@anna-ai/cli 0.1.1 → 0.1.9

package/README.md

@@ -25,7 +25,6 @@ Local dev (this repo):
 
 ```bash
 pnpm install
-pnpm sync:schema   # vendors @anna-ai/app-schema from sibling matrix-nexus checkout
 pnpm build
 node dist/cli.js --help
 ```
@@ -115,14 +114,21 @@ For executa authors. Lives in matrix-nexus at
 `packages/anna-executa-test/`. Provides `executa_session` /
 `executa_invoke` fixtures — see that package's README.
 
-## Schema bundle sync
+## Schema bundle
 
-The CLI vendors `@anna-ai/app-schema` until the npm bundle ships:
+[`@anna-ai/app-schema`](https://www.npmjs.com/package/@anna-ai/app-schema)
+is a regular npm dependency. Set `ANNA_APP_SCHEMA_DIR` to point at a
+local checkout (e.g. `matrix-nexus/packages/anna-app-schema/`) to
+iterate on the protocol without publishing.
 
-```bash
-pnpm sync:schema                          # default: ../matrix-nexus
-pnpm sync:schema -- --from /path/to/...   # override
-```
+## Browser SDK
+
+End-user app bundles load `AnnaAppRuntime` from
+`/static/anna-apps/_sdk/<version>/index.js`. Both the matrix-nexus
+production server and this CLI's harness serve that URL from the
+public npm package [`@anna-ai/app-runtime`](https://www.npmjs.com/package/@anna-ai/app-runtime),
+which is declared as a normal dependency. No vendored copy, no sync
+step.
 
 ## Roadmap
 

package/dist/cli.js

@@ -1,9 +1,12 @@
 #!/usr/bin/env node
+import { dirname, extname, join, relative, resolve } from "node:path";
+import { createRequire } from "node:module";
 import { Command } from "commander";
 import { cpSync, existsSync, mkdirSync, readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
-import { dirname, join, resolve } from "node:path";
 import { fileURLToPath } from "node:url";
 import kleur from "kleur";
+import Ajv from "ajv/dist/2020.js";
+import addFormats from "ajv-formats";
 
 //#region src/commands/init.ts
 const here = dirname(fileURLToPath(import.meta.url));
@@ -13,13 +16,14 @@ function templateRoot(template) {
 }
 function substitute(content, slug) {
 	const toolId = `tool-dev-${slug}`;
-	return content.replace(/__SLUG__/g, slug).replace(/__TOOL_ID__/g, toolId);
+	const slugPy = slug.replace(/-/g, "_");
+	return content.replace(/__SLUG_PY__/g, slugPy).replace(/__SLUG__/g, slug).replace(/__TOOL_ID__/g, toolId);
 }
 function copyDirWithSubst(src, dst, slug) {
 	mkdirSync(dst, { recursive: true });
 	for (const entry of readdirSync(src, { withFileTypes: true })) {
 		const s = join(src, entry.name);
-		const d = join(dst, entry.name);
+		const d = join(dst, substitute(entry.name, slug));
 		if (entry.isDirectory()) copyDirWithSubst(s, d, slug);
 		else if (entry.isFile()) {
 			const stat = statSync(s);
@@ -54,10 +58,371 @@ function runInit(opts) {
 	return 0;
 }
 
+//#endregion
+//#region src/schema-bundle.ts
+function resolveSchemaDir() {
+	if (process.env.ANNA_APP_SCHEMA_DIR) return process.env.ANNA_APP_SCHEMA_DIR;
+	const req = createRequire(import.meta.url);
+	const methodsAbs = req.resolve("@anna-ai/app-schema/methods");
+	return resolve(dirname(methodsAbs), "..");
+}
+function loadSchemaBundle() {
+	let dir;
+	try {
+		dir = resolveSchemaDir();
+	} catch (e) {
+		throw new Error(`Could not locate @anna-ai/app-schema: ${e.message}\nRun \`pnpm install\` (or set ANNA_APP_SCHEMA_DIR to a local checkout).`);
+	}
+	if (!existsSync(resolve(dir, "dispatcher_version.txt"))) throw new Error(`@anna-ai/app-schema bundle is missing expected files at ${dir}`);
+	const read = (rel) => readFileSync(resolve(dir, rel), "utf-8");
+	const readJson = (rel) => JSON.parse(read(rel));
+	const dispatcherVersion = read("dispatcher_version.txt").trim();
+	const appManifestSchema = readJson("manifest/AppManifest.json");
+	const uiSectionSchema = readJson("manifest/UiManifestSection.json");
+	const methodsTable = readJson("host_api/methods.json");
+	const eventsSchema = readJson("events/AnnaAppEvent.json");
+	return {
+		dir,
+		dispatcherVersion,
+		appManifestSchema,
+		uiSectionSchema,
+		methods: methodsTable.methods,
+		events: eventsSchema.properties.kind.enum
+	};
+}
+
+//#endregion
+//#region src/validate/manifest-schema.ts
+function validateManifestSchema(bundle, manifest) {
+	const ajv = new Ajv({
+		allErrors: true,
+		strict: false
+	});
+	addFormats(ajv);
+	const validate = ajv.compile(bundle.appManifestSchema);
+	const ok = validate(manifest);
+	if (ok) return [];
+	return (validate.errors ?? []).map((e) => ({
+		path: e.instancePath || "(root)",
+		message: `${e.message ?? "invalid"}${e.params ? " " + JSON.stringify(e.params) : ""}`
+	}));
+}
+const ANNA_CALL_RE = /\banna\.([a-z]+)\.([a-zA-Z_][a-zA-Z0-9_]*)\s*\(/g;
+function scanHostApiCalls(files) {
+	const out = [];
+	for (const f of files) {
+		const lines = f.content.split("\n");
+		for (let i = 0; i < lines.length; i++) {
+			const line = lines[i];
+			ANNA_CALL_RE.lastIndex = 0;
+			let m;
+			while ((m = ANNA_CALL_RE.exec(line)) !== null) out.push({
+				file: f.path,
+				line: i + 1,
+				ns: m[1],
+				method: m[2]
+			});
+		}
+	}
+	return out;
+}
+/**
+* Mirror of `anna_app_runtime_service.host_api_allows` (matrix-nexus).
+* Keep these in sync — divergence here means the CLI lies about what
+* production accepts.
+*/
+function hostApiAllows(manifest, ns, method) {
+	if (!manifest.ui) return false;
+	if (ns === "window") return true;
+	const grants = manifest.ui.host_api ?? {};
+	const methods = grants[ns];
+	if (!methods || methods.length === 0) return false;
+	if (methods.includes("*")) return true;
+	if (methods.includes(method)) return true;
+	if (ns === "tools" && (method === "invoke" || method === "list")) return true;
+	return false;
+}
+function checkHostApiAllowance(usages, manifest, bundleMethods) {
+	const errors = [];
+	const noAuth = new Set(bundleMethods.filter((m) => m.no_auth).map((m) => `${m.namespace}.${m.method}`));
+	const known = new Set(bundleMethods.map((m) => `${m.namespace}.${m.method}`));
+	for (const u of usages) {
+		const fq = `${u.ns}.${u.method}`;
+		if (!known.has(fq)) continue;
+		if (noAuth.has(fq)) continue;
+		if (!hostApiAllows(manifest, u.ns, u.method)) errors.push(`${u.file}:${u.line} calls anna.${fq} but manifest.ui.host_api.${u.ns} does not grant it`);
+	}
+	return errors;
+}
+
+//#endregion
+//#region src/validate/ui-section.ts
+/**
+* Static validation of `manifest.ui` — direct port of
+* `src/services/anna_app_validator.py::validate_ui_section_static` from
+* matrix-nexus. Keep these algorithms byte-equivalent: any divergence here
+* means `anna-app validate` will lie about what production accepts.
+*/
+const VIEW_NAME_PATTERN = /^[a-z0-9_-]{1,40}$/;
+const BUNDLE_PATH_PATTERN = /^[A-Za-z0-9_./\-]+$/;
+const HOST_API_TOOL_REF_PATTERN = /^(?:required:\*|optional:\*|required:[A-Za-z0-9_.\-]+|optional:[A-Za-z0-9_.\-]+|[A-Za-z0-9_.\-]+)$/;
+const CSP_OVERRIDABLE_DIRECTIVES = new Set([
+	"connect-src",
+	"img-src",
+	"media-src",
+	"font-src",
+	"style-src",
+	"script-src"
+]);
+function validateUiSectionStatic(manifest) {
+	const ui = manifest.ui;
+	if (!ui) return [];
+	const errors = [];
+	const bundle = ui.bundle;
+	if (bundle.format && bundle.format !== "static-spa") errors.push(`ui.bundle.format 当前仅支持 'static-spa': ${bundle.format}`);
+	const entry = bundle.entry ?? "";
+	const entryClean = entry.split("#")[0].split("?")[0];
+	if (!BUNDLE_PATH_PATTERN.test(entryClean)) errors.push(`ui.bundle.entry 包含非法字符: ${entry}`);
+	if (entry.includes("..") || entry.includes("\\") || entry.includes("//")) errors.push(`ui.bundle.entry 路径穿越禁止: ${entry}`);
+	for (const origin of bundle.external_origins ?? []) if (!origin.startsWith("https://") || origin.includes("*")) errors.push(`ui.bundle.external_origins 必须为 https:// 前缀且不含 '*': ${origin}`);
+	const views = ui.views ?? [];
+	if (views.length < 1 || views.length > 16) errors.push("ui.views 数量必须在 1..16 之间");
+	const defaults = views.filter((v) => v.default).length;
+	if (defaults > 1) errors.push("ui.views 中只能有一个 default=true");
+	const seen = new Set();
+	for (const v of views) {
+		if (!VIEW_NAME_PATTERN.test(v.name)) errors.push(`非法 view name: ${v.name}`);
+		if (seen.has(v.name)) errors.push(`重复 view name: ${v.name}`);
+		seen.add(v.name);
+		if (v.min_size && v.default_size) {
+			if (v.default_size.w < v.min_size.w || v.default_size.h < v.min_size.h) errors.push(`view '${v.name}' default_size 小于 min_size`);
+		}
+		if (v.max_size && v.default_size) {
+			if (v.default_size.w > v.max_size.w || v.default_size.h > v.max_size.h) errors.push(`view '${v.name}' default_size 大于 max_size`);
+		}
+	}
+	const requiredIds = new Set((manifest.required_executas ?? []).map((r) => r.tool_id));
+	const optionalIds = new Set((manifest.optional_executas ?? []).map((r) => r.tool_id));
+	for (const ref of ui.host_api?.tools ?? []) {
+		if (!HOST_API_TOOL_REF_PATTERN.test(ref)) {
+			errors.push(`host_api.tools 非法引用: ${ref}`);
+			continue;
+		}
+		if (ref === "required:*" || ref === "optional:*") continue;
+		const bare = ref.includes(":") ? ref.split(":", 2)[1] : ref;
+		if (!requiredIds.has(bare) && !optionalIds.has(bare)) errors.push(`host_api.tools 引用未在 manifest 中声明的 tool_id: ${ref}`);
+	}
+	const cspOverrides = ui.csp_overrides ?? {};
+	const badDirectives = Object.keys(cspOverrides).filter((d) => !CSP_OVERRIDABLE_DIRECTIVES.has(d)).sort();
+	if (badDirectives.length) errors.push(`csp_overrides 含不允许的 directive: ${JSON.stringify(badDirectives)}`);
+	for (const d of ["script-src", "style-src"]) for (const v of cspOverrides[d] ?? []) if (v !== "'self'" && !v.startsWith("'sha256-") && !v.startsWith("'nonce-")) errors.push(`csp_overrides[${d}] 仅允许 'self' / 'sha256-...' / 'nonce-...': ${v}`);
+	return errors;
+}
+
+//#endregion
+//#region src/validate/tool-id-linter.ts
+const TOOL_ID_RE = /\b(?:tool|skill)-[a-z0-9][a-z0-9-]{1,80}\b/g;
+const SCAN_EXTENSIONS = new Set([
+	".py",
+	".toml",
+	".json",
+	".js",
+	".ts",
+	".jsx",
+	".tsx",
+	".mjs",
+	".cjs"
+]);
+const SCAN_SKIP_DIRS = new Set([
+	"node_modules",
+	"dist",
+	"build",
+	".git",
+	".venv",
+	"venv",
+	"__pycache__",
+	".pytest_cache",
+	"coverage",
+	"fixtures"
+]);
+function walkAndScan(rootDir, fs) {
+	const occurrences = [];
+	const stack = [rootDir];
+	while (stack.length) {
+		const current = stack.pop();
+		let entries;
+		try {
+			entries = fs.readdirSync(current);
+		} catch {
+			continue;
+		}
+		for (const entry of entries) {
+			const full = join(current, entry.name);
+			if (entry.isDirectory()) {
+				if (entry.name.startsWith(".") && entry.name !== ".github") continue;
+				if (SCAN_SKIP_DIRS.has(entry.name)) continue;
+				stack.push(full);
+			} else if (entry.isFile()) {
+				const ext = extname(entry.name);
+				if (!SCAN_EXTENSIONS.has(ext) && entry.name !== "pyproject.toml") continue;
+				let content;
+				try {
+					const st = statSync(full);
+					if (st.size > 1024 * 1024) continue;
+					content = readFileSync(full, "utf-8");
+				} catch {
+					continue;
+				}
+				const rel = relative(rootDir, full);
+				const lines = content.split("\n");
+				for (let i = 0; i < lines.length; i++) {
+					const line = lines[i];
+					TOOL_ID_RE.lastIndex = 0;
+					let m;
+					while ((m = TOOL_ID_RE.exec(line)) !== null) occurrences.push({
+						file: rel,
+						line: i + 1,
+						toolId: m[0]
+					});
+				}
+			}
+		}
+	}
+	return occurrences;
+}
+function levenshtein(a, b) {
+	if (a === b) return 0;
+	if (!a.length) return b.length;
+	if (!b.length) return a.length;
+	const prev = new Array(b.length + 1);
+	const curr = new Array(b.length + 1);
+	for (let j = 0; j <= b.length; j++) prev[j] = j;
+	for (let i = 1; i <= a.length; i++) {
+		curr[0] = i;
+		for (let j = 1; j <= b.length; j++) {
+			const cost = a[i - 1] === b[j - 1] ? 0 : 1;
+			curr[j] = Math.min(curr[j - 1] + 1, prev[j] + 1, prev[j - 1] + cost);
+		}
+		for (let j = 0; j <= b.length; j++) prev[j] = curr[j];
+	}
+	return prev[b.length];
+}
+function analyzeToolIds(input) {
+	const byId = new Map();
+	for (const o of input.occurrences) {
+		if (!byId.has(o.toolId)) byId.set(o.toolId, []);
+		byId.get(o.toolId).push(o);
+	}
+	const errors = [];
+	const warnings = [];
+	input.declaredManifestIds;
+	const ids = Array.from(byId.keys());
+	for (let i = 0; i < ids.length; i++) for (let j = i + 1; j < ids.length; j++) {
+		const a = ids[i];
+		const b = ids[j];
+		if (Math.abs(a.length - b.length) > 1) continue;
+		if (levenshtein(a, b) > 1) continue;
+		const aLocs = byId.get(a);
+		const bLocs = byId.get(b);
+		const aFiles = new Set(aLocs.map((o) => o.file));
+		const bFiles = new Set(bLocs.map((o) => o.file));
+		const isolated = aFiles.size === 1 || bFiles.size === 1;
+		if (isolated) {
+			const minor = aFiles.size === 1 ? aLocs : bLocs;
+			const major = aFiles.size === 1 ? bLocs : aLocs;
+			errors.push(`Likely typo: "${minor[0].toolId}" (only at ${minor.map((o) => `${o.file}:${o.line}`).join(", ")}) differs by ≤1 char from "${major[0].toolId}" (used in ${major.length} place(s))`);
+		}
+	}
+	return {
+		occurrences: input.occurrences,
+		byId,
+		errors,
+		warnings
+	};
+}
+
+//#endregion
+//#region src/commands/validate.ts
+function readManifest(path) {
+	if (!existsSync(path)) throw new Error(`manifest not found: ${path}`);
+	return JSON.parse(readFileSync(path, "utf-8"));
+}
+function readBundleSources(dir) {
+	if (!existsSync(dir)) return [];
+	const out = [];
+	const stack = [dir];
+	while (stack.length) {
+		const cur = stack.pop();
+		let entries;
+		try {
+			entries = readdirSync(cur, { withFileTypes: true });
+		} catch {
+			continue;
+		}
+		for (const e of entries) {
+			const full = `${cur}/${e.name}`;
+			if (e.isDirectory()) {
+				if (e.name === "node_modules" || e.name.startsWith(".")) continue;
+				stack.push(full);
+			} else if (/\.(js|ts|jsx|tsx|mjs|cjs)$/.test(e.name)) try {
+				out.push({
+					path: full,
+					content: readFileSync(full, "utf-8")
+				});
+			} catch {}
+		}
+	}
+	return out;
+}
+function runValidate(opts) {
+	const errors = [];
+	const warnings = [];
+	const bundle = loadSchemaBundle();
+	console.log(kleur.gray(`[validate] @anna-ai/app-schema dispatcher_version=${bundle.dispatcherVersion}  (${bundle.dir})`));
+	const manifest = readManifest(opts.manifestPath);
+	const schemaIssues = validateManifestSchema(bundle, manifest);
+	for (const i of schemaIssues) errors.push(`schema ${i.path}: ${i.message}`);
+	for (const e of validateUiSectionStatic(manifest)) errors.push(`ui: ${e}`);
+	const occ = walkAndScan(opts.cwd, { readdirSync: (p) => readdirSync(p, { withFileTypes: true }).map((e) => ({
+		name: e.name,
+		isDirectory: () => e.isDirectory(),
+		isFile: () => e.isFile()
+	})) });
+	const declared = [...(manifest.required_executas ?? []).map((r) => r.tool_id), ...(manifest.optional_executas ?? []).map((r) => r.tool_id)];
+	const idReport = analyzeToolIds({
+		occurrences: occ,
+		declaredManifestIds: declared
+	});
+	for (const e of idReport.errors) errors.push(`tool-id: ${e}`);
+	for (const w of idReport.warnings) warnings.push(`tool-id: ${w}`);
+	if (opts.strict) {
+		const bundleDir = opts.bundleDir ?? resolve(opts.cwd, "bundle");
+		const sources = readBundleSources(bundleDir);
+		const usages = scanHostApiCalls(sources);
+		const aclErrs = checkHostApiAllowance(usages, manifest, bundle.methods);
+		for (const e of aclErrs) errors.push(`host-api: ${e}`);
+	}
+	return {
+		errors,
+		warnings
+	};
+}
+function printResult(result) {
+	for (const w of result.warnings) console.warn(kleur.yellow(`⚠ ${w}`));
+	for (const e of result.errors) console.error(kleur.red(`✗ ${e}`));
+	if (result.errors.length === 0) {
+		console.log(kleur.green(`✓ validate passed${result.warnings.length ? ` (${result.warnings.length} warning(s))` : ""}`));
+		return 0;
+	}
+	console.error(kleur.red(`✗ validate failed: ${result.errors.length} error(s)`));
+	return 1;
+}
+
 //#endregion
 //#region src/cli.ts
+const pkg = createRequire(import.meta.url)("../package.json");
 const program = new Command();
-program.name("anna-app").description("Anna App developer CLI (scaffold, validate, harness)").version("0.1.0");
+program.name("anna-app").description("Anna App developer CLI (scaffold, validate, harness)").version(pkg.version);
 program.command("init <dir>").description("Scaffold a new Anna App project").option("--slug <slug>", "App slug (lowercase, hyphens)", "").option("--template <name>", "Template to use", "minimal").option("--force", "Overwrite existing dir if non-empty", false).action((dir, opts) => {
 	const slug = opts.slug || dir.split(/[\\/]/).pop() || "my-anna-app";
 	const code = runInit({
@@ -68,8 +433,19 @@ program.command("init <dir>").description("Scaffold a new Anna App project").opt
 	});
 	process.exit(code);
 });
+program.command("validate").description("Run schema + ACL checks on a manifest+bundle").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bundle <dir>", "bundle directory (default: ./bundle)").option("--strict", "Enable strict checks (host_api ACL grep)", false).action(async (opts) => {
+	const cwd = process.cwd();
+	const result = runValidate({
+		cwd,
+		manifestPath: resolve(cwd, opts.manifest),
+		bundleDir: opts.bundle ? resolve(cwd, opts.bundle) : null,
+		strict: opts.strict
+	});
+	const code = printResult(result);
+	process.exit(code);
+});
 program.command("dev").description("Run a local harness (in-process dispatcher + iframe + SSE relay)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bundle <dir>", "bundle directory (default: ./bundle)").option("--slug <slug>", "App slug (overrides manifest.slug/name)").option("--view <name>", "View name to open (default: manifest default)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (auto-detected if omitted; can also use $ANNA_NEXUS_ROOT)").option("--port <number>", "HTTP port", "5180").option("--user-id <id>", "Harness user_id", "1").option("--cwd <dir>", "Project root (default: cwd)").option("--no-watch", "Disable bundle file watcher (default: enabled)").action(async (opts) => {
-	const { runDev } = await import("./dev-rBqMTjjY.js");
+	const { runDev } = await import("./dev-D-Tru6gP.js");
 	const code = await runDev({
 		cwd: opts.cwd ?? process.cwd(),
 		manifestPath: opts.manifest,
@@ -109,7 +485,7 @@ fixture.command("replay <file>").description("Dry-run replay of a harness record
 	process.exit(code);
 });
 program.command("doctor").description("Check environment for `anna-app dev` (uv, matrix-nexus, dev key)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (optional)").action(async (opts) => {
-	const { runDoctor } = await import("./doctor-yxWmMSJc.js");
+	const { runDoctor } = await import("./doctor-BmR0POfL.js");
 	const code = await runDoctor({ matrixNexusRoot: opts.matrixNexusRoot });
 	process.exit(code);
 });

package/dist/dashboard.html

@@ -181,7 +181,7 @@
           <span id="iframe-src">awaiting session…</span>
           <span class="size" id="size"></span>
         </div>
-        <iframe id="app" sandbox="allow-scripts allow-forms"></iframe>
+        <iframe id="app" sandbox="allow-scripts allow-same-origin allow-forms allow-popups"></iframe>
       </div>
     </main>
     <aside>

package/dist/{dev-rBqMTjjY.js → dev-D-Tru6gP.js}

@@ -1,5 +1,5 @@
-import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { dirname, isAbsolute, resolve } from "node:path";
+import { existsSync, readFileSync, readdirSync, statSync } from "node:fs";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 
 //#region src/commands/dev.ts
@@ -31,7 +31,7 @@ async function runDev(opts) {
 	const matrixNexusRoot = await resolveMatrixNexusRoot(opts.matrixNexusRoot, cwd);
 	const mode = matrixNexusRoot ? "nexus-source" : "uvx";
 	const { PythonBridge, PINNED_RUNTIME_VERSION } = await import("./bridge-BDBECvV1.js");
-	const { HarnessServer } = await import("./server-B6-Qdluv.js");
+	const { HarnessServer } = await import("./server-gl345fFN.js");
 	const bridge = new PythonBridge({
 		mode,
 		matrixNexusRoot: matrixNexusRoot ?? void 0,

package/dist/{doctor-yxWmMSJc.js → doctor-BmR0POfL.js}

@@ -1,6 +1,6 @@
 import { PINNED_RUNTIME_VERSION } from "./bridge-CBcQUQGU.js";
-import { existsSync, statSync } from "node:fs";
 import { dirname, isAbsolute, resolve } from "node:path";
+import { existsSync, statSync } from "node:fs";
 import { bold, dim, green, red, yellow } from "kleur/colors";
 import { spawnSync } from "node:child_process";
 import { homedir } from "node:os";

package/dist/{server-B6-Qdluv.js → server-gl345fFN.js}

@@ -1,5 +1,6 @@
-import { createReadStream, statSync, watch } from "node:fs";
 import { dirname, join, normalize, resolve } from "node:path";
+import { createRequire } from "node:module";
+import { createReadStream, statSync, watch } from "node:fs";
 import { fileURLToPath } from "node:url";
 import { readFile } from "node:fs/promises";
 import { createServer } from "node:http";
@@ -197,11 +198,16 @@ var HarnessServer = class {
 		}
 	}
 	async serveSdk(pathname, res) {
-		const root = this.cfg.matrixNexusRoot;
-		if (!root) return this.text(res, 404, "SDK assets not available in uvx mode");
-		const rel = pathname.replace(/^\/static\//, "");
-		const abs = resolve(root, "static", rel);
-		if (!abs.startsWith(resolve(root, "static"))) return this.text(res, 403, "forbidden");
+		const sdkRel = pathname.replace(/^\/static\/anna-apps\/_sdk\/[^/]+\//, "");
+		let distRoot;
+		try {
+			const req = createRequire(import.meta.url);
+			distRoot = dirname(req.resolve("@anna-ai/app-runtime"));
+		} catch (e) {
+			return this.text(res, 500, `@anna-ai/app-runtime is not installed: ${e.message}`);
+		}
+		const abs = resolve(distRoot, sdkRel);
+		if (!abs.startsWith(distRoot)) return this.text(res, 403, "forbidden");
 		return this.serveFile(abs, res);
 	}
 	async serveBundleAsset(rel, res) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anna-ai/cli",
-  "version": "0.1.1",
+  "version": "0.1.9",
   "description": "Anna App developer CLI: scaffold, validate, harness (Phase 2 MVP: init + validate).",
   "license": "MIT",
   "type": "module",
@@ -20,7 +20,6 @@
   "files": [
     "dist/",
     "templates/",
-    "vendor/",
     "README.md"
   ],
   "scripts": {
@@ -29,11 +28,12 @@
     "test": "vitest run",
     "test:watch": "vitest",
     "lint": "tsc --noEmit",
-    "sync:schema": "node scripts/sync-schema.mjs",
     "check:runtime-pin": "node scripts/check-runtime-pin.mjs",
     "prepublishOnly": "pnpm lint && pnpm test && pnpm build"
   },
   "dependencies": {
+    "@anna-ai/app-runtime": "^0.1.0",
+    "@anna-ai/app-schema": "^0.1.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "commander": "^12.1.0",

package/templates/minimal/bundle/index.html

@@ -4,7 +4,7 @@
     <meta charset="utf-8" />
     <title>__SLUG__</title>
     <script src="/static/anna-apps/_sdk/0.1.0/index.js" defer></script>
-    <script src="./app.js" type="module" defer></script>
+    <script src="./app.js" defer></script>
   </head>
   <body>
     <h1>__SLUG__</h1>

package/templates/minimal/executas/__SLUG__/{plugin.py → __SLUG_PY___plugin.py}

@@ -21,9 +21,13 @@ MANIFEST = {
 
 
 def invoke(method: str, args: dict) -> dict:
+    # Tool methods MUST return the dispatcher contract envelope:
+    #   {"success": True,  "data":  <payload-dict>}
+    #   {"success": False, "error": "<reason>"}
+    # Anything else surfaces to the iframe as `tool_failed`.
     if method == "ping":
-        return {"pong": True}
-    raise ValueError(f"unknown method: {method}")
+        return {"success": True, "data": {"pong": True}}
+    return {"success": False, "error": f"unknown method: {method}"}
 
 
 def main() -> None:

package/templates/minimal/executas/__SLUG__/pyproject.toml

@@ -1,6 +1,6 @@
 [build-system]
-requires = ["hatchling"]
-build-backend = "hatchling.build"
+requires = ["setuptools>=68", "wheel"]
+build-backend = "setuptools.build_meta"
 
 [project]
 name = "__TOOL_ID__"
@@ -9,4 +9,7 @@ description = "Executa for the __SLUG__ Anna App"
 requires-python = ">=3.10"
 
 [project.scripts]
-"__TOOL_ID__" = "__SLUG___executa.plugin:main"
+"__TOOL_ID__" = "__SLUG_PY___plugin:main"
+
+[tool.setuptools]
+py-modules = ["__SLUG_PY___plugin"]

package/vendor/anna-app-schema/README.md

@@ -1,22 +0,0 @@
-# @anna/app-schema (v0.1.0)
-
-Versioned schema bundle for the Anna App platform. Generated by
-`scripts/export_app_schema.py` in matrix-nexus; do not edit by hand.
-
-## Contents
-
-* `manifest/AppManifest.json` — JSON Schema for the app manifest.
-* `manifest/UiManifestSection.json` — JSON Schema for the `ui` block.
-* `host_api/methods.json` — Flat `(namespace, method)` table mirroring
-  the dispatcher's `_DISPATCH` map. `no_auth=true` methods skip the
-  `host_api` ACL gate.
-* `events/AnnaAppEvent.json` — SSE event union (the `kind` enum).
-* `dispatcher_version.txt` — Single source-of-truth bundle version;
-  harnesses must refuse to start when their copy disagrees.
-
-## Regenerate
-
-```bash
-uv run python scripts/export_app_schema.py        # write
-uv run python scripts/export_app_schema.py --check # CI gate
-```

package/vendor/anna-app-schema/dispatcher_version.txt

@@ -1 +0,0 @@
-0.1.0

package/vendor/anna-app-schema/events/AnnaAppEvent.json

@@ -1,38 +0,0 @@
-{
-  "$id": "https://schemas.anna.partners/anna-app-event.json",
-  "$schema": "https://json-schema.org/draft/2020-12/schema",
-  "additionalProperties": true,
-  "description": "SSE envelope union for `event: data_model/AnnaAppEvent` frames. Bundle consumers should treat unknown `kind` values as forward-compatible additions and ignore them.",
-  "properties": {
-    "by_client_id": {
-      "type": [
-        "string",
-        "null"
-      ]
-    },
-    "kind": {
-      "enum": [
-        "artifact_appended",
-        "chat_message_from_app",
-        "close_view",
-        "geometry_changed",
-        "open_view",
-        "ping",
-        "runtime_state_synced",
-        "status_changed",
-        "title_changed",
-        "window_focus_changed"
-      ],
-      "type": "string"
-    },
-    "window_uuid": {
-      "type": "string"
-    }
-  },
-  "required": [
-    "kind"
-  ],
-  "title": "AnnaAppEvent",
-  "type": "object",
-  "version": "0.1.0"
-}