@lambdacurry/arbor 0.18.0 → 0.19.0

package/dist/arbor.js

@@ -1679,9 +1679,9 @@ var computerRuns = sqliteTable("computer_runs", {
   profileId: text("profile_id").notNull().references(() => profiles.id),
   executionContextId: text("execution_context_id").notNull().references(() => executionContexts.id),
   mode: text("mode").$type().notNull(),
-  isolation: text("isolation").$type().notNull(),
+  execution: text("isolation").$type().notNull(),
   workspaceDir: text("workspace_dir").notNull(),
-  workspaceRef: text("workspace_ref"),
+  _legacyWorkspaceRef: text("workspace_ref"),
   baseSnapshotId: text("base_snapshot_id"),
   status: text("status").$type().notNull().default("active"),
   label: text("label"),
@@ -2198,8 +2198,6 @@ var watches = sqliteTable("watches", {
   watchTargetIdx: index("watches_target_idx").on(t.targetType, t.targetId)
 }));
 // ../core/src/ops/computer-run.ts
-var COMPUTER_WORKSPACE_ROOT = "/workspace";
-var COMPUTER_RUN_WORKSPACE_ROOT = `${COMPUTER_WORKSPACE_ROOT}/.arbor-runs`;
 var TERMINAL = new Set(["finished", "failed", "cancelled"]);
 
 // ../core/src/ops/computer.ts
@@ -16773,9 +16771,8 @@ var computerRun = exports_external.looseObject({
   profileId: id,
   executionContextId: id,
   mode: exports_external.enum(["read", "write"]),
-  isolation: exports_external.enum(["shared", "isolated"]),
+  execution: exports_external.enum(["shared", "isolated"]),
   workspaceDir: exports_external.string(),
-  workspaceRef: exports_external.string().nullable(),
   baseSnapshotId: id.nullable(),
   status: exports_external.enum(["active", "finished", "failed", "cancelled"]),
   label: exports_external.string().nullable(),
@@ -16791,8 +16788,8 @@ var computerRunReceipt = exports_external.looseObject({
   actor: exports_external.looseObject({ profileId: id, executionContextId: id }),
   label: exports_external.string().nullable(),
   mode: exports_external.enum(["read", "write"]),
-  isolation: exports_external.enum(["shared", "isolated"]),
-  workspace: exports_external.looseObject({ dir: exports_external.string(), ref: exports_external.string().nullable() }),
+  execution: exports_external.enum(["shared", "isolated"]),
+  workspace: exports_external.looseObject({ dir: exports_external.string() }),
   baseSnapshotId: id.nullable(),
   status: exports_external.enum(["active", "finished", "failed", "cancelled"]),
   outcome: exports_external.enum(["finished", "failed", "cancelled"]).nullable(),
@@ -17475,6 +17472,7 @@ var MCP_OUTPUT_SCHEMAS = {
     stdout: exports_external.string().optional(),
     stderr: exports_external.string().optional(),
     truncated: exports_external.boolean().optional(),
+    nextCursor: exports_external.string().optional(),
     exitCode: exports_external.number().int().nullable().optional()
   }),
   computer_process_terminate: exports_external.looseObject({
@@ -18114,10 +18112,11 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_run_start",
     title: "Start a run",
-    description: "Start one unit of work inside an opened Thread computer and receive the workspace it may use. A write run is given its OWN mutable checkout — a working tree per materialized repository, forked from the computer's current shared state — so a second task started on the SAME computer does not land in its edits. Pass the returned runId to computer_exec and computer_write: exec starts in that checkout and write's path is confined to it, so an Arbor-routed path cannot address the shared workspace or another run's checkout. This routes collaborating tasks apart rather than sandboxing them — the raw command text is not sandboxed, so an absolute path inside a command string still reaches the shared workspace or another run's checkout in the shared container, while relative paths keep a command's writes in your own checkout. It is isolation against collision, not against untrusted code. A read run stays on the shared /workspace. Finish every run with computer_run_finish. This creates no Thread and no second computer.",
+    description: "Start one unit of work inside an opened Thread computer. Write Runs default to isolated execution restored from the Computer's current base snapshot, so independent work does not collide. For intentional live collaboration, pass execution='shared' and the Run works directly in the Thread Computer alongside other shared Runs. Read Runs always share. All placements present the same /workspace layout; pass runId to Run-aware Computer operations and Arbor routes them correctly. Finish every Run with computer_run_finish, which destroys its isolated environment. This creates no second Thread or durable Computer.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
-      mode: exports_external.enum(["read", "write"]).describe("write for an isolated mutable checkout; read to share /workspace"),
+      mode: exports_external.enum(["read", "write"]).describe("write for mutable work; read for shared inspection"),
+      execution: exports_external.enum(["shared", "isolated"]).optional().describe("write Run placement; defaults to isolated. Use shared only for intentional live collaboration on the Thread Computer"),
       label: exports_external.string().max(120).optional().describe("short factual label for this unit of work")
     },
     surfaces: ["computer-mcp", "computer-cli"],
@@ -18127,7 +18126,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_run_finish",
     title: "Finish a run",
-    description: "Close a run with its terminal outcome and the one line that explains it. Checkpoint anything worth keeping first (computer_checkpoint or computer_stop); finishing a run releases the unit of work, it does not save or discard the files in its checkout. Repeating the same outcome is a safe no-op, and it keeps the reason the first caller settled — a different outcome is a conflict. Say what happened in reason: it is what computer_run_receipt shows a reader who was not here.",
+    description: "Close a Run with its terminal outcome and the one line that explains it. Finishing an isolated write Run destroys its execution environment, so push or otherwise publish anything that must outlive the Run before finishing it. Repeating the same outcome is a safe no-op, and it keeps the reason the first caller settled — a different one conflicts. Say what happened in reason: it is what computer_run_receipt shows a reader who was not here.",
     inputSchema: {
       runId: exports_external.string().describe("the runId returned by computer_run_start, run_…"),
       outcome: exports_external.enum(["finished", "failed", "cancelled"]).optional().describe("terminal outcome; defaults to finished"),
@@ -18140,7 +18139,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_run_receipt",
     title: "Read a run receipt",
-    description: "READ ONLY: read one run's compact receipt — its purpose, actor, computer session, the base snapshot it forked from, its workspace and effective isolation, how it ended and why, how long it took, and its lifecycle events. This is the normal way to inspect a run you or someone else started, and it stays readable after the run is terminal. Arbor keeps no process state and no command output, so the receipt says what the protocol recorded, not what scrolled past in the shell.",
+    description: "READ ONLY: read one run's compact receipt — its purpose, actor, computer session, the base snapshot it forked from, its workspace and execution placement, how it ended and why, how long it took, and its lifecycle events. This is the normal way to inspect a run you or someone else started, and it stays readable after the run is terminal. Arbor keeps no process state and no command output, so the receipt says what the protocol recorded, not what scrolled past in the shell.",
     inputSchema: {
       runId: exports_external.string().describe("the run to read, run_… (from computer_run_start or computer_runs)")
     },
@@ -18151,7 +18150,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_runs",
     title: "List runs",
-    description: "READ ONLY: list the active and recent runs of this Thread computer with each run's mode, effective isolation, and workspace identity. Use it to see what other work is in flight on the same computer before starting or finishing your own.",
+    description: "READ ONLY: list the active and recent runs of this Thread computer with each run's mode, execution placement, and workspace identity. Use it to see what other work is in flight on the same computer before starting or finishing your own.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
       status: exports_external.enum(["active", "finished", "failed", "cancelled"]).optional().describe("filter to one lifecycle status"),
@@ -18164,11 +18163,11 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_exec",
     title: "Run a command",
-    description: "Run one bounded logical operation in an opened Thread computer. Omitting cwd runs from the Computer's defaultCwd — the one materialized checkout when the recipe has exactly one repository, otherwise the workspace root — and the receipt echoes the cwd it ran in; pass cwd explicitly to override it. Pass runId to work inside that run's own checkout: the command starts there and relative paths keep its writes there, while the raw command text is not sandboxed — an absolute path still reaches the shared workspace or another run's checkout in the shared container. Strict Bash semantics are ON by default: an early command failure or failed pipeline makes the execution nonzero, while explicit handling such as `cmd || fallback` still works. Set strict=false only for an intentional best-effort script. For a connected human, Arbor supplies ambient GitHub authorization for normal gh/HTTPS Git commands and GitHub-linked author/committer identity ephemerally for every exec without writing credentials into the workspace; command-local Git environment overrides may still replace the identity. Use background only for the container backend; it returns a processId for computer_process_read / computer_process_terminate. worker-shell deliberately serializes mutations and rejects long-lived processes.",
+    description: "Run one bounded logical operation in an opened Thread computer. Omitting cwd uses the environment's defaultCwd; pass cwd explicitly to override it. Pass runId to route the command according to that Run's execution placement; without runId the command executes in the parent Computer. Strict Bash semantics are ON by default. For tests, builds, installs, or any command likely to run long, prefer background=true so the call returns a processId immediately; follow it with computer_process_read using the returned cursor for small incremental tails. For a connected human, Arbor supplies ambient GitHub authorization and Git identity ephemerally without writing credentials into the workspace. Background processes stay in the environment where they were started.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
       command: exports_external.string().min(1).describe("the shell command to run"),
-      runId: exports_external.string().optional().describe("run this inside the checkout of this run, run_… (from computer_run_start)"),
+      runId: exports_external.string().optional().describe("route this command according to this Run execution placement, run_… (from computer_run_start)"),
       cwd: exports_external.string().optional().describe("working directory under /workspace, or under the run"),
       timeout: exports_external.number().int().min(1000).max(1800000).optional().describe("timeout in milliseconds, from 1,000 through 1,800,000"),
       background: exports_external.boolean().optional().describe("start a container process and return its pid"),
@@ -18181,11 +18180,13 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_process_read",
     title: "Read a background process",
-    description: "READ ONLY: Inspect one process returned by computer_exec(background=true). Returns provider-owned lifecycle metadata plus bounded latest stdout/stderr and, once terminal, the final exit result. Re-read the same processId for progress without sentinel files or shell process archaeology.",
+    description: "READ ONLY: Tail one process returned by computer_exec(background=true). With no cursor, returns only the latest small output window; pass nextCursor on the next read to receive only newer output. Defaults to 4 KB total and allows an explicit larger read up to 64 KB. Once terminal, also returns the final exit result.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
+      runId: exports_external.string().optional().describe("the Run that owns this process, if it was started inside a Run"),
       processId: exports_external.string().min(1).describe("the opaque processId returned by computer_exec(background=true), proc_…"),
-      maxBytes: exports_external.number().int().min(1024).max(65536).optional().describe("maximum combined output bytes to return; default 16,384")
+      cursor: exports_external.string().optional().describe("continue after nextCursor from the prior process read; omit for a small latest tail"),
+      maxBytes: exports_external.number().int().min(1024).max(65536).optional().describe("maximum combined output bytes to return; default 4,096, opt up only when needed")
     },
     surfaces: ["computer-mcp", "computer-cli"],
     toolset: "loop",
@@ -18197,6 +18198,7 @@ var ACTION_DEFINITIONS = [
     description: "Terminate one process returned by computer_exec(background=true), including its provider-owned process tree. Returns the observed terminal state so ChatGPT can stop long verification explicitly without shell PIDs or ps/kill workarounds.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
+      runId: exports_external.string().optional().describe("the Run that owns this process, if it was started inside a Run"),
       processId: exports_external.string().min(1).describe("the opaque processId returned by computer_exec(background=true), proc_…")
     },
     surfaces: ["computer-mcp", "computer-cli"],
@@ -18232,6 +18234,7 @@ var ACTION_DEFINITIONS = [
     description: "Outline the symbols a file or directory defines, resolved by the project's language server. Reach for this before reading a large unfamiliar file — unlike a grep through `computer_exec`, it returns the real declarations with their kinds rather than every textual match. Needs the semantic-code capability shown on the computer_status card.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
+      runId: exports_external.string().optional().describe("route this semantic read according to this Run execution placement, run_…"),
       path: exports_external.string().max(512).describe("file or directory, absolute under /workspace or workspace-relative")
     },
     surfaces: ["computer-mcp", "computer-cli"],
@@ -18244,6 +18247,7 @@ var ACTION_DEFINITIONS = [
     description: "Locate a declaration by its name path (`ClassName/methodName`) and optionally return its body. Use it instead of a `computer_exec` grep when you want THE definition rather than every line mentioning the name; the language server distinguishes the declaration from its call sites and its string occurrences. Needs the semantic-code capability shown on the computer_status card.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
+      runId: exports_external.string().optional().describe("route this semantic read according to this Run execution placement, run_…"),
       namePath: exports_external.string().min(1).max(200).describe("symbol name path within a file, e.g. MyClass/myMethod"),
       path: exports_external.string().max(512).optional().describe("optional file or directory to restrict the search to"),
       includeBody: exports_external.boolean().optional().describe("include each symbol's source body"),
@@ -18259,6 +18263,7 @@ var ACTION_DEFINITIONS = [
     description: 'List the places that actually reference a symbol, each with a short snippet. This is the operation `computer_exec` cannot do: a text search finds the same identifier in comments, unrelated modules, and shadowed scopes, while the language server resolves real references — so it answers "is this safe to change". Needs the semantic-code capability shown on the computer_status card.',
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
+      runId: exports_external.string().optional().describe("route this semantic read according to this Run execution placement, run_…"),
       namePath: exports_external.string().min(1).max(200).describe("name path of the symbol to trace"),
       path: exports_external.string().max(512).describe("the file declaring that symbol, absolute under /workspace or workspace-relative")
     },
@@ -18272,6 +18277,7 @@ var ACTION_DEFINITIONS = [
     description: "List the concrete implementations or subtypes of an interface, abstract type, or method. A `computer_exec` search cannot follow a type relationship — only the language server knows which declarations satisfy this one. Needs the semantic-code capability shown on the computer_status card.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
+      runId: exports_external.string().optional().describe("route this semantic read according to this Run execution placement, run_…"),
       namePath: exports_external.string().min(1).max(200).describe("name path of the interface, type, or method"),
       path: exports_external.string().max(512).describe("the file declaring that symbol, absolute under /workspace or workspace-relative")
     },
@@ -18285,6 +18291,7 @@ var ACTION_DEFINITIONS = [
     description: "Return the language server's live errors and warnings for one file, mapped to symbols. Reach for it on a file you just edited: it answers in seconds without the whole-project build a `computer_exec` typecheck runs, though a green result here is not a substitute for that build. Needs the semantic-code capability shown on the computer_status card.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
+      runId: exports_external.string().optional().describe("route this semantic read according to this Run execution placement, run_…"),
       path: exports_external.string().max(512).describe("the file to inspect, absolute under /workspace or workspace-relative")
     },
     surfaces: ["computer-mcp", "computer-cli"],
@@ -18294,9 +18301,10 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_export",
     title: "Export a Thread file",
-    description: "Move one bounded image, MP4/WebM video, or supported file from an opened computer into a durable Thread Attachment. Describe what it shows so the returned attachments[].markdown has meaningful image alt text or a video/file label; put that Markdown where the media belongs and bind those ids when contributing or responding. Supply one stable idempotencyKey per logical export: safe retries return the original Attachment, while reusing the key for another path or description conflicts.",
+    description: "Move one bounded image, MP4/WebM video, or supported file from an opened Computer or Run into a durable Thread Attachment. Pass runId to export the exact files visible to that Run execution placement. Describe what it shows so the returned attachments[].markdown has meaningful image alt text or a video/file label; put that Markdown where the media belongs and bind those ids when contributing or responding. Supply one stable idempotencyKey per logical export: safe retries return the original Attachment, while reusing the key for another path or description conflicts.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
+      runId: exports_external.string().optional().describe("route this export according to this Run execution placement, run_…"),
       path: exports_external.string().describe("absolute path to one supported file under /workspace"),
       description: exports_external.string().min(1).max(500).describe("concise description of what the file shows or contains; becomes image alt text, a video caption, and the Artifact summary"),
       idempotencyKey: exports_external.string().min(1).max(200).describe("stable key for this ONE logical export (≤200 chars); reuse it only to retry the same path")
@@ -18308,11 +18316,11 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_write",
     title: "Write a project file",
-    description: "Write one file under /workspace. Content is UTF-8 by default; pass encoding=base64 only for binary bytes. Pass runId to write inside that run's own checkout, where the path may be relative and, being an Arbor-routed path, cannot reach the shared workspace or another run's files. Prefer normal editing tools for code changes; reach for this when the MCP/CLI computer surface is the only filesystem path.",
+    description: "Write one file under /workspace. Content is UTF-8 by default; pass encoding=base64 only for binary bytes. Pass runId to route the write according to that Run: isolated Runs target their Sandbox, shared Runs target the live parent Computer. Without runId the write targets the parent Computer. Prefer normal editing tools for code changes; reach for this when the MCP/CLI computer surface is the only filesystem path.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
       path: exports_external.string().describe("absolute path under /workspace, or a path inside the run"),
-      runId: exports_external.string().optional().describe("write into the checkout of this run, run_… (from computer_run_start)"),
+      runId: exports_external.string().optional().describe("route this write according to this Run execution placement, run_… (from computer_run_start)"),
       content: exports_external.string().describe("complete UTF-8 content, or base64 bytes when encoding=base64"),
       encoding: exports_external.enum(["utf8", "base64"]).optional().describe("content encoding; defaults to utf8, use base64 for binary files")
     },
@@ -18323,7 +18331,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_checkpoint",
     title: "Checkpoint completed work",
-    description: "Save an intermediate complete unit of project work into durable Thread lineage. A running background process may still be writing the workspace, so checkpointing refuses until it is finished or explicitly terminated; use computer_status to inspect active processes. For the final unit, call computer_stop instead; it performs the final checkpoint before teardown. No checkpoint is needed for computer_verify alone because remote visual capture starts no project runtime.",
+    description: "Save the live parent Thread Computer into durable Thread lineage. This is intentionally not Run-scoped: isolated Run publication/integration is a separate contract. If your work is in an isolated Run, do not call this expecting it to save that fork; publish the work through its repository workflow first. A running background process may still be writing the workspace, so checkpointing refuses until it is finished or explicitly terminated; use computer_status to inspect active processes. For the final unit, call computer_stop instead; it performs the final checkpoint before teardown. No checkpoint is needed for computer_verify alone because remote visual capture starts no project runtime.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…")
     },
@@ -18334,7 +18342,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_publish_preview",
     title: "Publish an immutable static Preview",
-    description: "Publish one checked HTML file or bounded static build directory as a private immutable Preview after checkpointing its source. The returned arborthreads.dev URL survives computer teardown; put it on its own line to show the interactive Preview card. A directory must contain index.html, use relative local asset URLs, and cannot include dotfiles, source maps, secrets, symlinks, or server code. Supply one stable idempotencyKey per logical publication: safe retries return the original immutable URL, while reusing the key for another path/title conflicts.",
+    description: "Publish one checked HTML file or bounded static build directory from the live parent Thread Computer as a private immutable Preview after checkpointing its source. This is intentionally not Run-scoped yet; an isolated Run must not silently publish stale parent files or imply integration. The returned arborthreads.dev URL survives computer teardown; put it on its own line to show the interactive Preview card. A directory must contain index.html, use relative local asset URLs, and cannot include dotfiles, source maps, secrets, symlinks, or server code. Supply one stable idempotencyKey per logical publication: safe retries return the original immutable URL, while reusing the key for another path/title conflicts.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
       path: exports_external.string().describe("absolute path to one HTML file or static build directory under /workspace"),
@@ -18348,7 +18356,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_publish_app_bundle",
     title: "Publish an immutable AppBundle",
-    description: "After a Bun container build is green, verify that entryPath bytes exactly match the referenced ArtifactVersion, capture source hashes plus Git/workspace provenance, then freeze the Worker module and optional static assets into a content-addressed AppBundle. A mismatch is rejected; dirty or untracked source is allowed but returned as an explicit warning. Use the returned bundleId with app_deploy; retries require the same idempotencyKey.",
+    description: "From the live parent Thread Computer, after a Bun container build is green, verify that entryPath bytes exactly match the referenced ArtifactVersion. This is intentionally not Run-scoped yet; isolated Run publication requires a separate integration/provenance decision. Then capture source hashes plus Git/workspace provenance, then freeze the Worker module and optional static assets into a content-addressed AppBundle. A mismatch is rejected; dirty or untracked source is allowed but returned as an explicit warning. Use the returned bundleId with app_deploy; retries require the same idempotencyKey.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
       artifactVersionId: exports_external.string().describe("the source ArtifactVersion, artv_…"),
@@ -18381,7 +18389,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "get_computer",
     title: "Read a Thread computer",
-    description: "Read a Thread's redacted effective recipe, active materialized generation, compatibility state, historical generation lineage, current Topic/Thread snapshot refs, recent attachment receipts, active and recent runs with each run's mode/isolation/workspace, and replacement outcomes. Recipe metadata includes provider/backend/profile/repositories/config revision and whether setup is configured, never setup content or credentials. This is durable Arbor protocol state, not live process/presence status.",
+    description: "Read a Thread's redacted effective recipe, active materialized generation, compatibility state, historical generation lineage, current Topic/Thread snapshot refs, recent attachment receipts, active and recent runs with each run's mode/execution/workspace, and replacement outcomes. Recipe metadata includes provider/backend/profile/repositories/config revision and whether setup is configured, never setup content or credentials. This is durable Arbor protocol state, not live process/presence status.",
     inputSchema: {
       threadId: exports_external.string().describe("the Thread, thr_…"),
       lineageLimit: exports_external.number().int().min(1).max(100).optional().describe("recent receipts/lineage rows (default 20)")

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.18.0",
+  "version": "0.19.0",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",