nextclaw 0.44.1 → 0.45.0

package/dist/cli/app/index.js

@@ -1,9 +1,9 @@
 #!/usr/bin/env node
-import { t as createNextclawDistribution } from "../../nextclaw-distribution.utils-BneKclXo.js";
+import { t as createNextclawDistribution } from "../../nextclaw-distribution.utils-Bba2GRvc.js";
 import { NextclawDistributionService } from "@nextclaw/service";
 //#region src/cli/app/index.ts
 NextclawDistributionService.configureRuntime(createNextclawDistribution(import.meta.url));
-const { nextclawCliProgram } = await import("../../nextclaw-cli-app-scOxgGRP.js");
+const { nextclawCliProgram } = await import("../../nextclaw-cli-app-Bwa2L2Jv.js");
 await nextclawCliProgram.parseAsync(process.argv);
 //#endregion
 export {};

package/dist/cli/launcher/index.js

@@ -1,5 +1,5 @@
 #!/usr/bin/env node
-import { t as createNextclawDistribution } from "../../nextclaw-distribution.utils-BneKclXo.js";
+import { t as createNextclawDistribution } from "../../nextclaw-distribution.utils-Bba2GRvc.js";
 import { NextclawDistributionService, runNextclawNpmRuntimeLauncher } from "@nextclaw/service";
 //#region src/cli/launcher/index.ts
 NextclawDistributionService.configure(createNextclawDistribution(import.meta.url));

package/dist/{nextclaw-cli-app-scOxgGRP.js → nextclaw-cli-app-Bwa2L2Jv.js}

@@ -1,6 +1,6 @@
 import { createRequire } from "node:module";
 import { APP_NAME, APP_TAGLINE, getConfigPath, getDataDir, getRunPath, loadConfig, resolveConfigSecrets } from "@nextclaw/core";
-import { NextclawServiceRuntime, readLearningLoopRuntimeConfig } from "@nextclaw/service";
+import { NextclawDistributionService, NextclawServiceRuntime, readLearningLoopRuntimeConfig } from "@nextclaw/service";
 import { constants, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
 import path, { join, resolve } from "node:path";
 import { Command, InvalidArgumentError } from "commander";
@@ -9,9 +9,10 @@ import { execFile } from "node:child_process";
 import { tmpdir } from "node:os";
 import "@nextclaw/server";
 import { access, mkdtemp, readFile, rm, stat } from "node:fs/promises";
-import { AppBundleService, AppHomeService, AppInstanceInventoryService, AppInstanceStorageService, AppPlatformTargetService, AppPublishService, AppPublishValidationService } from "@nextclaw/app-runtime";
-import { McpServiceAppRuntimeService, NextclawHarnessError, buildServiceActionId, getServiceAppManifestPath, mergeServiceAppRuntimeActions, readServiceAppManifest } from "@nextclaw/kernel";
+import { AppBundleService, AppHomeService, AppInstanceInventoryService, AppInstanceStorageService, AppManifestService, AppPlatformTargetService, AppPublishService, AppPublishValidationService, isAppComponentManifestBundle } from "@nextclaw/app-runtime";
+import { NextclawHarnessError, ServiceAppRuntimeService, buildServiceActionId, getServiceAppManifestPath, mergeServiceAppRuntimeActions, readServiceAppManifest } from "@nextclaw/kernel";
 import { format, promisify } from "node:util";
+import { formatNextClawAppInstallCommand } from "@nextclaw/shared";
 var __commonJSMin = (cb, mod) => () => (mod || cb((mod = { exports: {} }).exports, mod), mod.exports);
 var __require = /* @__PURE__ */ createRequire(import.meta.url);
 //#endregion
@@ -3647,15 +3648,17 @@ var ServiceAppDevService = class {
 			message: `--reset-data requires --confirm ${loaded.manifest.id}.`
 		});
 		if (this.hasErrors(issues)) return this.buildDevReport(appPath, this.toServiceAppRecord(appPath, loaded.manifest, this.idleRuntimeStatus), [], issues);
+		const portable = await this.loadPortableDevContext(appPath, loaded.manifest, issues);
+		if (this.hasErrors(issues)) return this.buildDevReport(appPath, this.toServiceAppRecord(appPath, loaded.manifest, this.idleRuntimeStatus), [], issues);
 		const runtime = this.createRuntimeService();
 		const storage = await this.createDevStorage(appPath, loaded.manifest.id, options.resetData === true);
 		try {
-			const startRecord = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage);
+			const startRecord = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage, portable);
 			const runtimeActions = await runtime.listActions({
 				app: startRecord,
 				manifest: loaded.manifest
 			});
-			const record = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage);
+			const record = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage, portable);
 			const actions = mergeServiceAppRuntimeActions({
 				record,
 				manifest: loaded.manifest,
@@ -3683,20 +3686,22 @@ var ServiceAppDevService = class {
 			const record = this.toServiceAppRecord(appPath, loaded.manifest, this.idleRuntimeStatus);
 			return this.buildCallReport(appPath, record, void 0, void 0, issues);
 		}
+		const portable = await this.loadPortableDevContext(appPath, loaded.manifest, issues);
+		if (this.hasErrors(issues)) return this.buildCallReport(appPath, this.toServiceAppRecord(appPath, loaded.manifest, this.idleRuntimeStatus), void 0, void 0, issues);
 		const runtime = this.createRuntimeService();
 		const storage = await this.createDevStorage(appPath, loaded.manifest.id);
 		try {
-			const record = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage);
+			const record = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage, portable);
 			const result = await runtime.invokeAction({
 				app: record,
 				manifest: loaded.manifest,
 				actionName: action,
 				input
 			});
-			const nextRecord = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage);
+			const nextRecord = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage, portable);
 			return this.buildCallReport(appPath, nextRecord, buildServiceActionId(loaded.manifest.id, action), result, issues);
 		} catch (error) {
-			const record = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage);
+			const record = this.toServiceAppRecord(appPath, loaded.manifest, runtime, storage, portable);
 			issues.push({
 				severity: "error",
 				code: "service.runtime.callFailed",
@@ -3730,7 +3735,60 @@ var ServiceAppDevService = class {
 			return null;
 		}
 	};
-	createRuntimeService = () => this.params.runtimeService ?? new McpServiceAppRuntimeService({ getConfig: this.params.getConfig ?? this.loadRuntimeConfig });
+	createRuntimeService = () => {
+		if (this.params.runtimeService) return this.params.runtimeService;
+		return new ServiceAppRuntimeService({
+			getConfig: this.params.getConfig ?? this.loadRuntimeConfig,
+			portableServiceRunnerPath: this.params.portableServiceRunnerPath
+		});
+	};
+	loadPortableDevContext = async (appPath, manifest, issues) => {
+		if (manifest.protocol !== "wasi-component") return void 0;
+		const componentPath = path.resolve(appPath, manifest.componentEntry ?? "");
+		if (!await this.pathExists(componentPath)) {
+			issues.push({
+				severity: "error",
+				code: "service.component.notFound",
+				message: `Portable Component does not exist: ${manifest.componentEntry ?? "(missing)"}.`
+			});
+			return;
+		}
+		const packageContext = await this.findOwningPackage(appPath);
+		if (!packageContext) {
+			issues.push({
+				severity: "error",
+				code: "service.package.required",
+				message: "Portable Service App development requires an owning schema v2 Mini App so permissions have one product owner.",
+				fixHint: "Place the service under a manifest.json components entry and run app dev on that service directory."
+			});
+			return;
+		}
+		return {
+			componentPath,
+			permissions: packageContext.permissions
+		};
+	};
+	findOwningPackage = async (appPath) => {
+		let candidate = path.dirname(appPath);
+		while (true) {
+			const permissions = await this.readOwningPackagePermissions(candidate, appPath);
+			if (permissions) return { permissions };
+			const parent = path.dirname(candidate);
+			if (parent === candidate) return void 0;
+			candidate = parent;
+		}
+	};
+	readOwningPackagePermissions = async (candidate, appPath) => {
+		if (!await this.pathExists(path.join(candidate, "manifest.json"))) return void 0;
+		const manifestService = new AppManifestService();
+		try {
+			const bundle = await manifestService.load(candidate);
+			if (!isAppComponentManifestBundle(bundle)) return void 0;
+			return bundle.components.some((component) => path.resolve(component.componentDirectory) === path.resolve(appPath)) ? manifestService.resolvePlatformSecurity(bundle.manifest).permissions : void 0;
+		} catch {
+			return;
+		}
+	};
 	loadRuntimeConfig = () => {
 		const configPath = getConfigPath();
 		return resolveConfigSecrets(loadConfig(configPath), { configPath });
@@ -3766,7 +3824,7 @@ var ServiceAppDevService = class {
 			return false;
 		}
 	};
-	toServiceAppRecord = (dirPath, manifest, runtime, storage) => {
+	toServiceAppRecord = (dirPath, manifest, runtime, storage, portable) => {
 		const runtimeStatus = runtime.getStatus(manifest.id);
 		const record = {
 			id: manifest.id,
@@ -3782,7 +3840,12 @@ var ServiceAppDevService = class {
 			dataDirectory: storage?.dataDirectory,
 			instanceId: storage?.instanceId,
 			storage,
-			isolation: "full-user"
+			isolation: manifest.protocol === "wasi-component" ? "host-mediated" : "full-user",
+			runtimeProfile: manifest.protocol === "wasi-component" ? "wasi" : "native-process",
+			componentPath: portable?.componentPath,
+			permissions: portable?.permissions,
+			providerIds: manifest.providerIds,
+			lifecycle: manifest.lifecycle
 		};
 		if (manifest.description) record.description = manifest.description;
 		if (runtimeStatus.lastError) record.lastError = runtimeStatus.lastError;
@@ -4239,15 +4302,17 @@ var ServiceAppCheckService = class {
 		const manifestResult = await readJsonObject(path.join(appPath, SERVICE_MANIFEST_FILE));
 		this.pushIssue(issues, manifestResult.issue);
 		if (!manifestResult.value) return issues;
-		const serviceId = this.checkManifestFields(appPath, manifestResult.value, issues);
+		const protocol = readOptionalString(manifestResult.value, "protocol") ?? "mcp";
+		const serviceId = this.checkManifestFields(appPath, manifestResult.value, protocol, issues);
 		const command = readOptionalString(manifestResult.value, "command");
 		const args = readStringArray(manifestResult.value.args, "service.args");
 		this.pushIssue(issues, args.issue);
 		this.checkActions(serviceId, manifestResult.value.actions, issues);
-		await this.checkCommand(appPath, command, args.values, issues);
+		if (protocol === "wasi-component") await this.checkPortableComponent(appPath, manifestResult.value, issues);
+		else await this.checkCommand(appPath, command, args.values, issues);
 		return issues;
 	};
-	checkManifestFields = (appPath, manifest, issues) => {
+	checkManifestFields = (appPath, manifest, protocol, issues) => {
 		const id = readRequiredString(manifest, "id", "service");
 		this.pushIssue(issues, id.issue);
 		if (id.value && (!KEBAB_ID_PATTERN.test(id.value) || id.value !== path.basename(appPath))) issues.push({
@@ -4256,14 +4321,42 @@ var ServiceAppCheckService = class {
 			message: `service-app.json id must be kebab-case and equal directory name: ${path.basename(appPath)}.`
 		});
 		this.pushIssue(issues, readRequiredString(manifest, "title", "service").issue);
-		this.pushIssue(issues, readRequiredString(manifest, "command", "service").issue);
-		if ((readOptionalString(manifest, "protocol") ?? "mcp") !== "mcp") issues.push({
+		if (protocol === "mcp") this.pushIssue(issues, readRequiredString(manifest, "command", "service").issue);
+		else if (protocol !== "wasi-component") issues.push({
 			severity: "error",
 			code: "service.protocol.invalid",
-			message: "Service App protocol must be mcp."
+			message: "Service App protocol must be mcp or wasi-component."
 		});
 		return id.value;
 	};
+	checkPortableComponent = async (appPath, manifest, issues) => {
+		if (!isRecord(manifest.component)) {
+			issues.push({
+				severity: "error",
+				code: "service.component.missing",
+				message: "wasi-component Service App must declare component.entry."
+			});
+			return;
+		}
+		const entry = readRequiredString(manifest.component, "entry", "service.component");
+		this.pushIssue(issues, entry.issue);
+		if (!entry.value) return;
+		const normalized = entry.value.replace(/\\/g, "/");
+		if (path.isAbsolute(normalized) || normalized.split("/").includes("..") || !normalized.endsWith(".wasm")) {
+			issues.push({
+				severity: "error",
+				code: "service.component.entryInvalid",
+				message: "service.component.entry must be a package-relative .wasm path."
+			});
+			return;
+		}
+		const componentPath = resolveRelativeFile(appPath, normalized);
+		if (!componentPath || !await fileExists(componentPath)) issues.push({
+			severity: "error",
+			code: "service.component.notFound",
+			message: `Portable Component does not exist: ${entry.value}.`
+		});
+	};
 	checkActions = (serviceId, value, issues) => {
 		if (!isRecord(value) || Object.keys(value).length === 0) {
 			issues.push({
@@ -4874,17 +4967,192 @@ var AppValidatePublishCommandController = class {
 	};
 };
 //#endregion
+//#region src/cli/app/services/app-packages/app-marketplace-query.service.ts
+const DEFAULT_APPS_MARKETPLACE_API_BASE = "https://apps-registry.nextclaw.io";
+var AppMarketplaceQueryService = class {
+	constructor(params = {}) {
+		this.params = params;
+	}
+	search = async (options = {}) => {
+		const search = new URLSearchParams();
+		if (options.query?.trim()) search.set("q", options.query.trim());
+		if (options.tag?.trim()) search.set("tag", options.tag.trim());
+		if (options.cursor?.trim()) search.set("cursor", options.cursor.trim());
+		search.set("limit", String(this.normalizeLimit(options.limit)));
+		return this.normalizeSearchResult(await this.request(`/api/v2/apps/items?${search.toString()}`));
+	};
+	info = async (selector) => {
+		const normalized = selector.trim();
+		if (!normalized) throw new Error("Marketplace app selector is required.");
+		return this.normalizeItem(await this.request(`/api/v1/apps/items/${encodeURIComponent(normalized)}`));
+	};
+	request = async (pathname) => {
+		const response = await (this.params.fetchImpl ?? fetch)(`${this.apiBaseUrl}${pathname}`, { headers: { accept: "application/json" } });
+		const payload = await response.json().catch(() => null);
+		if (!response.ok || !payload?.ok) throw new Error(`Apps marketplace request failed: ${response.status} ${response.statusText}`);
+		return payload.data;
+	};
+	normalizeSearchResult = (result) => ({
+		...result,
+		items: result.items.map((item) => this.normalizeItem(item))
+	});
+	normalizeItem = (item) => ({
+		...item,
+		install: {
+			spec: item.install.spec,
+			registry: item.install.registry
+		}
+	});
+	get apiBaseUrl() {
+		return (this.params.apiBaseUrl ?? DEFAULT_APPS_MARKETPLACE_API_BASE).replace(/\/+$/, "");
+	}
+	normalizeLimit = (limit) => {
+		if (limit === void 0) return 24;
+		if (!Number.isInteger(limit) || limit < 1 || limit > 100) throw new Error("--limit must be an integer between 1 and 100.");
+		return limit;
+	};
+};
+//#endregion
+//#region src/cli/app/services/local-api/app-package-live.service.ts
+var AppPackageLiveService = class {
+	constructor(params = {}) {
+		this.params = params;
+	}
+	list = async () => await this.requireApiClient().request({ path: "/api/app-packages" });
+	info = async (appId) => await this.requireApiClient().request({ path: `/api/app-packages/${encodeURIComponent(this.requireId(appId))}` });
+	listOperations = async () => await this.requireApiClient().request({ path: "/api/app-package-operations" });
+	install = async (source, registryUrl) => await this.requireApiClient().request({
+		path: "/api/app-package-operations/install",
+		method: "POST",
+		body: {
+			source: this.requireSource(source),
+			registryUrl
+		}
+	});
+	enable = async (appId) => await this.changeEnabled(appId, "enable");
+	disable = async (appId) => await this.changeEnabled(appId, "disable");
+	update = async (appId, options) => await this.requireApiClient().request({
+		path: `/api/app-package-operations/${encodeURIComponent(this.requireId(appId))}/update`,
+		method: "POST",
+		body: options
+	});
+	rollback = async (appId, version) => await this.requireApiClient().request({
+		path: `/api/app-package-operations/${encodeURIComponent(this.requireId(appId))}/rollback`,
+		method: "POST",
+		body: { version: this.requireVersion(version) }
+	});
+	uninstall = async (appId, purgeData) => await this.requireApiClient().request({
+		path: `/api/app-package-operations/${encodeURIComponent(this.requireId(appId))}/uninstall`,
+		method: "POST",
+		body: { purgeData }
+	});
+	changeEnabled = async (appId, action) => await this.requireApiClient().request({
+		path: `/api/app-packages/${encodeURIComponent(this.requireId(appId))}/${action}`,
+		method: "POST"
+	});
+	requireApiClient = () => {
+		const client = this.params.createApiClient ? this.params.createApiClient() : createLocalUiApiClient();
+		if (!client) throw new Error("NextClaw UI runtime is not running; start NextClaw before managing Apps.");
+		return client;
+	};
+	requireId = (value) => this.requireValue(value, "App id");
+	requireSource = (value) => this.requireValue(value, "App install source");
+	requireVersion = (value) => this.requireValue(value, "App version");
+	requireValue = (value, name) => {
+		const normalized = value.trim();
+		if (!normalized) throw new Error(`${name} is required.`);
+		return normalized;
+	};
+};
+//#endregion
+//#region src/cli/app/controllers/app-packages/app-package-command.controller.ts
+var AppPackageCommandController = class {
+	constructor(liveService = new AppPackageLiveService(), marketplaceService = new AppMarketplaceQueryService()) {
+		this.liveService = liveService;
+		this.marketplaceService = marketplaceService;
+	}
+	searchMarketplace = async (options) => {
+		const { query, tag, cursor, limit } = options;
+		const result = await this.marketplaceService.search({
+			query,
+			tag,
+			cursor,
+			limit: limit === void 0 ? void 0 : Number(limit)
+		});
+		this.write(result, options, this.formatMarketplaceSearch);
+	};
+	marketplaceInfo = async (selector, options) => this.write(await this.marketplaceService.info(selector), options, this.formatMarketplaceInfo);
+	list = async (options) => this.write(await this.liveService.list(), options, this.formatList);
+	info = async (appId, options) => this.write(await this.liveService.info(appId), options, this.formatApp);
+	operations = async (options) => this.write(await this.liveService.listOperations(), options, this.formatOperations);
+	install = async (source, options) => this.write(await this.liveService.install(source, options.registry), options, this.formatOperation);
+	enable = async (appId, options) => this.write(await this.liveService.enable(appId), options, this.formatApp);
+	disable = async (appId, options) => this.write(await this.liveService.disable(appId), options, this.formatApp);
+	update = async (appId, options) => this.write(await this.liveService.update(appId, {
+		version: options.version,
+		registryUrl: options.registry
+	}), options, this.formatOperation);
+	rollback = async (appId, options) => this.write(await this.liveService.rollback(appId, options.version), options, this.formatOperation);
+	uninstall = async (appId, options) => {
+		const { purgeData, confirm } = options;
+		if (purgeData) this.requirePurgeConfirmation(appId, confirm);
+		this.write(await this.liveService.uninstall(appId, purgeData === true), options, this.formatOperation);
+	};
+	write = (result, options, format) => {
+		process.stdout.write(options.json ? `${JSON.stringify(result, null, 2)}\n` : format(result));
+	};
+	formatMarketplaceSearch = (result) => {
+		if (result.items.length === 0) return "No Marketplace Apps found.\n";
+		return `${result.items.map((item) => this.formatMarketplaceInfo(item).trim()).join("\n\n")}\n`;
+	};
+	formatMarketplaceInfo = (item) => [
+		`${item.name} (${item.appId})`,
+		`  summary: ${item.summary}`,
+		`  version: ${item.latestVersion}`,
+		`  author: ${item.author}`,
+		`  tags: ${item.tags.join(", ") || "-"}`,
+		`  install: ${formatNextClawAppInstallCommand(item.install.spec)}`
+	].join("\n") + "\n";
+	formatList = (result) => {
+		if (result.entries.length === 0) return "Apps: none\n";
+		return `${result.entries.map((app) => this.formatApp(app).trim()).join("\n\n")}\n`;
+	};
+	formatApp = (app) => [
+		`${app.name} (${app.id})`,
+		`  version: ${app.activeVersion}`,
+		`  enabled: ${app.enabled ? "yes" : "no"}`,
+		`  built-in: ${app.builtIn ? "yes" : "no"}`,
+		`  versions: ${app.installedVersions.join(", ")}`
+	].join("\n") + "\n";
+	formatOperations = (result) => {
+		if (result.entries.length === 0) return "App operations: none\n";
+		return `${result.entries.map((operation) => this.formatOperation(operation).trim()).join("\n\n")}\n`;
+	};
+	formatOperation = (operation) => [
+		`App operation ${operation.id}`,
+		`  action: ${operation.action}`,
+		`  status: ${operation.status}`,
+		`  app: ${operation.appId ?? operation.source ?? "-"}`,
+		operation.error ? `  error: ${operation.error}` : ""
+	].filter(Boolean).join("\n") + "\n";
+	requirePurgeConfirmation = (appId, confirmation) => {
+		if (confirmation?.trim() !== appId.trim()) throw new Error("--purge-data requires --confirm <app-id> matching the exact App id.");
+	};
+};
+//#endregion
 //#region src/cli/app/register-app-commands.ts
-function registerAppCommands(program) {
+function registerAppCommands(program, options = {}) {
 	const app = program.command("app").description("Develop, validate, and publish NextClaw apps");
 	const appCheck = new AppCheckCommandController();
-	const appDev = new AppDevCommandController();
+	const serviceAppDev = new ServiceAppDevService({ portableServiceRunnerPath: options.portableServiceRunnerPath });
+	const appDev = new AppDevCommandController(serviceAppDev);
 	const appData = new AppDataCommandController();
-	const appCall = new AppCallCommandController();
+	const appCall = new AppCallCommandController(serviceAppDev);
 	const appRestart = new AppRestartCommandController();
 	const appPack = new AppPackCommandController();
 	const appValidatePublish = new AppValidatePublishCommandController();
 	const appPublish = new AppPublishCommandController();
+	const appPackages = new AppPackageCommandController();
 	app.command("pack <app-dir>").description("Pack one declared platform target as a NextClaw App artifact").requiredOption("--target <target-key>", "Pack a declared platform target").requiredOption("--out <path>", "Write the .napp artifact to a specific path").option("--json", "Output JSON", false).action(async (target, opts) => appPack.pack(target, opts));
 	app.command("validate-publish <app-dir>").description("Validate a NextClaw Mini App before Marketplace submission").option("--meta <path>", "Use a custom marketplace metadata file").option("--artifacts <dir>", "Use target-keyed .napp artifacts from a directory").option("--json", "Output JSON", false).action(async (target, opts) => appValidatePublish.validate(target, opts));
 	app.command("publish <app-dir>").description("Submit a NextClaw Mini App to the App Marketplace").option("--meta <path>", "Use a custom marketplace metadata file").option("--artifacts <dir>", "Publish target-keyed .napp artifacts from a directory").option("--allow-warnings", "Submit after reviewing validation warnings", false).option("--json", "Output JSON", false).action(async (target, opts) => appPublish.publish(target, opts));
@@ -4895,6 +5163,21 @@ function registerAppCommands(program) {
 	data.command("delete <data-id>").description("Permanently delete a retained App data instance").requiredOption("--confirm <app-id>", "Confirm the exact App id").option("--json", "Output JSON", false).action(async (dataId, opts) => appData.deleteRetained(dataId, opts));
 	app.command("call <service-app-dir> <action-name>").description("Call a Service App action through the real runtime").option("--input <json>", "JSON object input for the action").option("--json", "Output JSON", false).action(async (target, actionName, opts) => appCall.call(target, actionName, opts));
 	app.command("restart <app-id>").description("Restart a live Service App runtime in the running NextClaw UI").option("--json", "Output JSON", false).action(async (appId, opts) => appRestart.restart(appId, opts));
+	registerAppPackageCommands(app, appPackages);
+}
+function registerAppPackageCommands(app, appPackages) {
+	const marketplace = app.command("marketplace").description("Browse NextClaw App Marketplace");
+	marketplace.command("search").description("Search Apps in NextClaw App Marketplace").option("-q, --query <text>", "Search text").option("--tag <tag>", "Filter by tag").option("--cursor <cursor>", "Continue from a marketplace cursor").option("--limit <n>", "Maximum number of items").option("--json", "Output JSON", false).action(async (opts) => appPackages.searchMarketplace(opts));
+	marketplace.command("info <selector>").description("Show an App Marketplace item").option("--json", "Output JSON", false).action(async (selector, opts) => appPackages.marketplaceInfo(selector, opts));
+	app.command("list").description("List Apps installed in the running NextClaw host").option("--json", "Output JSON", false).action(async (opts) => appPackages.list(opts));
+	app.command("info <app-id>").description("Show an App installed in the running NextClaw host").option("--json", "Output JSON", false).action(async (appId, opts) => appPackages.info(appId, opts));
+	app.command("operations").description("List App install, update, rollback, and uninstall operations").option("--json", "Output JSON", false).action(async (opts) => appPackages.operations(opts));
+	app.command("install <source>").description("Install an App through the running NextClaw host").option("--registry <url>", "Registry URL for an App id").option("--json", "Output JSON", false).action(async (source, opts) => appPackages.install(source, opts));
+	app.command("enable <app-id>").description("Enable an installed App").option("--json", "Output JSON", false).action(async (appId, opts) => appPackages.enable(appId, opts));
+	app.command("disable <app-id>").description("Disable an installed App").option("--json", "Output JSON", false).action(async (appId, opts) => appPackages.disable(appId, opts));
+	app.command("update <app-id>").description("Update an App through the running NextClaw host").option("--version <version>", "Target version").option("--registry <url>", "Registry URL").option("--json", "Output JSON", false).action(async (appId, opts) => appPackages.update(appId, opts));
+	app.command("rollback <app-id>").description("Roll back an App to an installed version").requiredOption("--version <version>", "Installed version to activate").option("--json", "Output JSON", false).action(async (appId, opts) => appPackages.rollback(appId, opts));
+	app.command("uninstall <app-id>").description("Uninstall an App through the running NextClaw host").option("--purge-data", "Permanently delete App data", false).option("--confirm <app-id>", "Confirm the exact App id when purging data").option("--json", "Output JSON", false).action(async (appId, opts) => appPackages.uninstall(appId, opts));
 }
 //#endregion
 //#region src/cli/app/register-project-commands.ts
@@ -4913,6 +5196,7 @@ function registerSessionCommands(program, nextclaw) {
 	sessions.command("rename <session-id> <label>").description("Rename a session").option("--json", "Output JSON", false).action((sessionId, label, options) => commands.rename(sessionId, label, options));
 	sessions.command("set-project <session-id> <directory>").description("Bind a session to an existing project directory").option("--json", "Output JSON", false).action((sessionId, directory, options) => commands.setProject(sessionId, directory, options));
 	sessions.command("clear-project <session-id>").description("Clear a session project binding").option("--json", "Output JSON", false).action((sessionId, options) => commands.clearProject(sessionId, options));
+	sessions.command("delete <session-id>").description("Permanently delete a session").requiredOption("--confirm <session-id>", "Confirm the exact session id").option("--json", "Output JSON", false).action((sessionId, options) => commands.delete(sessionId, options));
 }
 //#endregion
 //#region src/cli/app/controllers/exec-command.controller.ts
@@ -5124,7 +5408,7 @@ registerAgentsCommands(program, runtime);
 registerProjectCommands(program, runtime);
 registerSessionCommands(program, runtime);
 registerExecCommand(program, runtime);
-registerAppCommands(program);
+registerAppCommands(program, { portableServiceRunnerPath: NextclawDistributionService.get().portableServiceRunnerPath });
 const config = program.command("config").description("Manage config values");
 config.command("get <path>").description("Get a config value by dot path").option("--json", "Output JSON", false).action((path, opts) => runtime.commands.config.get(path, opts));
 config.command("set <path> <value>").description("Set a config value by dot path").option("--json", "Parse value as JSON", false).action((path, value, opts) => runtime.commands.config.set(path, value, opts));
@@ -5164,4 +5448,4 @@ program.command("usage").description("Show observed LLM usage snapshots, history
 //#endregion
 export { program as nextclawCliProgram };
 
-//# sourceMappingURL=nextclaw-cli-app-scOxgGRP.js.map
+//# sourceMappingURL=nextclaw-cli-app-Bwa2L2Jv.js.map