@anna-ai/cli 0.1.49 → 0.1.52

package/dist/{dev-Bfv3WQC0.js → dev-uagVfV9Y.js}

@@ -61,8 +61,8 @@ async function runDev(opts) {
 		}
 		process.env.ANNA_APP_RUNTIME_WEB_MODE = "real";
 	}
-	const { PythonBridge, PINNED_RUNTIME_VERSION } = await import("./bridge-BP28T06H.js");
-	const { HarnessServer } = await import("./server-Dr_htFv8.js");
+	const { PythonBridge, PINNED_RUNTIME_VERSION } = await import("./bridge-nv-le8ff.js");
+	const { HarnessServer } = await import("./server-CBx61J7s.js");
 	const bridge = new PythonBridge({
 		mode,
 		matrixNexusRoot: matrixNexusRoot ?? void 0,
@@ -125,8 +125,10 @@ async function runDev(opts) {
 	if (llm === null) return 2;
 	llm.storageMode = storageMode;
 	llm.webMode = webMode;
+	llm.appManifest = manifest;
+	llm.strictStorageCaps = opts.strictCaps !== false;
 	console.log(`  llm bridge        ${dim(llm.mode === "off" ? "disabled (--no-llm)" : llm.mode === "mock" ? `mock (${opts.mockLlm})` : `real${opts.llmAccount ? ` [${opts.llmAccount}]` : ""} → app_slug=${llm.appSlug}`)}`);
-	console.log(`  storage backend   ${dim(storageMode === "aps" ? "aps (real nexus APS via /api/v1/storage/*)" : "legacy (in-memory runtime_state)")}`);
+	console.log(`  storage backend   ${dim(storageMode === "aps" ? `aps (real nexus APS via /api/v1/storage/*) · caps gate ${opts.strictCaps !== false ? "strict (production parity)" : "warn-only (--no-strict-caps)"}` : "legacy (in-memory runtime_state)")}`);
 	console.log(`  web backend       ${dim(webMode === "real" ? "real (platform web service via /api/v1/copilot/app/web/* — normal CU billing)" : "local (keyless ddgs + stdlib SSRF fetcher, unbilled)")}`);
 	const server = new HarnessServer({
 		slug,
@@ -175,7 +177,7 @@ async function runDev(opts) {
 */
 async function resolveRealLlm(args) {
 	const { getAccount } = await import("./credentials-Chkoidh5.js");
-	const { ensureDevAppRegistered } = await import("./dev-app-cache-Dw2JESld.js");
+	const { ensureDevAppRegistered } = await import("./dev-app-cache-CScRa7c3.js");
 	const acc = getAccount(args.account);
 	if (!acc) {
 		console.error(red("✗ no developer PAT on disk — run `anna-app login --host <nexus-url>` first.\n  (or use `--no-llm` / `--mock-llm <fixture>` to develop offline.)"));
@@ -204,7 +206,7 @@ async function resolveRealLlm(args) {
 			account: args.account,
 			appSlug: entry.slug,
 			onAppSlugNotFound: async () => {
-				const { invalidateDevAppCache } = await import("./dev-app-cache-Dw2JESld.js");
+				const { invalidateDevAppCache } = await import("./dev-app-cache-CScRa7c3.js");
 				invalidateDevAppCache(args.cwd);
 				const fresh = getAccount(args.account);
 				if (!fresh) throw new Error("PAT not found while re-registering dev app — run `anna-app login` again");

package/dist/{doctor-CHnkbamq.js → doctor-qFe9sXxR.js}

@@ -1,5 +1,5 @@
 import { findMatrixNexusRoot, nexusSchemaDir } from "./nexus-root-BlPwOusj.js";
-import { PINNED_RUNTIME_VERSION } from "./bridge-sFHqOOat.js";
+import { PINNED_RUNTIME_VERSION } from "./bridge-Bo8eu3-d.js";
 import { resolve } from "node:path";
 import { existsSync, statSync } from "node:fs";
 import { spawnSync } from "node:child_process";

package/dist/{executa-destructive-Du7RGJgn.js → executa-destructive-C06mgvfJ.js}

@@ -2,7 +2,7 @@ import "./credentials-BTv2IfUZ.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { deleteMyTool, listMyTools, listToolVersions, unpublishTool, yankToolVersion } from "./executas-CvQY_w2U.js";
-import { ensureDestructiveAllowed } from "./confirm-ChZAVrZe.js";
+import { ensureDestructiveAllowed } from "./confirm-DplLyBSG.js";
 import { dim, green, yellow } from "kleur/colors";
 
 //#region src/commands/executa-destructive.ts

package/dist/{executa-dev-DYO87dzg.js → executa-dev-BeYhrj-n.js}

@@ -1,5 +1,5 @@
 import "./nexus-root-BlPwOusj.js";
-import { parseExecutaSpec } from "./dev-Bfv3WQC0.js";
+import { parseExecutaSpec } from "./dev-uagVfV9Y.js";
 import { isAbsolute, resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
@@ -35,7 +35,7 @@ async function runExecutaDev(opts) {
 	const oneShot = !!(opts.describe || opts.health || opts.invoke);
 	const quiet = oneShot && (opts.json ?? false);
 	const { getAccount } = await import("./credentials-Chkoidh5.js");
-	const { ensureDevExecutaRegistered } = await import("./dev-app-cache-Dw2JESld.js");
+	const { ensureDevExecutaRegistered } = await import("./dev-app-cache-CScRa7c3.js");
 	const needsRealMint = !opts.noSampling && !opts.mockSampling || !opts.noAgent && !opts.mockAgent || !opts.noImage && !opts.mockImage || !opts.noUpload && !opts.mockUpload || opts.storage === "real";
 	let effectiveAppSlug = opts.appSlug;
 	let autoRegistered = false;
@@ -57,7 +57,7 @@ async function runExecutaDev(opts) {
 			}
 		}
 	}
-	const { SamplingBridge } = await import("./sampling-BpJcd6BC.js");
+	const { SamplingBridge } = await import("./sampling-BQwF3O-4.js");
 	const simulateUnsupportedResponseFormat = opts.samplingUnsupportedFormat;
 	const sampling = opts.noSampling ? new SamplingBridge({ mode: "off" }) : opts.mockSampling ? new SamplingBridge({
 		mode: "mock",
@@ -69,7 +69,7 @@ async function runExecutaDev(opts) {
 		appSlug: effectiveAppSlug,
 		simulateUnsupportedResponseFormat
 	}) : new SamplingBridge({ mode: "off" });
-	const { AgentBridge } = await import("./agent-DAOr_aiE.js");
+	const { AgentBridge } = await import("./agent-CX2VzG7e.js");
 	const agent = opts.noAgent ? new AgentBridge({ mode: "off" }) : opts.mockAgent ? new AgentBridge({
 		mode: "mock",
 		mockFile: opts.mockAgent
@@ -78,7 +78,7 @@ async function runExecutaDev(opts) {
 		account: opts.agentAccount ?? opts.samplingAccount,
 		appSlug: effectiveAppSlug
 	}) : new AgentBridge({ mode: "off" });
-	const { StorageBridge } = await import("./storage-aii8EyPC.js");
+	const { StorageBridge } = await import("./storage-CZ4c4ibf.js");
 	const storageMode = opts.storage ?? (opts.mockStorage ? "mock" : "memory");
 	const storage = new StorageBridge({
 		mode: storageMode,
@@ -88,8 +88,8 @@ async function runExecutaDev(opts) {
 		scopes: opts.storageScopes ? opts.storageScopes.split(",").map((s) => s.trim()).filter(Boolean) : void 0,
 		pluginName: parsed.tool_id
 	});
-	const { ExecutaRunner } = await import("./runner-Dq3cluPM.js");
-	const { ImageBridge } = await import("./image-B4UrufYH.js");
+	const { ExecutaRunner } = await import("./runner-aq0n-pdr.js");
+	const { ImageBridge } = await import("./image-C61zRJC8.js");
 	const image = opts.noImage ? new ImageBridge({ mode: "off" }) : opts.mockImage ? new ImageBridge({
 		mode: "mock",
 		mockFile: opts.mockImage
@@ -98,7 +98,7 @@ async function runExecutaDev(opts) {
 		account: opts.imageAccount ?? opts.samplingAccount,
 		appSlug: effectiveAppSlug
 	}) : new ImageBridge({ mode: "off" });
-	const { HostUploadBridge } = await import("./host_upload-CW_2Fxg6.js");
+	const { HostUploadBridge } = await import("./host_upload-BvzJZKAO.js");
 	const hostUpload = opts.noUpload ? new HostUploadBridge({ mode: "off" }) : opts.mockUpload ? new HostUploadBridge({
 		mode: "mock",
 		mockFile: opts.mockUpload

package/dist/executa-install-Dnerah9u.js

@@ -0,0 +1,7 @@
+import "./credentials-BTv2IfUZ.js";
+import "./nexus-root-BlPwOusj.js";
+import "./executa-cache-BFoUtb4J.js";
+import "./dev-uagVfV9Y.js";
+import { runExecutaInstall } from "./executa-install-u0nXcyy7.js";
+
+export { runExecutaInstall };

package/dist/{executa-install-DAposiBw.js → executa-install-u0nXcyy7.js}

@@ -1,5 +1,5 @@
 import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { parseExecutaSpec } from "./dev-Bfv3WQC0.js";
+import { parseExecutaSpec } from "./dev-uagVfV9Y.js";
 import { isAbsolute, join, resolve } from "node:path";
 import { chmodSync, existsSync, mkdirSync, writeFileSync } from "node:fs";
 import { bold, cyan, dim, green, red, yellow } from "kleur/colors";

package/dist/{executa-publish-BKnsUoZq.js → executa-publish-BuakG1RK.js}

@@ -2,9 +2,9 @@ import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { executaCacheMatches, invalidateExecutaCache, mintIdempotencyKey, readExecutaIdentity, writeExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { loadExecutaManifest } from "./manifest-B_DjigtQ.js";
+import { loadExecutaManifest, protocolHostCapabilities } from "./manifest-BCHiC184.js";
 import { commitDraft, createDraft, getMySkill, getMyTool, listToolVersions, publishToolVersion, setSkillVisibility, setToolVisibility, updateMySkill, updateMyTool } from "./executas-CvQY_w2U.js";
-import { uploadExecutaBinaries } from "./executa-upload-binaries-DwWQ18Dq.js";
+import { uploadExecutaBinaries } from "./executa-upload-binaries-D0JWYOtK.js";
 import { join, relative, resolve, sep } from "node:path";
 import { readFileSync, readdirSync, statSync, writeFileSync } from "node:fs";
 import { bold, cyan, dim, green, yellow } from "kleur/colors";
@@ -169,7 +169,8 @@ async function runExecutaPublish(opts) {
 					executa_type: manifest.executa_type,
 					slug: manifest.slug,
 					version: manifest.version,
-					...distributionPayload(manifest.distribution)
+					...distributionPayload(manifest.distribution),
+					...manifest.protocolManifest ? { manifest_cache: manifest.protocolManifest } : {}
 				};
 				if (manifest.executa_type === "skill") {
 					finalPayload.skill_content = manifest.skillContent;
@@ -202,12 +203,22 @@ async function runExecutaPublish(opts) {
 			version: manifest.version,
 			...manifest.executionMode ? { skill_execution_mode: manifest.executionMode } : {}
 		});
-		else await updateMyTool(client, executaId, {
-			name: manifest.name,
-			description: manifest.description,
-			version: manifest.version,
-			...distributionPayload(manifest.distribution)
-		});
+		else {
+			await updateMyTool(client, executaId, {
+				name: manifest.name,
+				description: manifest.description,
+				version: manifest.version,
+				...distributionPayload(manifest.distribution),
+				...manifest.protocolManifest ? { manifest_cache: manifest.protocolManifest } : {}
+			});
+			if (!opts.json && !opts.quiet) {
+				if (manifest.protocolManifest && manifest.protocolManifestPath) {
+					const caps = protocolHostCapabilities(manifest.protocolManifest);
+					const capsNote = caps.length > 0 ? `${caps.length} host capabilit${caps.length === 1 ? "y" : "ies"}: ${caps.join(", ")}` : "no host_capabilities declared";
+					console.log(dim(`  synced protocol manifest (${capsNote}) from ${manifest.protocolManifestPath.replace(cwd + "/", "")}`));
+				} else if (manifest.distribution) console.log(yellow("! no protocol manifest found (no `manifest.json` next to executa.json, no `manifest_file` field) — host-capability permissions (host.upload / aps.* / llm.* / web.*) declared by the plugin will NOT be grantable in the Executa permissions UI until an agent-side describe backfills them. Export the plugin's describe manifest to manifest.json and re-publish."));
+			}
+		}
 		if (!isSkill && manifest.distribution?.binaryArtifacts && opts.freeze !== false) {
 			const upLog = (msg) => {
 				if (!opts.json && !opts.quiet) console.log(msg);
@@ -254,7 +265,10 @@ async function runExecutaPublish(opts) {
 			first_publish: firstPublish,
 			published_public: publishedToPublic,
 			visibility: finalExecuta.visibility ?? null,
-			latest_version_id: latest?.id ?? null
+			latest_version_id: latest?.id ?? null,
+			executa_type: manifest.executa_type,
+			manifest_synced: Boolean(manifest.protocolManifest),
+			host_capabilities: protocolHostCapabilities(manifest.protocolManifest)
 		};
 		opts.capture?.(result);
 		if (opts.quiet) return 0;
@@ -270,6 +284,19 @@ async function runExecutaPublish(opts) {
 		return 0;
 	});
 }
+/**
+* One-line protocol-manifest sync note for a bundled `executa publish`
+* result, printed by the `apps publish` / `apps push` orchestration
+* (the nested publish itself runs `quiet`). `null` → nothing to print.
+*/
+function manifestSyncNote(r) {
+	if (r.executa_type !== "tool") return null;
+	if (r.manifest_synced) {
+		const caps = r.host_capabilities;
+		return dim("    protocol manifest synced (" + (caps.length > 0 ? `host capabilities: ${caps.join(", ")}` : "no host_capabilities declared") + ")");
+	}
+	return yellow("  ! no protocol manifest for this bundled executa — add manifest.json (the plugin's describe response) next to its executa.json so declared host capabilities (host.upload / aps.* / llm.* / web.*) become grantable in the Executa permissions UI");
+}
 
 //#endregion
-export { bumpVersion, bundleHash, canonicalize, manifestHash, rewriteVersion, runExecutaPublish };
+export { bumpVersion, bundleHash, canonicalize, manifestHash, manifestSyncNote, rewriteVersion, runExecutaPublish };

package/dist/{executa-publish-6awuH4Ma.js → executa-publish-CVlMaHIY.js}

@@ -2,10 +2,10 @@ import "./credentials-BTv2IfUZ.js";
 import "./client-sMzq2PWG.js";
 import "./_lifecycle-shared-_9BzQ9Y2.js";
 import "./executa-cache-BFoUtb4J.js";
-import "./manifest-B_DjigtQ.js";
+import "./manifest-BCHiC184.js";
 import "./executas-CvQY_w2U.js";
-import { runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
+import { manifestSyncNote, runExecutaPublish } from "./executa-publish-BuakG1RK.js";
 import "./binary-upload-DVhQ0uY0.js";
-import "./executa-upload-binaries-DwWQ18Dq.js";
+import "./executa-upload-binaries-D0JWYOtK.js";
 
 export { runExecutaPublish };

package/dist/{executa-upload-binaries-FWM2yXfB.js → executa-upload-binaries-BVWs6MFF.js}

@@ -2,8 +2,8 @@ import "./credentials-BTv2IfUZ.js";
 import "./client-sMzq2PWG.js";
 import "./_lifecycle-shared-_9BzQ9Y2.js";
 import "./executa-cache-BFoUtb4J.js";
-import "./manifest-B_DjigtQ.js";
+import "./manifest-BCHiC184.js";
 import "./binary-upload-DVhQ0uY0.js";
-import { expandArtifactPath, resolveArtifactPlan, runExecutaUploadBinaries, uploadExecutaBinaries, uploadPlannedParts } from "./executa-upload-binaries-DwWQ18Dq.js";
+import { expandArtifactPath, resolveArtifactPlan, runExecutaUploadBinaries, uploadExecutaBinaries, uploadPlannedParts } from "./executa-upload-binaries-D0JWYOtK.js";
 
 export { runExecutaUploadBinaries };

package/dist/{executa-upload-binaries-DwWQ18Dq.js → executa-upload-binaries-D0JWYOtK.js}

@@ -2,7 +2,7 @@ import { canonicalHost } from "./credentials-BTv2IfUZ.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { resolveClient, withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import { readExecutaIdentity } from "./executa-cache-BFoUtb4J.js";
-import { loadExecutaManifest } from "./manifest-B_DjigtQ.js";
+import { loadExecutaManifest } from "./manifest-BCHiC184.js";
 import { fetchGitHubIdToken, finalizeBinaryUpload, initBinaryUpload, mintUploadSession, mintUploadSessionViaOidc, uploadBinaryPart } from "./binary-upload-DVhQ0uY0.js";
 import { isAbsolute, resolve } from "node:path";
 import { closeSync, createReadStream, existsSync, openSync, readSync, statSync } from "node:fs";

package/dist/{listing-meta-DgweMStT.js → listing-meta-rIni8tjd.js}

@@ -1,4 +1,4 @@
-import { patchApp, uploadAppLogo, uploadAppScreenshot } from "./apps-HbfURK6y.js";
+import { patchApp, uploadAppLogo, uploadAppScreenshot } from "./apps-BRBufSyX.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { extname, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";

package/dist/{manifest-B_DjigtQ.js → manifest-BCHiC184.js}

@@ -1,5 +1,5 @@
 import { CliError } from "./client-sMzq2PWG.js";
-import { resolve } from "node:path";
+import { dirname, resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 
 //#region src/publish/manifest.ts
@@ -118,6 +118,7 @@ function loadExecutaManifest(cwd, manifestPath, profileOverride) {
 		skillContent = readFileSync(contentPath, "utf-8");
 		if (!skillContent.trim()) throw new CliError(`skill content file "${contentFile}" is empty`, 4);
 	}
+	const protocol = loadProtocolManifest(path, raw, t);
 	return {
 		kind: "executa",
 		path,
@@ -130,10 +131,55 @@ function loadExecutaManifest(cwd, manifestPath, profileOverride) {
 		changelog: pickString(raw, "changelog") ?? void 0,
 		skillContent,
 		executionMode: pickString(raw, "execution_mode") ?? void 0,
-		distribution: parseExecutaDistribution(raw["distribution"], t, profileOverride)
+		distribution: parseExecutaDistribution(raw["distribution"], t, profileOverride),
+		protocolManifest: protocol?.manifest,
+		protocolManifestPath: protocol?.path
 	};
 }
 /**
+* Load the Executa JSON-RPC protocol manifest for a `tool` Executa.
+*
+* Resolution (relative to the directory holding `executa.json`):
+*   1. explicit `executa.json` `manifest_file` path — must exist;
+*   2. sibling `manifest.json` convention — optional.
+*
+* Returns `undefined` when no protocol manifest is available (the server
+* `manifest_cache` field is then simply not synced — backwards compatible).
+*/
+function loadProtocolManifest(executaJsonPath, raw, executaType) {
+	const declared = raw["manifest_file"];
+	if (declared !== void 0 && typeof declared !== "string") throw new CliError("executa.json `manifest_file` must be a string path", 4);
+	if (executaType === "skill") {
+		if (declared) throw new CliError("executa.json `manifest_file` is only valid for `executa_type: \"tool\"` — skills have no JSON-RPC protocol manifest", 4);
+		return void 0;
+	}
+	const dir = dirname(executaJsonPath);
+	const path = resolve(dir, declared ?? "manifest.json");
+	if (!existsSync(path)) {
+		if (declared) throw new CliError(`executa.json \`manifest_file\` points at "${declared}" but ${path} does not exist`, 4);
+		return void 0;
+	}
+	const manifest = readJson(path);
+	const caps = manifest["host_capabilities"] ?? manifest["hostCapabilities"];
+	if (caps !== void 0 && caps !== null) {
+		const isStrArray = Array.isArray(caps) && caps.every((c) => typeof c === "string");
+		const isBoolMap = !Array.isArray(caps) && typeof caps === "object" && Object.values(caps).every((v) => typeof v === "boolean");
+		if (!isStrArray && !isBoolMap) throw new CliError(`protocol manifest ${path} \`host_capabilities\` must be an array of strings (or a {capability: bool} map)`, 4);
+	}
+	return {
+		manifest,
+		path
+	};
+}
+/** Declared host capability strings of a protocol manifest (normalised). */
+function protocolHostCapabilities(manifest) {
+	if (!manifest) return [];
+	const caps = manifest["host_capabilities"] ?? manifest["hostCapabilities"];
+	if (Array.isArray(caps)) return caps.filter((c) => typeof c === "string");
+	if (caps && typeof caps === "object") return Object.entries(caps).filter(([, v]) => v === true).map(([k]) => k);
+	return [];
+}
+/**
 * Parse + validate the optional `executa.json` `distribution` object.
 *
 * Returns `undefined` when absent (a dev-only Executa). Skills never carry
@@ -335,4 +381,4 @@ function pickStringArray(o, k) {
 }
 
 //#endregion
-export { loadAppManifest, loadExecutaManifest };
+export { loadAppManifest, loadExecutaManifest, protocolHostCapabilities };

package/dist/{publish-D5O5JKRb.js → publish-4C5_TgyZ.js}

@@ -1,18 +1,23 @@
 import "./credentials-BTv2IfUZ.js";
-import "./apps-HbfURK6y.js";
+import "./nexus-root-BlPwOusj.js";
+import "./apps-BRBufSyX.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { withErrorHandling } from "./_lifecycle-shared-_9BzQ9Y2.js";
 import "./executa-cache-BFoUtb4J.js";
 import "./bundled-executas-BRyQkI9u.js";
-import "./manifest-B_DjigtQ.js";
+import "./manifest-BCHiC184.js";
 import "./executas-CvQY_w2U.js";
-import { runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
+import { runExecutaPublish } from "./executa-publish-BuakG1RK.js";
 import "./binary-upload-DVhQ0uY0.js";
-import "./executa-upload-binaries-DwWQ18Dq.js";
+import "./executa-upload-binaries-D0JWYOtK.js";
+import "./dev-uagVfV9Y.js";
+import "./executa-install-u0nXcyy7.js";
 import "./app-cache-Cr3tKbux.js";
-import "./listing-meta-DgweMStT.js";
-import "./app-bundle-upload-Ca0r-kPy.js";
-import { runAppsPublish } from "./apps-publish-8N9x4VEM.js";
+import "./working-orchestration-BPMFemcH.js";
+import "./apps-cut-BLtUBokD.js";
+import "./listing-meta-rIni8tjd.js";
+import "./apps-push-DZ1LHDJW.js";
+import { runAppsPublish } from "./apps-publish-BzaoSyFn.js";
 import { resolve } from "node:path";
 import { existsSync } from "node:fs";
 import { red, yellow } from "kleur/colors";
@@ -21,9 +26,8 @@ import { red, yellow } from "kleur/colors";
 function detectProjectKind(cwd) {
 	const hasManifest = existsSync(resolve(cwd, "manifest.json"));
 	const hasExecuta = existsSync(resolve(cwd, "executa.json"));
-	if (hasManifest && hasExecuta) return "ambiguous";
-	if (hasManifest) return "app";
 	if (hasExecuta) return "executa";
+	if (hasManifest) return "app";
 	return "unknown";
 }
 
@@ -33,7 +37,6 @@ async function runTopLevelPublish(opts) {
 	return withErrorHandling(async () => {
 		const cwd = resolve(opts.cwd ?? process.cwd());
 		const kind = detectProjectKind(cwd);
-		if (kind === "ambiguous") throw new CliError(`cannot auto-detect: ${cwd} has BOTH manifest.json and executa.json. Run \`anna-app apps publish\` or \`anna-app executa publish\` explicitly.`, 4);
 		if (kind === "unknown") throw new CliError(`no manifest.json or executa.json found in ${cwd}`, 4);
 		if (kind === "app") return runAppsPublish({
 			cwd,

package/dist/{server-Dr_htFv8.js → server-CBx61J7s.js}

@@ -1,5 +1,5 @@
 import { canonicalHost, getAccount } from "./credentials-BTv2IfUZ.js";
-import { BridgeRequestError } from "./bridge-sFHqOOat.js";
+import { BridgeRequestError } from "./bridge-Bo8eu3-d.js";
 import { dirname, join, normalize, resolve } from "node:path";
 import { createRequire } from "node:module";
 import { createReadStream, existsSync, readFileSync, statSync, watch } from "node:fs";
@@ -9,6 +9,71 @@ import { createServer } from "node:http";
 import { WebSocketServer } from "ws";
 import { setTimeout as setTimeout$1 } from "node:timers/promises";
 
+//#region src/executa/storage-caps.ts
+/**
+* APS storage declaration predicates — TS mirror of the canonical Python
+* module `matrix-nexus/packages/anna-app-core/src/anna_app_core/storage_decl.py`
+* (design aps-authorization-simplification.md §4.3).
+*
+* ⚠️ The constant tables below are diffed against the Python source by
+* `scripts/check-storage-caps-sync.mjs` in CI — change BOTH sides together.
+*/
+/** Plugin-side storage_token mint trigger set (bare "aps" = historic umbrella). */
+const PLUGIN_STORAGE_CAPS = [
+	"aps.kv",
+	"aps.files",
+	"aps"
+];
+const APS_SCOPE_PREFIX = "aps.scope.";
+const STORAGE_SCOPES = new Set([
+	"user",
+	"app",
+	"tool"
+]);
+const STORAGE_MODES = new Set([
+	"r",
+	"w",
+	"rw"
+]);
+/** Whether a `host_capabilities` set triggers plugin-side storage_token
+*  minting. Wide convergence: `aps.scope.*` counts the same as
+*  `aps.kv`/`aps.files` (forum #284). */
+function declaresPluginStorage(caps) {
+	for (const c of caps) {
+		if (PLUGIN_STORAGE_CAPS.includes(c)) return true;
+		if (c.startsWith(APS_SCOPE_PREFIX)) return true;
+	}
+	return false;
+}
+/** Extract `host_capabilities` from a manifest-like object (list or
+*  `{cap: bool}` dict form). */
+function extractHostCapabilities(manifest) {
+	const raw = manifest?.host_capabilities ?? manifest?.hostCapabilities;
+	if (Array.isArray(raw)) return raw.map(String);
+	if (raw && typeof raw === "object") return Object.entries(raw).filter(([, v]) => !!v).map(([k]) => k);
+	return [];
+}
+/** Whether a full manifest declares plugin storage via EITHER form: legacy
+*  aps.* capability strings or the structured schema-3 `storage` entry. */
+function manifestDeclaresPluginStorage(manifest) {
+	if (!manifest) return false;
+	if (declaresPluginStorage(extractHostCapabilities(manifest))) return true;
+	const storage = manifest.storage;
+	if (storage && typeof storage === "object" && !Array.isArray(storage)) {
+		const s = storage;
+		if (s.kv || s.files) return true;
+		if (s.scopes && typeof s.scopes === "object") {
+			for (const [scope, mode] of Object.entries(s.scopes)) if (STORAGE_SCOPES.has(scope) && STORAGE_MODES.has(String(mode))) return true;
+		}
+	}
+	return false;
+}
+/** Production-parity error body for an unminted storage_token (matrix host
+*  `src/executa/storage.py` wording, verbatim) + a local-only fix hint. */
+const STORAGE_TOKEN_MISSING_ERROR = "-32021: storage_token missing — host did not authorize storage for this invoke";
+const STORAGE_CAPS_HINT = "hint: declare \"aps.kv\" (KV) / \"aps.files\" (Files) in host_capabilities; the platform will not mint a plugin storage_token without them (docs: executa-storage)";
+
+//#endregion
 //#region src/harness/llm-bridge.ts
 /** APS-mode ``storage`` methods the bridge forwards to ``/api/v1/storage/*``.
 *  ``get/set/delete/list`` are the KV family; ``files_*`` are the object/blob
@@ -117,6 +182,30 @@ var LlmBridge = class {
 	mintedStorage = null;
 	mocks = [];
 	streamCounter = 0;
+	warnedStorageCaps = false;
+	/** Production-parity storage caps gate (aps-authorization-simplification
+	*  §4.3): in prod, no `storage_token` is minted unless the manifest
+	*  declares storage — the invoke fails with `-32021` BEFORE scope
+	*  evaluation. Enforced for non-self scopes (`user`/`tool`) and the
+	*  executa reverse-RPC `files_*` family; iframe self app-scope needs no
+	*  capability declaration in prod either. */
+	assertStorageCaps(method, a) {
+		const manifest = this.opts.appManifest;
+		if (!manifest) return;
+		const scope = String(a?.scope ?? "app");
+		const reverseRpcFiles = method.startsWith("files_");
+		if (scope === "app" && !reverseRpcFiles) return;
+		if (manifestDeclaresPluginStorage(manifest)) return;
+		if (this.opts.strictStorageCaps === false) {
+			if (!this.warnedStorageCaps) {
+				this.warnedStorageCaps = true;
+				console.warn(`\n⚠ [storage-caps] ${STORAGE_TOKEN_MISSING_ERROR}\n⚠ [storage-caps] ${STORAGE_CAPS_HINT}\n⚠ [storage-caps] proceeding anyway (--no-strict-caps) — this WILL fail in production
+`);
+			}
+			return;
+		}
+		throw new Error(`${STORAGE_TOKEN_MISSING_ERROR}\n${STORAGE_CAPS_HINT}`);
+	}
 	constructor(opts) {
 		this.opts = opts;
 		if (opts.mode === "mock" && opts.mockFile) {
@@ -740,6 +829,7 @@ var LlmBridge = class {
 			};
 		}
 		if (args.ns === "storage") {
+			this.assertStorageCaps(args.method, args.args);
 			const sm = await this.mintStorage();
 			const a = args.args;
 			const base = `${canonicalHost(acc.host)}/api/v1/storage`;

package/dist/{storage-aii8EyPC.js → storage-CZ4c4ibf.js}

@@ -1,5 +1,5 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { hostOf, requireAccount, withCode } from "./dev-account-CfVdGa9j.js";
+import { hostOf, requireAccount, withCode } from "./dev-account-IrYL4u4F.js";
 import { resolve } from "node:path";
 import { existsSync, readFileSync } from "node:fs";
 

package/dist/{working-orchestration-CpBJLs50.js → working-orchestration-BPMFemcH.js}

@@ -1,10 +1,10 @@
 import { canonicalHost } from "./credentials-BTv2IfUZ.js";
-import { createApp, findAppBySlug, getApp } from "./apps-HbfURK6y.js";
+import { createApp, findAppBySlug, getApp } from "./apps-BRBufSyX.js";
 import { CliError } from "./client-sMzq2PWG.js";
 import { parseExecutaIdOverrides, readExecutasLock, substituteBundledRefs, validateBundledHandles, writeBundleToolIdSidecar, writeExecutasLock } from "./bundled-executas-BRyQkI9u.js";
-import { loadExecutaManifest } from "./manifest-B_DjigtQ.js";
-import { runExecutaPublish } from "./executa-publish-BKnsUoZq.js";
-import { runExecutaInstall } from "./executa-install-DAposiBw.js";
+import { loadExecutaManifest } from "./manifest-BCHiC184.js";
+import { manifestSyncNote, runExecutaPublish } from "./executa-publish-BuakG1RK.js";
+import { runExecutaInstall } from "./executa-install-u0nXcyy7.js";
 import { appCacheMatches, readAppIdentity, writeAppIdentity } from "./app-cache-Cr3tKbux.js";
 import { join, resolve } from "node:path";
 import { dim, green, yellow } from "kleur/colors";
@@ -72,7 +72,11 @@ async function resolveBundledExecutas(params) {
 			path: decl.path,
 			source: params.lockSource ?? (freeze ? "published" : "working")
 		};
-		if (!json) console.log(green(`  ✓ bundled:${decl.handle} → ${captured.tool_id}`) + dim(` (v${captured.version}${captured.idempotent_hit ? ", unchanged" : ""})`));
+		if (!json) {
+			console.log(green(`  ✓ bundled:${decl.handle} → ${captured.tool_id}`) + dim(` (v${captured.version}${captured.idempotent_hit ? ", unchanged" : ""})`));
+			const note = manifestSyncNote(captured);
+			if (note) console.log(note);
+		}
 	}
 	for (const o of overrides) if (!(o.handle in resolved)) {
 		resolved[o.handle] = o.toolId;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@anna-ai/cli",
-  "version": "0.1.49",
+  "version": "0.1.52",
   "description": "Anna App developer CLI: scaffold, validate, harness (Phase 2 MVP: init + validate).",
   "license": "MIT",
   "type": "module",
@@ -30,11 +30,12 @@
     "lint": "tsc --noEmit",
     "check:runtime-pin": "node scripts/check-runtime-pin.mjs",
     "check:sdk-pin": "node scripts/check-sdk-pin.mjs",
-    "prepublishOnly": "pnpm lint && pnpm test && pnpm build && node scripts/check-runtime-pin.mjs && node scripts/check-sdk-pin.mjs"
+    "check:storage-caps": "node scripts/check-storage-caps-sync.mjs",
+    "prepublishOnly": "pnpm lint && pnpm test && pnpm build && node scripts/check-runtime-pin.mjs && node scripts/check-sdk-pin.mjs && node scripts/check-storage-caps-sync.mjs"
   },
   "dependencies": {
-    "@anna-ai/app-runtime": "^0.15.0",
-    "@anna-ai/app-schema": "^0.19.0",
+    "@anna-ai/app-runtime": "^0.16.0",
+    "@anna-ai/app-schema": "^0.22.0",
     "ajv": "^8.17.1",
     "ajv-formats": "^3.0.1",
     "commander": "^12.1.0",

package/templates/minimal/manifest.json

@@ -1,6 +1,5 @@
 {
   "schema": 2,
-  "permissions": ["tools.invoke", "storage.read", "storage.write"],
   "required_executas": [
     {
       "tool_id": "__TOOL_ID__"

package/dist/apps-publish-4IIbF2xr.js

@@ -1,17 +0,0 @@
-import "./credentials-BTv2IfUZ.js";
-import "./apps-HbfURK6y.js";
-import "./client-sMzq2PWG.js";
-import "./_lifecycle-shared-_9BzQ9Y2.js";
-import "./executa-cache-BFoUtb4J.js";
-import "./bundled-executas-BRyQkI9u.js";
-import "./manifest-B_DjigtQ.js";
-import "./executas-CvQY_w2U.js";
-import "./executa-publish-BKnsUoZq.js";
-import "./binary-upload-DVhQ0uY0.js";
-import "./executa-upload-binaries-DwWQ18Dq.js";
-import "./app-cache-Cr3tKbux.js";
-import "./listing-meta-DgweMStT.js";
-import "./app-bundle-upload-Ca0r-kPy.js";
-import { runAppsPublish } from "./apps-publish-8N9x4VEM.js";
-
-export { runAppsPublish };