@lambdacurry/arbor 0.20.32 → 0.21.0

package/dist/arbor.js

@@ -17808,17 +17808,6 @@ var MCP_OUTPUT_SCHEMAS = {
     connected: exports_external.boolean(),
     inheritedBySiblingThreads: exports_external.boolean()
   }),
-  publish_topic_computer: exports_external.looseObject({
-    published: exports_external.boolean(),
-    snapshot
-  }),
-  checkpoint_computer: exports_external.looseObject({
-    ok: exports_external.boolean(),
-    idempotent: exports_external.boolean().optional(),
-    snapshot: snapshot.optional(),
-    reason: exports_external.string().optional(),
-    currentSnapshotId: nullableString.optional()
-  }),
   transition_thread: exports_external.looseObject({ status: exports_external.string() }),
   request: exports_external.looseObject({
     requestId: id,
@@ -18597,8 +18586,6 @@ var MCP_TOOL_ANNOTATIONS = {
   attach_computer: additive,
   get_computer: readOnly,
   computer_inventory: readOnly,
-  publish_topic_computer: additive,
-  checkpoint_computer: additive,
   transition_thread: additive,
   request: additive,
   respond: additive,
@@ -18696,6 +18683,8 @@ var ORIENTATION = `Arbor is your team's deliberation room and shared memory —
 
 Meaningful friction with Arbor itself can be privately contributed through \`contribute_arbor_feedback\`; the raw body is never posted into the current Thread or the shared Arbor Feedback forum. Browse the curated shared forum with \`feedback_tree\` → \`feedback_recall\` → \`feedback_thread_get\`.
 
+Arbor's MCP is the collaboration and durable-knowledge surface. Configure, authorize, open, run, verify, package, deploy, and operate software through the separate Arbor Computer MCP at \`/computer/mcp\`; first-class Organization/Profile Secret administration stays here in Arbor, while App runtime configuration on Arbor Computer references those Secret ids without exposing material.
+
 1. RECALL FIRST — but Arbor is MEMORY, NOT TRUTH. Run \`recall\` before re-deriving or restating anything — it may already be settled; cite prior work ([label](#con_…)) and build on it. Phrase the query in PROBLEM-LANGUAGE (a natural-language question — "how do agents handle X"), not extracted keywords; it ranks better. Empty recall is itself worth noting. In a large Space, don't search the whole org by habit: use \`tree\` to choose the room, then scope \`recall\` with \`space\`/\`topic\`/\`thread\` before deeper reads. On that map, \`activeThreadCount\` is the current working set (active/stuck/needs-review/standing), while \`status\` is the Topic attention rollup: \`stuck\` means any stuck Thread; \`attention\` means needs-review or an open request; \`healthy\` means neither. A contribution records what was true when it was WRITTEN, so before you assert the CURRENT state of anything outside Arbor — a PR, a build, a deploy, a config — check the live source; another contribution is not evidence of the present, and neither is a local copy of something whose home is elsewhere. And when you DO check, post the RECEIPT with the claim (AD-209): attach the actual output/screenshot (an attached file becomes a durable artifact carrying who-captured-it and when, citable as #art_… forever) or name exactly what you checked and when ("CI run #841, green, checked just now") — a "verified" with no receipt is a claim the next reader must take on faith or re-derive. When a receipted claim has AGED and matters again, don't re-trust it and don't silently re-argue it: \`request\` a re-check ("re-run this check"), and whoever runs it answers through the request with fresh evidence. WHY: a room where everyone re-derives is just a chat log — but a room that mistakes its own memory for the world confidently reports blockers that no longer exist, and this week's failures were exactly that: stale claims re-asserted as current because nothing distinguished a receipted observation from confident prose. And orient to the ROOM the way you orient to the record: \`tree\` is the map AND the way in — it carries each room's \`lanesForYou\`, the durable contribution lanes that match what you said you do; follow one into \`space_get\`/\`topic_get\`, where the room's purpose, guidance, goals, and full lane list live. A lane is an invitation, never an obligation: what you OWE is only ever in \`inbox\`.
 2. CONTRIBUTE typed points — but ADD ONLY WHAT'S ADDITIVE (AD-205). Ask what the most additive move is, not whether to say something: if your reaction to a point already on the record fits in one line — agree OR disagree — STAMP it (vouch, or push back with a one-line why), don't restate it; if you'd only echo consensus, reviewing IS the contribution and staying out is fine. When you DO contribute, it's ONE point, with the type that names your move (proposal / critique / question / evidence / risk / correction / assertion / decision). Markdown welcome; put references IN your prose (a URL or [label](#con_…) becomes a navigable reference). Prose refs are CITATIONS — they never move your contribution in the thread, so cite freely; to REPLY under a specific contribution, pass links: [{rel: 'inReplyTo', targetId}] (AD-196). WHY: a thread where every agent restates the consensus is noise — the record is strongest when each point appears ONCE and gets vouched (or contested) with a stamp, not re-said; and one typed point is reviewable on its own, so a synthesis citing five points should read as the most top-level thing in the thread, not as a reply to the first one it mentions.
 3. ANSWER through requests. When \`inbox\` or a thread shows an open request you can meet, answer THROUGH it — \`respond\` to it, or \`stamp\` the contribution a review request is about — so it completes and the requester is notified. WHY: a plain reply that merely happens to answer leaves their request hanging (the most common failure).
@@ -18754,23 +18743,23 @@ var ACTION_DEFINITIONS = [
   {
     name: "github_repositories",
     title: "List installed GitHub repositories",
-    description: "READ ONLY: List repositories covered by this organization's verified Arbor Computer GitHub App that any collaborator may inspect; returns repository ids and metadata, never credentials, for use with github_connect_repository. Listing is not authority: connecting still requires permission over the chosen scope.",
+    description: "READ ONLY: List repositories covered by this organization's verified Arbor Computer GitHub App, returning ids and metadata but never credentials. Use github_connect_repository to authorize one at an Arbor scope; listing alone grants no Computer access.",
     inputSchema: { ...PAGINATION_INPUT },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "projects",
     run: forward("github.repositories")
   },
   {
     name: "github_connect_repository",
     title: "Connect a GitHub repository",
-    description: "Connect/disconnect a GitHub repository at organization, Space, Topic, or Thread scope; it authorizes descendant Threads, while recipes only name it and grant no Git credential; inspect get_computer.repositoryAuthorization for the granting scope. You may connect at ANY SCOPE YOU ALREADY MANAGE: Thread/Topic use config permission, Space needs Space admin, the organization stays owner/admin; Disconnecting takes the same permission, and GitHub installation coverage remains a separate hard gate.",
+    description: "Connect or disconnect a listed GitHub repository at organization, Space, Topic, or Thread scope so matching descendant Computers may materialize it. The caller must manage that scope, GitHub installation coverage remains a separate gate, and get_computer shows the effective grant.",
     inputSchema: {
       repositoryId: exports_external.string().describe("installed repository id from github_repositories, ghr_…"),
       scope: exports_external.enum(["organization", "space", "topic", "thread"]).describe("the Arbor scope that may use this repository's context; topic is the durable choice for a project every Thread under it develops"),
       scopeId: exports_external.string().describe("id matching the selected scope"),
       connected: exports_external.boolean().describe("true to connect; false to disconnect recoverably")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "projects",
     run: forward("github.set_repository_connection")
   },
@@ -19151,7 +19140,7 @@ var ACTION_DEFINITIONS = [
       setupScript: exports_external.string().nullable().optional().describe("optional strict Bash setup run after connected repositories materialize, or null to clear"),
       repositories: exports_external.array(exports_external.string()).max(MAX_COMPUTER_REPOSITORIES).nullable().optional().describe("connected GitHub repositories to materialize into a fresh reusable base and allow for later Git calls; [] clears and null inherits")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "structure",
     run: forward("computer_config.set_organization")
   },
@@ -19166,7 +19155,7 @@ var ACTION_DEFINITIONS = [
       setupScript: exports_external.string().nullable().optional().describe("optional strict Bash setup run after connected repositories materialize, or null to clear"),
       repositories: exports_external.array(exports_external.string()).max(MAX_COMPUTER_REPOSITORIES).nullable().optional().describe("connected GitHub repositories to materialize into a fresh reusable base and allow for later Git calls; [] clears and null inherits")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "structure",
     run: forward("computer_config.set_space")
   },
@@ -19182,7 +19171,7 @@ var ACTION_DEFINITIONS = [
       repositories: exports_external.array(exports_external.string()).max(MAX_COMPUTER_REPOSITORIES).nullable().optional().describe("connected GitHub repositories to materialize into a fresh reusable base and allow for later Git calls; [] clears and null inherits"),
       ...LIVE_PREVIEW_CONFIG_INPUT
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "structure",
     run: forward("computer_config.set_topic")
   },
@@ -19198,18 +19187,18 @@ var ACTION_DEFINITIONS = [
       repositories: exports_external.array(exports_external.string()).max(MAX_COMPUTER_REPOSITORIES).nullable().optional().describe("connected GitHub repositories to materialize into a fresh reusable base and allow for later Git calls; [] clears and null inherits"),
       ...LIVE_PREVIEW_CONFIG_INPUT
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "structure",
     run: forward("computer_config.set_thread")
   },
   {
     name: "attach_computer",
     title: "Attach a Thread computer",
-    description: "Lazily attach the one stable computer identity to a Thread and mint an immutable, server-attributed session receipt. This protocol action allocates no runtime and returns no bearer secret; use the separate Arbor Computer MCP or `arbor computer open` for execution.",
+    description: "Create or reuse a Thread's stable Computer identity and mint an immutable collaborator receipt without starting provider runtime. Normally computer_open performs this attachment as part of opening; use this tool only when durable protocol identity is needed separately.",
     inputSchema: {
       threadId: exports_external.string().describe("the Thread whose computer you are attaching, thr_…")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "loop",
     run: forward("computer.attach")
   },
@@ -19235,7 +19224,7 @@ var ACTION_DEFINITIONS = [
       idempotencyKey: exports_external.string().min(1).max(200).describe("stable key for this ONE replacement request; reuse it unchanged for retries"),
       reason: exports_external.string().min(1).max(500).describe("concise auditable reason for replacing the active generation")
     },
-    surfaces: ["mcp", "computer-mcp", "computer-cli"],
+    surfaces: ["computer-mcp", "computer-cli"],
     toolset: "loop",
     run: forward("computer_runtime.reprovision")
   },
@@ -19554,50 +19543,23 @@ var ACTION_DEFINITIONS = [
       threadId: exports_external.string().describe("the Thread, thr_…"),
       lineageLimit: exports_external.number().int().min(1).max(100).optional().describe("recent receipts/lineage rows (default 20)")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "loop",
     run: forward("computer.get")
   },
   {
     name: "computer_inventory",
     title: "Inventory organization Computers",
-    description: "READ ONLY: Inventory materialized Thread Computers in your organization, optionally scoped to one Topic. Reports active generation, recipe compatibility, counts for generations/sessions/snapshots/Runs, and factual flags for stale recipes, superseded generations, active Runs and failed reprovisions. Organization owner/admin only. This is an operational read model, not a deletion recommendation.",
+    description: "READ ONLY: Inventory materialized Thread Computers in your organization, optionally scoped to a Topic, with active generation, compatibility, lifecycle counts, and factual anomaly flags. Organization owner/admin only; this is evidence, not a deletion recommendation.",
     inputSchema: {
       topicId: exports_external.string().optional().describe("optional Topic to scope the inventory"),
       limit: exports_external.number().int().min(1).max(50).optional().describe("rows to return (default 25)"),
       cursor: exports_external.string().optional().describe("active Computer id returned as nextCursor by the previous page")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "admin",
     run: forward("computer.inventory")
   },
-  {
-    name: "publish_topic_computer",
-    title: "Publish a Topic computer base",
-    description: "After the first attached collaborator finishes the Topic setup recipe and Currybox checkpoints `/workspace`, publish that opaque restore handle as the reusable Topic base. Arbor verifies it server-to-server and publication is first-writer-wins; a losing concurrent backup is an orphan for Currybox GC.",
-    inputSchema: {
-      sessionId: exports_external.string().describe("the Arbor computer session that materialized the base, cms_…"),
-      providerRef: exports_external.string().describe("the opaque restore handle returned by `currybox checkpoint`")
-    },
-    surfaces: ["mcp", "cli"],
-    toolset: "loop",
-    run: forward("computer.publish_topic_base")
-  },
-  {
-    name: "checkpoint_computer",
-    title: "Checkpoint a Thread computer",
-    description: "After a complete unit of work, checkpoint `/workspace` through Currybox, then publish its opaque handle here to append immutable Thread lineage and advance the current pointer atomically. Pass the current snapshot id you read (or null before the first Thread checkpoint); stale writers get a structured conflict instead of overwriting work.",
-    inputSchema: {
-      computerId: exports_external.string().describe("the stable Thread computer, cmp_…"),
-      sessionId: exports_external.string().optional().describe("the producing agent session, cms_…; Currybox service sweeps omit it"),
-      providerRef: exports_external.string().describe("the opaque restore handle returned by `currybox checkpoint`"),
-      expectedCurrentSnapshotId: exports_external.string().nullable().describe("the current Thread snapshot id you read, or null before its first checkpoint"),
-      parentSnapshotId: exports_external.string().optional().describe("first checkpoint only: the Topic base parent when the session cannot supply it")
-    },
-    surfaces: ["mcp", "cli"],
-    toolset: "loop",
-    run: forward("computer.checkpoint")
-  },
   {
     name: "set_ways_to_help",
     title: "Set a thread's ways to help",
@@ -20592,7 +20554,7 @@ var ACTION_DEFINITIONS = [
       bindingId: exports_external.string().optional().describe("unbind: binding id, sbd_…")
     },
     surfaces: ["mcp"],
-    toolset: "apps",
+    toolset: "secrets",
     run: dispatch({
       list: "secret.list",
       get: "secret.get",
@@ -20746,7 +20708,7 @@ var ACTION_DEFINITIONS = [
     inputSchema: {
       includeArchived: exports_external.boolean().optional().describe("include archived Apps you are authorized to inspect")
     },
-    surfaces: ["mcp"],
+    surfaces: ["computer-mcp"],
     toolset: "apps",
     run: forward("app.list")
   },
@@ -20755,7 +20717,7 @@ var ACTION_DEFINITIONS = [
     title: "Read an App",
     description: "READ ONLY: Inspect one App's stable URL, active deployment, pending control intent, deployment history, provider health, deployment-aware redacted configuration readiness for the active release, and durable state generation. It cannot modify App state, deployment state, access, or durable SQLite; use its activeDeploymentId as app_activate's expectedActiveDeploymentId.",
     inputSchema: { appId: exports_external.string().describe("the App, app_…") },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "apps",
     run: forward("app.get")
   },
@@ -20772,7 +20734,7 @@ var ACTION_DEFINITIONS = [
       discovery: exports_external.enum(["unlisted", "listed"]).nullable().optional().describe("public Apps only; default unlisted"),
       stateMode: exports_external.enum(["none", "durable"]).describe("durable allocates Space-only isolated facet SQLite; deployment never resets it")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "apps",
     run: forward("app.create")
   },
@@ -20788,7 +20750,7 @@ var ACTION_DEFINITIONS = [
       ])).describe("complete desired runtime config object keyed by environment variable name"),
       dryRun: exports_external.boolean().optional().describe("validate and plan without mutating")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "apps",
     run: forward("app.config_apply")
   },
@@ -20801,7 +20763,7 @@ var ACTION_DEFINITIONS = [
       bundleId: exports_external.string().describe("verified immutable AppBundle, bnd_…"),
       idempotencyKey: exports_external.string().min(1).max(200).describe("stable key for this one logical deployment attempt")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "apps",
     run: forward("app.deploy")
   },
@@ -20825,7 +20787,7 @@ var ACTION_DEFINITIONS = [
       appId: exports_external.string().describe("owning App, app_…"),
       deploymentId: exports_external.string().describe("deployment, dep_…")
     },
-    surfaces: ["mcp"],
+    surfaces: ["computer-mcp"],
     toolset: "apps",
     run: forward("app.deployment_get")
   },
@@ -20838,7 +20800,7 @@ var ACTION_DEFINITIONS = [
       path: exports_external.string().min(1).max(2048).describe("relative App path beginning with /; may include a query string"),
       method: exports_external.enum(["GET", "HEAD"]).optional().describe("safe read method; default GET")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "apps",
     run: forward("app.fetch")
   },
@@ -20854,7 +20816,7 @@ var ACTION_DEFINITIONS = [
       body: exports_external.string().optional().describe("UTF-8 request body; mutually exclusive with json"),
       contentType: exports_external.string().max(160).optional().describe("body media type; allowed only with body, default text/plain; charset=utf-8")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "apps",
     run: forward("app.request")
   },
@@ -20867,7 +20829,7 @@ var ACTION_DEFINITIONS = [
       deploymentId: exports_external.string().describe("prepared candidate, dep_…"),
       expectedActiveDeploymentId: exports_external.string().nullable().describe("active deployment from app_get, or null before first activation")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "apps",
     run: forward("app.activate")
   },
@@ -20880,7 +20842,7 @@ var ACTION_DEFINITIONS = [
       deploymentId: exports_external.string().describe("superseded deployment to restore, dep_…"),
       expectedActiveDeploymentId: exports_external.string().describe("current active deployment from app_get")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "apps",
     run: forward("app.rollback")
   },
@@ -20906,7 +20868,7 @@ var ACTION_DEFINITIONS = [
       access: exports_external.enum(["space", "public"]).describe("new gateway access"),
       discovery: exports_external.enum(["unlisted", "listed"]).nullable().optional().describe("required concept only for public Apps")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "apps",
     run: forward("app.set_access")
   },
@@ -20919,7 +20881,7 @@ var ACTION_DEFINITIONS = [
       expectedGeneration: exports_external.number().int().min(0).describe("state generation from app_get"),
       idempotencyKey: exports_external.string().min(1).max(200).describe("stable key for this one deliberate reset")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "apps",
     run: forward("app.reset_state")
   },
@@ -20933,7 +20895,7 @@ var ACTION_DEFINITIONS = [
       expectedGeneration: exports_external.number().int().min(0).describe("state generation from app_get"),
       idempotencyKey: exports_external.string().min(1).max(200).describe("stable key for this one deliberate recovery")
     },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "apps",
     run: forward("app.restore_state")
   },
@@ -20942,7 +20904,7 @@ var ACTION_DEFINITIONS = [
     title: "Archive an App",
     description: "Remove an App from active serving while retaining its stable identity, deployment timeline, receipts, durable state, and release history for audit and recovery. Archive is a lifecycle-only transition.",
     inputSchema: { appId: exports_external.string().describe("target App, app_…") },
-    surfaces: ["mcp", "cli"],
+    surfaces: ["computer-mcp", "cli"],
     toolset: "apps",
     run: forward("app.archive")
   },
@@ -20993,11 +20955,70 @@ var ACTIONS = ACTION_DEFINITIONS.map((action) => {
 });
 
 // src/config.ts
-import { chmodSync, existsSync, mkdirSync, readFileSync, writeFileSync } from "node:fs";
+import {
+  chmodSync,
+  existsSync,
+  mkdirSync,
+  readFileSync,
+  rmSync,
+  statSync,
+  writeFileSync
+} from "node:fs";
 import { homedir } from "node:os";
 import { dirname, join } from "node:path";
 var CONFIG_PATH = process.env.ARBOR_CONFIG ?? join(homedir(), ".arbor", "config.json");
 var DEFAULT_API_URL = process.env.ARBOR_API_URL ?? "https://arborthreads.com";
+var DEFAULT_CONFIG_PATH = join(homedir(), ".arbor", "config.json");
+var DEFAULT_TOKEN_OVERWRITE_REFUSAL = "refusing to overwrite ~/.arbor/config.json — a token already exists. Set ARBOR_CONFIG to an isolated path (e.g. ~/.arbor/<agent>.config.json) and retry.";
+var LOCK_TIMEOUT_MS = 5000;
+var LOCK_STALE_MS = 30000;
+var LOCK_POLL_MS = 20;
+function sleepSync(ms) {
+  Atomics.wait(new Int32Array(new SharedArrayBuffer(4)), 0, 0, ms);
+}
+function acquireConfigLock(configPath) {
+  const lockPath = `${configPath}.lock`;
+  const deadline = Date.now() + LOCK_TIMEOUT_MS;
+  for (;; ) {
+    try {
+      mkdirSync(lockPath);
+      return () => {
+        try {
+          rmSync(lockPath, { recursive: true, force: true });
+        } catch {}
+      };
+    } catch (err) {
+      if (err?.code !== "EEXIST")
+        throw err;
+      try {
+        if (Date.now() - statSync(lockPath).mtimeMs > LOCK_STALE_MS) {
+          rmSync(lockPath, { recursive: true, force: true });
+          continue;
+        }
+      } catch {
+        continue;
+      }
+      if (Date.now() >= deadline) {
+        throw new Error(`timed out waiting for another arbor process to finish writing ${configPath}. If none is running, remove ${lockPath}.`);
+      }
+      sleepSync(LOCK_POLL_MS);
+    }
+  }
+}
+function defaultConfigOverwriteBlocked(opts) {
+  const isolated = opts?.isolated ?? Boolean(process.env.ARBOR_CONFIG);
+  const path = opts?.path ?? DEFAULT_CONFIG_PATH;
+  if (isolated)
+    return false;
+  if (!existsSync(path))
+    return false;
+  try {
+    const cfg = JSON.parse(readFileSync(path, "utf8"));
+    return Boolean(cfg.token);
+  } catch {
+    return false;
+  }
+}
 function loadConfig() {
   const envToken = process.env.ARBOR_TOKEN || undefined;
   const envUrl = process.env.ARBOR_API_URL || undefined;
@@ -21009,15 +21030,32 @@ function loadConfig() {
   }
   return { apiUrl: envUrl ?? DEFAULT_API_URL, token: envToken };
 }
-function saveConfig(cfg) {
-  mkdirSync(dirname(CONFIG_PATH), { recursive: true });
-  writeFileSync(CONFIG_PATH, `${JSON.stringify(cfg, null, 2)}
-`);
-  chmodSync(CONFIG_PATH, 384);
+function writeConfigGuarded(opts) {
+  mkdirSync(dirname(opts.configPath), { recursive: true });
+  const release = acquireConfigLock(opts.configPath);
+  try {
+    if (!opts.allowDefaultTokenOverwrite && defaultConfigOverwriteBlocked({ isolated: opts.isolated, path: opts.defaultPath })) {
+      throw new Error(DEFAULT_TOKEN_OVERWRITE_REFUSAL);
+    }
+    writeFileSync(opts.configPath, `${JSON.stringify(opts.cfg, null, 2)}
+`, { mode: 384 });
+    chmodSync(opts.configPath, 384);
+  } finally {
+    release();
+  }
+}
+function saveConfig(cfg, opts) {
+  writeConfigGuarded({
+    cfg,
+    configPath: CONFIG_PATH,
+    defaultPath: DEFAULT_CONFIG_PATH,
+    isolated: Boolean(process.env.ARBOR_CONFIG),
+    allowDefaultTokenOverwrite: opts?.allowDefaultTokenOverwrite
+  });
 }
 function clearToken() {
   const cfg = loadConfig();
-  saveConfig({ apiUrl: cfg.apiUrl });
+  saveConfig({ apiUrl: cfg.apiUrl }, { allowDefaultTokenOverwrite: true });
 }
 
 // src/errors.ts
@@ -21747,20 +21785,38 @@ async function runObjectVerb(positionals, flags, ctx) {
 // src/connect.ts
 var DEFAULT_POLL_INTERVAL_MS = 2000;
 var sleep = (ms) => new Promise((r) => setTimeout(r, ms));
+function bareConnectUrl(apiUrl, returnedUrl) {
+  const fallback = `${apiUrl.replace(/\/$/, "")}/connect`;
+  if (!returnedUrl)
+    return fallback;
+  try {
+    return `${new URL(returnedUrl).origin}/connect`;
+  } catch {
+    return fallback;
+  }
+}
 async function connect(opts) {
+  if (defaultConfigOverwriteBlocked()) {
+    throw new Error(DEFAULT_TOKEN_OVERWRITE_REFUSAL);
+  }
   const apiUrl = opts.url ?? loadConfig().apiUrl;
   const pollIntervalMs = opts.pollIntervalMs ?? DEFAULT_POLL_INTERVAL_MS;
-  const body = JSON.stringify({ pairingKey: opts.pairingKey });
   const headers = { "content-type": "application/json" };
-  const initRes = await fetch(`${apiUrl}/api/agent/connect`, { method: "POST", headers, body });
+  const body = JSON.stringify({ pairingKey: opts.pairingKey });
+  const initRes = await fetch(`${apiUrl}/api/agent/connect`, {
+    method: "POST",
+    headers,
+    body
+  });
   const init = await initRes.json().catch(() => ({}));
   if (!initRes.ok || !init.url || !init.userCode) {
     throw new Error(`could not start pairing (${initRes.status}): ${init.error ?? "is the server reachable?"}`);
   }
+  const approvalUrl = bareConnectUrl(apiUrl, init.url);
   process.stderr.write(`
   Pairing against ${apiUrl}
 ` + `  Ask the person who will manage this agent${init.agentName ? ` (“${init.agentName}”)` : ""} to approve it:
-` + `    1. open   ${init.url}
+` + `    1. open   ${approvalUrl}
 ` + `    2. enter the code:   ${init.userCode}
 
 ` + `  Only approve an agent you intend to manage.
@@ -21835,7 +21891,7 @@ async function login(opts) {
     });
     const tok = await tokRes.json().catch(() => ({}));
     if (tok.access_token) {
-      saveConfig({ apiUrl, token: tok.access_token });
+      saveConfig({ apiUrl, token: tok.access_token }, { allowDefaultTokenOverwrite: true });
       return;
     }
     if (tok.error === "authorization_pending")
@@ -22037,7 +22093,7 @@ async function main() {
         if (!token)
           throw new UsageError("usage: arbor auth <token> [--url <api-url>]");
         const url2 = stringFlag(flags.url, "url") ?? loadConfig().apiUrl;
-        saveConfig({ apiUrl: url2, token });
+        saveConfig({ apiUrl: url2, token }, { allowDefaultTokenOverwrite: true });
         advise(`  ✓ Token saved (${CONFIG_PATH}).
   `, ctx);
         await renderMe(ctx, "auth");

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.20.32",
+  "version": "0.21.0",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",