CLI: Implement decoupled config file strategy

apps/cli/__mocks__/lib/daemon-client.ts

@@ -2,7 +2,7 @@ import { vi } from 'vitest';
 
 export const connectToDaemon = vi.fn().mockResolvedValue( undefined );
 export const disconnectFromDaemon = vi.fn().mockResolvedValue( undefined );
-export const emitSiteEvent = vi.fn().mockResolvedValue( undefined );
+export const emitCliEvent = vi.fn().mockResolvedValue( undefined );
 export const killDaemonAndChildren = vi.fn().mockResolvedValue( undefined );
 export const listProcesses = vi.fn().mockResolvedValue( [] );
 export const getDaemonBus = vi.fn().mockResolvedValue( {} );

apps/cli/ai/auth.ts

@@ -4,7 +4,7 @@ import {
 	getAiProviderDefinition,
 	type AiProviderId,
 } from 'cli/ai/providers';
-import { getAiProvider, saveAiProvider } from 'cli/lib/appdata';
+import { readCliConfig, updateCliConfigWithPartial } from 'cli/lib/cli-config/core';
 
 async function getPreferredReadyProvider(
 	exclude?: AiProviderId
@@ -49,7 +49,7 @@ export async function resolveUnavailableAiProvider(
 }
 
 export async function resolveInitialAiProvider(): Promise< AiProviderId > {
-	const savedProvider = await getAiProvider();
+	const { aiProvider: savedProvider } = await readCliConfig();
 	if ( savedProvider ) {
 		const definition = getAiProviderDefinition( savedProvider );
 		if (
@@ -73,7 +73,7 @@ export async function resolveInitialAiProvider(): Promise< AiProviderId > {
 }
 
 export async function saveSelectedAiProvider( provider: AiProviderId ): Promise< void > {
-	await saveAiProvider( provider );
+	await updateCliConfigWithPartial( { aiProvider: provider } );
 }
 
 export async function prepareAiProvider(

apps/cli/ai/providers.ts

@@ -1,8 +1,8 @@
 import childProcess from 'child_process';
 import { password } from '@inquirer/prompts';
+import { readAuthToken } from '@studio/common/lib/shared-config';
 import { __ } from '@wordpress/i18n';
-import { z } from 'zod';
-import { getAnthropicApiKey, getAuthToken, saveAnthropicApiKey } from 'cli/lib/appdata';
+import { readCliConfig, updateCliConfigWithPartial } from 'cli/lib/cli-config/core';
 import { LoggerError } from 'cli/logger';
 
 export const AI_PROVIDERS = {
@@ -13,7 +13,6 @@ export const AI_PROVIDERS = {
 
 export type AiProviderId = keyof typeof AI_PROVIDERS;
 
-export const aiProviderSchema = z.enum( [ 'wpcom', 'anthropic-claude', 'anthropic-api-key' ] );
 export const DEFAULT_AI_PROVIDER: AiProviderId = 'anthropic-api-key';
 export const AI_PROVIDER_PRIORITY: AiProviderId[] = [
 	'wpcom',
@@ -51,7 +50,7 @@ export function hasClaudeCodeAuth(): boolean {
 async function resolveAnthropicApiKey( options?: {
 	force?: boolean;
 } ): Promise< string | undefined > {
-	const savedKey = await getAnthropicApiKey();
+	const { anthropicApiKey: savedKey } = await readCliConfig();
 	if ( savedKey && ! options?.force ) {
 		return savedKey;
 	}
@@ -67,7 +66,7 @@ async function resolveAnthropicApiKey( options?: {
 		},
 	} );
 
-	await saveAnthropicApiKey( apiKey );
+	await updateCliConfigWithPartial( { anthropicApiKey: apiKey } );
 	return apiKey;
 }
 
@@ -83,12 +82,8 @@ function getWpcomAiGatewayBaseUrl(): string {
 }
 
 async function hasValidWpcomAuth(): Promise< boolean > {
-	try {
-		await getAuthToken();
-		return true;
-	} catch {
-		return false;
-	}
+	const token = await readAuthToken();
+	return token !== null;
 }
 
 function createBaseEnvironment(): Record< string, string > {
@@ -117,7 +112,10 @@ const AI_PROVIDER_DEFINITIONS: Record< AiProviderId, AiProviderDefinition > = {
 			throw new LoggerError( __( 'WordPress.com login required. Use /login to authenticate.' ) );
 		},
 		resolveEnv: async () => {
-			const token = await getAuthToken();
+			const token = await readAuthToken();
+			if ( ! token ) {
+				throw new LoggerError( __( 'WordPress.com login required. Use /login to authenticate.' ) );
+			}
 			const env = createBaseEnvironment();
 			env.ANTHROPIC_BASE_URL = getWpcomAiGatewayBaseUrl();
 			env.ANTHROPIC_AUTH_TOKEN = token.accessToken;
@@ -156,12 +154,15 @@ const AI_PROVIDER_DEFINITIONS: Record< AiProviderId, AiProviderDefinition > = {
 		id: 'anthropic-api-key',
 		autoFallbackWhenUnavailable: false,
 		isVisible: async () => true,
-		isReady: async () => Boolean( await getAnthropicApiKey() ),
+		isReady: async () => {
+			const { anthropicApiKey } = await readCliConfig();
+			return Boolean( anthropicApiKey );
+		},
 		prepare: async ( options ) => {
 			await resolveAnthropicApiKey( options );
 		},
 		resolveEnv: async () => {
-			const apiKey = await getAnthropicApiKey();
+			const { anthropicApiKey: apiKey } = await readCliConfig();
 			if ( ! apiKey ) {
 				throw new LoggerError(
 					__(

apps/cli/ai/sessions/paths.ts

@@ -1,5 +1,5 @@
 import path from 'path';
-import { getAppdataDirectory } from 'cli/lib/appdata';
+import { getAppdataDirectory } from 'cli/lib/server-files';
 
 // Keep month/day segments zero-padded so directory names sort chronologically.
 function formatDatePart( value: number ): string {

apps/cli/ai/tests/auth.test.ts

@@ -1,5 +1,6 @@
 import childProcess from 'child_process';
 import { password } from '@inquirer/prompts';
+import { readAuthToken } from '@studio/common/lib/shared-config';
 import { vi } from 'vitest';
 import {
 	getAvailableAiProviders,
@@ -9,12 +10,7 @@ import {
 	resolveInitialAiProvider,
 	resolveUnavailableAiProvider,
 } from 'cli/ai/auth';
-import {
-	getAiProvider,
-	getAnthropicApiKey,
-	getAuthToken,
-	saveAnthropicApiKey,
-} from 'cli/lib/appdata';
+import { readCliConfig, updateCliConfigWithPartial } from 'cli/lib/cli-config/core';
 import { LoggerError } from 'cli/logger';
 
 vi.mock( 'child_process', () => ( {
@@ -28,33 +24,40 @@ vi.mock( '@inquirer/prompts', () => ( {
 	password: vi.fn(),
 } ) );
 
-vi.mock( 'cli/lib/appdata', () => ( {
-	getAiProvider: vi.fn(),
-	getAnthropicApiKey: vi.fn(),
-	getAuthToken: vi.fn(),
-	saveAnthropicApiKey: vi.fn(),
-	saveAiProvider: vi.fn(),
+vi.mock( '@studio/common/lib/shared-config', () => ( {
+	readAuthToken: vi.fn(),
+} ) );
+
+vi.mock( 'cli/lib/cli-config/core', () => ( {
+	readCliConfig: vi.fn().mockResolvedValue( { version: 1, sites: [] } ),
+	updateCliConfigWithPartial: vi.fn(),
 } ) );
 
 describe( 'AI auth helpers', () => {
 	beforeEach( () => {
 		vi.resetAllMocks();
+		vi.mocked( readCliConfig ).mockResolvedValue( { version: 1, sites: [], snapshots: [] } );
 		delete process.env.WPCOM_AI_PROXY_BASE_URL;
 	} );
 
 	it( 'uses the saved Anthropic API key when provider is Anthropic API key', async () => {
-		vi.mocked( getAnthropicApiKey ).mockResolvedValue( 'saved-key' );
+		vi.mocked( readCliConfig ).mockResolvedValue( {
+			version: 1,
+			sites: [],
+			snapshots: [],
+			anthropicApiKey: 'saved-key',
+		} );
 
 		const env = await resolveAiEnvironment( 'anthropic-api-key' );
 
 		expect( env.ANTHROPIC_API_KEY ).toBe( 'saved-key' );
 		expect( env.ANTHROPIC_BASE_URL ).toBeUndefined();
 		expect( env.ANTHROPIC_AUTH_TOKEN ).toBeUndefined();
-		expect( saveAnthropicApiKey ).not.toHaveBeenCalled();
+		expect( updateCliConfigWithPartial ).not.toHaveBeenCalled();
 	} );
 
 	it( 'requires a saved Anthropic API key in API key mode', async () => {
-		vi.mocked( getAnthropicApiKey ).mockResolvedValue( undefined );
+		vi.mocked( readCliConfig ).mockResolvedValue( { version: 1, sites: [], snapshots: [] } );
 
 		await expect( resolveAiEnvironment( 'anthropic-api-key' ) ).rejects.toBeInstanceOf(
 			LoggerError
@@ -72,23 +75,30 @@ describe( 'AI auth helpers', () => {
 	} );
 
 	it( 'prompts for the API key immediately when preparing the API key provider', async () => {
-		vi.mocked( getAnthropicApiKey ).mockResolvedValue( undefined );
+		vi.mocked( readCliConfig ).mockResolvedValue( { version: 1, sites: [], snapshots: [] } );
 		vi.mocked( password ).mockResolvedValue( 'prompted-key' );
 
 		await prepareAiProvider( 'anthropic-api-key' );
 
 		expect( password ).toHaveBeenCalledOnce();
-		expect( saveAnthropicApiKey ).toHaveBeenCalledWith( 'prompted-key' );
+		expect( updateCliConfigWithPartial ).toHaveBeenCalledWith( {
+			anthropicApiKey: 'prompted-key',
+		} );
 	} );
 
 	it( 'can force re-entering the API key even when one is already saved', async () => {
-		vi.mocked( getAnthropicApiKey ).mockResolvedValue( 'saved-key' );
+		vi.mocked( readCliConfig ).mockResolvedValue( {
+			version: 1,
+			sites: [],
+			snapshots: [],
+			anthropicApiKey: 'saved-key',
+		} );
 		vi.mocked( password ).mockResolvedValue( 'updated-key' );
 
 		await prepareAiProvider( 'anthropic-api-key', { force: true } );
 
 		expect( password ).toHaveBeenCalledOnce();
-		expect( saveAnthropicApiKey ).toHaveBeenCalledWith( 'updated-key' );
+		expect( updateCliConfigWithPartial ).toHaveBeenCalledWith( { anthropicApiKey: 'updated-key' } );
 	} );
 
 	it( 'lists Claude auth only when it is available', async () => {
@@ -106,7 +116,7 @@ describe( 'AI auth helpers', () => {
 	} );
 
 	it( 'configures the WP.com gateway environment', async () => {
-		vi.mocked( getAuthToken ).mockResolvedValue( {
+		vi.mocked( readAuthToken ).mockResolvedValue( {
 			accessToken: 'wpcom-token',
 			displayName: 'User',
 			email: 'user@example.com',
@@ -127,15 +137,26 @@ describe( 'AI auth helpers', () => {
 	} );
 
 	it( 'prefers the saved provider', async () => {
-		vi.mocked( getAiProvider ).mockResolvedValue( 'anthropic-api-key' );
+		vi.mocked( readCliConfig ).mockResolvedValue( {
+			version: 1,
+			sites: [],
+			snapshots: [],
+			aiProvider: 'anthropic-api-key',
+			anthropicApiKey: 'key',
+		} );
 
 		await expect( resolveInitialAiProvider() ).resolves.toBe( 'anthropic-api-key' );
-		expect( getAuthToken ).not.toHaveBeenCalled();
+		expect( readAuthToken ).not.toHaveBeenCalled();
 	} );
 
 	it( 'falls back to API key mode when saved Claude auth is no longer available', async () => {
-		vi.mocked( getAiProvider ).mockResolvedValue( 'anthropic-claude' );
-		vi.mocked( getAuthToken ).mockRejectedValue( new Error( 'not authenticated' ) );
+		vi.mocked( readCliConfig ).mockResolvedValue( {
+			version: 1,
+			sites: [],
+			snapshots: [],
+			aiProvider: 'anthropic-claude',
+		} );
+		vi.mocked( readAuthToken ).mockResolvedValue( null );
 		vi.mocked( childProcess.execFileSync ).mockImplementation( () => {
 			throw new Error( 'not authenticated' );
 		} );
@@ -144,16 +165,21 @@ describe( 'AI auth helpers', () => {
 	} );
 
 	it( 'falls back from saved WP.com provider when WordPress.com auth is unavailable and Claude auth is ready', async () => {
-		vi.mocked( getAiProvider ).mockResolvedValue( 'wpcom' );
-		vi.mocked( getAuthToken ).mockRejectedValue( new Error( 'not authenticated' ) );
+		vi.mocked( readCliConfig ).mockResolvedValue( {
+			version: 1,
+			sites: [],
+			snapshots: [],
+			aiProvider: 'wpcom',
+		} );
+		vi.mocked( readAuthToken ).mockResolvedValue( null );
 		vi.mocked( childProcess.execFileSync ).mockReturnValue( 'Authenticated' as never );
 
 		await expect( resolveInitialAiProvider() ).resolves.toBe( 'anthropic-claude' );
 	} );
 
 	it( 'defaults to WP.com when no provider is saved and a valid WP.com token exists', async () => {
-		vi.mocked( getAiProvider ).mockResolvedValue( undefined );
-		vi.mocked( getAuthToken ).mockResolvedValue( {
+		vi.mocked( readCliConfig ).mockResolvedValue( { version: 1, sites: [], snapshots: [] } );
+		vi.mocked( readAuthToken ).mockResolvedValue( {
 			accessToken: 'wpcom-token',
 			displayName: 'User',
 			email: 'user@example.com',
@@ -166,8 +192,8 @@ describe( 'AI auth helpers', () => {
 	} );
 
 	it( 'falls back to Anthropic API key when no other auth is available', async () => {
-		vi.mocked( getAiProvider ).mockResolvedValue( undefined );
-		vi.mocked( getAuthToken ).mockRejectedValue( new Error( 'not authenticated' ) );
+		vi.mocked( readCliConfig ).mockResolvedValue( { version: 1, sites: [], snapshots: [] } );
+		vi.mocked( readAuthToken ).mockResolvedValue( null );
 		vi.mocked( childProcess.execFileSync ).mockImplementation( () => {
 			throw new Error( 'not authenticated' );
 		} );
@@ -176,15 +202,15 @@ describe( 'AI auth helpers', () => {
 	} );
 
 	it( 'defaults to Claude auth when no provider is saved and Claude auth is available', async () => {
-		vi.mocked( getAiProvider ).mockResolvedValue( undefined );
-		vi.mocked( getAuthToken ).mockRejectedValue( new Error( 'not authenticated' ) );
+		vi.mocked( readCliConfig ).mockResolvedValue( { version: 1, sites: [], snapshots: [] } );
+		vi.mocked( readAuthToken ).mockResolvedValue( null );
 		vi.mocked( childProcess.execFileSync ).mockReturnValue( 'Authenticated' as never );
 
 		await expect( resolveInitialAiProvider() ).resolves.toBe( 'anthropic-claude' );
 	} );
 
 	it( 'reports WordPress.com readiness based on WP.com auth state', async () => {
-		vi.mocked( getAuthToken ).mockResolvedValue( {
+		vi.mocked( readAuthToken ).mockResolvedValue( {
 			accessToken: 'wpcom-token',
 			displayName: 'User',
 			email: 'user@example.com',
@@ -195,13 +221,18 @@ describe( 'AI auth helpers', () => {
 
 		await expect( isAiProviderReady( 'wpcom' ) ).resolves.toBe( true );
 
-		vi.mocked( getAuthToken ).mockRejectedValue( new Error( 'not authenticated' ) );
+		vi.mocked( readAuthToken ).mockResolvedValue( null );
 		await expect( isAiProviderReady( 'wpcom' ) ).resolves.toBe( false );
 	} );
 
 	it( 'resolves a fallback provider only for providers that auto-fallback', async () => {
-		vi.mocked( getAuthToken ).mockRejectedValue( new Error( 'not authenticated' ) );
-		vi.mocked( getAnthropicApiKey ).mockResolvedValue( 'saved-key' );
+		vi.mocked( readAuthToken ).mockResolvedValue( null );
+		vi.mocked( readCliConfig ).mockResolvedValue( {
+			version: 1,
+			sites: [],
+			snapshots: [],
+			anthropicApiKey: 'saved-key',
+		} );
 
 		await expect( resolveUnavailableAiProvider( 'wpcom' ) ).resolves.toBe( 'anthropic-api-key' );
 		await expect( resolveUnavailableAiProvider( 'anthropic-api-key' ) ).resolves.toBeUndefined();

apps/cli/ai/tests/tools.test.ts

@@ -3,7 +3,8 @@ import { runCommand as runCreatePreviewCommand } from 'cli/commands/preview/crea
 import { runCommand as runDeletePreviewCommand } from 'cli/commands/preview/delete';
 import { runCommand as runListPreviewCommand } from 'cli/commands/preview/list';
 import { runCommand as runUpdatePreviewCommand } from 'cli/commands/preview/update';
-import { getSiteByFolder, readAppdata } from 'cli/lib/appdata';
+import { readCliConfig } from 'cli/lib/cli-config/core';
+import { getSiteByFolder } from 'cli/lib/cli-config/sites';
 import { getProgressCallback, setProgressCallback } from 'cli/logger';
 import { studioToolDefinitions } from '../tools';
 
@@ -56,10 +57,13 @@ vi.mock( 'cli/commands/site/stop', () => ( {
 	runCommand: vi.fn(),
 } ) );
 
-vi.mock( 'cli/lib/appdata', async () => ( {
-	...( await vi.importActual( 'cli/lib/appdata' ) ),
+vi.mock( 'cli/lib/cli-config/core', async () => ( {
+	...( await vi.importActual( 'cli/lib/cli-config/core' ) ),
+	readCliConfig: vi.fn(),
+} ) );
+vi.mock( 'cli/lib/cli-config/sites', async () => ( {
+	...( await vi.importActual( 'cli/lib/cli-config/sites' ) ),
 	getSiteByFolder: vi.fn(),
-	readAppdata: vi.fn(),
 } ) );
 
 vi.mock( 'cli/lib/daemon-client', () => ( {
@@ -97,9 +101,9 @@ describe( 'Studio AI MCP tools', () => {
 		vi.resetAllMocks();
 		process.exitCode = undefined;
 		setProgressCallback( null );
-		vi.mocked( readAppdata ).mockResolvedValue( {
+		vi.mocked( readCliConfig ).mockResolvedValue( {
 			sites: [ mockSite ],
-		} as Awaited< ReturnType< typeof readAppdata > > );
+		} as Awaited< ReturnType< typeof readCliConfig > > );
 		vi.mocked( getSiteByFolder ).mockResolvedValue( mockSite );
 	} );