@lambdacurry/arbor 0.13.6 → 0.13.7

package/dist/arbor.js

@@ -16440,6 +16440,16 @@ var id = exports_external.string();
 var timestamp = exports_external.string();
 var nullableString = exports_external.string().nullable();
 var jsonObject = exports_external.looseObject({});
+var appInvocationResponse = exports_external.object({
+  status: exports_external.number().int().min(100).max(599),
+  headers: exports_external.record(exports_external.string(), exports_external.string()),
+  body: exports_external.string(),
+  byteCount: exports_external.number().int().min(0).max(64 * 1024),
+  truncated: exports_external.boolean(),
+  bodyKind: exports_external.enum(["text", "unsupported"]),
+  unsupportedReason: exports_external.enum(["binary_content_type", "invalid_utf8"]).optional(),
+  json: exports_external.json().optional()
+});
 var spaceRef = exports_external.looseObject({ id, title: nullableString });
 var recallHit = exports_external.looseObject({
   id,
@@ -16950,6 +16960,8 @@ var MCP_OUTPUT_SCHEMAS = {
     url: exports_external.string()
   }),
   app_deployment_get: exports_external.looseObject({ deployment, bundle: jsonObject }),
+  app_fetch: appInvocationResponse,
+  app_request: appInvocationResponse,
   app_create: app2,
   app_deploy: exports_external.looseObject({
     deployment,
@@ -17211,6 +17223,8 @@ var MCP_TOOL_ANNOTATIONS = {
   app_get: readOnly,
   app_list: readOnly,
   app_deployment_get: readOnly,
+  app_fetch: readOnly,
+  app_request: destructive,
   app_create: additive,
   app_deploy: idempotent,
   app_activate: additive,
@@ -18851,6 +18865,35 @@ var ACTION_DEFINITIONS = [
     toolset: "apps",
     run: forward("app.deployment_get")
   },
+  {
+    name: "app_fetch",
+    title: "Fetch from an App",
+    description: "READ ONLY: Invoke GET or HEAD on one relative path of an App using your current Arbor identity; for Space Apps, current Space membership is rechecked on every call. It cannot modify App lifecycle, deployments, access, or durable SQLite; browser grants, cookies, credentials, and reserved /__arbor paths are never exposed to App code.",
+    inputSchema: {
+      appId: exports_external.string().describe("target App, app_…"),
+      path: exports_external.string().min(1).max(2048).describe("relative App path beginning with /; may include a query string"),
+      method: exports_external.enum(["GET", "HEAD"]).optional().describe("safe read method; default GET")
+    },
+    surfaces: ["mcp"],
+    toolset: "apps",
+    run: forward("app.fetch")
+  },
+  {
+    name: "app_request",
+    title: "Send a mutating App request",
+    description: "Send POST, PUT, PATCH, or DELETE to one relative path of an App using your current Arbor identity; the App may mutate its own state. Supply either json or UTF-8 body, never both; browser grants, cookies, credentials, caller headers, and reserved /__arbor paths are never exposed to App code.",
+    inputSchema: {
+      appId: exports_external.string().describe("target App, app_…"),
+      path: exports_external.string().min(1).max(2048).describe("relative App path beginning with /; may include a query string"),
+      method: exports_external.enum(["POST", "PUT", "PATCH", "DELETE"]).describe("mutating HTTP method"),
+      json: exports_external.json().optional().describe("JSON request value; mutually exclusive with body and sets application/json"),
+      body: exports_external.string().optional().describe("UTF-8 request body; mutually exclusive with json"),
+      contentType: exports_external.string().max(160).optional().describe("body media type; allowed only with body, default text/plain; charset=utf-8")
+    },
+    surfaces: ["mcp"],
+    toolset: "apps",
+    run: forward("app.request")
+  },
   {
     name: "app_activate",
     title: "Activate a verified deployment",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.13.6",
+  "version": "0.13.7",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",