@lambdacurry/arbor 0.14.5 → 0.15.0

package/dist/arbor.js

@@ -1625,6 +1625,7 @@ var computerReprovisions = sqliteTable("computer_reprovisions", {
   restorationOutcome: text("restoration_outcome").$type().notNull().default("not_needed"),
   restoredSnapshotId: text("restored_snapshot_id"),
   failureCode: text("failure_code"),
+  failureDetail: text("failure_detail"),
   createdAt: ts("created_at").notNull(),
   completedAt: ts("completed_at")
 }, (t) => ({
@@ -1908,6 +1909,7 @@ var appBundles = sqliteTable("app_bundles", {
   }).$type(),
   runtimeEntrypoint: text("runtime_entrypoint").$type().notNull(),
   capabilityRequirements: text("capability_requirements", { mode: "json" }).$type().notNull().default([]),
+  runtimeConfigRequirements: text("runtime_config_requirements", { mode: "json" }).$type().notNull().default([]),
   stateSchemaVersion: integer("state_schema_version").notNull().default(0),
   stateCompatibleFrom: integer("state_compatible_from").notNull().default(0),
   stateCompatibleThrough: integer("state_compatible_through").notNull().default(0),
@@ -1974,6 +1976,22 @@ var secretBindings = sqliteTable("secret_bindings", {
   appNameUq: uniqueIndex("secret_bindings_app_name_uq").on(t.appId, t.bindingName),
   secretIdx: index("secret_bindings_secret_idx").on(t.secretId, t.status)
 }));
+var appRuntimeVars = sqliteTable("app_runtime_vars", {
+  id: text("id").primaryKey(),
+  appId: text("app_id").notNull().references(() => apps.id),
+  name: text("name").notNull(),
+  value: text("value").notNull(),
+  revision: integer("revision").notNull().default(1),
+  createdByProfileId: text("created_by_profile_id").notNull().references(() => profiles.id),
+  createdExecutionContextId: text("created_execution_context_id").notNull().references(() => executionContexts.id),
+  createdAt: ts("created_at").notNull(),
+  updatedByProfileId: text("updated_by_profile_id").notNull().references(() => profiles.id),
+  updatedExecutionContextId: text("updated_execution_context_id").notNull().references(() => executionContexts.id),
+  updatedAt: ts("updated_at").notNull()
+}, (t) => ({
+  appNameUq: uniqueIndex("app_runtime_vars_app_name_uq").on(t.appId, t.name),
+  appIdx: index("app_runtime_vars_app_idx").on(t.appId)
+}));
 var appDeployments = sqliteTable("app_deployments", {
   id: text("id").primaryKey(),
   appId: text("app_id").notNull().references(() => apps.id),
@@ -17203,6 +17221,7 @@ var MCP_OUTPUT_SCHEMAS = {
   app_fetch: appInvocationResponse,
   app_request: appInvocationResponse,
   app_create: app2,
+  app_config_apply: exports_external.object({ appId: id, dryRun: exports_external.boolean(), changes: exports_external.array(jsonObject) }),
   app_deploy: exports_external.looseObject({
     deployment,
     activated: exports_external.boolean(),
@@ -17310,6 +17329,7 @@ var MCP_OUTPUT_SCHEMAS = {
     operation: exports_external.literal("clone"),
     repository: exports_external.string(),
     dir: exports_external.string(),
+    credential: exports_external.enum(["caller", "arbor-managed"]),
     branch: exports_external.string().optional(),
     head: exports_external.string().optional(),
     refs: exports_external.array(exports_external.string()).optional()
@@ -17319,6 +17339,7 @@ var MCP_OUTPUT_SCHEMAS = {
     operation: exports_external.literal("fetch"),
     repository: exports_external.string(),
     dir: exports_external.string(),
+    credential: exports_external.enum(["caller", "arbor-managed"]),
     branch: exports_external.string().optional(),
     head: exports_external.string().optional(),
     fetchHead: exports_external.string().optional(),
@@ -17329,6 +17350,7 @@ var MCP_OUTPUT_SCHEMAS = {
     operation: exports_external.literal("pull"),
     repository: exports_external.string(),
     dir: exports_external.string(),
+    credential: exports_external.enum(["caller", "arbor-managed"]),
     branch: exports_external.string().optional(),
     head: exports_external.string().optional(),
     before: exports_external.string().optional(),
@@ -17341,6 +17363,7 @@ var MCP_OUTPUT_SCHEMAS = {
     operation: exports_external.literal("push"),
     repository: exports_external.string(),
     dir: exports_external.string(),
+    credential: exports_external.enum(["caller", "arbor-managed"]),
     branch: exports_external.string().optional(),
     head: exports_external.string().optional(),
     before: exports_external.string().optional(),
@@ -17487,6 +17510,7 @@ var MCP_TOOL_ANNOTATIONS = {
   app_fetch: readOnly,
   app_request: destructive,
   app_create: additive,
+  app_config_apply: idempotent,
   app_deploy: idempotent,
   app_activate: additive,
   app_rollback: additive,
@@ -17964,13 +17988,13 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_sync",
     title: "Sync an allowed repository",
-    description: "Fetch, fast-forward pull, or push the checked-out branch of a cloned recipe repository using the working collaborator's GitHub token just in time. The lightweight Computer fixes the allowlisted GitHub URL, never force-pushes or deletes refs, and neither stores nor returns the token.",
+    description: "Fetch, fast-forward pull, or push the checked-out branch of a cloned recipe repository. OMIT githubToken to refresh a repository named in this computer's effective recipe with Arbor's own managed credential — Arbor rechecks the repository connection and mints a request-scoped one-repository read credential server-side, so a restored computer can reach current history with no token of yours. Managed refresh covers fetch and pull; push writes to GitHub and still takes your just-in-time collaborator token. The lightweight Computer fixes the allowlisted GitHub URL, never force-pushes or deletes refs, and neither stores nor returns either credential.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
       repository: exports_external.string().describe("allowed owner/repository slug already cloned by computer_clone"),
       operation: exports_external.enum(["fetch", "pull", "push"]).describe("network operation to perform"),
-      githubToken: exports_external.string().min(1).describe("short-lived GitHub token supplied by the caller"),
-      githubUsername: exports_external.string().optional().describe("GitHub username; defaults to x-access-token")
+      githubToken: exports_external.string().min(1).optional().describe("short-lived collaborator GitHub token; omit for fetch/pull to use Arbor's managed recipe credential, required for push"),
+      githubUsername: exports_external.string().optional().describe("GitHub username for a supplied githubToken; defaults to x-access-token")
     },
     surfaces: ["computer-cli"],
     toolset: "loop",
@@ -17979,12 +18003,12 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_fetch",
     title: "Fetch an allowed repository",
-    description: "Fetch remote refs for a cloned recipe repository without changing its checked-out branch or any remote ref. The collaborator's GitHub token is spent only on this call and is neither stored nor returned.",
+    description: `Fetch remote refs for a cloned recipe repository without changing its checked-out branch or any remote ref. OMIT githubToken and Arbor refreshes it for you: it rechecks that the repository is in this computer's effective recipe and still connected, mints a request-scoped one-repository read credential server-side, spends it on this fetch alone, and returns credential: "arbor-managed" — this is the way a RESTORED computer, which deliberately holds no credential, catches up with the remote. Supply githubToken instead to fetch as the collaborator. Neither credential is stored or returned.`,
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
       repository: exports_external.string().describe("allowed owner/repository slug already cloned"),
-      githubToken: exports_external.string().min(1).describe("short-lived GitHub token supplied by the caller"),
-      githubUsername: exports_external.string().optional().describe("GitHub username; defaults to x-access-token")
+      githubToken: exports_external.string().min(1).optional().describe("short-lived collaborator GitHub token; omit to use Arbor's managed recipe credential"),
+      githubUsername: exports_external.string().optional().describe("GitHub username for a supplied githubToken; defaults to x-access-token")
     },
     surfaces: ["computer-mcp"],
     toolset: "loop",
@@ -17993,12 +18017,12 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_pull",
     title: "Fast-forward an allowed repository",
-    description: "Fetch and fast-forward the checked-out branch of a cloned recipe repository; divergent history is rejected. The collaborator's GitHub token is spent only on this call and is neither stored nor returned.",
+    description: "Fetch and fast-forward the checked-out branch of a cloned recipe repository; divergent history, a dirty working tree, and anything needing a merge are rejected rather than forced. OMIT githubToken and Arbor pulls with its own managed recipe credential after rechecking the repository connection — the way a restored computer reaches current history. Supply githubToken instead to pull as the collaborator. Neither credential is stored or returned.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
       repository: exports_external.string().describe("allowed owner/repository slug already cloned"),
-      githubToken: exports_external.string().min(1).describe("short-lived GitHub token supplied by the caller"),
-      githubUsername: exports_external.string().optional().describe("GitHub username; defaults to x-access-token")
+      githubToken: exports_external.string().min(1).optional().describe("short-lived collaborator GitHub token; omit to use Arbor's managed recipe credential"),
+      githubUsername: exports_external.string().optional().describe("GitHub username for a supplied githubToken; defaults to x-access-token")
     },
     surfaces: ["computer-mcp"],
     toolset: "loop",
@@ -18057,6 +18081,7 @@ var ACTION_DEFINITIONS = [
       stateSchemaVersion: exports_external.number().int().min(0).optional().describe("durable schema this release writes; default 0"),
       stateCompatibleFrom: exports_external.number().int().min(0).optional().describe("oldest durable schema this code can open"),
       stateCompatibleThrough: exports_external.number().int().min(0).optional().describe("newest durable schema this code can open"),
+      runtimeConfigRequirements: exports_external.array(exports_external.object({ name: exports_external.string().min(1).max(64), kind: exports_external.enum(["var", "secret"]) })).optional().describe("required runtime config keys and kinds; values are never part of the AppBundle"),
       idempotencyKey: exports_external.string().min(1).max(200).describe("stable key for this one logical bundle publication")
     },
     surfaces: ["computer-mcp", "computer-cli"],
@@ -19287,6 +19312,22 @@ var ACTION_DEFINITIONS = [
     toolset: "apps",
     run: forward("app.create")
   },
+  {
+    name: "app_config_apply",
+    title: "Apply App runtime config",
+    description: "Declaratively apply the complete typed runtime config for one App. var stores an ordinary runtime value; secret references an existing Arbor Secret without accepting or returning secret material. Dry-run performs the same validation and returns create/update/delete/no-op actions without mutating.",
+    inputSchema: {
+      appId: exports_external.string().describe("target App, app_…"),
+      config: exports_external.record(exports_external.string(), exports_external.discriminatedUnion("kind", [
+        exports_external.object({ kind: exports_external.literal("var"), value: exports_external.string().max(16384) }),
+        exports_external.object({ kind: exports_external.literal("secret"), secretId: exports_external.string() })
+      ])).describe("complete desired runtime config object keyed by environment variable name"),
+      dryRun: exports_external.boolean().optional().describe("validate and plan without mutating")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "apps",
+    run: forward("app.config_apply")
+  },
   {
     name: "app_deploy",
     title: "Prepare an App deployment",
@@ -19842,6 +19883,9 @@ function kindOf(node) {
       return "array";
     case "boolean":
       return "boolean";
+    case "object":
+    case "record":
+      return "json";
     default:
       return "string";
   }
@@ -19850,7 +19894,7 @@ function acceptedFlags(inputSchema) {
   const out = new Set;
   for (const spec of flagsForSchema(inputSchema)) {
     out.add(spec.flag);
-    if (spec.kind === "string")
+    if (spec.kind === "string" || spec.kind === "json")
       out.add(`${spec.flag}-file`);
   }
   return out;
@@ -19886,7 +19930,7 @@ function buildInput(inputSchema, flags, command) {
   const primary = primaryPositionalField(inputSchema);
   const input = {};
   for (const spec of flagsForSchema(inputSchema)) {
-    if (spec.kind === "string") {
+    if (spec.kind === "string" || spec.kind === "json") {
       const fileSrc = lastValue(flags[`${spec.flag}-file`]);
       if (fileSrc !== undefined) {
         if (flags[spec.flag] !== undefined) {
@@ -19894,7 +19938,16 @@ function buildInput(inputSchema, flags, command) {
         }
         if (fileSrc === true)
           throw new UsageError(`--${spec.flag}-file expects a path (or - for stdin)`);
-        input[spec.field] = readTextSource(String(fileSrc));
+        const sourced = readTextSource(String(fileSrc));
+        if (spec.kind === "json") {
+          try {
+            input[spec.field] = JSON.parse(sourced);
+          } catch {
+            throw new UsageError(`--${spec.flag}-file must contain valid JSON`);
+          }
+        } else {
+          input[spec.field] = sourced;
+        }
         continue;
       }
     }
@@ -19958,6 +20011,14 @@ function buildInput(inputSchema, flags, command) {
         input[spec.field] = out;
         break;
       }
+      case "json": {
+        try {
+          input[spec.field] = JSON.parse(String(lastValue(raw)));
+        } catch {
+          throw new UsageError(`--${spec.flag} must be valid JSON`);
+        }
+        break;
+      }
       case "boolean": {
         const v = lastValue(raw);
         input[spec.field] = v === true ? true : v !== "false";

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.14.5",
+  "version": "0.15.0",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",