@anna-ai/cli 0.1.22 → 0.1.26

package/dist/{executa-dev-BvS9zTpO.js → executa-dev-Cr9Yepph.js}

@@ -1,4 +1,5 @@
-import { parseExecutaSpec } from "./dev-E7mqXj5S.js";
+import "./nexus-root-BlPwOusj.js";
+import { parseExecutaSpec } from "./dev-3okZmzNM.js";
 import { isAbsolute, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
@@ -33,8 +34,8 @@ async function runExecutaDev(opts) {
 	}
 	const oneShot = !!(opts.describe || opts.health || opts.invoke);
 	const quiet = oneShot && (opts.json ?? false);
-	const { getAccount } = await import("./credentials-DklPMD22.js");
-	const { ensureDevExecutaRegistered } = await import("./dev-app-cache-D-r6ZpEk.js");
+	const { getAccount } = await import("./credentials-Chkoidh5.js");
+	const { ensureDevExecutaRegistered } = await import("./dev-app-cache-TSjL4D4n.js");
 	const needsRealMint = !opts.noSampling && !opts.mockSampling || !opts.noAgent && !opts.mockAgent || !opts.noImage && !opts.mockImage || !opts.noUpload && !opts.mockUpload || opts.storage === "real";
 	let effectiveAppSlug = opts.appSlug;
 	let autoRegistered = false;
@@ -56,7 +57,7 @@ async function runExecutaDev(opts) {
 			}
 		}
 	}
-	const { SamplingBridge } = await import("./sampling-CXke7hq1.js");
+	const { SamplingBridge } = await import("./sampling-BcML4teS.js");
 	const sampling = opts.noSampling ? new SamplingBridge({ mode: "off" }) : opts.mockSampling ? new SamplingBridge({
 		mode: "mock",
 		mockFile: opts.mockSampling
@@ -65,7 +66,7 @@ async function runExecutaDev(opts) {
 		account: opts.samplingAccount,
 		appSlug: effectiveAppSlug
 	}) : new SamplingBridge({ mode: "off" });
-	const { AgentBridge } = await import("./agent-Br6zY2qw.js");
+	const { AgentBridge } = await import("./agent-CaZVCPs6.js");
 	const agent = opts.noAgent ? new AgentBridge({ mode: "off" }) : opts.mockAgent ? new AgentBridge({
 		mode: "mock",
 		mockFile: opts.mockAgent
@@ -74,7 +75,7 @@ async function runExecutaDev(opts) {
 		account: opts.agentAccount ?? opts.samplingAccount,
 		appSlug: effectiveAppSlug
 	}) : new AgentBridge({ mode: "off" });
-	const { StorageBridge } = await import("./storage-CTkApNQ9.js");
+	const { StorageBridge } = await import("./storage-CKTmE87u.js");
 	const storageMode = opts.storage ?? (opts.mockStorage ? "mock" : "memory");
 	const storage = new StorageBridge({
 		mode: storageMode,
@@ -84,8 +85,8 @@ async function runExecutaDev(opts) {
 		scopes: opts.storageScopes ? opts.storageScopes.split(",").map((s) => s.trim()).filter(Boolean) : void 0,
 		pluginName: parsed.tool_id
 	});
-	const { ExecutaRunner } = await import("./runner-B-hIqx5L.js");
-	const { ImageBridge } = await import("./image-DduR91n5.js");
+	const { ExecutaRunner } = await import("./runner-BuYbm-ex.js");
+	const { ImageBridge } = await import("./image-CSEXEfD-.js");
 	const image = opts.noImage ? new ImageBridge({ mode: "off" }) : opts.mockImage ? new ImageBridge({
 		mode: "mock",
 		mockFile: opts.mockImage
@@ -94,7 +95,7 @@ async function runExecutaDev(opts) {
 		account: opts.imageAccount ?? opts.samplingAccount,
 		appSlug: effectiveAppSlug
 	}) : new ImageBridge({ mode: "off" });
-	const { HostUploadBridge } = await import("./host_upload-GXVkDM5M.js");
+	const { HostUploadBridge } = await import("./host_upload-BXeHTgJs.js");
 	const hostUpload = opts.noUpload ? new HostUploadBridge({ mode: "off" }) : opts.mockUpload ? new HostUploadBridge({
 		mode: "mock",
 		mockFile: opts.mockUpload

package/dist/executa-install-DQIhVHPT.js

@@ -0,0 +1,90 @@
+import { readExecutaIdentity } from "./executa-cache-CXiEgFZY.js";
+import { parseExecutaSpec } from "./dev-3okZmzNM.js";
+import { isAbsolute, join, resolve } from "node:path";
+import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
+import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
+import { homedir } from "node:os";
+
+//#region src/commands/executa-install.ts
+/** POSIX single-quote one argument for safe embedding in the shim. */
+function shQuote(arg) {
+	return `'${arg.replace(/'/g, "'\\''")}'`;
+}
+function buildShim(projectDir, command) {
+	const cd = `cd ${shQuote(projectDir)} || exit 1`;
+	const exec = `exec ${command.map(shQuote).join(" ")} "$@"`;
+	return [
+		"#!/bin/sh",
+		"# Auto-generated by `anna-app executa install`.",
+		"# Local-dev launcher shim — runs the Executa from source so the Agent",
+		"# can discover it via 'Rediscover Local'. Safe to delete; regenerate",
+		"# with `anna-app executa install`.",
+		cd,
+		exec,
+		""
+	].join("\n");
+}
+async function runExecutaInstall(opts) {
+	const json = opts.json ?? false;
+	const cwd = opts.dir ? isAbsolute(opts.dir) ? opts.dir : resolve(process.cwd(), opts.dir) : process.cwd();
+	if (!existsSync(cwd)) {
+		console.error(red(`✗ executa dir not found: ${cwd}`));
+		return 2;
+	}
+	const parsed = parseExecutaSpec(`dir=${cwd}`, process.cwd());
+	if (parsed instanceof Error) {
+		console.error(red(`✗ ${parsed.message}`));
+		return 2;
+	}
+	if (!parsed.command || parsed.command.length === 0) {
+		console.error(red(`✗ could not derive a launch command for ${cwd}`));
+		return 2;
+	}
+	const identity = readExecutaIdentity(cwd);
+	const targetId = opts.toolId ?? identity?.tool_id ?? parsed.tool_id;
+	if (!targetId) {
+		console.error(red("✗ could not resolve a tool_id — pass --tool-id <id>, or run `anna-app executa publish` / `anna-app apps push` first to mint one."));
+		return 2;
+	}
+	if (/[/\\]/.test(targetId) || targetId.startsWith(".")) {
+		console.error(red(`✗ invalid tool_id "${targetId}" (no path separators or leading dot)`));
+		return 2;
+	}
+	const binDir = opts.binDir ? isAbsolute(opts.binDir) ? opts.binDir : resolve(process.cwd(), opts.binDir) : join(homedir(), ".anna", "executa", "bin");
+	const shimPath = join(binDir, targetId);
+	if (existsSync(shimPath) && !opts.force) {
+		console.error(red(`✗ shim already exists: ${shimPath}`) + dim(" (pass --force to overwrite)"));
+		return 1;
+	}
+	try {
+		mkdirSync(binDir, { recursive: true });
+		writeFileSync(shimPath, buildShim(parsed.project_dir, parsed.command), "utf-8");
+		chmodSync(shimPath, 493);
+	} catch (e) {
+		console.error(red(`✗ failed to write shim: ${e.message}`));
+		return 1;
+	}
+	if (json) {
+		console.log(JSON.stringify({
+			tool_id: targetId,
+			shim_path: shimPath,
+			project_dir: parsed.project_dir,
+			command: parsed.command,
+			source: opts.toolId ? "flag" : identity?.tool_id ? "identity-cache" : "discovered"
+		}));
+		return 0;
+	}
+	if (opts.quiet) return 0;
+	console.log(bold(cyan("anna-app executa install")));
+	console.log(`  tool_id   ${green(targetId)}`);
+	console.log(`  shim      ${dim(shimPath)}`);
+	console.log(`  dir       ${dim(parsed.project_dir)}`);
+	console.log(`  command   ${dim(parsed.command.join(" "))}`);
+	if (!opts.toolId && identity?.tool_id) console.log(`  source    ${dim("minted tool_id from .anna/executa.json")}`);
+	else if (!opts.toolId) console.log(yellow("  ! using the placeholder tool_id from executa.json — run `executa publish`/`apps push` to mint the real one, then re-run with --force (or pass --tool-id)."));
+	console.log(dim("\n→ open the Agent's Plugin Details modal and click " + bold("Rediscover Local") + dim(" to load it under this tool_id.")));
+	return 0;
+}
+
+//#endregion
+export { runExecutaInstall };

package/dist/executa-install-DjXE_-U-.js

@@ -0,0 +1,7 @@
+import "./credentials-BTv2IfUZ.js";
+import "./nexus-root-BlPwOusj.js";
+import "./executa-cache-CXiEgFZY.js";
+import "./dev-3okZmzNM.js";
+import { runExecutaInstall } from "./executa-install-DQIhVHPT.js";
+
+export { runExecutaInstall };

package/dist/{executa-publish-Ca5V7MyA.js → executa-publish-CkPAB34b.js}

@@ -1,9 +1,9 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { CliError } from "./client-Dn9zThOd.js";
-import { commitDraft, createDraft, getMySkill, getMyTool, listToolVersions, publishToolVersion, setSkillVisibility, setToolVisibility, updateMySkill, updateMyTool } from "./executas-Cep6KEo0.js";
-import { executaCacheMatches, invalidateExecutaCache, mintIdempotencyKey, readExecutaIdentity, writeExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { loadExecutaManifest } from "./manifest-DGwRap2i.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-sbea9HtH.js";
+import { CliError } from "./client-D-_z1ALk.js";
+import { commitDraft, createDraft, getMySkill, getMyTool, listToolVersions, publishToolVersion, setSkillVisibility, setToolVisibility, updateMySkill, updateMyTool } from "./executas-CK3er6f9.js";
+import { executaCacheMatches, invalidateExecutaCache, mintIdempotencyKey, readExecutaIdentity, writeExecutaIdentity } from "./executa-cache-CXiEgFZY.js";
+import { loadExecutaManifest } from "./manifest-Bljz8Y6T.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-BpSOfVCP.js";
 import { join, relative, resolve, sep } from "node:path";
 import { readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";

package/dist/executa-publish-IXWSwva0.js

@@ -0,0 +1,9 @@
+import "./credentials-BTv2IfUZ.js";
+import "./client-D-_z1ALk.js";
+import "./executas-CK3er6f9.js";
+import "./executa-cache-CXiEgFZY.js";
+import { runExecutaPublish } from "./executa-publish-CkPAB34b.js";
+import "./manifest-Bljz8Y6T.js";
+import "./_lifecycle-shared-BpSOfVCP.js";
+
+export { runExecutaPublish };

package/dist/{executa-reads-CQ6S8gHY.js → executa-reads-CjGZq1yP.js}

@@ -1,7 +1,7 @@
 import "./credentials-BTv2IfUZ.js";
-import { CliError } from "./client-Dn9zThOd.js";
-import { getMyTool, listMyTools, listToolVersions } from "./executas-Cep6KEo0.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-sbea9HtH.js";
+import { CliError } from "./client-D-_z1ALk.js";
+import { getMyTool, listMyTools, listToolVersions } from "./executas-CK3er6f9.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-BpSOfVCP.js";
 import { bold, cyan, dim, green } from "kleur/colors";
 
 //#region src/commands/executa-reads.ts

package/dist/{manifest-DGwRap2i.js → manifest-Bljz8Y6T.js}

@@ -1,4 +1,4 @@
-import { CliError } from "./client-Dn9zThOd.js";
+import { CliError } from "./client-D-_z1ALk.js";
 import { resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 
@@ -124,23 +124,82 @@ function loadExecutaManifest(cwd, manifestPath) {
 * Returns `undefined` when absent (a dev-only Executa). Skills never carry
 * distribution config — they are declarative Markdown, not installable
 * processes — so a `distribution` block on a skill is rejected.
+*
+* Two shapes are accepted:
+*
+*   1. Flat (single mode) — the historical form:
+*
+*        "distribution": { "type": "binary", "binary_urls": { … } }
+*
+*   2. Multi-profile (switchable) — keep several modes side by side and flip
+*      `active` to choose which one is published:
+*
+*        "distribution": {
+*          "active": "binary",
+*          "profiles": {
+*            "local":  { "type": "local",  "executable_name": "…" },
+*            "binary": { "type": "binary", "binary_urls": { … } }
+*          }
+*        }
+*
+*      Every profile is validated (so a typo in an *inactive* profile is
+*      still caught), but the returned `ExecutaDistribution` carries the
+*      fields of the *active* profile plus `active`/`profiles` for
+*      introspection. Downstream publish code stays profile-agnostic.
 */
 function parseExecutaDistribution(value, executaType) {
 	if (value === void 0 || value === null) return void 0;
-	if (typeof value !== "object" || Array.isArray(value)) throw new CliError("executa.json `distribution` must be an object with a `type` field", 4);
+	if (typeof value !== "object" || Array.isArray(value)) throw new CliError("executa.json `distribution` must be an object with a `type` field (or `profiles` for the switchable multi-mode form)", 4);
 	if (executaType === "skill") throw new CliError("executa.json `distribution` is only valid for `executa_type: \"tool\"` — skills are declarative Markdown and are not installed as a process", 4);
 	const d = value;
+	if (d["profiles"] !== void 0) return parseProfiledDistribution(d);
+	return parseDistributionProfile(d, "distribution");
+}
+/**
+* Resolve the multi-profile `distribution` form into the selected profile.
+* Validates *all* profiles and records them under `profiles`.
+*/
+function parseProfiledDistribution(d) {
+	if (d["type"] !== void 0) throw new CliError("executa.json `distribution` cannot set both `type` (flat form) and `profiles` (switchable form) — pick one", 4);
+	const profilesRaw = d["profiles"];
+	if (profilesRaw === null || typeof profilesRaw !== "object" || Array.isArray(profilesRaw)) throw new CliError("executa.json `distribution.profiles` must be an object mapping a profile name → distribution config", 4);
+	const profileEntries = Object.entries(profilesRaw);
+	if (profileEntries.length === 0) throw new CliError("executa.json `distribution.profiles` must declare at least one profile", 4);
+	const profiles = {};
+	for (const [pname, pval] of profileEntries) {
+		if (pval === null || typeof pval !== "object" || Array.isArray(pval)) throw new CliError(`executa.json \`distribution.profiles["${pname}"]\` must be an object`, 4);
+		profiles[pname] = parseDistributionProfile(pval, `distribution.profiles["${pname}"]`);
+	}
+	const active = pickString(d, "active");
+	let selected;
+	if (active !== void 0) {
+		if (!(active in profiles)) throw new CliError(`executa.json \`distribution.active\` "${active}" is not a declared profile — expected one of ${Object.keys(profiles).join(" | ")}`, 4);
+		selected = active;
+	} else if (profileEntries.length === 1) selected = profileEntries[0][0];
+	else throw new CliError(`executa.json \`distribution.active\` is required when more than one profile is declared — expected one of ${Object.keys(profiles).join(" | ")}`, 4);
+	const resolved = profiles[selected];
+	return {
+		...resolved,
+		active: selected,
+		profiles
+	};
+}
+/**
+* Parse + validate a single distribution config (one flat block or one entry
+* of a `profiles` map). `ctx` is the JSON path label used in error messages.
+*/
+function parseDistributionProfile(d, ctx) {
 	const type = pickString(d, "type");
-	if (!type) throw new CliError("executa.json `distribution.type` is required", 4);
-	if (!DISTRIBUTION_TYPES.has(type)) throw new CliError(`executa.json \`distribution.type\` "${type}" is invalid — expected one of ` + [...DISTRIBUTION_TYPES].join(" | "), 4);
+	if (!type) throw new CliError(`executa.json \`${ctx}.type\` is required`, 4);
+	if (!DISTRIBUTION_TYPES.has(type)) throw new CliError(`executa.json \`${ctx}.type\` "${type}" is invalid — expected one of ` + [...DISTRIBUTION_TYPES].join(" | "), 4);
 	const distType = type;
 	const packageName = pickString(d, "package_name");
 	const executableName = pickString(d, "executable_name");
 	const supportsProtocol = pickBool(d, "supports_protocol");
-	const binaryUrls = parseBinaryUrls(d["binary_urls"]);
-	const capabilities = parseCapabilities(d["capabilities"]);
-	if (PACKAGE_BACKED.has(distType) && !packageName) throw new CliError(`executa.json \`distribution.package_name\` is required for \`distribution.type: "${distType}"\``, 4);
-	if (distType === "binary" && (!binaryUrls || Object.keys(binaryUrls).length === 0)) throw new CliError("executa.json `distribution.binary_urls` is required (and non-empty) for `distribution.type: \"binary\"`", 4);
+	const binaryUrls = parseBinaryUrls(d["binary_urls"], ctx);
+	const capabilities = parseCapabilities(d["capabilities"], ctx);
+	if (PACKAGE_BACKED.has(distType) && !packageName) throw new CliError(`executa.json \`${ctx}.package_name\` is required for \`${ctx}.type: "${distType}"\``, 4);
+	if (distType === "binary" && (!binaryUrls || Object.keys(binaryUrls).length === 0)) throw new CliError(`executa.json \`${ctx}.binary_urls\` is required (and non-empty) for \`${ctx}.type: "binary"\``, 4);
 	return {
 		type: distType,
 		packageName,
@@ -150,29 +209,29 @@ function parseExecutaDistribution(value, executaType) {
 		capabilities
 	};
 }
-function parseBinaryUrls(value) {
+function parseBinaryUrls(value, ctx = "distribution") {
 	if (value === void 0 || value === null) return void 0;
-	if (typeof value !== "object" || Array.isArray(value)) throw new CliError("executa.json `distribution.binary_urls` must be an object mapping platform → URL string or asset dict", 4);
+	if (typeof value !== "object" || Array.isArray(value)) throw new CliError(`executa.json \`${ctx}.binary_urls\` must be an object mapping platform → URL string or asset dict`, 4);
 	const out = {};
 	for (const [platform, asset] of Object.entries(value)) {
 		if (typeof asset === "string") {
-			if (!asset.trim()) throw new CliError(`executa.json \`distribution.binary_urls["${platform}"]\` is empty`, 4);
+			if (!asset.trim()) throw new CliError(`executa.json \`${ctx}.binary_urls["${platform}"]\` is empty`, 4);
 			out[platform] = asset;
 			continue;
 		}
 		if (asset && typeof asset === "object" && !Array.isArray(asset)) {
 			const url = pickString(asset, "url");
-			if (!url) throw new CliError(`executa.json \`distribution.binary_urls["${platform}"]\` asset dict missing required \`url\``, 4);
+			if (!url) throw new CliError(`executa.json \`${ctx}.binary_urls["${platform}"]\` asset dict missing required \`url\``, 4);
 			out[platform] = asset;
 			continue;
 		}
-		throw new CliError(`executa.json \`distribution.binary_urls["${platform}"]\` must be a URL string or an asset dict \`{ url, sha256?, size?, entrypoint?, format? }\``, 4);
+		throw new CliError(`executa.json \`${ctx}.binary_urls["${platform}"]\` must be a URL string or an asset dict \`{ url, sha256?, size?, entrypoint?, format? }\``, 4);
 	}
 	return out;
 }
-function parseCapabilities(value) {
+function parseCapabilities(value, ctx = "distribution") {
 	if (value === void 0 || value === null) return void 0;
-	if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) throw new CliError("executa.json `distribution.capabilities` must be an array of strings", 4);
+	if (!Array.isArray(value) || value.some((v) => typeof v !== "string")) throw new CliError(`executa.json \`${ctx}.capabilities\` must be an array of strings`, 4);
 	return value;
 }
 function pickBool(o, k) {

package/dist/nexus-root-BlPwOusj.js

@@ -0,0 +1,49 @@
+import { dirname, isAbsolute, resolve } from "node:path";
+import { existsSync } from "node:fs";
+
+//#region src/nexus-root.ts
+/**
+* Resolve an absolute matrix-nexus root, or null if none is found.
+*
+* Search order (first hit wins):
+*   1. `explicit` (the `--matrix-nexus-root` flag).
+*   2. `$ANNA_NEXUS_ROOT`.
+*   3. Walk up from `cwd`.
+*   4. Sibling `../matrix-nexus`.
+*
+* A candidate qualifies only if it contains
+* `packages/anna-app-runtime-local/pyproject.toml` (the marker that also
+* gates `nexus-source` runtime mode), so the three escape hatches can
+* never disagree on what counts as "a matrix-nexus checkout".
+*/
+function findMatrixNexusRoot(explicit, cwd) {
+	const candidates = [explicit, process.env.ANNA_NEXUS_ROOT];
+	let dir = cwd;
+	while (true) {
+		candidates.push(dir);
+		const parent = dirname(dir);
+		if (parent === dir) break;
+		dir = parent;
+	}
+	candidates.push(resolve(cwd, "..", "matrix-nexus"));
+	for (const c of candidates) {
+		if (!c) continue;
+		const abs = isAbsolute(c) ? c : resolve(cwd, c);
+		if (existsSync(resolve(abs, "packages/anna-app-runtime-local/pyproject.toml"))) return abs;
+	}
+	return null;
+}
+/**
+* Locate the in-tree `@anna-ai/app-schema` bundle inside a matrix-nexus
+* root, or null if it is absent / not built. The returned dir is suitable
+* for `ANNA_APP_SCHEMA_DIR` / `loadSchemaBundle`'s override so contributors
+* can `validate` against an UNPUBLISHED schema bump without waiting for the
+* npm push — parity with the runtime/SDK nexus-source hatches.
+*/
+function nexusSchemaDir(root) {
+	const dir = resolve(root, "packages", "anna-app-schema");
+	return existsSync(resolve(dir, "dispatcher_version.txt")) ? dir : null;
+}
+
+//#endregion
+export { findMatrixNexusRoot, nexusSchemaDir };

package/dist/{publish-C1wcf-qI.js → publish-BYWuujP3.js}

@@ -1,15 +1,15 @@
 import "./credentials-BTv2IfUZ.js";
-import "./apps-B1Nd8l_t.js";
-import { CliError } from "./client-Dn9zThOd.js";
-import "./bundled-executas-BNOKw4kv.js";
-import "./executas-Cep6KEo0.js";
-import "./executa-cache-BFoUtb4J.js";
-import { runExecutaPublish } from "./executa-publish-Ca5V7MyA.js";
-import "./manifest-DGwRap2i.js";
-import { withErrorHandling } from "./_lifecycle-shared-sbea9HtH.js";
-import "./app-cache-BEM653Th.js";
-import "./app-bundle-upload-DuLalcSt.js";
-import { runAppsPublish } from "./apps-publish-CaTCanDu.js";
+import "./apps-CCdtLmxQ.js";
+import { CliError } from "./client-D-_z1ALk.js";
+import "./bundled-executas-B6b8gIfp.js";
+import "./executas-CK3er6f9.js";
+import "./executa-cache-CXiEgFZY.js";
+import { runExecutaPublish } from "./executa-publish-CkPAB34b.js";
+import "./manifest-Bljz8Y6T.js";
+import { withErrorHandling } from "./_lifecycle-shared-BpSOfVCP.js";
+import "./app-cache-Bl7cE5fm.js";
+import "./app-bundle-upload-BhAYo6yj.js";
+import { runAppsPublish } from "./apps-publish-Dgi4lBlu.js";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { red, yellow } from "kleur/colors";

package/dist/{server-_IG8Igje.js → server-Cp7mYV9t.js}

@@ -1,5 +1,5 @@
 import { canonicalHost, getAccount } from "./credentials-BTv2IfUZ.js";
-import { BridgeRequestError } from "./bridge-BuklhzeE.js";
+import { BridgeRequestError } from "./bridge-DxBd0Fl9.js";
 import { dirname, join, normalize, resolve } from "node:path";
 import { createRequire } from "node:module";
 import { createReadStream, existsSync, readFileSync, statSync, watch } from "node:fs";
@@ -445,6 +445,26 @@ var LlmBridge = class {
 					message: "agent.session.history is not exposed over HTTP; available only via in-process store"
 				}
 			};
+			case "session.list": {
+				const includeExpired = Boolean(args.args?.include_expired);
+				const rawLimit = Number(args.args?.limit ?? 50);
+				const limit = Math.max(1, Math.min(100, Number.isFinite(rawLimit) ? rawLimit : 50));
+				const now = Math.floor(Date.now() / 1e3);
+				const sessions = [...this.mintedAgent.values()].filter((ms) => includeExpired || ms.expiresAt > now).slice(0, limit).map((ms) => ({
+					app_session_uuid: ms.appSessionUuid,
+					kind: "agent",
+					submode: ms.submode,
+					fixed_client_id: null,
+					label: "anna-app dev",
+					created_at: null,
+					last_active_at: null,
+					expires_at: new Date(ms.expiresAt * 1e3).toISOString()
+				}));
+				return {
+					ok: true,
+					result: { sessions }
+				};
+			}
 			case "session.delete": {
 				const apsUuid = String(args.args.app_session_uuid ?? "");
 				const ms = this.mintedAgent.get(apsUuid);
@@ -857,6 +877,11 @@ var HarnessServer = class {
 				"agent",
 				"session.delete"
 			],
+			[
+				"host.agent.session.list",
+				"agent",
+				"session.list"
+			],
 			[
 				"host.image.generate",
 				"image",
@@ -1133,17 +1158,34 @@ var HarnessServer = class {
 	}
 	async serveSdk(pathname, res) {
 		const sdkRel = pathname.replace(/^\/static\/anna-apps\/_sdk\/[^/]+\//, "");
-		let distRoot;
-		try {
-			const req = createRequire(import.meta.url);
-			distRoot = dirname(req.resolve("@anna-ai/app-runtime"));
-		} catch (e) {
-			return this.text(res, 500, `@anna-ai/app-runtime is not installed: ${e.message}`);
-		}
+		const distRoot = this.resolveSdkDistRoot();
+		if (!distRoot) return this.text(res, 500, "@anna-ai/app-runtime is not installed and no in-tree packages/anna-app-runtime/dist was found.");
 		const abs = resolve(distRoot, sdkRel);
 		if (!abs.startsWith(distRoot)) return this.text(res, 403, "forbidden");
 		return this.serveFile(abs, res);
 	}
+	/**
+	* Resolve the directory the browser SDK (`index.js` + friends) is served
+	* from. When `--matrix-nexus-root` is set we prefer the in-tree
+	* `packages/anna-app-runtime/dist/` so contributors run byte-identical
+	* with the unpublished workspace SDK (parity with the Python bridge, which
+	* already runs in-tree in `nexus-source` mode). Falls back to the
+	* published npm package resolved from anna-app-cli's own node_modules.
+	* Returns null if neither is available.
+	*/
+	resolveSdkDistRoot() {
+		const root = this.cfg.matrixNexusRoot;
+		if (root) {
+			const inTree = resolve(root, "packages", "anna-app-runtime", "dist");
+			if (existsSync(join(inTree, "index.js"))) return inTree;
+		}
+		try {
+			const req = createRequire(import.meta.url);
+			return dirname(req.resolve("@anna-ai/app-runtime"));
+		} catch {
+			return null;
+		}
+	}
 	async serveBundleAsset(rel, res) {
 		const abs = resolve(this.cfg.bundleDir, normalize(rel));
 		if (!abs.startsWith(resolve(this.cfg.bundleDir))) return this.text(res, 403, "forbidden");

package/dist/{storage-CTkApNQ9.js → storage-CKTmE87u.js}

@@ -1,5 +1,5 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { hostOf, requireAccount, withCode } from "./dev-account-qRaET1Cp.js";
+import { hostOf, requireAccount, withCode } from "./dev-account-CGo8k9_2.js";
 import { resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 

package/dist/test/index.js

@@ -22,6 +22,9 @@ function deriveAcl(manifest) {
 		const bare = ref.includes(":") ? ref.split(":", 2)[1] : ref;
 		allowedTools.add(bare);
 	}
+	if (allowedTools.size === 0 && !toolsWildcard) {
+		for (const r of [...manifest.required_executas ?? [], ...manifest.optional_executas ?? []]) if (r.tool_id) allowedTools.add(r.tool_id);
+	}
 	if (allowedTools.size > 0 || toolsWildcard) allowed.add("tools.invoke");
 	for (const ns of Object.keys(NAMESPACED)) {
 		if (ns === "tools") continue;

package/dist/{token-B9JUPelx.js → token-Cg7BZGp6.js}

@@ -1,6 +1,6 @@
 import "./credentials-BTv2IfUZ.js";
-import "./client-Dn9zThOd.js";
-import { resolveClient, withErrorHandling } from "./_lifecycle-shared-sbea9HtH.js";
+import "./client-D-_z1ALk.js";
+import { resolveClient, withErrorHandling } from "./_lifecycle-shared-BpSOfVCP.js";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
 
 //#region src/api/tokens.ts

package/dist/{working-orchestration-Dw9u1Vq0.js → working-orchestration-Dd1ETQ3c.js}

@@ -1,11 +1,14 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { createApp, findAppBySlug, getApp } from "./apps-B1Nd8l_t.js";
-import { CliError } from "./client-Dn9zThOd.js";
-import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-BNOKw4kv.js";
-import { runExecutaPublish } from "./executa-publish-Ca5V7MyA.js";
-import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-BEM653Th.js";
-import { resolve } from "node:path";
+import { createApp, findAppBySlug, getApp } from "./apps-CCdtLmxQ.js";
+import { CliError } from "./client-D-_z1ALk.js";
+import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-B6b8gIfp.js";
+import { runExecutaPublish } from "./executa-publish-CkPAB34b.js";
+import { loadExecutaManifest } from "./manifest-Bljz8Y6T.js";
+import { runExecutaInstall } from "./executa-install-DQIhVHPT.js";
+import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-Bl7cE5fm.js";
+import { join, resolve } from "node:path";
 import { dim, green, yellow } from "kleur/colors";
+import { homedir } from "node:os";
 
 //#region src/publish/working-orchestration.ts
 async function resolveBundledExecutas(params) {
@@ -104,6 +107,50 @@ async function resolveBundledExecutas(params) {
 	};
 }
 /**
+* Install a local-dev launcher shim for every bundled executa whose *active*
+* distribution profile is `local`, under its minted `tool_id`. This closes
+* the manual gap after `apps push`: a `local` executa never triggers a server
+* `install_plugin` RPC, so the only way it turns "Running" on an Agent is the
+* **Rediscover Local** flow — which needs an on-disk shim named exactly the
+* minted `tool_id`. Binary/uv/npm/etc. profiles are skipped (the Agent
+* installs those itself), as are skills (no runtime process) and dev-only
+* executas with no distribution block.
+*
+* Failures are non-fatal: a shim that can't be written warns but does not
+* fail the surrounding `apps push`.
+*/
+async function installLocalBundledShims(params) {
+	const { manifest, cwd, resolved, json = false } = params;
+	const binDir = params.binDir ?? join(homedir(), ".anna", "executa", "bin");
+	const installed = [];
+	for (const decl of manifest.bundledExecutas) {
+		const toolId = resolved[decl.handle];
+		if (!toolId) continue;
+		const dir = resolve(cwd, decl.path);
+		let exManifest;
+		try {
+			exManifest = loadExecutaManifest(dir);
+		} catch {
+			continue;
+		}
+		if (exManifest.distribution?.type !== "local") continue;
+		const code = await runExecutaInstall({
+			dir,
+			toolId,
+			binDir: params.binDir,
+			force: true,
+			quiet: true
+		});
+		if (code === 0) installed.push({
+			handle: decl.handle,
+			tool_id: toolId,
+			shim_path: join(binDir, toolId)
+		});
+		else if (!json) console.log(yellow(`  ! could not install local dev shim for "${decl.handle}" (exit ${code})`));
+	}
+	return installed;
+}
+/**
 * Resolve (creating if absent) the `AnnaApp` row, persisting the identity
 * cache before any subsequent network call. Returns `null` only in dry-run
 * mode when the app does not exist yet (nothing to create).
@@ -187,4 +234,4 @@ async function resolveAppBySlugOrCache(client, host, opts) {
 }
 
 //#endregion
-export { resolveAppBySlugOrCache, resolveAppIdentity, resolveBundledExecutas };
+export { installLocalBundledShims, resolveAppBySlugOrCache, resolveAppIdentity, resolveBundledExecutas };

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anna-ai/cli",
-  "version": "0.1.22",
+  "version": "0.1.26",
   "description": "Anna App developer CLI: scaffold, validate, harness (Phase 2 MVP: init + validate).",
   "license": "MIT",
   "type": "module",
@@ -29,11 +29,12 @@
     "test:watch": "vitest",
     "lint": "tsc --noEmit",
     "check:runtime-pin": "node scripts/check-runtime-pin.mjs",
-    "prepublishOnly": "pnpm lint && pnpm test && pnpm build"
+    "check:sdk-pin": "node scripts/check-sdk-pin.mjs",
+    "prepublishOnly": "pnpm lint && pnpm test && pnpm build && node scripts/check-runtime-pin.mjs && node scripts/check-sdk-pin.mjs"
   },
   "dependencies": {
-    "@anna-ai/app-runtime": "^0.5.0",
-    "@anna-ai/app-schema": "^0.8.0",
+    "@anna-ai/app-runtime": "^0.7.0",
+    "@anna-ai/app-schema": "^0.9.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "commander": "^12.1.0",