@lambdacurry/arbor 0.14.6 → 0.15.1

package/dist/arbor.js

@@ -1526,6 +1526,32 @@ var githubInstallations = sqliteTable("github_installations", {
   githubIdIdx: uniqueIndex("github_installations_github_id_idx").on(t.githubInstallationId),
   orgIdx: index("github_installations_org_idx").on(t.orgId, t.status)
 }));
+var githubUserAuthorizations = sqliteTable("github_user_authorizations", {
+  id: text("id").primaryKey(),
+  profileId: text("profile_id").notNull().references(() => profiles.id),
+  orgId: text("org_id").notNull().references(() => orgs.id),
+  githubUserId: text("github_user_id").notNull(),
+  githubLogin: text("github_login").notNull(),
+  status: text("status").$type().notNull().default("active"),
+  accessCiphertext: text("access_ciphertext"),
+  accessIv: text("access_iv"),
+  accessKeyId: text("access_key_id"),
+  accessAlgorithm: text("access_algorithm"),
+  accessExpiresAt: ts("access_expires_at"),
+  refreshCiphertext: text("refresh_ciphertext"),
+  refreshIv: text("refresh_iv"),
+  refreshKeyId: text("refresh_key_id"),
+  refreshAlgorithm: text("refresh_algorithm"),
+  refreshExpiresAt: ts("refresh_expires_at"),
+  createdExecutionContextId: text("created_execution_context_id").notNull().references(() => executionContexts.id),
+  updatedExecutionContextId: text("updated_execution_context_id").notNull().references(() => executionContexts.id),
+  createdAt: ts("created_at").notNull(),
+  updatedAt: ts("updated_at").notNull()
+}, (t) => ({
+  profileIdx: uniqueIndex("github_user_authorizations_profile_idx").on(t.profileId),
+  githubUserIdx: index("github_user_authorizations_github_user_idx").on(t.githubUserId, t.status),
+  orgIdx: index("github_user_authorizations_org_idx").on(t.orgId, t.status)
+}));
 var githubRepositories = sqliteTable("github_repositories", {
   id: text("id").primaryKey(),
   installationId: text("installation_id").notNull().references(() => githubInstallations.id),
@@ -1625,6 +1651,7 @@ var computerReprovisions = sqliteTable("computer_reprovisions", {
   restorationOutcome: text("restoration_outcome").$type().notNull().default("not_needed"),
   restoredSnapshotId: text("restored_snapshot_id"),
   failureCode: text("failure_code"),
+  failureDetail: text("failure_detail"),
   createdAt: ts("created_at").notNull(),
   completedAt: ts("completed_at")
 }, (t) => ({
@@ -2176,9 +2203,6 @@ var PREVIEW_MIME_TYPES = new Set([
   "font/woff",
   "font/woff2"
 ]);
-// ../core/src/ops/app.ts
-var APP_MAX_MODULE_BYTES = 10 * 1024 * 1024;
-var APP_MAX_ASSET_BYTES = 25 * 1024 * 1024;
 // ../core/src/ops/secret.ts
 var SECRET_PERMISSIONS = [
   "create",
@@ -2192,6 +2216,10 @@ var SECRET_PERMISSIONS = [
   "plaintext:read"
 ];
 var SECRET_ADMIN_PERMISSIONS = SECRET_PERMISSIONS.filter((permission) => permission !== "create" && permission !== "plaintext:read");
+
+// ../core/src/ops/app.ts
+var APP_MAX_MODULE_BYTES = 10 * 1024 * 1024;
+var APP_MAX_ASSET_BYTES = 25 * 1024 * 1024;
 // ../core/src/queries/lane-match.ts
 var STOP_WORDS = new Set("a an and are as at be by for from has have here how i in is it me of on or our the their they this to was what when where which who will with you your".split(" "));
 // ../core/src/queries/activity.ts
@@ -17212,11 +17240,16 @@ var MCP_OUTPUT_SCHEMAS = {
   app_get: exports_external.looseObject({
     app: app2,
     deployments: exports_external.array(jsonObject),
+    configurationReadiness: jsonObject.nullable(),
     resets: exports_external.array(jsonObject),
     events: exports_external.array(jsonObject),
     url: exports_external.string()
   }),
-  app_deployment_get: exports_external.looseObject({ deployment, bundle: jsonObject }),
+  app_deployment_get: exports_external.looseObject({
+    deployment,
+    bundle: jsonObject,
+    configurationReadiness: jsonObject
+  }),
   app_fetch: appInvocationResponse,
   app_request: appInvocationResponse,
   app_create: app2,
@@ -17328,6 +17361,7 @@ var MCP_OUTPUT_SCHEMAS = {
     operation: exports_external.literal("clone"),
     repository: exports_external.string(),
     dir: exports_external.string(),
+    credential: exports_external.literal("caller"),
     branch: exports_external.string().optional(),
     head: exports_external.string().optional(),
     refs: exports_external.array(exports_external.string()).optional()
@@ -17337,6 +17371,7 @@ var MCP_OUTPUT_SCHEMAS = {
     operation: exports_external.literal("fetch"),
     repository: exports_external.string(),
     dir: exports_external.string(),
+    credential: exports_external.enum(["caller", "arbor-managed"]),
     branch: exports_external.string().optional(),
     head: exports_external.string().optional(),
     fetchHead: exports_external.string().optional(),
@@ -17347,6 +17382,7 @@ var MCP_OUTPUT_SCHEMAS = {
     operation: exports_external.literal("pull"),
     repository: exports_external.string(),
     dir: exports_external.string(),
+    credential: exports_external.enum(["caller", "arbor-managed"]),
     branch: exports_external.string().optional(),
     head: exports_external.string().optional(),
     before: exports_external.string().optional(),
@@ -17359,6 +17395,7 @@ var MCP_OUTPUT_SCHEMAS = {
     operation: exports_external.literal("push"),
     repository: exports_external.string(),
     dir: exports_external.string(),
+    credential: exports_external.enum(["caller", "github-user"]),
     branch: exports_external.string().optional(),
     head: exports_external.string().optional(),
     before: exports_external.string().optional(),
@@ -17618,6 +17655,33 @@ var ACTION_DEFINITIONS = [
     toolset: "admin",
     run: forward("github.set_repository_connection")
   },
+  {
+    name: "github_identity",
+    title: "Show your GitHub connection",
+    description: "Show whether your own Arbor human profile has a connected GitHub identity, with the login and when the connection expires. Redacted by construction — it never returns a credential.",
+    inputSchema: {},
+    surfaces: ["cli"],
+    toolset: "admin",
+    run: forward("github.user_status")
+  },
+  {
+    name: "github_connect_identity",
+    title: "Connect your GitHub identity",
+    description: "Mint the short-lived URL you open in a signed-in browser to connect your GitHub identity, so an Arbor Computer can push your commits as you. Human profiles only; the URL authorizes nothing by itself and expires in ten minutes.",
+    inputSchema: {},
+    surfaces: ["cli"],
+    toolset: "admin",
+    run: forward("github.user_connect")
+  },
+  {
+    name: "github_disconnect_identity",
+    title: "Disconnect your GitHub identity",
+    description: "Disconnect your own GitHub identity from Arbor and erase the stored credential material; a Computer can no longer push as you until you connect again. The audit record of the connection is preserved.",
+    inputSchema: {},
+    surfaces: ["cli"],
+    toolset: "admin",
+    run: forward("github.user_disconnect")
+  },
   {
     name: "recall",
     title: "Recall existing knowledge",
@@ -17983,13 +18047,13 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_sync",
     title: "Sync an allowed repository",
-    description: "Fetch, fast-forward pull, or push the checked-out branch of a cloned recipe repository using the working collaborator's GitHub token just in time. The lightweight Computer fixes the allowlisted GitHub URL, never force-pushes or deletes refs, and neither stores nor returns the token.",
+    description: "Fetch, fast-forward pull, or push the checked-out branch of a cloned recipe repository. OMIT githubToken to refresh a repository named in this computer's effective recipe with Arbor's own managed credential — Arbor rechecks the repository connection and mints a request-scoped one-repository read credential server-side, so a restored computer can reach current history with no token of yours. Managed refresh covers fetch and pull; push writes to GitHub, so omit githubToken there to push as the signed-in human's GitHub identity connected in Account Settings, or supply your just-in-time collaborator token as an override. The lightweight Computer fixes the allowlisted GitHub URL, never force-pushes or deletes refs, and neither stores nor returns either credential.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
       repository: exports_external.string().describe("allowed owner/repository slug already cloned by computer_clone"),
       operation: exports_external.enum(["fetch", "pull", "push"]).describe("network operation to perform"),
-      githubToken: exports_external.string().min(1).describe("short-lived GitHub token supplied by the caller"),
-      githubUsername: exports_external.string().optional().describe("GitHub username; defaults to x-access-token")
+      githubToken: exports_external.string().min(1).optional().describe("short-lived collaborator GitHub token; omit for fetch/pull to use Arbor's managed read credential, or for push to use the signed-in human's connected GitHub identity"),
+      githubUsername: exports_external.string().optional().describe("GitHub username for a supplied githubToken; defaults to x-access-token")
     },
     surfaces: ["computer-cli"],
     toolset: "loop",
@@ -17998,12 +18062,12 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_fetch",
     title: "Fetch an allowed repository",
-    description: "Fetch remote refs for a cloned recipe repository without changing its checked-out branch or any remote ref. The collaborator's GitHub token is spent only on this call and is neither stored nor returned.",
+    description: `Fetch remote refs for a cloned recipe repository without changing its checked-out branch or any remote ref. OMIT githubToken and Arbor refreshes it for you: it rechecks that the repository is in this computer's effective recipe and still connected, mints a request-scoped one-repository read credential server-side, spends it on this fetch alone, and returns credential: "arbor-managed" — this is the way a RESTORED computer, which deliberately holds no credential, catches up with the remote. Supply githubToken instead to fetch as the collaborator. Neither credential is stored or returned.`,
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
       repository: exports_external.string().describe("allowed owner/repository slug already cloned"),
-      githubToken: exports_external.string().min(1).describe("short-lived GitHub token supplied by the caller"),
-      githubUsername: exports_external.string().optional().describe("GitHub username; defaults to x-access-token")
+      githubToken: exports_external.string().min(1).optional().describe("short-lived collaborator GitHub token; omit to use Arbor's managed recipe credential"),
+      githubUsername: exports_external.string().optional().describe("GitHub username for a supplied githubToken; defaults to x-access-token")
     },
     surfaces: ["computer-mcp"],
     toolset: "loop",
@@ -18012,12 +18076,12 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_pull",
     title: "Fast-forward an allowed repository",
-    description: "Fetch and fast-forward the checked-out branch of a cloned recipe repository; divergent history is rejected. The collaborator's GitHub token is spent only on this call and is neither stored nor returned.",
+    description: "Fetch and fast-forward the checked-out branch of a cloned recipe repository; divergent history, a dirty working tree, and anything needing a merge are rejected rather than forced. OMIT githubToken and Arbor pulls with its own managed recipe credential after rechecking the repository connection — the way a restored computer reaches current history. Supply githubToken instead to pull as the collaborator. Neither credential is stored or returned.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
       repository: exports_external.string().describe("allowed owner/repository slug already cloned"),
-      githubToken: exports_external.string().min(1).describe("short-lived GitHub token supplied by the caller"),
-      githubUsername: exports_external.string().optional().describe("GitHub username; defaults to x-access-token")
+      githubToken: exports_external.string().min(1).optional().describe("short-lived collaborator GitHub token; omit to use Arbor's managed recipe credential"),
+      githubUsername: exports_external.string().optional().describe("GitHub username for a supplied githubToken; defaults to x-access-token")
     },
     surfaces: ["computer-mcp"],
     toolset: "loop",
@@ -18026,12 +18090,12 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_push",
     title: "Push an allowed repository",
-    description: "Push the checked-out branch to its fixed allowlisted GitHub repository without force-pushing or deleting refs. The collaborator's GitHub token is spent only on this call and is neither stored nor returned.",
+    description: "Push the checked-out branch to its fixed allowlisted GitHub repository without force-pushing or deleting refs. OMIT githubToken to use the signed-in human's GitHub connection from Account Settings; Arbor refreshes that GitHub App user credential server-side and never returns or persists it in the Computer. Supply githubToken only for an explicit caller credential override.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
       repository: exports_external.string().describe("allowed owner/repository slug already cloned"),
-      githubToken: exports_external.string().min(1).describe("short-lived GitHub token supplied by the caller"),
-      githubUsername: exports_external.string().optional().describe("GitHub username; defaults to x-access-token")
+      githubToken: exports_external.string().min(1).optional().describe("optional short-lived GitHub token override; omit to use your connected GitHub identity"),
+      githubUsername: exports_external.string().optional().describe("GitHub username for a supplied githubToken; omit for your connected GitHub identity")
     },
     surfaces: ["computer-mcp"],
     toolset: "loop",
@@ -19284,7 +19348,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "app_get",
     title: "Read an App",
-    description: "READ ONLY: Inspect one App's stable URL, active deployment, pending control intent, deployment history, health, and durable state generation. It cannot modify App state, deployment state, access, or durable SQLite; use its activeDeploymentId as app_activate's expectedActiveDeploymentId.",
+    description: "READ ONLY: Inspect one App's stable URL, active deployment, pending control intent, deployment history, provider health, deployment-aware redacted configuration readiness for the active release, and durable state generation. It cannot modify App state, deployment state, access, or durable SQLite; use its activeDeploymentId as app_activate's expectedActiveDeploymentId.",
     inputSchema: { appId: exports_external.string().describe("the App, app_…") },
     surfaces: ["mcp", "cli"],
     toolset: "apps",
@@ -19351,7 +19415,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "app_deployment_get",
     title: "Inspect an App deployment",
-    description: "READ ONLY: Inspect one deployment's candidate, active, failed, or superseded state, source AppBundle, provider receipt, and redacted health result. It cannot modify App state, deployment state, access, or durable SQLite.",
+    description: "READ ONLY: Inspect one deployment's candidate, active, failed, or superseded state, source AppBundle, provider receipt, redacted provider health result, and redacted configuration readiness against that bundle's declared runtime requirements. It cannot modify App state, deployment state, access, or durable SQLite.",
     inputSchema: {
       appId: exports_external.string().describe("owning App, app_…"),
       deploymentId: exports_external.string().describe("deployment, dep_…")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.14.6",
+  "version": "0.15.1",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",