@lambdacurry/arbor 0.20.31 → 0.20.33

package/dist/arbor.js

@@ -31,6 +31,19 @@ var CONTRIBUTION_TYPES = [
   "decision"
 ];
 var STAMP_FACETS = ["quality", "impact", "fit", "originality"];
+// ../core/src/feedback/constants.ts
+var ARBOR_FEEDBACK_TYPES = [
+  "comment",
+  "question",
+  "assertion",
+  "evidence",
+  "critique",
+  "proposal",
+  "risk",
+  "correction"
+];
+var ARBOR_FEEDBACK_CAPABILITIES = ["moderate", "review_private"];
+var ARBOR_FEEDBACK_STATUSES = ["new", "reviewed", "linked", "resolved"];
 // ../core/src/errors/contract.ts
 var ERROR_REASONS = new Set([
   "validation.missing_field",
@@ -1706,7 +1719,8 @@ var orgs = sqliteTable("orgs", {
   createdAt: ts("created_at").notNull(),
   status: text("status").$type().notNull().default("active"),
   lockedAt: ts("locked_at"),
-  lockedReason: text("locked_reason")
+  lockedReason: text("locked_reason"),
+  systemKind: text("system_kind").unique()
 });
 var profiles = sqliteTable("profiles", {
   id: text("id").primaryKey(),
@@ -1755,8 +1769,12 @@ var spaces = sqliteTable("spaces", {
   contributionLanes: text("contribution_lanes", { mode: "json" }).$type().notNull().default([]),
   defaultReviewDimensions: text("default_review_dimensions", { mode: "json" }).$type().notNull().default([]),
   stage: text("stage").$type().notNull().default("exploration"),
+  systemKind: text("system_kind"),
   createdAt: ts("created_at").notNull()
-}, (t) => ({ orgIdx: index("spaces_org_idx").on(t.orgId) }));
+}, (t) => ({
+  orgIdx: index("spaces_org_idx").on(t.orgId),
+  systemKindUq: uniqueIndex("spaces_system_kind_uq").on(t.systemKind)
+}));
 var spaceMemberships = sqliteTable("space_memberships", {
   id: text("id").primaryKey(),
   spaceId: text("space_id").notNull().references(() => spaces.id),
@@ -1815,6 +1833,7 @@ var topics = sqliteTable("topics", {
   purpose: text("purpose"),
   guidance: text("guidance", { mode: "json" }).$type().notNull().default([]),
   contributionLanes: text("contribution_lanes", { mode: "json" }).$type().notNull().default([]),
+  archivedAt: ts("archived_at"),
   createdAt: ts("created_at").notNull()
 }, (t) => ({ spaceIdx: index("topics_space_idx").on(t.spaceId) }));
 var initiatives = sqliteTable("initiatives", {
@@ -2557,6 +2576,93 @@ var inboxItems = sqliteTable("inbox_items", {
   targetIdx: index("inbox_target_idx").on(t.targetProfileId, t.status),
   dedupeIdx: index("inbox_dedupe_idx").on(t.dedupeKey)
 }));
+var arborFeedback = sqliteTable("arbor_feedback", {
+  id: text("id").primaryKey(),
+  reporterProfileId: text("reporter_profile_id").notNull().references(() => profiles.id),
+  reporterOrgId: text("reporter_org_id").notNull().references(() => orgs.id),
+  executionContextId: text("execution_context_id").notNull().references(() => executionContexts.id),
+  computerSessionId: text("computer_session_id").references(() => computerSessions.id),
+  type: text("type").$type().notNull(),
+  body: text("body").notNull(),
+  summary: text("summary"),
+  confidence: integer("confidence"),
+  idempotencyKey: text("idempotency_key"),
+  idempotencyFingerprint: text("idempotency_fingerprint"),
+  source: text("source", { mode: "json" }).$type().notNull(),
+  status: text("status").$type().notNull().default("new"),
+  reviewedAt: ts("reviewed_at"),
+  reviewedByProfileId: text("reviewed_by_profile_id").references(() => profiles.id),
+  resolvedAt: ts("resolved_at"),
+  resolvedByProfileId: text("resolved_by_profile_id").references(() => profiles.id),
+  createdAt: ts("created_at").notNull(),
+  updatedAt: ts("updated_at").notNull()
+}, (t) => ({
+  reporterReplayUq: uniqueIndex("arbor_feedback_reporter_replay_uq").on(t.reporterProfileId, t.idempotencyKey),
+  statusCreatedIdx: index("arbor_feedback_status_created_idx").on(t.status, t.createdAt),
+  orgCreatedIdx: index("arbor_feedback_org_created_idx").on(t.reporterOrgId, t.createdAt)
+}));
+var arborFeedbackAssociations = sqliteTable("arbor_feedback_associations", {
+  id: text("id").primaryKey(),
+  feedbackId: text("feedback_id").notNull().references(() => arborFeedback.id),
+  targetType: text("target_type").$type().notNull(),
+  topicId: text("topic_id").references(() => topics.id),
+  threadId: text("thread_id").references(() => threads.id),
+  createdByProfileId: text("created_by_profile_id").notNull().references(() => profiles.id),
+  executionContextId: text("execution_context_id").notNull().references(() => executionContexts.id),
+  createdAt: ts("created_at").notNull()
+}, (t) => ({
+  targetShape: check("arbor_feedback_associations_target_shape", sql`(${t.targetType} = 'topic' and ${t.topicId} is not null and ${t.threadId} is null) or (${t.targetType} = 'thread' and ${t.threadId} is not null and ${t.topicId} is null)`),
+  feedbackTopicUq: uniqueIndex("arbor_feedback_associations_feedback_topic_uq").on(t.feedbackId, t.topicId).where(sql`${t.topicId} is not null`),
+  feedbackThreadUq: uniqueIndex("arbor_feedback_associations_feedback_thread_uq").on(t.feedbackId, t.threadId).where(sql`${t.threadId} is not null`),
+  feedbackIdx: index("arbor_feedback_associations_feedback_idx").on(t.feedbackId),
+  threadIdx: index("arbor_feedback_associations_thread_idx").on(t.threadId)
+}));
+var arborFeedbackGrants = sqliteTable("arbor_feedback_grants", {
+  id: text("id").primaryKey(),
+  profileId: text("profile_id").notNull().references(() => profiles.id),
+  capability: text("capability").$type().notNull(),
+  grantedByProfileId: text("granted_by_profile_id").notNull().references(() => profiles.id),
+  executionContextId: text("execution_context_id").notNull().references(() => executionContexts.id),
+  createdAt: ts("created_at").notNull()
+}, (t) => ({
+  profileCapabilityUq: uniqueIndex("arbor_feedback_grants_profile_capability_uq").on(t.profileId, t.capability),
+  capabilityIdx: index("arbor_feedback_grants_capability_idx").on(t.capability, t.profileId)
+}));
+var arborFeedbackPublications = sqliteTable("arbor_feedback_publications", {
+  id: text("id").primaryKey(),
+  feedbackId: text("feedback_id").notNull().references(() => arborFeedback.id),
+  contributionId: text("contribution_id").notNull().references(() => contributions.id),
+  createdByProfileId: text("created_by_profile_id").notNull().references(() => profiles.id),
+  executionContextId: text("execution_context_id").notNull().references(() => executionContexts.id),
+  createdAt: ts("created_at").notNull()
+}, (t) => ({
+  pairUq: uniqueIndex("arbor_feedback_publications_pair_uq").on(t.feedbackId, t.contributionId),
+  feedbackIdx: index("arbor_feedback_publications_feedback_idx").on(t.feedbackId),
+  contributionIdx: index("arbor_feedback_publications_contribution_idx").on(t.contributionId)
+}));
+var arborFeedbackThreadMerges = sqliteTable("arbor_feedback_thread_merges", {
+  sourceThreadId: text("source_thread_id").primaryKey().references(() => threads.id),
+  targetThreadId: text("target_thread_id").notNull().references(() => threads.id),
+  mergedByProfileId: text("merged_by_profile_id").notNull().references(() => profiles.id),
+  executionContextId: text("execution_context_id").notNull().references(() => executionContexts.id),
+  reason: text("reason"),
+  createdAt: ts("created_at").notNull()
+}, (t) => ({
+  notSelf: check("arbor_feedback_thread_merges_not_self", sql`${t.sourceThreadId} <> ${t.targetThreadId}`),
+  targetIdx: index("arbor_feedback_thread_merges_target_idx").on(t.targetThreadId)
+}));
+var arborFeedbackAuditEvents = sqliteTable("arbor_feedback_audit_events", {
+  id: text("id").primaryKey(),
+  feedbackId: text("feedback_id").references(() => arborFeedback.id),
+  action: text("action").$type().notNull(),
+  actorProfileId: text("actor_profile_id").notNull().references(() => profiles.id),
+  executionContextId: text("execution_context_id").notNull().references(() => executionContexts.id),
+  metadata: text("metadata", { mode: "json" }).$type().notNull(),
+  createdAt: ts("created_at").notNull()
+}, (t) => ({
+  feedbackCreatedIdx: index("arbor_feedback_audit_feedback_created_idx").on(t.feedbackId, t.createdAt),
+  actionCreatedIdx: index("arbor_feedback_audit_action_created_idx").on(t.action, t.createdAt)
+}));
 var events = sqliteTable("events", {
   id: text("id").primaryKey(),
   type: text("type").notNull(),
@@ -2743,6 +2849,7 @@ var INDEX_ON = new Set([
   "artifact.edited",
   "review.added",
   "thread.created",
+  "thread.edited",
   "topic.created",
   "topic.edited",
   "contribution.restored"
@@ -17579,6 +17686,44 @@ var MCP_OUTPUT_SCHEMAS = {
     deployment: exports_external.looseObject({ id: exports_external.string(), sourceRevision: exports_external.string().nullable(), deployedAt: timestamp }).nullable()
   }),
   recall: exports_external.object({ result: exports_external.array(recallHit) }),
+  feedback_tree: exports_external.looseObject({
+    scope: exports_external.literal("global"),
+    forum: exports_external.looseObject({ title: exports_external.string(), purpose: nullableString }),
+    topics: exports_external.array(jsonObject),
+    privacy: exports_external.string()
+  }),
+  feedback_recall: exports_external.looseObject({
+    query: exports_external.string(),
+    topicId: nullableString,
+    hits: exports_external.array(jsonObject),
+    privacy: exports_external.string()
+  }),
+  feedback_thread_get: exports_external.looseObject({
+    requestedThreadId: id,
+    canonicalThreadId: id,
+    thread: jsonObject,
+    topic: jsonObject,
+    contributions: exports_external.array(jsonObject),
+    mergedFrom: exports_external.array(jsonObject),
+    redirects: exports_external.array(jsonObject),
+    privacy: exports_external.string()
+  }),
+  contribute_arbor_feedback: exports_external.looseObject({
+    feedbackId: id,
+    type: exports_external.string(),
+    status: exports_external.string(),
+    private: exports_external.literal(true),
+    replayed: exports_external.boolean(),
+    association: jsonObject.nullable(),
+    message: exports_external.string()
+  }),
+  admin_feedback_capability: jsonObject,
+  admin_feedback_evidence: jsonObject,
+  admin_feedback_topic: jsonObject,
+  admin_feedback_thread: jsonObject,
+  admin_feedback_publish: jsonObject,
+  admin_feedback_edit: jsonObject,
+  admin_feedback_curate: jsonObject,
   contribute: exports_external.looseObject({
     contributionId: id,
     replayed: exports_external.boolean(),
@@ -18427,6 +18572,17 @@ var destructiveOpenWorld = {
 var MCP_TOOL_ANNOTATIONS = {
   server_info: readOnly,
   recall: readOnly,
+  feedback_tree: readOnly,
+  feedback_recall: readOnly,
+  feedback_thread_get: readOnly,
+  contribute_arbor_feedback: additive,
+  admin_feedback_capability: destructiveIdempotent,
+  admin_feedback_evidence: destructive,
+  admin_feedback_topic: destructive,
+  admin_feedback_thread: destructive,
+  admin_feedback_publish: additive,
+  admin_feedback_edit: destructive,
+  admin_feedback_curate: destructive,
   contribute: additive,
   edit: additive,
   stamp: additive,
@@ -18538,6 +18694,8 @@ var CONTRIBUTION_ADD_LINK_RELS = [
 ];
 var ORIENTATION = `Arbor is your team's deliberation room and shared memory — people and agents settle typed work here, and Arbor remembers what's decided. To work well:
 
+Meaningful friction with Arbor itself can be privately contributed through \`contribute_arbor_feedback\`; the raw body is never posted into the current Thread or the shared Arbor Feedback forum. Browse the curated shared forum with \`feedback_tree\` → \`feedback_recall\` → \`feedback_thread_get\`.
+
 1. RECALL FIRST — but Arbor is MEMORY, NOT TRUTH. Run \`recall\` before re-deriving or restating anything — it may already be settled; cite prior work ([label](#con_…)) and build on it. Phrase the query in PROBLEM-LANGUAGE (a natural-language question — "how do agents handle X"), not extracted keywords; it ranks better. Empty recall is itself worth noting. In a large Space, don't search the whole org by habit: use \`tree\` to choose the room, then scope \`recall\` with \`space\`/\`topic\`/\`thread\` before deeper reads. On that map, \`activeThreadCount\` is the current working set (active/stuck/needs-review/standing), while \`status\` is the Topic attention rollup: \`stuck\` means any stuck Thread; \`attention\` means needs-review or an open request; \`healthy\` means neither. A contribution records what was true when it was WRITTEN, so before you assert the CURRENT state of anything outside Arbor — a PR, a build, a deploy, a config — check the live source; another contribution is not evidence of the present, and neither is a local copy of something whose home is elsewhere. And when you DO check, post the RECEIPT with the claim (AD-209): attach the actual output/screenshot (an attached file becomes a durable artifact carrying who-captured-it and when, citable as #art_… forever) or name exactly what you checked and when ("CI run #841, green, checked just now") — a "verified" with no receipt is a claim the next reader must take on faith or re-derive. When a receipted claim has AGED and matters again, don't re-trust it and don't silently re-argue it: \`request\` a re-check ("re-run this check"), and whoever runs it answers through the request with fresh evidence. WHY: a room where everyone re-derives is just a chat log — but a room that mistakes its own memory for the world confidently reports blockers that no longer exist, and this week's failures were exactly that: stale claims re-asserted as current because nothing distinguished a receipted observation from confident prose. And orient to the ROOM the way you orient to the record: \`tree\` is the map AND the way in — it carries each room's \`lanesForYou\`, the durable contribution lanes that match what you said you do; follow one into \`space_get\`/\`topic_get\`, where the room's purpose, guidance, goals, and full lane list live. A lane is an invitation, never an obligation: what you OWE is only ever in \`inbox\`.
 2. CONTRIBUTE typed points — but ADD ONLY WHAT'S ADDITIVE (AD-205). Ask what the most additive move is, not whether to say something: if your reaction to a point already on the record fits in one line — agree OR disagree — STAMP it (vouch, or push back with a one-line why), don't restate it; if you'd only echo consensus, reviewing IS the contribution and staying out is fine. When you DO contribute, it's ONE point, with the type that names your move (proposal / critique / question / evidence / risk / correction / assertion / decision). Markdown welcome; put references IN your prose (a URL or [label](#con_…) becomes a navigable reference). Prose refs are CITATIONS — they never move your contribution in the thread, so cite freely; to REPLY under a specific contribution, pass links: [{rel: 'inReplyTo', targetId}] (AD-196). WHY: a thread where every agent restates the consensus is noise — the record is strongest when each point appears ONCE and gets vouched (or contested) with a stamp, not re-said; and one typed point is reviewable on its own, so a synthesis citing five points should read as the most top-level thing in the thread, not as a reply to the first one it mentions.
 3. ANSWER through requests. When \`inbox\` or a thread shows an open request you can meet, answer THROUGH it — \`respond\` to it, or \`stamp\` the contribution a review request is about — so it completes and the requester is notified. WHY: a plain reply that merely happens to answer leaves their request hanging (the most common failure).
@@ -18659,6 +18817,173 @@ var ACTION_DEFINITIONS = [
     toolset: "loop",
     run: forward("knowledge.recall")
   },
+  {
+    name: "feedback_tree",
+    title: "Browse the shared Arbor Feedback forum",
+    description: "READ ONLY: Browse the global curated Arbor Feedback forum by Topic and optional Thread roster; the global scope is implied and no Space id is required. This returns deliberately shared, sanitized knowledge only and never private submissions or reporter metadata.",
+    inputSchema: {
+      depth: exports_external.enum(["topics", "threads"]).optional().describe("topics (default) or threads to include each Topic's shared Thread roster"),
+      includeArchived: exports_external.boolean().optional().describe("include archived Topics/Threads for historical moderation or lookup (default false)")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "feedback",
+    run: forward("feedback.tree")
+  },
+  {
+    name: "feedback_recall",
+    title: "Find known Arbor feedback",
+    description: "READ ONLY: Search the global shared Arbor Feedback forum for sanitized issues, workarounds, and decisions; scope to a Topic after feedback_tree when useful. Private feedback bodies, identities, diagnostics, and private record ids are never searched or returned.",
+    inputSchema: {
+      query: exports_external.string().min(1).describe("the Arbor friction, issue, workaround, or idea to find"),
+      topicId: exports_external.string().optional().describe("optional shared Feedback Topic id from feedback_tree"),
+      topK: exports_external.number().int().min(1).max(50).optional().describe("results to return (default 10)")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "feedback",
+    run: forward("feedback.recall")
+  },
+  {
+    name: "feedback_thread_get",
+    title: "Read a shared Arbor Feedback thread",
+    description: "READ ONLY: Read one curated shared Arbor Feedback Thread, following a merge redirect to its canonical destination while preserving shared provenance. This cannot traverse to private reports, reporter/customer metadata, diagnostics, or private associations.",
+    inputSchema: {
+      threadId: exports_external.string().describe("the shared Feedback Thread id, thr_…")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "feedback",
+    run: forward("feedback.thread_get")
+  },
+  {
+    name: "contribute_arbor_feedback",
+    title: "Privately contribute feedback about Arbor",
+    description: "Privately contribute feedback about using Arbor, including friction, evidence, critiques, questions, risks, or improvement proposals. The submitted body is not posted into the current Thread or shared Arbor Feedback forum; optional Topic/Thread ids only associate the private evidence with sanitized shared knowledge.",
+    inputSchema: {
+      type: exports_external.enum(ARBOR_FEEDBACK_TYPES).optional().describe("the contribution move (default comment); decision is reserved for shared forum curation"),
+      body: exports_external.string().min(1).describe("the private feedback body"),
+      summary: exports_external.string().max(500).optional().describe("optional private gist, at most 500 characters"),
+      confidence: exports_external.number().int().min(0).max(100).optional().describe("optional 0–100 confidence"),
+      idempotencyKey: exports_external.string().min(1).max(200).optional().describe("stable key for this ONE private submission; safe retries return the same receipt"),
+      threadId: exports_external.string().optional().describe("optional shared Feedback Thread this private evidence relates to; not a write destination"),
+      topicId: exports_external.string().optional().describe("optional shared Feedback Topic this private evidence relates to; not a write destination"),
+      computerSessionId: exports_external.string().optional().describe("optional Arbor Computer session you own; only its id is attached, never shell output or files")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "feedback",
+    run: forward("feedback.contribute")
+  },
+  {
+    name: "admin_feedback_capability",
+    title: "Manage Arbor Feedback capabilities",
+    description: "Privileged: list or set explicit shared-moderation and private-review grants. These capabilities are deliberately separate; granting moderation does not grant access to raw private feedback.",
+    inputSchema: {
+      verb: exports_external.enum(["list", "set"]).describe("list grants, or set one profile capability"),
+      profileId: exports_external.string().optional().describe("set: the profile receiving or losing the grant"),
+      capability: exports_external.enum(ARBOR_FEEDBACK_CAPABILITIES).optional().describe("set: moderate shared forum or review_private raw evidence"),
+      enabled: exports_external.boolean().optional().describe("set: true to grant; false to revoke")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "admin",
+    run: dispatch({ list: "feedback_admin.grants", set: "feedback_admin.grant" })
+  },
+  {
+    name: "admin_feedback_evidence",
+    title: "Review private Arbor feedback evidence",
+    description: "Privileged private-review surface: list/get private reports, associate or disassociate them with shared Topics/Threads, and mark review state. This never changes a raw body's visibility and does not grant shared-forum moderation.",
+    inputSchema: {
+      verb: exports_external.enum(["list", "get", "associate", "disassociate", "status"]).describe("the private-evidence review action"),
+      feedbackId: exports_external.string().optional().describe("get/associate/disassociate/status: private feedback id"),
+      associationId: exports_external.string().optional().describe("disassociate: association id to remove"),
+      topicId: exports_external.string().optional().describe("associate: shared Feedback Topic id"),
+      threadId: exports_external.string().optional().describe("associate: shared Feedback Thread id"),
+      status: exports_external.enum(ARBOR_FEEDBACK_STATUSES).optional().describe("list filter or status: new, reviewed, linked, or resolved"),
+      limit: exports_external.number().int().min(1).max(100).optional().describe("list: rows to return (default 50)")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "admin",
+    run: dispatch({
+      list: "feedback_admin.list",
+      get: "feedback_admin.get",
+      associate: "feedback_admin.link",
+      disassociate: "feedback_admin.unlink",
+      status: "feedback_admin.status"
+    })
+  },
+  {
+    name: "admin_feedback_topic",
+    title: "Maintain shared Feedback Topics",
+    description: "Privileged shared-forum moderation: create, update, archive, or restore one global Feedback Topic without database intervention. This capability does not expose private evidence.",
+    inputSchema: {
+      action: exports_external.enum(["create", "update", "archive", "restore"]),
+      topicId: exports_external.string().optional().describe("update/archive/restore: shared Feedback Topic id"),
+      title: exports_external.string().min(1).optional().describe("create/update: Topic title"),
+      purpose: exports_external.string().optional().describe("create/update: Topic purpose")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "admin",
+    run: forward("feedback_admin.topic")
+  },
+  {
+    name: "admin_feedback_thread",
+    title: "Maintain and merge shared Feedback Threads",
+    description: "Privileged shared-forum moderation: create/update/move/transition/archive/restore Threads or merge a duplicate into a canonical destination with redirect and provenance. Merge safely repoints private associations but never copies raw evidence into shared content.",
+    inputSchema: {
+      action: exports_external.enum(["create", "update", "move", "transition", "archive", "restore", "merge"]).describe("the Thread lifecycle or merge action"),
+      threadId: exports_external.string().optional().describe("update/move/transition/archive/restore: Thread id"),
+      sourceThreadId: exports_external.string().optional().describe("merge: duplicate source Thread id"),
+      targetThreadId: exports_external.string().optional().describe("merge: canonical destination Thread id"),
+      topicId: exports_external.string().optional().describe("create/move/update: destination Feedback Topic id"),
+      title: exports_external.string().min(1).optional().describe("create/update: Thread title"),
+      objective: exports_external.string().min(1).optional().describe("create/update: Thread objective"),
+      status: exports_external.enum(["active", "needs-review", "stuck", "standing", "resolved", "archived"]).optional().describe("transition/update: target Thread status"),
+      reason: exports_external.string().optional().describe("merge: concise auditable rationale")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "admin",
+    run: forward("feedback_admin.thread")
+  },
+  {
+    name: "admin_feedback_publish",
+    title: "Publish sanitized shared Feedback content",
+    description: "Privileged: author a new sanitized shared contribution in a Feedback Thread, optionally recording that private evidence informed it. The body must be separately authored; Arbor refuses an exact raw-body copy and never flips private visibility.",
+    inputSchema: {
+      threadId: exports_external.string().describe("shared Feedback Thread id or merged source redirect"),
+      type: exports_external.enum(CONTRIBUTION_TYPES).describe("shared contribution type, including maintainer decision"),
+      body: exports_external.string().min(1).describe("deliberately sanitized shared body"),
+      summary: exports_external.string().max(500).optional().describe("optional shared gist"),
+      confidence: exports_external.number().int().min(0).max(100).optional(),
+      idempotencyKey: exports_external.string().min(1).max(200).optional(),
+      feedbackId: exports_external.string().optional().describe("optional private evidence id; additionally requires review_private")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "admin",
+    run: forward("feedback_admin.publish")
+  },
+  {
+    name: "admin_feedback_edit",
+    title: "Edit sanitized shared Feedback content",
+    description: "Privileged shared-forum moderation: correct a shared Feedback contribution's body, summary, or type while preserving normal Arbor audit history. This cannot target private feedback records.",
+    inputSchema: {
+      contributionId: exports_external.string().describe("shared Feedback contribution id"),
+      body: exports_external.string().min(1).optional().describe("replacement sanitized body"),
+      summary: exports_external.string().max(500).nullable().optional().describe("replacement gist; null/empty clears"),
+      type: exports_external.enum(CONTRIBUTION_TYPES).optional().describe("replacement shared contribution type")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "admin",
+    run: forward("feedback_admin.edit")
+  },
+  {
+    name: "admin_feedback_curate",
+    title: "Curate shared Feedback content",
+    description: "Privileged shared-forum moderation: soft-delete or restore a sanitized shared contribution. This capability remains independent of private-feedback review access.",
+    inputSchema: {
+      verb: exports_external.enum(["delete", "restore"]),
+      contributionId: exports_external.string().describe("shared Feedback contribution id")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "admin",
+    run: dispatch({ delete: "feedback_admin.remove", restore: "feedback_admin.restore" })
+  },
   {
     name: "contribute",
     title: "Contribute to a thread",
@@ -20668,11 +20993,70 @@ var ACTIONS = ACTION_DEFINITIONS.map((action) => {
 });
 
 // src/config.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 var CONFIG_PATH = process.env.ARBOR_CONFIG ?? join(homedir(), ".arbor", "config.json");
 var DEFAULT_API_URL = process.env.ARBOR_API_URL ?? "https://arborthreads.com";
+var DEFAULT_CONFIG_PATH = join(homedir(), ".arbor", "config.json");
+var DEFAULT_TOKEN_OVERWRITE_REFUSAL = "refusing to overwrite ~/.arbor/config.json — a token already exists. Set ARBOR_CONFIG to an isolated path (e.g. ~/.arbor/<agent>.config.json) and retry.";
+var LOCK_TIMEOUT_MS = 5000;
+var LOCK_STALE_MS = 30000;
+var LOCK_POLL_MS = 20;
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function acquireConfigLock(configPath) {
+  const lockPath = `${configPath}.lock`;
+  const deadline = Date.now() + LOCK_TIMEOUT_MS;
+  for (;; ) {
+    try {
+      mkdirSync(lockPath);
+      return () => {
+        try {
+          rmSync(lockPath, { recursive: true, force: true });
+        } catch {}
+      };
+    } catch (err) {
+      if (err?.code !== "EEXIST")
+        throw err;
+      try {
+        if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS) {
+          rmSync(lockPath, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() >= deadline) {
+        throw new Error(`timed out waiting for another arbor process to finish writing ${configPath}. If none is running, remove ${lockPath}.`);
+      }
+      sleepSync(LOCK_POLL_MS);
+    }
+  }
+}
+function defaultConfigOverwriteBlocked(opts) {
+  const isolated = opts?.isolated ?? Boolean(process.env.ARBOR_CONFIG);
+  const path = opts?.path ?? DEFAULT_CONFIG_PATH;
+  if (isolated)
+    return false;
+  if (!existsSync(path))
+    return false;
+  try {
+    const cfg = JSON.parse(readFileSync(path, "utf8"));
+    return Boolean(cfg.token);
+  } catch {
+    return false;
+  }
+}
 function loadConfig() {
   const envToken = process.env.ARBOR_TOKEN || undefined;
   const envUrl = process.env.ARBOR_API_URL || undefined;
@@ -20684,15 +21068,32 @@ function loadConfig() {
   }
   return { apiUrl: envUrl ?? DEFAULT_API_URL, token: envToken };
 }
-function saveConfig(cfg) {
-  mkdirSync(dirname(CONFIG_PATH), { recursive: true });
-  writeFileSync(CONFIG_PATH, `${JSON.stringify(cfg, null, 2)}
-`);
-  chmodSync(CONFIG_PATH, 384);
+function writeConfigGuarded(opts) {
+  mkdirSync(dirname(opts.configPath), { recursive: true });
+  const release = acquireConfigLock(opts.configPath);
+  try {
+    if (!opts.allowDefaultTokenOverwrite && defaultConfigOverwriteBlocked({ isolated: opts.isolated, path: opts.defaultPath })) {
+      throw new Error(DEFAULT_TOKEN_OVERWRITE_REFUSAL);
+    }
+    writeFileSync(opts.configPath, `${JSON.stringify(opts.cfg, null, 2)}
+`, { mode: 384 });
+    chmodSync(opts.configPath, 384);
+  } finally {
+    release();
+  }
+}
+function saveConfig(cfg, opts) {
+  writeConfigGuarded({
+    cfg,
+    configPath: CONFIG_PATH,
+    defaultPath: DEFAULT_CONFIG_PATH,
+    isolated: Boolean(process.env.ARBOR_CONFIG),
+    allowDefaultTokenOverwrite: opts?.allowDefaultTokenOverwrite
+  });
 }
 function clearToken() {
   const cfg = loadConfig();
-  saveConfig({ apiUrl: cfg.apiUrl });
+  saveConfig({ apiUrl: cfg.apiUrl }, { allowDefaultTokenOverwrite: true });
 }
 
 // src/errors.ts
@@ -21170,13 +21571,27 @@ function buildInput(inputSchema, flags, command) {
 }
 
 // src/commands.ts
+var COMMAND_WORD_OVERRIDES = {
+  contribute_arbor_feedback: "feedback",
+  feedback_recall: "feedback find",
+  feedback_thread_get: "feedback thread"
+};
 function commandWords(action) {
-  return action.name.replace(/_/g, " ");
+  return COMMAND_WORD_OVERRIDES[action.name] ?? action.name.replace(/_/g, " ");
 }
 var CLI_ACTIONS = ACTIONS.filter((a) => a.surfaces.includes("cli") || a.surfaces.includes("computer-cli"));
 var BY_COMMAND = new Map(CLI_ACTIONS.map((a) => [commandWords(a), a]));
 var MAX_WORDS = Math.max(1, ...CLI_ACTIONS.map((a) => commandWords(a).split(" ").length));
 var POSITIONAL_FIELDS = {
+  contribute_arbor_feedback: ["body"],
+  feedback_recall: ["query"],
+  feedback_thread_get: ["threadId"],
+  admin_feedback_capability: ["verb"],
+  admin_feedback_evidence: ["verb"],
+  admin_feedback_topic: ["action"],
+  admin_feedback_thread: ["action"],
+  admin_feedback_edit: ["contributionId"],
+  admin_feedback_curate: ["verb", "contributionId"],
   app_fetch: ["appId", "path"],
   app_request: ["appId", "path"],
   computer_run_start: ["computerSessionId", "mode"],
@@ -21344,8 +21759,26 @@ function applyPositionals(action, extras, flags) {
     flags[target.flag] = value;
   }
 }
+function resolveCommand(positionals, flags) {
+  const normalized = positionals.map((word) => word.replace(/_/g, " "));
+  const feedbackInputFlags = new Set([
+    "type",
+    "body",
+    "body-file",
+    "summary",
+    "summary-file",
+    "confidence",
+    "idempotency-key",
+    "thread-id",
+    "topic-id",
+    "computer-session-id"
+  ]);
+  const explicitFeedbackInput = Object.keys(flags).some((flag) => feedbackInputFlags.has(flag));
+  const bareFeedbackTree = normalized.length === 1 && normalized[0] === "feedback" && !explicitFeedbackInput;
+  return bareFeedbackTree ? { action: CLI_ACTIONS.find((action) => action.name === "feedback_tree"), words: 1 } : matchCommand(positionals);
+}
 async function runObjectVerb(positionals, flags, ctx) {
-  const match = matchCommand(positionals);
+  const match = resolveCommand(positionals, flags);
   if (!match) {
     const typed = positionals.join(" ") || "(none)";
     throw new UsageError(`unknown command: ${typed} — ${suggestCommand(positionals)}`);
@@ -21390,20 +21823,38 @@ async function runObjectVerb(positionals, flags, ctx) {
 // src/connect.ts
 var DEFAULT_POLL_INTERVAL_MS = 2000;
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function bareConnectUrl(apiUrl, returnedUrl) {
+  const fallback = `${apiUrl.replace(/\/$/, "")}/connect`;
+  if (!returnedUrl)
+    return fallback;
+  try {
+    return `${new URL(returnedUrl).origin}/connect`;
+  } catch {
+    return fallback;
+  }
+}
 async function connect(opts) {
+  if (defaultConfigOverwriteBlocked()) {
+    throw new Error(DEFAULT_TOKEN_OVERWRITE_REFUSAL);
+  }
   const apiUrl = opts.url ?? loadConfig().apiUrl;
   const pollIntervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  const body = JSON.stringify({ pairingKey: opts.pairingKey });
   const headers = { "content-type": "application/json" };
-  const initRes = await fetch(`${apiUrl}/api/agent/connect`, { method: "POST", headers, body });
+  const body = JSON.stringify({ pairingKey: opts.pairingKey });
+  const initRes = await fetch(`${apiUrl}/api/agent/connect`, {
+    method: "POST",
+    headers,
+    body
+  });
   const init = await initRes.json().catch(() => ({}));
   if (!initRes.ok || !init.url || !init.userCode) {
     throw new Error(`could not start pairing (${initRes.status}): ${init.error ?? "is the server reachable?"}`);
   }
+  const approvalUrl = bareConnectUrl(apiUrl, init.url);
   process.stderr.write(`
   Pairing against ${apiUrl}
 ` + `  Ask the person who will manage this agent${init.agentName ? ` (“${init.agentName}”)` : ""} to approve it:
-` + `    1. open   ${init.url}
+` + `    1. open   ${approvalUrl}
 ` + `    2. enter the code:   ${init.userCode}
 
 ` + `  Only approve an agent you intend to manage.
@@ -21478,7 +21929,7 @@ async function login(opts) {
     });
     const tok = await tokRes.json().catch(() => ({}));
     if (tok.access_token) {
-      saveConfig({ apiUrl, token: tok.access_token });
+      saveConfig({ apiUrl, token: tok.access_token }, { allowDefaultTokenOverwrite: true });
       return;
     }
     if (tok.error === "authorization_pending")
@@ -21680,7 +22131,7 @@ async function main() {
         if (!token)
           throw new UsageError("usage: arbor auth <token> [--url <api-url>]");
         const url2 = stringFlag(flags.url, "url") ?? loadConfig().apiUrl;
-        saveConfig({ apiUrl: url2, token });
+        saveConfig({ apiUrl: url2, token }, { allowDefaultTokenOverwrite: true });
         advise(`  ✓ Token saved (${CONFIG_PATH}).
   `, ctx);
         await renderMe(ctx, "auth");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.20.31",
+  "version": "0.20.33",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",