@anna-ai/cli 0.1.14 → 0.1.16

package/dist/{apps-BEJUn9Ws.js → apps-Bt9CT5Sl.js}

@@ -1,5 +1,5 @@
 import { getAccount } from "./credentials-BTv2IfUZ.js";
-import { listDevApps } from "./dev-app-cache-C3D1Sp_V.js";
+import { listDevApps } from "./dev-app-cache-DAHcq46m.js";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 
 //#region src/commands/apps.ts

package/dist/bridge-AJilXBw2.js

@@ -0,0 +1,3 @@
+import { PINNED_RUNTIME_VERSION, PythonBridge } from "./bridge-nqQ3-j-t.js";
+
+export { PINNED_RUNTIME_VERSION, PythonBridge };

package/dist/{bridge-D6YyP9DM.js → bridge-nqQ3-j-t.js}

@@ -9,7 +9,7 @@ import { createInterface } from "node:readline";
 * `uvx <pkg>@<version>` so end users always run the dispatcher version
 * the CLI was tested against.
 */
-const PINNED_RUNTIME_VERSION = "0.2.0a2";
+const PINNED_RUNTIME_VERSION = "0.2.0a3";
 var PythonBridge = class {
 	proc = null;
 	nextId = 1;

package/dist/cli.js

@@ -451,7 +451,7 @@ program.command("validate").description("Run schema + ACL checks on a manifest+b
 	process.exit(code);
 });
 program.command("dev").description("Run a local harness (in-process dispatcher + iframe + SSE relay)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bundle <dir>", "bundle directory (default: ./bundle)").option("--slug <slug>", "App slug (overrides manifest.slug/name)").option("--view <name>", "View name to open (default: manifest default)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (auto-detected if omitted; can also use $ANNA_NEXUS_ROOT)").option("--port <number>", "HTTP port", "5180").option("--user-id <id>", "Harness user_id", "1").option("--cwd <dir>", "Project root (default: cwd)").option("--no-watch", "Disable bundle file watcher (default: enabled)").option("--executa <spec>", "Explicit executa registration; repeatable. Spec: comma-separated key=value (dir=<path>[,tool_id=<id>][,type=python|node|go|binary][,command=\"<argv>\"]). When only `dir=` is given, the executa is auto-detected from executa.json / pyproject.toml / package.json / go.mod. Overrides directory auto-discovery under <manifest-dir>/executas/.", (val, prev) => prev ? [...prev, val] : [val]).option("--no-llm", "Disable LLM bridge (anna.llm/agent return llm_disabled)").option("--mock-llm <fixture>", "Serve canned LLM responses from a JSONL fixture").option("--llm-account <host>", "Saved account host to use (default: current)").option("--llm-app-slug <slug>", "Override the manifest slug used to register / look up the dev AnnaApp (default: manifest.slug)").action(async (opts) => {
-	const { runDev, parseExecutaSpec } = await import("./dev-C81H9c9_.js");
+	const { runDev, parseExecutaSpec } = await import("./dev-BRlFgo2I.js");
 	const cwd = opts.cwd ?? process.cwd();
 	let executas;
 	if (opts.executa && opts.executa.length > 0) {
@@ -509,7 +509,7 @@ fixture.command("replay <file>").description("Dry-run replay of a harness record
 	process.exit(code);
 });
 program.command("doctor").description("Check environment for `anna-app dev` (uv, matrix-nexus, dev key)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (optional)").action(async (opts) => {
-	const { runDoctor } = await import("./doctor-B3u0edUg.js");
+	const { runDoctor } = await import("./doctor-C8MWfLt8.js");
 	const code = await runDoctor({ matrixNexusRoot: opts.matrixNexusRoot });
 	process.exit(code);
 });
@@ -535,7 +535,7 @@ program.command("whoami").description("Show the current account (and any others)
 	process.exit(code);
 });
 program.command("apps:list").description("List dev apps installed for the current PAT").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
-	const { runAppsList } = await import("./apps-BEJUn9Ws.js");
+	const { runAppsList } = await import("./apps-Bt9CT5Sl.js");
 	const code = await runAppsList({
 		account: opts.account,
 		json: opts.json
@@ -569,8 +569,8 @@ executa.command("register").description("Register a standalone executa with nexu
 	const code = await runExecutaRegister(opts);
 	process.exit(code);
 });
-executa.command("dev").description("Run one Executa plugin in isolation (REPL or one-shot describe/invoke)").option("--dir <path>", "Executa project dir (default: CWD)").option("--spec <spec>", "Override discovery: comma-separated key=value (tool_id=...,type=...,command=\"...\")").option("--describe", "Print MANIFEST and exit", false).option("--health", "Print health and exit", false).option("--invoke <tool>", "Invoke one tool and exit").option("--args <json>", "JSON object passed as tool arguments", "{}").option("--json", "One-shot: emit compact JSON (no banners)", false).option("--no-sampling", "Hard-disable sampling reverse RPC (returns sampling_disabled)").option("--mock-sampling <fixture>", "Serve canned sampling responses from a JSONL fixture (offline)").option("--app-slug <slug>", "Forward sampling to nexus on behalf of this dev AnnaApp slug").option("--sampling-account <host>", "Saved account host for nexus sampling (default: current)").option("--no-agent", "Hard-disable agent reverse RPC (returns agent_not_granted)").option("--mock-agent <fixture>", "Serve canned agent/* responses from a JSONL fixture (offline)").option("--agent-account <host>", "Saved account host for nexus agent (default: --sampling-account or current)").option("--storage <mode>", "Storage backend: off | memory | mock | real (default: memory)").option("--mock-storage <fixture>", "Serve canned storage/* + files/* responses from a JSONL fixture").option("--storage-account <host>", "Saved account host for nexus storage (default: --sampling-account or current)").option("--storage-scopes <list>", "Comma-separated scopes for real storage tokens (default: user,app,tool)").action(async (opts) => {
-	const { runExecutaDev } = await import("./executa-dev-BhouP8jh.js");
+executa.command("dev").description("Run one Executa plugin in isolation (REPL or one-shot describe/invoke)").option("--dir <path>", "Executa project dir (default: CWD)").option("--spec <spec>", "Override discovery: comma-separated key=value (tool_id=...,type=...,command=\"...\")").option("--describe", "Print MANIFEST and exit", false).option("--health", "Print health and exit", false).option("--invoke <tool>", "Invoke one tool and exit").option("--args <json>", "JSON object passed as tool arguments", "{}").option("--json", "One-shot: emit compact JSON (no banners)", false).option("--no-sampling", "Hard-disable sampling reverse RPC (returns sampling_disabled)").option("--mock-sampling <fixture>", "Serve canned sampling responses from a JSONL fixture (offline)").option("--app-slug <slug>", "Forward sampling to nexus on behalf of this dev AnnaApp slug").option("--sampling-account <host>", "Saved account host for nexus sampling (default: current)").option("--no-agent", "Hard-disable agent reverse RPC (returns agent_not_granted)").option("--mock-agent <fixture>", "Serve canned agent/* responses from a JSONL fixture (offline)").option("--agent-account <host>", "Saved account host for nexus agent (default: --sampling-account or current)").option("--storage <mode>", "Storage backend: off | memory | mock | real (default: memory)").option("--mock-storage <fixture>", "Serve canned storage/* + files/* responses from a JSONL fixture").option("--storage-account <host>", "Saved account host for nexus storage (default: --sampling-account or current)").option("--storage-scopes <list>", "Comma-separated scopes for real storage tokens (default: user,app,tool)").option("--no-image", "Hard-disable image reverse RPC (returns image_not_granted)").option("--mock-image <fixture>", "Serve canned image/generate + image/edit responses from a JSONL fixture").option("--image-account <host>", "Saved account host for nexus image (default: --sampling-account or current)").option("--no-upload", "Hard-disable host/uploadFile reverse RPC (returns upload_not_granted)").option("--mock-upload <fixture>", "Serve canned host/uploadFile responses from a JSONL fixture").option("--upload-account <host>", "Saved account host for nexus uploads (default: --sampling-account or current)").action(async (opts) => {
+	const { runExecutaDev } = await import("./executa-dev-4FZ7AJHR.js");
 	const storageMode = opts.storage === void 0 ? void 0 : (() => {
 		const m = opts.storage;
 		if (m === "off" || m === "memory" || m === "mock" || m === "real") return m;
@@ -595,7 +595,13 @@ executa.command("dev").description("Run one Executa plugin in isolation (REPL or
 		storage: storageMode,
 		mockStorage: opts.mockStorage,
 		storageAccount: opts.storageAccount,
-		storageScopes: opts.storageScopes
+		storageScopes: opts.storageScopes,
+		noImage: opts.image === false,
+		mockImage: opts.mockImage,
+		imageAccount: opts.imageAccount,
+		noUpload: opts.upload === false,
+		mockUpload: opts.mockUpload,
+		uploadAccount: opts.uploadAccount
 	});
 	process.exit(code);
 });

package/dist/dev-BRlFgo2I.js

@@ -0,0 +1,3 @@
+import { parseExecutaSpec, runDev } from "./dev-C6v5yRV2.js";
+
+export { parseExecutaSpec, runDev };

package/dist/{dev-BfLGxpiT.js → dev-C6v5yRV2.js}

@@ -31,8 +31,8 @@ async function runDev(opts) {
 	}
 	const matrixNexusRoot = await resolveMatrixNexusRoot(opts.matrixNexusRoot, cwd);
 	const mode = matrixNexusRoot ? "nexus-source" : "uvx";
-	const { PythonBridge, PINNED_RUNTIME_VERSION } = await import("./bridge-C0DWb5eQ.js");
-	const { HarnessServer } = await import("./server-q6nKCeEV.js");
+	const { PythonBridge, PINNED_RUNTIME_VERSION } = await import("./bridge-AJilXBw2.js");
+	const { HarnessServer } = await import("./server-D8R6ppOp.js");
 	const bridge = new PythonBridge({
 		mode,
 		matrixNexusRoot: matrixNexusRoot ?? void 0,
@@ -123,7 +123,7 @@ async function runDev(opts) {
 */
 async function resolveRealLlm(args) {
 	const { getAccount } = await import("./credentials-DDqx6XMQ.js");
-	const { ensureDevAppRegistered } = await import("./dev-app-cache-CZ8lIKiw.js");
+	const { ensureDevAppRegistered } = await import("./dev-app-cache-DGF2Kuzd.js");
 	const acc = getAccount(args.account);
 	if (!acc) {
 		console.error(red("✗ no developer PAT on disk — run `anna-app login --host <nexus-url>` first.\n  (or use `--no-llm` / `--mock-llm <fixture>` to develop offline.)"));

package/dist/dev-app-cache-DAHcq46m.js

@@ -0,0 +1,175 @@
+import { canonicalHost } from "./credentials-BTv2IfUZ.js";
+import { dirname, join, resolve } from "node:path";
+import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+
+//#region src/dev-app-cache.ts
+const CACHE_DIR = ".anna";
+const CACHE_FILE = "dev-app.json";
+function cachePath(cwd) {
+	return resolve(cwd, CACHE_DIR, CACHE_FILE);
+}
+function readDevAppCache(cwd) {
+	const p = cachePath(cwd);
+	if (!existsSync(p)) return null;
+	try {
+		const raw = JSON.parse(readFileSync(p, "utf-8"));
+		if (typeof raw.host === "string" && typeof raw.slug === "string" && typeof raw.app_id === "number") return {
+			host: raw.host,
+			slug: raw.slug,
+			app_id: raw.app_id,
+			name: raw.name ?? raw.slug,
+			registered_at: raw.registered_at ?? ""
+		};
+	} catch {}
+	return null;
+}
+function writeDevAppCache(cwd, entry) {
+	const p = cachePath(cwd);
+	mkdirSync(dirname(p), { recursive: true });
+	writeFileSync(p, JSON.stringify(entry, null, 2) + "\n", "utf-8");
+}
+/** Call POST /api/v1/anna-apps/dev/apps/register. Idempotent server-side. */
+async function registerDevApp(args) {
+	const url = `${canonicalHost(args.host)}/api/v1/anna-apps/dev/apps/register`;
+	const res = await fetch(url, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			pat: args.pat,
+			slug: args.input.slug,
+			name: args.input.name,
+			category: args.input.category,
+			tagline: args.input.tagline
+		})
+	});
+	if (!res.ok) {
+		const text = await res.text().catch(() => "");
+		throw new Error(`/dev/apps/register failed: HTTP ${res.status} ${text}`);
+	}
+	return await res.json();
+}
+/** Call GET /api/v1/anna-apps/dev/apps. */
+async function listDevApps(args) {
+	const url = new URL(`${canonicalHost(args.host)}/api/v1/anna-apps/dev/apps`);
+	url.searchParams.set("pat", args.pat);
+	const res = await fetch(url, { method: "GET" });
+	if (!res.ok) {
+		const text = await res.text().catch(() => "");
+		throw new Error(`/dev/apps failed: HTTP ${res.status} ${text}`);
+	}
+	const body = await res.json();
+	return body.apps;
+}
+/**
+* Convenience helper for `anna-app dev`: returns a valid cached entry if
+* it still matches the manifest slug, otherwise hits the server to
+* (re-)register. Throws if no PAT is available on disk.
+*/
+async function ensureDevAppRegistered(args) {
+	const canonical = canonicalHost(args.host);
+	const cached = readDevAppCache(args.cwd);
+	if (cached && cached.host === canonical && cached.slug === args.input.slug) return cached;
+	const r = await registerDevApp({
+		host: args.host,
+		pat: args.pat,
+		input: args.input
+	});
+	const entry = {
+		host: canonical,
+		slug: r.slug,
+		app_id: r.app_id,
+		name: r.name,
+		registered_at: new Date().toISOString()
+	};
+	writeDevAppCache(args.cwd, entry);
+	return entry;
+}
+const _internal = {
+	cachePath,
+	CACHE_DIR: join(CACHE_DIR, CACHE_FILE)
+};
+const EXECUTA_CACHE_FILE = "dev-executa.json";
+/**
+* Bump this whenever the server-side dev-executa grant shape changes in
+* a way that requires a re-register to pick up. Cached entries written
+* with a lower `cache_version` are treated as stale and re-POSTed.
+*
+*   1 — initial (llm_grant only)
+*   2 — adds image_grant + upload_grant; fixes `allowedPurposes` to
+*       protocol whitelist {image_input,image_reference,user_artifact}
+*/
+const EXECUTA_CACHE_VERSION = 2;
+function executaCachePath(cwd) {
+	return resolve(cwd, CACHE_DIR, EXECUTA_CACHE_FILE);
+}
+function readDevExecutaCache(cwd) {
+	const p = executaCachePath(cwd);
+	if (!existsSync(p)) return null;
+	try {
+		const raw = JSON.parse(readFileSync(p, "utf-8"));
+		if (typeof raw.host === "string" && typeof raw.slug === "string" && typeof raw.app_id === "number" && typeof raw.tool_id === "string") return {
+			host: raw.host,
+			slug: raw.slug,
+			app_id: raw.app_id,
+			tool_id: raw.tool_id,
+			name: raw.name ?? raw.tool_id,
+			registered_at: raw.registered_at ?? "",
+			cache_version: typeof raw.cache_version === "number" ? raw.cache_version : 0
+		};
+	} catch {}
+	return null;
+}
+function writeDevExecutaCache(cwd, entry) {
+	const p = executaCachePath(cwd);
+	mkdirSync(dirname(p), { recursive: true });
+	writeFileSync(p, JSON.stringify(entry, null, 2) + "\n", "utf-8");
+}
+/** Call `POST /api/v1/anna-apps/dev/executas/register`. Idempotent. */
+async function registerDevExecuta(args) {
+	const url = `${canonicalHost(args.host)}/api/v1/anna-apps/dev/executas/register`;
+	const res = await fetch(url, {
+		method: "POST",
+		headers: { "content-type": "application/json" },
+		body: JSON.stringify({
+			pat: args.pat,
+			tool_id: args.toolId,
+			slug: args.slug,
+			name: args.name
+		})
+	});
+	if (!res.ok) {
+		const text = await res.text().catch(() => "");
+		throw new Error(`/dev/executas/register failed: HTTP ${res.status} ${text}`);
+	}
+	return await res.json();
+}
+/**
+* Convenience: return a cached executa registration if still valid for
+* this host+tool_id, otherwise hit the server. Throws if no PAT.
+*/
+async function ensureDevExecutaRegistered(args) {
+	const canonical = canonicalHost(args.host);
+	const cached = readDevExecutaCache(args.cwd);
+	if (cached && cached.host === canonical && cached.tool_id === args.toolId && cached.cache_version >= EXECUTA_CACHE_VERSION && (!args.slug || cached.slug === args.slug)) return cached;
+	const r = await registerDevExecuta({
+		host: args.host,
+		pat: args.pat,
+		toolId: args.toolId,
+		slug: args.slug,
+		name: args.name
+	});
+	const entry = {
+		host: canonical,
+		slug: r.slug,
+		app_id: r.app_id,
+		tool_id: r.tool_id,
+		name: r.name,
+		registered_at: new Date().toISOString(),
+		cache_version: EXECUTA_CACHE_VERSION
+	};
+	writeDevExecutaCache(args.cwd, entry);
+	return entry;
+}
+
+//#endregion
+export { ensureDevAppRegistered, ensureDevExecutaRegistered, listDevApps, readDevAppCache, readDevExecutaCache, registerDevApp, registerDevExecuta, writeDevAppCache, writeDevExecutaCache };

package/dist/dev-app-cache-DGF2Kuzd.js

@@ -0,0 +1,4 @@
+import "./credentials-BTv2IfUZ.js";
+import { ensureDevAppRegistered, ensureDevExecutaRegistered, listDevApps, readDevAppCache, readDevExecutaCache, registerDevApp, registerDevExecuta, writeDevAppCache, writeDevExecutaCache } from "./dev-app-cache-DAHcq46m.js";
+
+export { ensureDevAppRegistered, ensureDevExecutaRegistered };

package/dist/{doctor-B3u0edUg.js → doctor-C8MWfLt8.js}

@@ -1,4 +1,4 @@
-import { PINNED_RUNTIME_VERSION } from "./bridge-D6YyP9DM.js";
+import { PINNED_RUNTIME_VERSION } from "./bridge-nqQ3-j-t.js";
 import { dirname, isAbsolute, resolve } from "node:path";
 import { existsSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";

package/dist/{executa-dev-BhouP8jh.js → executa-dev-4FZ7AJHR.js}

@@ -1,4 +1,4 @@
-import { parseExecutaSpec } from "./dev-BfLGxpiT.js";
+import { parseExecutaSpec } from "./dev-C6v5yRV2.js";
 import { isAbsolute, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
@@ -33,54 +33,101 @@ async function runExecutaDev(opts) {
 	}
 	const oneShot = !!(opts.describe || opts.health || opts.invoke);
 	const quiet = oneShot && (opts.json ?? false);
-	const { SamplingBridge } = await import("./sampling-3EfSlDHM.js");
+	const { getAccount } = await import("./credentials-DDqx6XMQ.js");
+	const { ensureDevExecutaRegistered } = await import("./dev-app-cache-DGF2Kuzd.js");
+	const needsRealMint = !opts.noSampling && !opts.mockSampling || !opts.noAgent && !opts.mockAgent || !opts.noImage && !opts.mockImage || !opts.noUpload && !opts.mockUpload || opts.storage === "real";
+	let effectiveAppSlug = opts.appSlug;
+	let autoRegistered = false;
+	if (!effectiveAppSlug && needsRealMint) {
+		const acc = getAccount(opts.samplingAccount);
+		if (acc) try {
+			const reg = await ensureDevExecutaRegistered({
+				cwd: parsed.project_dir,
+				host: acc.host,
+				pat: acc.pat,
+				toolId: parsed.tool_id
+			});
+			effectiveAppSlug = reg.slug;
+			autoRegistered = true;
+		} catch (e) {
+			if (!quiet) {
+				console.warn(yellow(`! executa auto-register failed: ${e.message}`));
+				console.warn(yellow("  reverse-RPC bridges (sampling/agent/image/upload) will run in disabled mode. Pass `--app-slug <slug>` to override, or `--no-sampling --no-agent --no-image --no-upload` to silence."));
+			}
+		}
+	}
+	const { SamplingBridge } = await import("./sampling-CJUDG-mf.js");
 	const sampling = opts.noSampling ? new SamplingBridge({ mode: "off" }) : opts.mockSampling ? new SamplingBridge({
 		mode: "mock",
 		mockFile: opts.mockSampling
-	}) : opts.appSlug ? new SamplingBridge({
+	}) : effectiveAppSlug ? new SamplingBridge({
 		mode: "real",
 		account: opts.samplingAccount,
-		appSlug: opts.appSlug
+		appSlug: effectiveAppSlug
 	}) : new SamplingBridge({ mode: "off" });
 	const { AgentBridge } = await import("./agent-DUmINbo4.js");
 	const agent = opts.noAgent ? new AgentBridge({ mode: "off" }) : opts.mockAgent ? new AgentBridge({
 		mode: "mock",
 		mockFile: opts.mockAgent
-	}) : opts.appSlug ? new AgentBridge({
+	}) : effectiveAppSlug ? new AgentBridge({
 		mode: "real",
 		account: opts.agentAccount ?? opts.samplingAccount,
-		appSlug: opts.appSlug
+		appSlug: effectiveAppSlug
 	}) : new AgentBridge({ mode: "off" });
-	const { StorageBridge } = await import("./storage-CnWTZqq_.js");
+	const { StorageBridge } = await import("./storage-EQJA_0UW.js");
 	const storageMode = opts.storage ?? (opts.mockStorage ? "mock" : "memory");
 	const storage = new StorageBridge({
 		mode: storageMode,
 		mockFile: opts.mockStorage,
 		account: opts.storageAccount ?? opts.samplingAccount,
-		appSlug: opts.appSlug,
+		appSlug: effectiveAppSlug,
 		scopes: opts.storageScopes ? opts.storageScopes.split(",").map((s) => s.trim()).filter(Boolean) : void 0,
 		pluginName: parsed.tool_id
 	});
-	const { ExecutaRunner } = await import("./runner-Bral1LFW.js");
+	const { ExecutaRunner } = await import("./runner-DmGLdat0.js");
+	const { ImageBridge } = await import("./image-bwolX7pa.js");
+	const image = opts.noImage ? new ImageBridge({ mode: "off" }) : opts.mockImage ? new ImageBridge({
+		mode: "mock",
+		mockFile: opts.mockImage
+	}) : effectiveAppSlug ? new ImageBridge({
+		mode: "real",
+		account: opts.imageAccount ?? opts.samplingAccount,
+		appSlug: effectiveAppSlug
+	}) : new ImageBridge({ mode: "off" });
+	const { HostUploadBridge } = await import("./host_upload-C_pGOS6p.js");
+	const hostUpload = opts.noUpload ? new HostUploadBridge({ mode: "off" }) : opts.mockUpload ? new HostUploadBridge({
+		mode: "mock",
+		mockFile: opts.mockUpload
+	}) : effectiveAppSlug ? new HostUploadBridge({
+		mode: "real",
+		account: opts.uploadAccount ?? opts.samplingAccount,
+		appSlug: effectiveAppSlug
+	}) : new HostUploadBridge({ mode: "off" });
 	const runner = new ExecutaRunner({
 		command: parsed.command,
 		cwd: parsed.project_dir,
 		sampling,
 		agent,
 		storage,
+		image,
+		hostUpload,
 		onStderr: (line) => {
 			const text = quiet ? `${line}\n` : dim(`[executa] ${line}\n`);
 			writeStderrCooperative(text);
 		}
 	});
 	if (!quiet) {
+		const slugTag = (mode) => effectiveAppSlug ? `${mode} → app_slug=${effectiveAppSlug}${autoRegistered ? " (auto)" : ""}` : "disabled (no fixture, no --app-slug, no PAT)";
 		console.log(bold(cyan("anna-app executa dev")));
 		console.log(`  tool_id   ${dim(parsed.tool_id)}`);
 		console.log(`  dir       ${dim(parsed.project_dir)}`);
 		console.log(`  command   ${dim(parsed.command.join(" "))}`);
-		console.log(`  sampling  ${dim(opts.noSampling ? "disabled (--no-sampling)" : opts.mockSampling ? `mock (${opts.mockSampling})` : opts.appSlug ? `real → app_slug=${opts.appSlug}` : "disabled (no fixture, no --app-slug)")}`);
-		console.log(`  agent     ${dim(opts.noAgent ? "disabled (--no-agent)" : opts.mockAgent ? `mock (${opts.mockAgent})` : opts.appSlug ? `real → app_slug=${opts.appSlug}` : "disabled (no fixture, no --app-slug)")}`);
-		console.log(`  storage   ${dim(storageMode === "mock" ? `mock (${opts.mockStorage ?? "<no-fixture>"})` : storageMode === "real" ? `real → app_slug=${opts.appSlug ?? "<unset>"}` : storageMode)}`);
+		if (autoRegistered && effectiveAppSlug) console.log(`  executa   ${dim(`auto-registered as ${effectiveAppSlug}`)}`);
+		console.log(`  sampling  ${dim(opts.noSampling ? "disabled (--no-sampling)" : opts.mockSampling ? `mock (${opts.mockSampling})` : slugTag("real"))}`);
+		console.log(`  agent     ${dim(opts.noAgent ? "disabled (--no-agent)" : opts.mockAgent ? `mock (${opts.mockAgent})` : slugTag("real"))}`);
+		console.log(`  storage   ${dim(storageMode === "mock" ? `mock (${opts.mockStorage ?? "<no-fixture>"})` : storageMode === "real" ? `real → app_slug=${effectiveAppSlug ?? "<unset>"}` : storageMode)}`);
+		console.log(`  image     ${dim(opts.noImage ? "disabled (--no-image)" : opts.mockImage ? `mock (${opts.mockImage})` : slugTag("real"))}`);
+		console.log(`  upload    ${dim(opts.noUpload ? "disabled (--no-upload)" : opts.mockUpload ? `mock (${opts.mockUpload})` : slugTag("real"))}`);
 	}
 	let init;
 	try {

package/dist/host_upload-C_pGOS6p.js

@@ -0,0 +1,136 @@
+import { canonicalHost, getAccount } from "./credentials-BTv2IfUZ.js";
+import { resolve } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+import { createHash } from "node:crypto";
+
+//#region src/executa/host_upload.ts
+var HostUploadBridge = class {
+	mocks = [];
+	cachedSession = null;
+	constructor(opts) {
+		this.opts = opts;
+		if (opts.mode === "mock" && opts.mockFile) {
+			const path = resolve(opts.mockFile);
+			if (existsSync(path)) for (const line of readFileSync(path, "utf8").split(/\r?\n/)) {
+				if (!line.trim() || line.startsWith("#")) continue;
+				try {
+					this.mocks.push(JSON.parse(line));
+				} catch {}
+			}
+		}
+	}
+	async call(method, params) {
+		if (method !== "host/uploadFile") throw withCode(new Error(`unsupported host method: ${method}`), -32601);
+		if (this.opts.mode === "off") throw withCode(new Error("host upload disabled — rerun without `--no-upload`"), -32201);
+		if (this.opts.mode === "mock") return this.mockCall(params);
+		return this.realCall(params);
+	}
+	mockCall(params) {
+		const mode = String(params.mode ?? "inline");
+		const filename = String(params.filename ?? "");
+		const candidates = this.mocks.filter((m) => m.ns === "host" && m.method === "uploadFile");
+		const matched = candidates.find((m) => (!m.match?.modeEquals || m.match.modeEquals === mode) && (!m.match?.filenameIncludes || filename.includes(m.match.filenameIncludes))) ?? candidates[0];
+		if (matched && matched.result) return matched.result;
+		if (mode === "inline") {
+			const b64 = String(params.content_b64 ?? "");
+			const mime = String(params.mime_type ?? "application/octet-stream");
+			const url = `data:${mime};base64,${b64}`;
+			const r2Key = `mock/${hashShort(filename + ":" + b64)}/${filename || "blob"}`;
+			return {
+				download_url: url,
+				r2_key: r2Key,
+				size_bytes: Math.floor(b64.length * .75),
+				expires_at: new Date(Date.now() + 3600 * 1e3).toISOString()
+			};
+		}
+		if (mode === "negotiate") {
+			const key = `mock/${hashShort(filename + Date.now())}/${filename || "blob"}`;
+			return {
+				put_url: `https://mock.local/${key}?signature=mock`,
+				headers: { "content-type": String(params.mime_type ?? "") },
+				r2_key: key,
+				expires_at: new Date(Date.now() + 600 * 1e3).toISOString()
+			};
+		}
+		if (mode === "confirm") {
+			const key = String(params.r2_key ?? "");
+			return {
+				download_url: `https://mock.local/${key}`,
+				r2_key: key,
+				size_bytes: 0,
+				expires_at: new Date(Date.now() + 3600 * 1e3).toISOString()
+			};
+		}
+		throw withCode(new Error(`unknown upload mode: ${mode}`), -32203);
+	}
+	account() {
+		const acc = getAccount(this.opts.account);
+		if (!acc) throw withCode(new Error("no PAT on disk — run `anna-app login --host <nexus-url>` first (or pass `--mock-upload <fixture>` / `--no-upload`)"), -32201);
+		if (acc.expires_at && acc.expires_at < Math.floor(Date.now() / 1e3)) throw withCode(new Error("PAT expired — run `anna-app login` again"), -32201);
+		return acc;
+	}
+	async mint() {
+		if (this.cachedSession && this.cachedSession.expiresAt - 30 > Math.floor(Date.now() / 1e3)) return this.cachedSession;
+		const acc = this.account();
+		if (!this.opts.appSlug) throw withCode(new Error("host upload bridge has no app_slug — pass `--app-slug <slug>`"), -32203);
+		const url = `${canonicalHost(acc.host)}/api/v1/anna-apps/dev/session/mint`;
+		const res = await fetch(url, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				pat: acc.pat,
+				kind: "complete",
+				app_slug: this.opts.appSlug
+			})
+		});
+		if (!res.ok) {
+			const text = await res.text().catch(() => "");
+			throw withCode(new Error(`session.mint failed: HTTP ${res.status} ${text}`), -32207);
+		}
+		const body = await res.json();
+		this.cachedSession = {
+			appSessionToken: body.app_session_token,
+			expiresAt: Math.floor(Date.now() / 1e3) + (body.expires_in || 600)
+		};
+		return this.cachedSession;
+	}
+	async realCall(params) {
+		const acc = this.account();
+		const session = await this.mint();
+		const mode = String(params.mode ?? "inline");
+		const path = mode === "negotiate" ? "/api/v1/copilot/app/upload/negotiate" : mode === "confirm" ? "/api/v1/copilot/app/upload/confirm" : "/api/v1/copilot/app/upload";
+		const res = await fetch(`${canonicalHost(acc.host)}${path}`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				authorization: `Bearer ${session.appSessionToken}`
+			},
+			body: JSON.stringify(params)
+		});
+		if (!res.ok) {
+			const text = await res.text().catch(() => "");
+			throw withCode(new Error(`HTTP ${res.status}: ${text}`), httpToUploadCode(res.status));
+		}
+		return res.json();
+	}
+};
+function withCode(err, code) {
+	err.rpcCode = code;
+	return err;
+}
+function hashShort(s) {
+	return createHash("sha256").update(s).digest("hex").slice(0, 12);
+}
+function httpToUploadCode(status) {
+	if (status === 403) return -32201;
+	if (status === 429) return -32202;
+	if (status === 400) return -32203;
+	if (status === 413) return -32204;
+	if (status === 415) return -32205;
+	if (status === 404) return -32212;
+	if (status === 504) return -32208;
+	return -32207;
+}
+
+//#endregion
+export { HostUploadBridge };

package/dist/image-bwolX7pa.js

@@ -0,0 +1,131 @@
+import { canonicalHost, getAccount } from "./credentials-BTv2IfUZ.js";
+import { resolve } from "node:path";
+import { existsSync, readFileSync } from "node:fs";
+
+//#region src/executa/image.ts
+var ImageBridge = class {
+	mocks = [];
+	cachedSession = null;
+	constructor(opts) {
+		this.opts = opts;
+		if (opts.mode === "mock" && opts.mockFile) {
+			const path = resolve(opts.mockFile);
+			if (existsSync(path)) for (const line of readFileSync(path, "utf8").split(/\r?\n/)) {
+				if (!line.trim() || line.startsWith("#")) continue;
+				try {
+					this.mocks.push(JSON.parse(line));
+				} catch {}
+			}
+		}
+	}
+	async generate(req) {
+		if (this.opts.mode === "off") throw withCode(new Error("image generation disabled — rerun without `--no-image`"), -32101);
+		if (this.opts.mode === "mock") return this.pickMock("generate", req.prompt);
+		return this.realCall("/api/v1/copilot/app/image/generate", req);
+	}
+	async edit(req) {
+		if (this.opts.mode === "off") throw withCode(new Error("image edit disabled — rerun without `--no-image`"), -32101);
+		if (this.opts.mode === "mock") return this.pickMock("edit", req.prompt);
+		return this.realCall("/api/v1/copilot/app/image/edit", req);
+	}
+	pickMock(method, prompt) {
+		const wantedMethod = method === "generate" ? "generate" : "edit";
+		const candidates = this.mocks.filter((m) => m.ns === "image" && m.method === wantedMethod);
+		const matched = candidates.find((m) => m.match?.promptIncludes && prompt.includes(m.match.promptIncludes)) ?? candidates[0];
+		if (matched && matched.result) return normaliseImageResult(matched.result);
+		return {
+			images: [{
+				url: "data:image/png;base64,iVBORw0KGgoAAAANSUhEUgAAAAEAAAABCAQAAAC1HAwCAAAAC0lEQVR42mNkYAAAAAYAAjCB0C8AAAAASUVORK5CYII=",
+				mimeType: "image/png"
+			}],
+			model: "mock-image-model"
+		};
+	}
+	account() {
+		const acc = getAccount(this.opts.account);
+		if (!acc) throw withCode(new Error("no PAT on disk — run `anna-app login --host <nexus-url>` first (or pass `--mock-image <fixture>` / `--no-image`)"), -32101);
+		if (acc.expires_at && acc.expires_at < Math.floor(Date.now() / 1e3)) throw withCode(new Error("PAT expired — run `anna-app login` again"), -32101);
+		return acc;
+	}
+	async mint() {
+		if (this.cachedSession && this.cachedSession.expiresAt - 30 > Math.floor(Date.now() / 1e3)) return this.cachedSession;
+		const acc = this.account();
+		if (!this.opts.appSlug) throw withCode(new Error("image bridge has no app_slug — pass `--app-slug <slug>` to `anna-app executa dev` so nexus can attribute the spend"), -32104);
+		const url = `${canonicalHost(acc.host)}/api/v1/anna-apps/dev/session/mint`;
+		const res = await fetch(url, {
+			method: "POST",
+			headers: { "content-type": "application/json" },
+			body: JSON.stringify({
+				pat: acc.pat,
+				kind: "complete",
+				app_slug: this.opts.appSlug
+			})
+		});
+		if (!res.ok) {
+			const text = await res.text().catch(() => "");
+			throw withCode(new Error(`session.mint failed: HTTP ${res.status} ${text}`), -32103);
+		}
+		const body = await res.json();
+		this.cachedSession = {
+			appSessionToken: body.app_session_token,
+			expiresAt: Math.floor(Date.now() / 1e3) + (body.expires_in || 600)
+		};
+		return this.cachedSession;
+	}
+	async realCall(path, body) {
+		const acc = this.account();
+		const session = await this.mint();
+		const res = await fetch(`${canonicalHost(acc.host)}${path}`, {
+			method: "POST",
+			headers: {
+				"content-type": "application/json",
+				authorization: `Bearer ${session.appSessionToken}`
+			},
+			body: JSON.stringify(body)
+		});
+		if (!res.ok) {
+			const text = await res.text().catch(() => "");
+			throw withCode(
+				new Error(`HTTP ${res.status}: ${text}`),
+				// Map common HTTP statuses to canonical image codes; otherwise
+				// let the host's body propagate.
+				httpToImageCode(res.status)
+);
+		}
+		const out = await res.json();
+		return normaliseImageResult(out);
+	}
+};
+function withCode(err, code) {
+	err.rpcCode = code;
+	return err;
+}
+function httpToImageCode(status) {
+	if (status === 403) return -32101;
+	if (status === 429) return -32102;
+	if (status === 400) return -32104;
+	if (status === 504) return -32105;
+	return -32103;
+}
+function normaliseImageResult(raw) {
+	if (!raw || typeof raw !== "object") return {
+		images: [],
+		model: "unknown"
+	};
+	const o = raw;
+	const images = Array.isArray(o.images) ? o.images.map((img) => ({
+		url: String(img.url ?? ""),
+		mimeType: img.mimeType ? String(img.mimeType) : void 0,
+		width: typeof img.width === "number" ? img.width : void 0,
+		height: typeof img.height === "number" ? img.height : void 0
+	})) : [];
+	return {
+		images,
+		model: typeof o.model === "string" ? o.model : void 0,
+		quota_used: o.quota_used && typeof o.quota_used === "object" ? o.quota_used : void 0,
+		_meta: o._meta && typeof o._meta === "object" ? o._meta : void 0
+	};
+}
+
+//#endregion
+export { ImageBridge };

package/dist/{runner-Bral1LFW.js → runner-DmGLdat0.js}

@@ -8,7 +8,10 @@ const HOST_INITIALIZE_PARAMS = {
 	client_capabilities: {
 		sampling: {},
 		agent: {},
-		storage: {}
+		storage: {},
+		image: {},
+		"image.edit": {},
+		upload: {}
 	},
 	client_info: {
 		name: "anna-app-cli",
@@ -248,6 +251,46 @@ var ExecutaRunner = class {
 			}
 			return;
 		}
+		if (method === "image/generate" || method === "image/edit") {
+			if (!this.opts.image) {
+				respond({ error: {
+					code: -32101,
+					message: "image not configured (rerun without `--no-image`, or pass `--mock-image <fixture>` / `--app-slug`)"
+				} });
+				return;
+			}
+			try {
+				const result = method === "image/generate" ? await this.opts.image.generate(params) : await this.opts.image.edit(params);
+				respond({ result });
+			} catch (e) {
+				const code = e.rpcCode ?? -32103;
+				respond({ error: {
+					code,
+					message: e.message
+				} });
+			}
+			return;
+		}
+		if (method === "host/uploadFile") {
+			if (!this.opts.hostUpload) {
+				respond({ error: {
+					code: -32201,
+					message: "host upload not configured (rerun without `--no-upload`, or pass `--mock-upload <fixture>` / `--app-slug`)"
+				} });
+				return;
+			}
+			try {
+				const result = await this.opts.hostUpload.call(method, params);
+				respond({ result });
+			} catch (e) {
+				const code = e.rpcCode ?? -32207;
+				respond({ error: {
+					code,
+					message: e.message
+				} });
+			}
+			return;
+		}
 		if (method.startsWith("storage/") || method.startsWith("files/")) {
 			if (!this.opts.storage) {
 				respond({ error: {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anna-ai/cli",
-  "version": "0.1.14",
+  "version": "0.1.16",
   "description": "Anna App developer CLI: scaffold, validate, harness (Phase 2 MVP: init + validate).",
   "license": "MIT",
   "type": "module",

package/templates/minimal/bundle/app.js

@@ -1,4 +1,6 @@
 // Minimal Anna App bundle entry. Replace with real logic.
+import { AnnaAppRuntime } from "/static/anna-apps/_sdk/latest/index.js";
+
 const TOOL_ID = "__TOOL_ID__";
 
 async function main() {

package/templates/minimal/bundle/index.html

@@ -3,8 +3,7 @@
   <head>
     <meta charset="utf-8" />
     <title>__SLUG__</title>
-    <script src="/static/anna-apps/_sdk/0.1.0/index.js" defer></script>
-    <script src="./app.js" defer></script>
+    <script src="./app.js" type="module"></script>
   </head>
   <body>
     <h1>__SLUG__</h1>

package/dist/bridge-C0DWb5eQ.js

@@ -1,3 +0,0 @@
-import { PINNED_RUNTIME_VERSION, PythonBridge } from "./bridge-D6YyP9DM.js";
-
-export { PINNED_RUNTIME_VERSION, PythonBridge };

package/dist/dev-C81H9c9_.js

@@ -1,3 +0,0 @@
-import { parseExecutaSpec, runDev } from "./dev-BfLGxpiT.js";
-
-export { parseExecutaSpec, runDev };

package/dist/dev-app-cache-C3D1Sp_V.js

@@ -1,93 +0,0 @@
-import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { dirname, join, resolve } from "node:path";
-import { existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-
-//#region src/dev-app-cache.ts
-const CACHE_DIR = ".anna";
-const CACHE_FILE = "dev-app.json";
-function cachePath(cwd) {
-	return resolve(cwd, CACHE_DIR, CACHE_FILE);
-}
-function readDevAppCache(cwd) {
-	const p = cachePath(cwd);
-	if (!existsSync(p)) return null;
-	try {
-		const raw = JSON.parse(readFileSync(p, "utf-8"));
-		if (typeof raw.host === "string" && typeof raw.slug === "string" && typeof raw.app_id === "number") return {
-			host: raw.host,
-			slug: raw.slug,
-			app_id: raw.app_id,
-			name: raw.name ?? raw.slug,
-			registered_at: raw.registered_at ?? ""
-		};
-	} catch {}
-	return null;
-}
-function writeDevAppCache(cwd, entry) {
-	const p = cachePath(cwd);
-	mkdirSync(dirname(p), { recursive: true });
-	writeFileSync(p, JSON.stringify(entry, null, 2) + "\n", "utf-8");
-}
-/** Call POST /api/v1/anna-apps/dev/apps/register. Idempotent server-side. */
-async function registerDevApp(args) {
-	const url = `${canonicalHost(args.host)}/api/v1/anna-apps/dev/apps/register`;
-	const res = await fetch(url, {
-		method: "POST",
-		headers: { "content-type": "application/json" },
-		body: JSON.stringify({
-			pat: args.pat,
-			slug: args.input.slug,
-			name: args.input.name,
-			category: args.input.category,
-			tagline: args.input.tagline
-		})
-	});
-	if (!res.ok) {
-		const text = await res.text().catch(() => "");
-		throw new Error(`/dev/apps/register failed: HTTP ${res.status} ${text}`);
-	}
-	return await res.json();
-}
-/** Call GET /api/v1/anna-apps/dev/apps. */
-async function listDevApps(args) {
-	const url = new URL(`${canonicalHost(args.host)}/api/v1/anna-apps/dev/apps`);
-	url.searchParams.set("pat", args.pat);
-	const res = await fetch(url, { method: "GET" });
-	if (!res.ok) {
-		const text = await res.text().catch(() => "");
-		throw new Error(`/dev/apps failed: HTTP ${res.status} ${text}`);
-	}
-	const body = await res.json();
-	return body.apps;
-}
-/**
-* Convenience helper for `anna-app dev`: returns a valid cached entry if
-* it still matches the manifest slug, otherwise hits the server to
-* (re-)register. Throws if no PAT is available on disk.
-*/
-async function ensureDevAppRegistered(args) {
-	const canonical = canonicalHost(args.host);
-	const cached = readDevAppCache(args.cwd);
-	if (cached && cached.host === canonical && cached.slug === args.input.slug) return cached;
-	const r = await registerDevApp({
-		host: args.host,
-		pat: args.pat,
-		input: args.input
-	});
-	const entry = {
-		host: canonical,
-		slug: r.slug,
-		app_id: r.app_id,
-		name: r.name,
-		registered_at: new Date().toISOString()
-	};
-	writeDevAppCache(args.cwd, entry);
-	return entry;
-}
-const _internal = {
-	cachePath,
-	CACHE_DIR: join(CACHE_DIR, CACHE_FILE)
-};
-
-//#endregion
-export { ensureDevAppRegistered, listDevApps, readDevAppCache, registerDevApp, writeDevAppCache };

package/dist/dev-app-cache-CZ8lIKiw.js

@@ -1,4 +0,0 @@
-import "./credentials-BTv2IfUZ.js";
-import { ensureDevAppRegistered, listDevApps, readDevAppCache, registerDevApp, writeDevAppCache } from "./dev-app-cache-C3D1Sp_V.js";
-
-export { ensureDevAppRegistered };