@lambdacurry/arbor 0.17.6 → 0.18.0

package/dist/arbor.js

@@ -1671,6 +1671,29 @@ var computerSessions = sqliteTable("computer_sessions", {
   computerIdx: index("computer_sessions_computer_idx").on(t.computerId, t.attachedAt),
   threadIdx: index("computer_sessions_thread_idx").on(t.threadId, t.attachedAt)
 }));
+var computerRuns = sqliteTable("computer_runs", {
+  id: text("id").primaryKey(),
+  computerId: text("computer_id").notNull().references(() => threadComputers.id),
+  threadId: text("thread_id").notNull().references(() => threads.id),
+  computerSessionId: text("computer_session_id").notNull().references(() => computerSessions.id),
+  profileId: text("profile_id").notNull().references(() => profiles.id),
+  executionContextId: text("execution_context_id").notNull().references(() => executionContexts.id),
+  mode: text("mode").$type().notNull(),
+  isolation: text("isolation").$type().notNull(),
+  workspaceDir: text("workspace_dir").notNull(),
+  workspaceRef: text("workspace_ref"),
+  baseSnapshotId: text("base_snapshot_id"),
+  status: text("status").$type().notNull().default("active"),
+  label: text("label"),
+  reason: text("reason"),
+  startedAt: ts("started_at").notNull(),
+  endedAt: ts("ended_at")
+}, (t) => ({
+  computerIdx: index("computer_runs_computer_idx").on(t.computerId, t.startedAt),
+  threadIdx: index("computer_runs_thread_idx").on(t.threadId, t.startedAt),
+  sessionIdx: index("computer_runs_session_idx").on(t.computerSessionId, t.startedAt),
+  statusIdx: index("computer_runs_status_idx").on(t.computerId, t.status)
+}));
 var computerSnapshots = sqliteTable("computer_snapshots", {
   id: text("id").primaryKey(),
   ownerScope: text("owner_scope").$type().notNull(),
@@ -2174,6 +2197,11 @@ var watches = sqliteTable("watches", {
   watchUq: uniqueIndex("watches_watcher_target_uniq").on(t.watcherProfileId, t.targetType, t.targetId),
   watchTargetIdx: index("watches_target_idx").on(t.targetType, t.targetId)
 }));
+// ../core/src/ops/computer-run.ts
+var COMPUTER_WORKSPACE_ROOT = "/workspace";
+var COMPUTER_RUN_WORKSPACE_ROOT = `${COMPUTER_WORKSPACE_ROOT}/.arbor-runs`;
+var TERMINAL = new Set(["finished", "failed", "cancelled"]);
+
 // ../core/src/ops/computer.ts
 var MAX_COMPUTER_REPOSITORIES = 10;
 
@@ -16737,6 +16765,43 @@ var computerProfile = exports_external.looseObject({
   tools: exports_external.array(exports_external.string()),
   recommendedEditingPrimitive: exports_external.string()
 });
+var computerRun = exports_external.looseObject({
+  runId: id,
+  computerId: id,
+  threadId: id,
+  computerSessionId: id,
+  profileId: id,
+  executionContextId: id,
+  mode: exports_external.enum(["read", "write"]),
+  isolation: exports_external.enum(["shared", "isolated"]),
+  workspaceDir: exports_external.string(),
+  workspaceRef: exports_external.string().nullable(),
+  baseSnapshotId: id.nullable(),
+  status: exports_external.enum(["active", "finished", "failed", "cancelled"]),
+  label: exports_external.string().nullable(),
+  reason: exports_external.string().nullable(),
+  startedAt: exports_external.string(),
+  endedAt: exports_external.string().nullable()
+});
+var computerRunReceipt = exports_external.looseObject({
+  runId: id,
+  threadId: id,
+  computerId: id,
+  computerSessionId: id,
+  actor: exports_external.looseObject({ profileId: id, executionContextId: id }),
+  label: exports_external.string().nullable(),
+  mode: exports_external.enum(["read", "write"]),
+  isolation: exports_external.enum(["shared", "isolated"]),
+  workspace: exports_external.looseObject({ dir: exports_external.string(), ref: exports_external.string().nullable() }),
+  baseSnapshotId: id.nullable(),
+  status: exports_external.enum(["active", "finished", "failed", "cancelled"]),
+  outcome: exports_external.enum(["finished", "failed", "cancelled"]).nullable(),
+  reason: exports_external.string().nullable(),
+  startedAt: exports_external.string(),
+  endedAt: exports_external.string().nullable(),
+  durationMs: exports_external.number().nullable(),
+  lifecycle: exports_external.array(exports_external.looseObject({ type: exports_external.string(), at: exports_external.string() }))
+});
 var computerCapabilityCard = exports_external.looseObject({
   capabilities: exports_external.array(exports_external.looseObject({
     id: exports_external.string(),
@@ -17354,6 +17419,28 @@ var MCP_OUTPUT_SCHEMAS = {
       toContainerProfileRevision: exports_external.number().int().nullable()
     }).optional()
   }),
+  computer_run_start: exports_external.looseObject({
+    run: computerRun,
+    workspace: exports_external.looseObject({
+      workspaceRoot: exports_external.string(),
+      repositories: exports_external.array(exports_external.looseObject({ repository: exports_external.string(), path: exports_external.string() })),
+      defaultCwd: exports_external.string(),
+      ref: exports_external.string().nullable().optional(),
+      root: exports_external.string().optional()
+    })
+  }),
+  computer_run_finish: exports_external.looseObject({
+    run: computerRun,
+    replayed: exports_external.boolean()
+  }),
+  computer_run_receipt: exports_external.looseObject({
+    receipt: computerRunReceipt
+  }),
+  computer_runs: exports_external.looseObject({
+    computerId: id,
+    threadId: id,
+    runs: exports_external.array(computerRun)
+  }),
   computer_reprovision: exports_external.looseObject({
     reprovisionId: id,
     threadId: id,
@@ -17620,6 +17707,10 @@ var MCP_TOOL_ANNOTATIONS = {
   github_connect_repository: idempotent,
   computer_open: additive,
   computer_reprovision: destructiveIdempotent,
+  computer_run_start: additive,
+  computer_run_finish: idempotent,
+  computer_run_receipt: readOnly,
+  computer_runs: readOnly,
   computer_exec: destructiveOpenWorld,
   computer_process_read: readOnly,
   computer_process_terminate: destructiveOpenWorld,
@@ -18020,14 +18111,65 @@ var ACTION_DEFINITIONS = [
     toolset: "loop",
     run: forward("computer_runtime.reprovision")
   },
+  {
+    name: "computer_run_start",
+    title: "Start a run",
+    description: "Start one unit of work inside an opened Thread computer and receive the workspace it may use. A write run is given its OWN mutable checkout — a working tree per materialized repository, forked from the computer's current shared state — so a second task started on the SAME computer does not land in its edits. Pass the returned runId to computer_exec and computer_write: exec starts in that checkout and write's path is confined to it, so an Arbor-routed path cannot address the shared workspace or another run's checkout. This routes collaborating tasks apart rather than sandboxing them — the raw command text is not sandboxed, so an absolute path inside a command string still reaches the shared workspace or another run's checkout in the shared container, while relative paths keep a command's writes in your own checkout. It is isolation against collision, not against untrusted code. A read run stays on the shared /workspace. Finish every run with computer_run_finish. This creates no Thread and no second computer.",
+    inputSchema: {
+      computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
+      mode: exports_external.enum(["read", "write"]).describe("write for an isolated mutable checkout; read to share /workspace"),
+      label: exports_external.string().max(120).optional().describe("short factual label for this unit of work")
+    },
+    surfaces: ["computer-mcp", "computer-cli"],
+    toolset: "loop",
+    run: forward("computer_runtime.run_start")
+  },
+  {
+    name: "computer_run_finish",
+    title: "Finish a run",
+    description: "Close a run with its terminal outcome and the one line that explains it. Checkpoint anything worth keeping first (computer_checkpoint or computer_stop); finishing a run releases the unit of work, it does not save or discard the files in its checkout. Repeating the same outcome is a safe no-op, and it keeps the reason the first caller settled — a different outcome is a conflict. Say what happened in reason: it is what computer_run_receipt shows a reader who was not here.",
+    inputSchema: {
+      runId: exports_external.string().describe("the runId returned by computer_run_start, run_…"),
+      outcome: exports_external.enum(["finished", "failed", "cancelled"]).optional().describe("terminal outcome; defaults to finished"),
+      reason: exports_external.string().max(500).optional().describe("one factual line on how this unit of work ended, e.g. what shipped or what broke")
+    },
+    surfaces: ["computer-mcp", "computer-cli"],
+    toolset: "loop",
+    run: forward("computer_runtime.run_finish")
+  },
+  {
+    name: "computer_run_receipt",
+    title: "Read a run receipt",
+    description: "READ ONLY: read one run's compact receipt — its purpose, actor, computer session, the base snapshot it forked from, its workspace and effective isolation, how it ended and why, how long it took, and its lifecycle events. This is the normal way to inspect a run you or someone else started, and it stays readable after the run is terminal. Arbor keeps no process state and no command output, so the receipt says what the protocol recorded, not what scrolled past in the shell.",
+    inputSchema: {
+      runId: exports_external.string().describe("the run to read, run_… (from computer_run_start or computer_runs)")
+    },
+    surfaces: ["computer-mcp", "computer-cli"],
+    toolset: "loop",
+    run: forward("computer_runtime.run_receipt")
+  },
+  {
+    name: "computer_runs",
+    title: "List runs",
+    description: "READ ONLY: list the active and recent runs of this Thread computer with each run's mode, effective isolation, and workspace identity. Use it to see what other work is in flight on the same computer before starting or finishing your own.",
+    inputSchema: {
+      computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
+      status: exports_external.enum(["active", "finished", "failed", "cancelled"]).optional().describe("filter to one lifecycle status"),
+      limit: exports_external.number().int().min(1).max(100).optional().describe("rows to return (default 20)")
+    },
+    surfaces: ["computer-mcp", "computer-cli"],
+    toolset: "loop",
+    run: forward("computer_runtime.run_list")
+  },
   {
     name: "computer_exec",
     title: "Run a command",
-    description: "Run one bounded logical operation in an opened Thread computer. Omitting cwd runs from the Computer's defaultCwd — the one materialized checkout when the recipe has exactly one repository, otherwise the workspace root — and the receipt echoes the cwd it ran in; pass cwd explicitly to override it. Strict Bash semantics are ON by default: an early command failure or failed pipeline makes the execution nonzero, while explicit handling such as `cmd || fallback` still works. Set strict=false only for an intentional best-effort script. For a connected human, Arbor supplies ambient GitHub authorization for normal gh/HTTPS Git commands and GitHub-linked author/committer identity ephemerally for every exec without writing credentials into the workspace; command-local Git environment overrides may still replace the identity. Use background only for the container backend; it returns a processId for computer_process_read / computer_process_terminate. worker-shell deliberately serializes mutations and rejects long-lived processes.",
+    description: "Run one bounded logical operation in an opened Thread computer. Omitting cwd runs from the Computer's defaultCwd — the one materialized checkout when the recipe has exactly one repository, otherwise the workspace root — and the receipt echoes the cwd it ran in; pass cwd explicitly to override it. Pass runId to work inside that run's own checkout: the command starts there and relative paths keep its writes there, while the raw command text is not sandboxed — an absolute path still reaches the shared workspace or another run's checkout in the shared container. Strict Bash semantics are ON by default: an early command failure or failed pipeline makes the execution nonzero, while explicit handling such as `cmd || fallback` still works. Set strict=false only for an intentional best-effort script. For a connected human, Arbor supplies ambient GitHub authorization for normal gh/HTTPS Git commands and GitHub-linked author/committer identity ephemerally for every exec without writing credentials into the workspace; command-local Git environment overrides may still replace the identity. Use background only for the container backend; it returns a processId for computer_process_read / computer_process_terminate. worker-shell deliberately serializes mutations and rejects long-lived processes.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
       command: exports_external.string().min(1).describe("the shell command to run"),
-      cwd: exports_external.string().optional().describe("working directory under /workspace"),
+      runId: exports_external.string().optional().describe("run this inside the checkout of this run, run_… (from computer_run_start)"),
+      cwd: exports_external.string().optional().describe("working directory under /workspace, or under the run"),
       timeout: exports_external.number().int().min(1000).max(1800000).optional().describe("timeout in milliseconds, from 1,000 through 1,800,000"),
       background: exports_external.boolean().optional().describe("start a container process and return its pid"),
       strict: exports_external.boolean().optional().describe("fail on the first unhandled command or pipeline failure; defaults to true, set false only for intentional best-effort execution")
@@ -18166,10 +18308,11 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_write",
     title: "Write a project file",
-    description: "Write one file under /workspace. Content is UTF-8 by default; pass encoding=base64 only for binary bytes. Prefer normal editing tools for code changes; reach for this when the MCP/CLI computer surface is the only filesystem path.",
+    description: "Write one file under /workspace. Content is UTF-8 by default; pass encoding=base64 only for binary bytes. Pass runId to write inside that run's own checkout, where the path may be relative and, being an Arbor-routed path, cannot reach the shared workspace or another run's files. Prefer normal editing tools for code changes; reach for this when the MCP/CLI computer surface is the only filesystem path.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
-      path: exports_external.string().describe("absolute path under /workspace"),
+      path: exports_external.string().describe("absolute path under /workspace, or a path inside the run"),
+      runId: exports_external.string().optional().describe("write into the checkout of this run, run_… (from computer_run_start)"),
       content: exports_external.string().describe("complete UTF-8 content, or base64 bytes when encoding=base64"),
       encoding: exports_external.enum(["utf8", "base64"]).optional().describe("content encoding; defaults to utf8, use base64 for binary files")
     },
@@ -18238,7 +18381,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "get_computer",
     title: "Read a Thread computer",
-    description: "Read a Thread's redacted effective recipe, active materialized generation, compatibility state, historical generation lineage, current Topic/Thread snapshot refs, recent attachment receipts, and replacement outcomes. Recipe metadata includes provider/backend/profile/repositories/config revision and whether setup is configured, never setup content or credentials. This is durable Arbor protocol state, not live process/presence status.",
+    description: "Read a Thread's redacted effective recipe, active materialized generation, compatibility state, historical generation lineage, current Topic/Thread snapshot refs, recent attachment receipts, active and recent runs with each run's mode/isolation/workspace, and replacement outcomes. Recipe metadata includes provider/backend/profile/repositories/config revision and whether setup is configured, never setup content or credentials. This is durable Arbor protocol state, not live process/presence status.",
     inputSchema: {
       threadId: exports_external.string().describe("the Thread, thr_…"),
       lineageLimit: exports_external.number().int().min(1).max(100).optional().describe("recent receipts/lineage rows (default 20)")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.17.6",
+  "version": "0.18.0",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",