nextclaw 0.34.0 → 0.36.0

package/dist/cli/app/index.js

@@ -4,16 +4,16 @@ import { createRequire } from "node:module";
 import { APP_NAME, APP_TAGLINE, getConfigPath, getDataDir, getRunPath, loadConfig, resolveConfigSecrets } from "@nextclaw/core";
 import { Command, InvalidArgumentError } from "commander";
 import { constants, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
-import { randomBytes } from "node:crypto";
+import { createHash, randomBytes } from "node:crypto";
 import { execFile } from "node:child_process";
 import path, { join, resolve } from "node:path";
 import { tmpdir } from "node:os";
 import "@nextclaw/server";
 import { NextclawDistributionService, NextclawServiceRuntime, readLearningLoopRuntimeConfig } from "@nextclaw/service";
 import { access, mkdtemp, readFile, rm, stat } from "node:fs/promises";
+import { AppHomeService, AppInstanceInventoryService, AppInstanceStorageService, AppPublishService, AppPublishValidationService } from "@nextclaw/app-runtime";
 import { McpServiceAppRuntimeService, buildServiceActionId, getServiceAppManifestPath, mergeServiceAppRuntimeActions, readServiceAppManifest } from "@nextclaw/kernel";
 import { promisify } from "node:util";
-import { AppPublishService, AppPublishValidationService } from "@nextclaw/app-runtime";
 var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
@@ -2020,7 +2020,7 @@ var require_websocket = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 	const http$1 = __require("http");
 	const net = __require("net");
 	const tls = __require("tls");
-	const { randomBytes: randomBytes$1, createHash: createHash$1 } = __require("crypto");
+	const { randomBytes: randomBytes$1, createHash: createHash$2 } = __require("crypto");
 	const { Duplex: Duplex$2, Readable } = __require("stream");
 	const { URL: URL$1 } = __require("url");
 	const PerMessageDeflate = require_permessage_deflate();
@@ -2672,7 +2672,7 @@ var require_websocket = /* @__PURE__ */ __commonJSMin(((exports, module) => {
 				abortHandshake(websocket, socket, "Invalid Upgrade header");
 				return;
 			}
-			const digest = createHash$1("sha1").update(key + GUID).digest("base64");
+			const digest = createHash$2("sha1").update(key + GUID).digest("base64");
 			if (res.headers["sec-websocket-accept"] !== digest) {
 				abortHandshake(websocket, socket, "Invalid Sec-WebSocket-Accept header");
 				return;
@@ -3144,7 +3144,7 @@ var require_websocket_server = /* @__PURE__ */ __commonJSMin(((exports, module)
 	const EventEmitter = __require("events");
 	const http = __require("http");
 	const { Duplex } = __require("stream");
-	const { createHash } = __require("crypto");
+	const { createHash: createHash$1 } = __require("crypto");
 	const extension = require_extension();
 	const PerMessageDeflate = require_permessage_deflate();
 	const subprotocol = require_subprotocol();
@@ -3403,7 +3403,7 @@ var require_websocket_server = /* @__PURE__ */ __commonJSMin(((exports, module)
 				"HTTP/1.1 101 Switching Protocols",
 				"Upgrade: websocket",
 				"Connection: Upgrade",
-				`Sec-WebSocket-Accept: ${createHash("sha1").update(key + GUID).digest("base64")}`
+				`Sec-WebSocket-Accept: ${createHash$1("sha1").update(key + GUID).digest("base64")}`
 			];
 			const ws = new this.options.WebSocket(null, void 0, this.options);
 			if (protocols.size) {
@@ -3633,24 +3633,31 @@ const registerHostServiceControls = ({ program, nextclaw }) => {
 //#endregion
 //#region src/cli/app/services/service-app-dev.service.ts
 var ServiceAppDevService = class {
+	instanceInventoryService = new AppInstanceInventoryService();
+	instanceStorageService = new AppInstanceStorageService();
 	constructor(params = {}) {
 		this.params = params;
 	}
-	inspect = async (target) => {
+	inspect = async (target, options = {}) => {
 		const appPath = path.resolve(target);
 		const issues = [];
 		const loaded = await this.loadServiceApp(appPath, issues);
 		if (!loaded) return this.buildDevReport(appPath, void 0, [], issues);
+		if (options.resetData && options.confirmAppId?.trim() !== loaded.manifest.id) issues.push({
+			severity: "error",
+			code: "service.data.confirmationMismatch",
+			message: `--reset-data requires --confirm ${loaded.manifest.id}.`
+		});
 		if (this.hasErrors(issues)) return this.buildDevReport(appPath, this.toServiceAppRecord(appPath, loaded.manifest, this.idleRuntimeStatus), [], issues);
 		const runtime = this.createRuntimeService();
-		const dataDirectory = await this.createDevDataDirectory();
+		const storage = await this.createDevStorage(appPath, loaded.manifest.id, options.resetData === true);
 		try {
-			const startRecord = this.toServiceAppRecord(appPath, loaded.manifest, runtime, dataDirectory);
+			const startRecord = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage);
 			const runtimeActions = await runtime.listActions({
 				app: startRecord,
 				manifest: loaded.manifest
 			});
-			const record = this.toServiceAppRecord(appPath, loaded.manifest, runtime, dataDirectory);
+			const record = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage);
 			const actions = mergeServiceAppRuntimeActions({
 				record,
 				manifest: loaded.manifest,
@@ -3659,14 +3666,7 @@ var ServiceAppDevService = class {
 			this.collectRuntimeIssues(record, actions, issues);
 			return this.buildDevReport(appPath, record, actions, issues);
 		} finally {
-			try {
-				await runtime.dispose();
-			} finally {
-				await rm(dataDirectory, {
-					recursive: true,
-					force: true
-				});
-			}
+			await runtime.dispose();
 		}
 	};
 	call = async (target, actionName, input) => {
@@ -3686,19 +3686,19 @@ var ServiceAppDevService = class {
 			return this.buildCallReport(appPath, record, void 0, void 0, issues);
 		}
 		const runtime = this.createRuntimeService();
-		const dataDirectory = await this.createDevDataDirectory();
+		const storage = await this.createDevStorage(appPath, loaded.manifest.id);
 		try {
-			const record = this.toServiceAppRecord(appPath, loaded.manifest, runtime, dataDirectory);
+			const record = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage);
 			const result = await runtime.invokeAction({
 				app: record,
 				manifest: loaded.manifest,
 				actionName: action,
 				input
 			});
-			const nextRecord = this.toServiceAppRecord(appPath, loaded.manifest, runtime, dataDirectory);
+			const nextRecord = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage);
 			return this.buildCallReport(appPath, nextRecord, buildServiceActionId(loaded.manifest.id, action), result, issues);
 		} catch (error) {
-			const record = this.toServiceAppRecord(appPath, loaded.manifest, runtime, dataDirectory);
+			const record = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage);
 			issues.push({
 				severity: "error",
 				code: "service.runtime.callFailed",
@@ -3706,14 +3706,7 @@ var ServiceAppDevService = class {
 			});
 			return this.buildCallReport(appPath, record, buildServiceActionId(loaded.manifest.id, action), void 0, issues);
 		} finally {
-			try {
-				await runtime.dispose();
-			} finally {
-				await rm(dataDirectory, {
-					recursive: true,
-					force: true
-				});
-			}
+			await runtime.dispose();
 		}
 	};
 	loadServiceApp = async (appPath, issues) => {
@@ -3745,8 +3738,37 @@ var ServiceAppDevService = class {
 		return resolveConfigSecrets(loadConfig(configPath), { configPath });
 	};
 	idleRuntimeStatus = { getStatus: () => ({ status: "idle" }) };
-	createDevDataDirectory = async () => await mkdtemp(path.join(tmpdir(), "nextclaw-service-app-dev-data-"));
-	toServiceAppRecord = (dirPath, manifest, runtime, dataDirectory) => {
+	createDevStorage = async (appPath, appId, resetData = false) => {
+		const sourceId = this.getSourceId(appPath);
+		const appHomeDirectory = new AppHomeService().getAppHomeDirectory();
+		const instanceDirectory = path.join(appHomeDirectory, "dev-instances", appId, sourceId, "default");
+		if (resetData && await this.pathExists(instanceDirectory)) await this.instanceInventoryService.purgeNested({
+			instancesRoot: appHomeDirectory,
+			pathSegments: [
+				"dev-instances",
+				appId,
+				sourceId,
+				"default"
+			],
+			appId,
+			instanceId: "default"
+		});
+		return (await this.instanceStorageService.materialize({
+			appId,
+			instanceId: "default",
+			instanceDirectory
+		})).storage;
+	};
+	getSourceId = (appPath) => createHash("sha256").update(appPath).digest("hex").slice(0, 16);
+	pathExists = async (targetPath) => {
+		try {
+			await access(targetPath);
+			return true;
+		} catch {
+			return false;
+		}
+	};
+	toServiceAppRecord = (dirPath, manifest, runtime, storage) => {
 		const runtimeStatus = runtime.getStatus(manifest.id);
 		const record = {
 			id: manifest.id,
@@ -3759,7 +3781,10 @@ var ServiceAppDevService = class {
 			enabled: manifest.enabled,
 			protocol: manifest.protocol,
 			status: manifest.enabled ? runtimeStatus.status : "stopped",
-			dataDirectory
+			dataDirectory: storage?.dataDirectory,
+			instanceId: storage?.instanceId,
+			storage,
+			isolation: "full-user"
 		};
 		if (manifest.description) record.description = manifest.description;
 		if (runtimeStatus.lastError) record.lastError = runtimeStatus.lastError;
@@ -4419,7 +4444,10 @@ var AppDevCommandController = class {
 		this.serviceAppDevService = serviceAppDevService;
 	}
 	dev = async (target, options) => {
-		const report = await this.serviceAppDevService.inspect(target);
+		const report = await this.serviceAppDevService.inspect(target, {
+			resetData: options.resetData,
+			confirmAppId: options.confirm
+		});
 		process.stdout.write(options.json ? `${JSON.stringify(report, null, 2)}\n` : this.format(report));
 		if (!report.ok) process.exitCode = 1;
 	};
@@ -4442,6 +4470,125 @@ var AppDevCommandController = class {
 	};
 };
 //#endregion
+//#region src/cli/app/services/local-api/local-ui-api-client.service.ts
+function createLocalUiApiClient() {
+	const apiBase = resolveLocalUiApiBase();
+	return apiBase ? new LocalUiApiClient(apiBase) : null;
+}
+var LocalUiApiClient = class {
+	cookie;
+	constructor(apiBase) {
+		this.apiBase = apiBase;
+	}
+	request = async (params) => {
+		const { body, method, path } = params;
+		const cookie = await this.getCookie();
+		const headers = {};
+		if (body) headers["Content-Type"] = "application/json";
+		if (cookie) headers.Cookie = cookie;
+		const response = await fetch(`${this.apiBase}${path}`, {
+			method: method ?? "GET",
+			headers,
+			...body ? { body: JSON.stringify(body) } : {}
+		});
+		if (!response.ok) throw new Error(`api request failed with status ${response.status}`);
+		const payload = await response.json();
+		if (!payload.ok) throw new Error(payload.error?.message ?? "api request failed");
+		return payload.data;
+	};
+	getCookie = async () => {
+		if (this.cookie !== void 0) return this.cookie;
+		const response = await fetch(`${this.apiBase}/api/auth/bridge`, {
+			method: "POST",
+			headers: { "x-nextclaw-ui-bridge-secret": ensureUiBridgeSecret() }
+		});
+		if (!response.ok) throw new Error(`bridge auth failed with status ${response.status}`);
+		const payload = await response.json();
+		if (!payload.ok) throw new Error(payload.error?.message ?? "bridge auth failed");
+		this.cookie = typeof payload.data.cookie === "string" && payload.data.cookie.trim() ? payload.data.cookie.trim() : null;
+		return this.cookie;
+	};
+};
+function resolveLocalUiApiBase() {
+	const state = readRunningRuntimeState(resolve(getRunPath(), "ui-runtime.json")) ?? readRunningRuntimeState(resolve(getRunPath(), "service.json"));
+	if (!state) return null;
+	if (typeof state.uiUrl === "string" && state.uiUrl.trim()) return state.uiUrl.replace(/\/+$/, "");
+	if (typeof state.apiUrl === "string" && state.apiUrl.trim()) return state.apiUrl.replace(/\/api\/?$/, "").replace(/\/+$/, "");
+	return null;
+}
+function readRunningRuntimeState(statePath) {
+	if (!existsSync(statePath)) return null;
+	try {
+		const state = JSON.parse(readFileSync(statePath, "utf-8"));
+		return typeof state.pid === "number" && isProcessRunning(state.pid) ? state : null;
+	} catch {
+		return null;
+	}
+}
+function isProcessRunning(pid) {
+	try {
+		process.kill(pid, 0);
+		return true;
+	} catch {
+		return false;
+	}
+}
+function ensureUiBridgeSecret() {
+	const dirPath = join(getDataDir(), "remote");
+	const secretPath = join(dirPath, "ui-bridge-secret");
+	if (existsSync(secretPath)) {
+		const existing = readFileSync(secretPath, "utf-8").trim();
+		if (existing) return existing;
+	}
+	mkdirSync(dirPath, { recursive: true });
+	const secret = randomBytes(24).toString("hex");
+	writeFileSync(secretPath, `${secret}\n`, "utf-8");
+	return secret;
+}
+//#endregion
+//#region src/cli/app/services/local-api/app-data-live.service.ts
+var AppDataLiveService = class {
+	constructor(params = {}) {
+		this.params = params;
+	}
+	list = async () => await this.requireApiClient().request({ path: "/api/app-data" });
+	deleteRetained = async (dataId, confirmAppId) => {
+		const normalizedDataId = dataId.trim();
+		const normalizedAppId = confirmAppId.trim();
+		if (!normalizedDataId) throw new Error("App data id is required.");
+		if (!normalizedAppId) throw new Error("--confirm <app-id> is required.");
+		return await this.requireApiClient().request({
+			path: `/api/app-data/${encodeURIComponent(normalizedDataId)}`,
+			method: "DELETE",
+			body: { confirmAppId: normalizedAppId }
+		});
+	};
+	requireApiClient = () => {
+		const client = this.params.createApiClient ? this.params.createApiClient() : createLocalUiApiClient();
+		if (!client) throw new Error("NextClaw UI runtime is not running; start NextClaw before managing App data.");
+		return client;
+	};
+};
+//#endregion
+//#region src/cli/app/controllers/app-data-command.controller.ts
+var AppDataCommandController = class {
+	constructor(service = new AppDataLiveService()) {
+		this.service = service;
+	}
+	list = async (options) => {
+		const result = await this.service.list();
+		process.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : this.formatList(result));
+	};
+	deleteRetained = async (dataId, options) => {
+		const result = await this.service.deleteRetained(dataId, options.confirm);
+		process.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : `Deleted App data: ${result.appId}/${result.instanceId}\n`);
+	};
+	formatList = (result) => {
+		if (result.entries.length === 0) return "App data: none\n";
+		return `${result.entries.map((entry) => `${entry.id}\t${entry.lifecycle}\t${entry.source}\t${entry.appId}\t${entry.usage.totalBytes} B\t${entry.storage.instanceDirectory}`).join("\n")}\n`;
+	};
+};
+//#endregion
 //#region src/cli/app/services/service-app-live-runtime.service.ts
 function readErrorMessage(error) {
 	if (error instanceof Error && error.message.trim().length > 0) return error.message.trim();
@@ -4504,81 +4651,9 @@ var ServiceAppLiveRuntimeService = class {
 	};
 	createApiClient = () => {
 		if (this.params.createApiClient) return this.params.createApiClient();
-		const apiBase = resolveLocalUiApiBase();
-		return apiBase ? new LocalUiApiClient(apiBase) : null;
+		return createLocalUiApiClient();
 	};
 };
-var LocalUiApiClient = class {
-	cookie;
-	constructor(apiBase) {
-		this.apiBase = apiBase;
-	}
-	request = async (params) => {
-		const { body, method, path } = params;
-		const cookie = await this.getCookie();
-		const headers = {};
-		if (body) headers["Content-Type"] = "application/json";
-		if (cookie) headers.Cookie = cookie;
-		const requestInit = {
-			method: method ?? "GET",
-			headers
-		};
-		if (body) requestInit.body = JSON.stringify(body);
-		const response = await fetch(`${this.apiBase}${path}`, requestInit);
-		if (!response.ok) throw new Error(`api request failed with status ${response.status}`);
-		const payload = await response.json();
-		if (!payload.ok) throw new Error(payload.error?.message ?? "api request failed");
-		return payload.data;
-	};
-	getCookie = async () => {
-		if (this.cookie !== void 0) return this.cookie;
-		const response = await fetch(`${this.apiBase}/api/auth/bridge`, {
-			method: "POST",
-			headers: { "x-nextclaw-ui-bridge-secret": ensureUiBridgeSecret() }
-		});
-		if (!response.ok) throw new Error(`bridge auth failed with status ${response.status}`);
-		const payload = await response.json();
-		if (!payload.ok) throw new Error(payload.error?.message ?? "bridge auth failed");
-		this.cookie = typeof payload.data.cookie === "string" && payload.data.cookie.trim().length > 0 ? payload.data.cookie.trim() : null;
-		return this.cookie;
-	};
-};
-function resolveLocalUiApiBase() {
-	const state = readRunningRuntimeState(resolve(getRunPath(), "ui-runtime.json")) ?? readRunningRuntimeState(resolve(getRunPath(), "service.json"));
-	if (!state) return null;
-	if (typeof state.uiUrl === "string" && state.uiUrl.trim().length > 0) return state.uiUrl.replace(/\/+$/, "");
-	if (typeof state.apiUrl === "string" && state.apiUrl.trim().length > 0) return state.apiUrl.replace(/\/api\/?$/, "").replace(/\/+$/, "");
-	return null;
-}
-function readRunningRuntimeState(statePath) {
-	if (!existsSync(statePath)) return null;
-	try {
-		const state = JSON.parse(readFileSync(statePath, "utf-8"));
-		return typeof state.pid === "number" && isProcessRunning(state.pid) ? state : null;
-	} catch {
-		return null;
-	}
-}
-function isProcessRunning(pid) {
-	try {
-		process.kill(pid, 0);
-		return true;
-	} catch {
-		return false;
-	}
-}
-function ensureUiBridgeSecret() {
-	const dirPath = join(getDataDir(), "remote");
-	const secretPath = join(dirPath, "ui-bridge-secret");
-	if (existsSync(secretPath)) {
-		const existing = readFileSync(secretPath, "utf-8").trim();
-		if (existing.length > 0) return existing;
-	}
-	mkdirSync(dirPath, { recursive: true });
-	const secret = randomBytes(24).toString("hex");
-	writeFileSync(secretPath, `${secret}\n`, "utf-8");
-	return secret;
-}
 //#endregion
 //#region src/cli/app/controllers/app-restart-command.controller.ts
 var AppRestartCommandController = class {
@@ -4761,6 +4836,7 @@ function registerAppCommands(program) {
 	const app = program.command("app").description("Develop, validate, and publish NextClaw apps");
 	const appCheck = new AppCheckCommandController();
 	const appDev = new AppDevCommandController();
+	const appData = new AppDataCommandController();
 	const appCall = new AppCallCommandController();
 	const appRestart = new AppRestartCommandController();
 	const appValidatePublish = new AppValidatePublishCommandController();
@@ -4768,7 +4844,10 @@ function registerAppCommands(program) {
 	app.command("validate-publish <app-dir>").description("Validate a NextClaw Mini App before Marketplace submission").option("--meta <path>", "Use a custom marketplace metadata file").option("--json", "Output JSON", false).action(async (target, opts) => appValidatePublish.validate(target, opts));
 	app.command("publish <app-dir>").description("Submit a NextClaw Mini App to the App Marketplace").option("--meta <path>", "Use a custom marketplace metadata file").option("--allow-warnings", "Submit after reviewing validation warnings", false).option("--json", "Output JSON", false).action(async (target, opts) => appPublish.publish(target, opts));
 	app.command("check <app-dir>").description("Check a Panel App or Service App directory").option("--json", "Output JSON", false).action(async (target, opts) => appCheck.check(target, opts));
-	app.command("dev <service-app-dir>").description("Start a Service App through the real runtime and inspect its actions").option("--json", "Output JSON", false).action(async (target, opts) => appDev.dev(target, opts));
+	app.command("dev <service-app-dir>").description("Start a Service App through the real runtime and inspect its actions").option("--json", "Output JSON", false).option("--reset-data", "Reset the exact development instance before starting", false).option("--confirm <app-id>", "Confirm the Service App id when resetting data").action(async (target, opts) => appDev.dev(target, opts));
+	const data = app.command("data").description("Inspect and manage NextClaw App data");
+	data.command("list").description("List active and retained App data through the running NextClaw host").option("--json", "Output JSON", false).action(async (opts) => appData.list(opts));
+	data.command("delete <data-id>").description("Permanently delete a retained App data instance").requiredOption("--confirm <app-id>", "Confirm the exact App id").option("--json", "Output JSON", false).action(async (dataId, opts) => appData.deleteRetained(dataId, opts));
 	app.command("call <service-app-dir> <action-name>").description("Call a Service App action through the real runtime").option("--input <json>", "JSON object input for the action").option("--json", "Output JSON", false).action(async (target, actionName, opts) => appCall.call(target, actionName, opts));
 	app.command("restart <app-id>").description("Restart a live Service App runtime in the running NextClaw UI").option("--json", "Output JSON", false).action(async (appId, opts) => appRestart.restart(appId, opts));
 }