@anna-ai/cli 0.1.9 → 0.1.12

package/README.md

@@ -48,17 +48,62 @@ Layered fail-fast checks: JSON Schema → `ui` static → cross-file `tool_id`
 linter (with Levenshtein-1 typo detection) → `--strict` host_api ACL grep
 of bundle JS/TS.
 
-### `anna-app dev [--manifest …] [--bundle …] [--port 5180] [--matrix-nexus-root <path>]`
+### `anna-app dev [--manifest …] [--bundle …] [--port 5180] [--matrix-nexus-root <path>] [--executa <spec>…]`
 
 Boots the local harness:
 
 - Spawns the Python `anna-app-bridge` (production dispatcher reused via
   `WindowStoreProtocol`).
 - Serves a mock dashboard at `http://localhost:<port>/`.
-- Auto-discovers `<manifest-dir>/executas/<name>/pyproject.toml` and
-  registers them in the in-process `ExecutaPool`.
+- Auto-discovers `<manifest-dir>/executas/<name>/` plugins (Python /
+  Node.js / Go / pre-built binary) and registers them in the in-process
+  `ExecutaPool`. See "Multi-language executas" below.
 - Hot-reloads the bundle on disk changes (use `--no-watch` to disable).
 
+#### Multi-language executas
+
+Each subdirectory of `<manifest-dir>/executas/` is launched according to
+the first sentinel that matches:
+
+| # | Sentinel                | Type     | Default launch                                                |
+| - | ----------------------- | -------- | ------------------------------------------------------------- |
+| 0 | `executa.json`          | (any)    | `command` field, else type-specific default below             |
+| 1 | `pyproject.toml`        | `python` | `uv run --project <dir> <tool_id>`                            |
+| 2 | `package.json`          | `node`   | `node <bin[tool_id] \| bin \| main \| module>`                |
+| 3 | `go.mod` (alone)        | `go`     | requires `executa.json` declaring `type: "go"`                |
+| 4 | `bin/<dirname>` exec    | `binary` | runs the executable directly                                  |
+
+`executa.json` (recommended for clarity, required for Go and pre-built
+binary tools):
+
+```jsonc
+{
+  "tool_id": "tool-yourhandle-foo-abcd1234",
+  "type":    "python" | "node" | "go" | "binary",
+  "command": ["…"],          // optional; full override of type defaults
+  "enabled": true             // optional; default true. Set false to skip
+                              // (useful when shipping multiple language
+                              // flavours of the same tool_id).
+}
+```
+
+The `--executa <spec>` flag (repeatable) registers an out-of-tree
+executa, or fully overrides auto-discovery for the run. Spec syntax:
+
+```bash
+# Auto-detect from the dir (same rules as in-tree discovery):
+anna-app dev --executa dir=./vendor/external-tool
+
+# Force type when there's no executa.json:
+anna-app dev --executa dir=./executas/foo,type=go
+
+# Fully explicit:
+anna-app dev --executa dir=./executas/foo,tool_id=tool-h-foo-12345678,command="node plugin.js"
+```
+
+For the full discovery / `executa.json` reference, see
+[`anna-executa-examples/docs/multi-language-anna-apps.md`](https://github.com/openclaw/anna-executa-examples/blob/main/docs/multi-language-anna-apps.md).
+
 Two runtime modes (auto-selected):
 
 | Mode | When | Command |
@@ -130,6 +175,22 @@ public npm package [`@anna-ai/app-runtime`](https://www.npmjs.com/package/@anna-
 which is declared as a normal dependency. No vendored copy, no sync
 step.
 
+## Persistent storage (APS)
+
+Anna 1.2+ exposes a per-user JSON-RPC storage surface under the
+`storage/*` namespace. Plugins authored with this CLI can opt in by:
+
+1. Declaring `storage.user` (or `.app`/`.tool`) in the manifest's
+   `host_capabilities` array.
+2. Negotiating `client_capabilities.storage = {}` during `initialize`.
+3. Asking the user to grant storage in the Anna admin panel.
+
+See the protocol & best-practice guide at
+[anna-executa-examples/docs/persistent-storage.md](https://github.com/openclaw/anna-executa-examples/blob/main/docs/persistent-storage.md)
+for wire format, error codes, and a worked OCR-cache example. The
+local `dev` harness mocks APS by default so end-to-end tests do not
+need network access.
+
 ## Roadmap
 
 | Phase | Status | Scope |

package/dist/apps-CDe6Fjq2.js

@@ -0,0 +1,44 @@
+import { getAccount } from "./credentials-BTv2IfUZ.js";
+import { listDevApps } from "./dev-app-cache-BMfOlTHd.js";
+import { bold, cyan, dim, green, red, yellow } from "kleur/colors";
+
+//#region src/commands/apps.ts
+async function runAppsList(opts) {
+	const acc = getAccount(opts.account);
+	if (!acc) {
+		console.error(red("✗ no PAT on disk — run `anna-app login --host <nexus-url>` first."));
+		return 2;
+	}
+	let apps;
+	try {
+		apps = await listDevApps({
+			host: acc.host,
+			pat: acc.pat
+		});
+	} catch (e) {
+		console.error(red(`✗ ${e.message}`));
+		return 2;
+	}
+	if (opts.json) {
+		console.log(JSON.stringify({
+			host: acc.host,
+			apps
+		}, null, 2));
+		return 0;
+	}
+	console.log(bold(cyan("dev apps installed for")) + " " + cyan(acc.host));
+	if (apps.length === 0) {
+		console.log(dim("  (none — run `anna-app dev` in a project to register one)"));
+		return 0;
+	}
+	for (const a of apps) {
+		const tag = a.is_dev ? yellow("[dev]") : green("[prod]");
+		const enabled = a.is_enabled ? green("✓") : red("✗");
+		console.log(`  ${tag} ${enabled} ${bold(a.slug)} ${dim(`(app_id=${a.app_id}, v=${a.installed_version})`)}`);
+		if (a.name && a.name !== a.slug) console.log(`        ${dim(a.name)}`);
+	}
+	return 0;
+}
+
+//#endregion
+export { runAppsList };

package/dist/bridge-BEHyfpPI.js

@@ -0,0 +1,3 @@
+import { PINNED_RUNTIME_VERSION, PythonBridge } from "./bridge-BQUo6ehX.js";
+
+export { PINNED_RUNTIME_VERSION, PythonBridge };

package/dist/{bridge-CBcQUQGU.js → bridge-BQUo6ehX.js}

@@ -9,7 +9,7 @@ import { createInterface } from "node:readline";
 * `uvx <pkg>@<version>` so end users always run the dispatcher version
 * the CLI was tested against.
 */
-const PINNED_RUNTIME_VERSION = "0.2.0a1";
+const PINNED_RUNTIME_VERSION = "0.2.0a2";
 var PythonBridge = class {
 	proc = null;
 	nextId = 1;

package/dist/cli.js

@@ -444,10 +444,23 @@ program.command("validate").description("Run schema + ACL checks on a manifest+b
 	const code = printResult(result);
 	process.exit(code);
 });
-program.command("dev").description("Run a local harness (in-process dispatcher + iframe + SSE relay)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bundle <dir>", "bundle directory (default: ./bundle)").option("--slug <slug>", "App slug (overrides manifest.slug/name)").option("--view <name>", "View name to open (default: manifest default)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (auto-detected if omitted; can also use $ANNA_NEXUS_ROOT)").option("--port <number>", "HTTP port", "5180").option("--user-id <id>", "Harness user_id", "1").option("--cwd <dir>", "Project root (default: cwd)").option("--no-watch", "Disable bundle file watcher (default: enabled)").action(async (opts) => {
-	const { runDev } = await import("./dev-D-Tru6gP.js");
+program.command("dev").description("Run a local harness (in-process dispatcher + iframe + SSE relay)").option("--manifest <path>", "manifest.json path", "manifest.json").option("--bundle <dir>", "bundle directory (default: ./bundle)").option("--slug <slug>", "App slug (overrides manifest.slug/name)").option("--view <name>", "View name to open (default: manifest default)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (auto-detected if omitted; can also use $ANNA_NEXUS_ROOT)").option("--port <number>", "HTTP port", "5180").option("--user-id <id>", "Harness user_id", "1").option("--cwd <dir>", "Project root (default: cwd)").option("--no-watch", "Disable bundle file watcher (default: enabled)").option("--executa <spec>", "Explicit executa registration; repeatable. Spec: comma-separated key=value (dir=<path>[,tool_id=<id>][,type=python|node|go|binary][,command=\"<argv>\"]). When only `dir=` is given, the executa is auto-detected from executa.json / pyproject.toml / package.json / go.mod. Overrides directory auto-discovery under <manifest-dir>/executas/.", (val, prev) => prev ? [...prev, val] : [val]).option("--no-llm", "Disable LLM bridge (anna.llm/agent return llm_disabled)").option("--mock-llm <fixture>", "Serve canned LLM responses from a JSONL fixture").option("--llm-account <host>", "Saved account host to use (default: current)").option("--llm-app-slug <slug>", "Override the manifest slug used to register / look up the dev AnnaApp (default: manifest.slug)").action(async (opts) => {
+	const { runDev, parseExecutaSpec } = await import("./dev-DoY58pBM.js");
+	const cwd = opts.cwd ?? process.cwd();
+	let executas;
+	if (opts.executa && opts.executa.length > 0) {
+		executas = [];
+		for (const spec of opts.executa) {
+			const r = parseExecutaSpec(spec, cwd);
+			if (r instanceof Error) {
+				console.error(`✗ --executa: ${r.message}`);
+				process.exit(2);
+			}
+			executas.push(r);
+		}
+	}
 	const code = await runDev({
-		cwd: opts.cwd ?? process.cwd(),
+		cwd,
 		manifestPath: opts.manifest,
 		bundleDir: opts.bundle,
 		slug: opts.slug,
@@ -455,13 +468,18 @@ program.command("dev").description("Run a local harness (in-process dispatcher +
 		matrixNexusRoot: opts.matrixNexusRoot,
 		port: Number.parseInt(opts.port, 10),
 		userId: Number.parseInt(opts.userId, 10),
-		noWatch: opts.watch === false
+		noWatch: opts.watch === false,
+		executas,
+		noLlm: opts.llm === false,
+		mockLlm: opts.mockLlm,
+		llmAccount: opts.llmAccount,
+		llmAppSlug: opts.llmAppSlug
 	});
 	process.exit(code);
 });
 const fixture = program.command("fixture").description("Inspect / replay harness recordings (Phase 6)");
 fixture.command("verify <file>").description("Schema + invariant checks on a harness JSONL recording").option("--json", "Emit machine-readable JSON", false).action(async (file, opts) => {
-	const { runFixtureVerify } = await import("./fixture-BGjMtqWA.js");
+	const { runFixtureVerify } = await import("./fixture-BEu4LXLG.js");
 	const code = await runFixtureVerify({
 		file,
 		json: opts.json
@@ -469,7 +487,7 @@ fixture.command("verify <file>").description("Schema + invariant checks on a har
 	process.exit(code);
 });
 fixture.command("summarize <file>").description("Print a human-readable digest of a harness recording").option("--json", "Emit machine-readable JSON", false).action(async (file, opts) => {
-	const { runFixtureSummarize } = await import("./fixture-BGjMtqWA.js");
+	const { runFixtureSummarize } = await import("./fixture-BEu4LXLG.js");
 	const code = await runFixtureSummarize({
 		file,
 		json: opts.json
@@ -477,7 +495,7 @@ fixture.command("summarize <file>").description("Print a human-readable digest o
 	process.exit(code);
 });
 fixture.command("replay <file>").description("Dry-run replay of a harness recording (Phase 6 MVP)").option("--manifest <path>", "manifest.json path", "manifest.json").action(async (file, opts) => {
-	const { runFixtureReplay } = await import("./fixture-BGjMtqWA.js");
+	const { runFixtureReplay } = await import("./fixture-BEu4LXLG.js");
 	const code = await runFixtureReplay({
 		file,
 		manifest: opts.manifest
@@ -485,10 +503,39 @@ fixture.command("replay <file>").description("Dry-run replay of a harness record
 	process.exit(code);
 });
 program.command("doctor").description("Check environment for `anna-app dev` (uv, matrix-nexus, dev key)").option("--matrix-nexus-root <path>", "matrix-nexus checkout (optional)").action(async (opts) => {
-	const { runDoctor } = await import("./doctor-BmR0POfL.js");
+	const { runDoctor } = await import("./doctor-DP2UB10l.js");
 	const code = await runDoctor({ matrixNexusRoot: opts.matrixNexusRoot });
 	process.exit(code);
 });
+program.command("login").description("Device-flow login against a nexus host; saves a PAT to ~/.config/anna/credentials.json").requiredOption("--host <url>", "nexus base URL, e.g. https://nexus.example.com").option("--no-browser", "Do not open a browser window automatically", false).action(async (opts) => {
+	const { runLogin } = await import("./login-dl1Zfny8.js");
+	const code = await runLogin({
+		host: opts.host,
+		noBrowser: opts.browser === false
+	});
+	process.exit(code);
+});
+program.command("logout").description("Remove a saved PAT entry").option("--host <url>", "Account to remove (default: current)").option("--all", "Remove every saved account", false).action(async (opts) => {
+	const { runLogout } = await import("./logout-DablvlFs.js");
+	const code = await runLogout({
+		host: opts.host,
+		all: opts.all
+	});
+	process.exit(code);
+});
+program.command("whoami").description("Show the current account (and any others)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+	const { runWhoami } = await import("./whoami-giXOY415.js");
+	const code = await runWhoami({ json: opts.json });
+	process.exit(code);
+});
+program.command("apps:list").description("List dev apps installed for the current PAT").option("--account <host>", "Saved account host (default: current)").option("--json", "Emit machine-readable JSON", false).action(async (opts) => {
+	const { runAppsList } = await import("./apps-CDe6Fjq2.js");
+	const code = await runAppsList({
+		account: opts.account,
+		json: opts.json
+	});
+	process.exit(code);
+});
 program.parseAsync(process.argv).catch((e) => {
 	console.error(e);
 	process.exit(2);

package/dist/credentials-BTv2IfUZ.js

@@ -0,0 +1,122 @@
+import { createRequire } from "module";
+import { dirname, join } from "node:path";
+import { chmodSync, existsSync, mkdirSync, readFileSync, statSync, unlinkSync, writeFileSync } from "node:fs";
+import { homedir } from "node:os";
+
+//#region rolldown:runtime
+var __require = /* @__PURE__ */ createRequire(import.meta.url);
+
+//#endregion
+//#region src/credentials.ts
+/** Resolve credentials file path. Honours $XDG_CONFIG_HOME. */
+function credentialsPath() {
+	const xdg = process.env.XDG_CONFIG_HOME;
+	const base = xdg && xdg.length > 0 ? xdg : join(homedir(), ".config");
+	return join(base, "anna", "credentials.json");
+}
+/** Normalise a host URL to its canonical key (https://x.example.com). */
+function canonicalHost(input) {
+	let url;
+	try {
+		url = new URL(input);
+	} catch {
+		url = new URL(`https://${input}`);
+	}
+	const port = url.port ? `:${url.port}` : "";
+	return `${url.protocol}//${url.hostname}${port}`;
+}
+/** Read credentials file (returns empty container if missing or unreadable). */
+function readCredentials() {
+	const path = credentialsPath();
+	if (!existsSync(path)) return {
+		version: 1,
+		current: null,
+		accounts: {}
+	};
+	try {
+		const raw = readFileSync(path, "utf8");
+		const parsed = JSON.parse(raw);
+		return {
+			version: 1,
+			current: parsed.current ?? null,
+			accounts: parsed.accounts ?? {}
+		};
+	} catch {
+		return {
+			version: 1,
+			current: null,
+			accounts: {}
+		};
+	}
+}
+/** Atomically write credentials file (chmod 600). */
+function writeCredentials(data) {
+	const path = credentialsPath();
+	mkdirSync(dirname(path), {
+		recursive: true,
+		mode: 448
+	});
+	const tmp = `${path}.tmp.${process.pid}`;
+	writeFileSync(tmp, JSON.stringify(data, null, 2), { mode: 384 });
+	try {
+		__require("node:fs").renameSync(tmp, path);
+	} catch (e) {
+		try {
+			unlinkSync(tmp);
+		} catch {}
+		throw e;
+	}
+	try {
+		chmodSync(path, 384);
+	} catch {}
+}
+/** Set or replace the entry for `host`; mark as `current`. */
+function saveAccount(rec) {
+	const data = readCredentials();
+	const key = canonicalHost(rec.host);
+	data.accounts[key] = {
+		...rec,
+		host: key
+	};
+	data.current = key;
+	writeCredentials(data);
+}
+/** Remove one account; if it was current, switch to any remaining one. */
+function removeAccount(host) {
+	const data = readCredentials();
+	const key = canonicalHost(host);
+	if (!(key in data.accounts)) return false;
+	delete data.accounts[key];
+	if (data.current === key) {
+		const next = Object.keys(data.accounts);
+		data.current = next.length > 0 ? next[0] ?? null : null;
+	}
+	writeCredentials(data);
+	return true;
+}
+/** Look up an account by host (or current account if `host` omitted). */
+function getAccount(host) {
+	const data = readCredentials();
+	const key = host ? canonicalHost(host) : data.current;
+	if (!key) return null;
+	return data.accounts[key] ?? null;
+}
+/** Mask a PAT for safe display: ``eyJh…aZQp (90d, scopes=aps:dev)``. */
+function maskPat(pat) {
+	if (pat.length <= 12) return "***";
+	return `${pat.slice(0, 4)}…${pat.slice(-4)}`;
+}
+/** Permission check — warn callers if file mode is loose. */
+function credentialsAreLooselyPermissioned() {
+	const path = credentialsPath();
+	if (!existsSync(path)) return false;
+	try {
+		const st = statSync(path);
+		return (st.mode & 63) !== 0;
+	} catch {
+		return false;
+	}
+}
+
+//#endregion
+export { canonicalHost, credentialsAreLooselyPermissioned, credentialsPath, getAccount, maskPat, readCredentials, removeAccount, saveAccount, writeCredentials };

package/dist/credentials-CIOYq2Lm.js

@@ -0,0 +1,3 @@
+import { canonicalHost, credentialsAreLooselyPermissioned, credentialsPath, getAccount, maskPat, readCredentials, removeAccount, saveAccount, writeCredentials } from "./credentials-BTv2IfUZ.js";
+
+export { getAccount };

package/dist/dashboard.html

@@ -337,20 +337,24 @@
       }
 
       function relayEventToIframe(ev) {
-        // ev = { kind:"event", user_id, kind:..., payload, ts } from server.ts
+        // ev arrives from the WS server as { kind:"event", event:"<name>", payload }
+        // (see server.ts: `ws.send({ kind: "event", ...ev })`). The SDK keys its
+        // handlers off `event` (e.g. "rpc.stream", "auth.refresh"), so we MUST
+        // forward `ev.event` — not `ev.kind`, which is always the literal
+        // string "event" and would drop every frame on the floor.
         if (!iframe.contentWindow) return;
         const env = {
           wid: windowUuid,
           kind: "event",
-          event: ev.kind,
+          event: ev.event,
           payload: ev.payload,
         };
         iframe.contentWindow.postMessage(env, "*");
         logLine(
           "event",
-          `← event <span class="pill">${escapeHtml(ev.kind)}</span> ${escapeHtml(JSON.stringify(ev.payload))}`,
+          `← event <span class="pill">${escapeHtml(ev.event)}</span> ${escapeHtml(JSON.stringify(ev.payload))}`,
         );
-        recPush("event", { event: ev.kind, payload: ev.payload });
+        recPush("event", { event: ev.event, payload: ev.payload });
       }
 
       // postMessage RPC bridge: iframe → POST /api/session/call → result