config, null, 2)}\n`, 'utf8');
+    const config = readProjectConfig(cwd);
+    setDeployTarget(config, 'cloudflare');
+    writeProjectConfig(cwd, config);
   }
   const result = { ok: true, feature: addon.id, capabilities: addon.capabilities, description: addon.description, state_file: '.agentsam/features.json' };
   if (opts.json) process.stdout.write(`${JSON.stringify(result, null, 2)}\n`);

package/src/commands/resume.js

@@ -0,0 +1,67 @@
+import path from 'node:path';
+import { isCancel, select } from '@clack/prompts';
+import { listLocalSessions, loadLocalSession } from '../lib/local-sessions.js';
+import { runShell } from './shell.js';
+
+function writeLine(write, value = '') { write(`${value}\n`); }
+function formatWhen(value) {
+  const date = new Date(value);
+  return Number.isNaN(date.getTime()) ? String(value || '') : date.toLocaleString();
+}
+
+export function renderSessionList(sessions = []) {
+  if (!sessions.length) return '\n  No resumable Agent Sam sessions found.\n';
+  const lines = ['', '  Agent Sam · sessions', ''];
+  for (const row of sessions) {
+    lines.push(`  ${row.id}  ${row.title}`);
+    lines.push(`    ${formatWhen(row.updated_at)} · ${row.model_key || 'no model'} · ${row.cwd}`);
+  }
+  lines.push('');
+  return lines.join('\n');
+}
+
+export async function runResume(argv = [], options = {}) {
+  const write = options.write || ((text) => process.stdout.write(text));
+  const json = argv.includes('--json');
+  const listOnly = argv.includes('--list');
+  const positional = argv.filter((arg) => !arg.startsWith('-'));
+  const unknown = argv.filter((arg) => arg.startsWith('-') && !['--json', '--list'].includes(arg));
+  if (unknown.length) throw new Error(`unknown resume option: ${unknown[0]}`);
+  if (positional.length > 1) throw new Error('agentsam resume accepts at most one session id');
+
+  if (listOnly || (json && !positional[0])) {
+    const sessions = listLocalSessions({ home: options.home, limit: 30 });
+    if (json) writeLine(write, JSON.stringify(sessions, null, 2));
+    else write(renderSessionList(sessions));
+    return sessions;
+  }
+
+  let sessionId = positional[0] || '';
+  if (!sessionId) {
+    const sessions = listLocalSessions({ home: options.home, limit: 30 });
+    if (!sessions.length) { write(renderSessionList([])); return null; }
+    const interactive = options.interactive ?? Boolean(process.stdin.isTTY && process.stdout.isTTY);
+    if (!interactive) { write(renderSessionList(sessions)); return null; }
+    const choice = await select({
+      message: 'Resume Agent Sam session',
+      options: sessions.map((row) => ({
+        value: row.id,
+        label: row.title,
+        hint: `${path.basename(row.cwd)} · ${formatWhen(row.updated_at)}`,
+      })),
+    });
+    if (isCancel(choice)) return null;
+    sessionId = choice;
+  }
+
+  const session = loadLocalSession(sessionId, { home: options.home });
+  if (!session) throw new Error(`session_not_found:${sessionId}`);
+  if (json) { writeLine(write, JSON.stringify(session, null, 2)); return session; }
+
+  writeLine(write, `\n  Resuming ${session.id}`);
+  writeLine(write, `  ${session.title}`);
+  writeLine(write, `  ${session.cwd}\n`);
+  const runner = options.runShellImpl || runShell;
+  await runner([], { cwd: session.cwd, intro: 'quiet', session, home: options.home });
+  return session;
+}

package/src/commands/security.js

@@ -1,18 +1,19 @@
 import fs from 'node:fs';
 import { scanProjectSecurity, reportExitCode, repairProject, formatSecurityReport } from '../security/index.js';
 import { runProcess } from '../security/process.js';
+import { diagnosticFromError, renderDiagnosticError } from '../errors/index.js';
 
 const help = [
-  'Agent Sam · dependency health',
+  'Agent Sam · security',
   '  agentsam security scan [--path DIR] [--offline] [--json]',
   '  agentsam security check --log FILE [--path DIR] [--json]',
   '  agentsam security run [--path DIR] [--json] -- COMMAND ARGS...',
   '  agentsam security repair [--path DIR] [--log FILE] [--apply] [--verify SCRIPT] [--json]',
   '  agentsam sca ...                 alias',
   '',
-  'scan/check: exact npm lockfile versions, full OSV advisories, deprecations and log triage.',
+  'scan/check: npm/OSV evidence plus AST+Merkle client/server trust-boundary contradictions.',
   'run: execute an explicitly supplied install/build command, then check its logs and dependencies.',
-  'repair: plan by default; --apply updates an isolated Git worktree, installs, verifies and rescans.',
+  'repair: plans dependency + trust-boundary repairs; --apply automates dependency-only repairs in an isolated worktree.',
   'Online lookup sends package names/versions to OSV, never source code or deployment logs.',
   'Offline is inventory only and exits 2. pnpm/Yarn/Bun graphs are explicitly unsupported.',
   'Exit: 0 clean/verified, 1 unresolved findings or command failure, 2 incomplete/error.',
@@ -63,9 +64,10 @@ export async function runSecurity(argv) {
     }
     process.stdout.write(options.json ? JSON.stringify(report, null, 2) + '\n' : formatSecurityReport(report, { color: Boolean(process.stdout.isTTY && !process.env.NO_COLOR) }));
     process.exitCode = reportExitCode(report);
-  } catch {
-    const report = { schema_version: 1, ok: false, complete: false, status: 'error', error: 'Security operation failed. Check command options, manifest/log validity, network access, and Git prerequisites. Use --help.' };
-    process.stdout.write(options.json ? JSON.stringify(report) + '\n' : report.error + '\n');
+  } catch (error) {
+    const diagnostic = diagnosticFromError(error, { source: 'security', kind: 'security_operation_error' });
+    const report = { schema_version: 1, ok: false, complete: false, status: 'error', error: diagnostic };
+    process.stdout.write(options.json ? JSON.stringify(report) + '\n' : `${renderDiagnosticError(error)}\n`);
     process.exitCode = 2;
   }
 }