@lambdacurry/arbor 0.20.9 → 0.20.11

package/dist/arbor.js

@@ -754,6 +754,33 @@ function alias(table, alias2) {
   return new Proxy(table, new TableAliasProxyHandler(alias2, false));
 }
 
+// ../../node_modules/.pnpm/drizzle-orm@0.38.4_@cloudflare+workers-types@4.20260529.1_@prisma+client@5.22.0_@types+_885285c61ee4b1c788385eea24f801ee/node_modules/drizzle-orm/sqlite-core/checks.js
+class CheckBuilder {
+  constructor(name, value) {
+    this.name = name;
+    this.value = value;
+  }
+  static [entityKind] = "SQLiteCheckBuilder";
+  brand;
+  build(table) {
+    return new Check(table, this);
+  }
+}
+
+class Check {
+  constructor(table, builder) {
+    this.table = table;
+    this.name = builder.name;
+    this.value = builder.value;
+  }
+  static [entityKind] = "SQLiteCheck";
+  name;
+  value;
+}
+function check(name, value) {
+  return new CheckBuilder(name, value);
+}
+
 // ../../node_modules/.pnpm/drizzle-orm@0.38.4_@cloudflare+workers-types@4.20260529.1_@prisma+client@5.22.0_@types+_885285c61ee4b1c788385eea24f801ee/node_modules/drizzle-orm/utils.js
 function getColumnNameAndConfig(a, b) {
   return {
@@ -1681,7 +1708,6 @@ var computerRuns = sqliteTable("computer_runs", {
   mode: text("mode").$type().notNull(),
   execution: text("isolation").$type().notNull(),
   workspaceDir: text("workspace_dir").notNull(),
-  _legacyWorkspaceRef: text("workspace_ref"),
   baseSnapshotId: text("base_snapshot_id"),
   gitStart: text("git_start", { mode: "json" }).$type(),
   status: text("status").$type().notNull().default("active"),
@@ -1743,7 +1769,8 @@ var previewVersions = sqliteTable("preview_versions", {
   fileCount: integer("file_count").notNull(),
   byteCount: integer("byte_count").notNull(),
   computerSessionId: text("computer_session_id").notNull().references(() => computerSessions.id),
-  snapshotId: text("snapshot_id").notNull().references(() => computerSnapshots.id),
+  snapshotId: text("snapshot_id").references(() => computerSnapshots.id),
+  runId: text("run_id").references(() => computerRuns.id),
   publishedByProfileId: text("published_by_profile_id").notNull().references(() => profiles.id),
   idempotencyKey: text("idempotency_key"),
   idempotencyFingerprint: text("idempotency_fingerprint"),
@@ -1756,7 +1783,9 @@ var previewVersions = sqliteTable("preview_versions", {
   hostIdx: uniqueIndex("preview_versions_host_idx").on(t.hostLabel),
   sessionIdx: index("preview_versions_session_idx").on(t.computerSessionId, t.createdAt),
   idempotencyIdx: uniqueIndex("preview_versions_idempotency_idx").on(t.computerSessionId, t.publishedByProfileId, t.idempotencyKey),
-  snapshotIdx: index("preview_versions_snapshot_idx").on(t.snapshotId)
+  snapshotIdx: index("preview_versions_snapshot_idx").on(t.snapshotId),
+  runIdx: index("preview_versions_run_idx").on(t.runId),
+  sourceCheck: check("preview_versions_source_check", sql`(${t.snapshotId} is not null and ${t.runId} is null) or (${t.snapshotId} is null and ${t.runId} is not null)`)
 }));
 var previewVersionFiles = sqliteTable("preview_version_files", {
   versionId: text("version_id").notNull().references(() => previewVersions.id),
@@ -2533,7 +2562,7 @@ __export(exports_external, {
   clone: () => clone,
   cidrv6: () => cidrv62,
   cidrv4: () => cidrv42,
-  check: () => check,
+  check: () => check2,
   catch: () => _catch2,
   boolean: () => boolean2,
   bigint: () => bigint2,
@@ -14650,7 +14679,7 @@ __export(exports_schemas2, {
   codec: () => codec,
   cidrv6: () => cidrv62,
   cidrv4: () => cidrv42,
-  check: () => check,
+  check: () => check2,
   catch: () => _catch2,
   boolean: () => boolean2,
   bigint: () => bigint2,
@@ -14942,8 +14971,8 @@ var ZodType = /* @__PURE__ */ $constructor("ZodType", (inst, def) => {
       reg.add(this, meta2);
       return this;
     },
-    refine(check, params) {
-      return this.check(refine(check, params));
+    refine(check2, params) {
+      return this.check(refine(check2, params));
     },
     superRefine(refinement, params) {
       return this.check(superRefine(refinement, params));
@@ -16085,7 +16114,7 @@ var ZodCustom = /* @__PURE__ */ $constructor("ZodCustom", (inst, def) => {
   ZodType.init(inst, def);
   inst._zod.processJSONSchema = (ctx, json, params) => customProcessor(inst, ctx, json, params);
 });
-function check(fn) {
+function check2(fn) {
   const ch = new $ZodCheck({
     check: "custom"
   });
@@ -17528,9 +17557,12 @@ var MCP_OUTPUT_SCHEMAS = {
     manifestDigest: exports_external.string(),
     fileCount: exports_external.number(),
     byteCount: exports_external.number(),
-    snapshotId: id,
+    snapshotId: id.optional(),
+    runId: id.optional(),
     published: exports_external.boolean(),
     replayed: exports_external.boolean()
+  }).refine((value) => Boolean(value.snapshotId) !== Boolean(value.runId), {
+    message: "Preview output requires exactly one provenance source: snapshotId or runId"
   }),
   computer_publish_app_bundle: exports_external.looseObject({
     bundleId: id,
@@ -18266,7 +18298,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_exec",
     title: "Run a command",
-    description: "Run one bounded logical operation in an opened Thread computer. Omitting cwd uses the environment's defaultCwd; pass cwd explicitly to override it. Pass runId to route the command according to that Run's execution placement; without runId the command executes in the parent Computer. Strict Bash semantics are ON by default. For tests, builds, installs, or any command likely to run long, prefer background=true so the call returns a processId immediately; follow it with computer_process_read using the returned cursor for small incremental tails. For a connected human, Arbor supplies ambient GitHub authorization and Git identity ephemerally without writing credentials into the workspace. Background processes stay in the environment where they were started.",
+    description: "Run one bounded logical operation in an opened Thread computer. Omitting cwd uses the environment's defaultCwd; pass cwd explicitly to override it. Pass runId to route the command according to that Run's execution placement; without runId the command executes in the parent Computer. Strict Bash semantics are ON by default. For tests, builds, installs, or any command likely to run long, prefer background=true so the call returns a processId immediately; follow it with computer_process_read using the returned cursor for small incremental tails. For a labeled run-scoped verification check, pass activityKind=verification so the terminal exit becomes a distilled verification outcome. For a connected human, Arbor supplies ambient GitHub authorization and Git identity ephemerally without writing credentials into the workspace. Background processes stay in the environment where they were started.",
     inputSchema: {
       computerSessionId: exports_external.string().optional().describe("the computerSessionId returned by computer_open, cms_…; required unless runId is supplied"),
       command: exports_external.string().min(1).describe("the shell command to run"),
@@ -18275,6 +18307,7 @@ var ACTION_DEFINITIONS = [
       timeout: exports_external.number().int().min(1000).max(1800000).optional().describe("timeout in milliseconds, from 1,000 through 1,800,000"),
       background: exports_external.boolean().optional().describe("start a container process and return its pid"),
       activityLabel: exports_external.string().min(1).max(COMPUTER_RUN_ACTIVITY_LABEL_MAX).optional().describe("short human-readable label for run-scoped background work; Arbor records this label instead of the raw command or output"),
+      activityKind: exports_external.literal("verification").optional().describe("mark a labeled run-scoped background command as a verification check; its provider-observed terminal result is recorded as verification.finished"),
       strict: exports_external.boolean().optional().describe("fail on the first unhandled command or pipeline failure; defaults to true, set false only for intentional best-effort execution")
     },
     surfaces: ["computer-mcp", "computer-cli"],
@@ -18446,9 +18479,10 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_publish_preview",
     title: "Publish an immutable static Preview",
-    description: "Publish one checked HTML file or bounded static build directory from the live parent Thread Computer as a private immutable Preview after checkpointing its source. This is intentionally not Run-scoped yet; an isolated Run must not silently publish stale parent files or imply integration. The returned arborthreads.dev URL survives computer teardown; put it on its own line to show the interactive Preview card. A directory must contain index.html, use relative local asset URLs, and cannot include dotfiles, source maps, secrets, symlinks, or server code. Supply one stable idempotencyKey per logical publication: safe retries return the original immutable URL, while reusing the key for another path/title conflicts.",
+    description: "Publish one checked HTML file or bounded static build directory as a private immutable Preview. Parent publication uses computerSessionId, checkpoints the source into Thread lineage, then publishes it. Isolated Run publication uses runId, freezes that Run's exact static bytes without checkpointing, adopting the Run, or advancing parent lineage, and remains durable after the Run is destroyed. The returned arborthreads.dev URL survives teardown; put it on its own line to show the interactive Preview card. A directory must contain index.html, use relative local asset URLs, and cannot include dotfiles, source maps, secrets, symlinks, or server code. Supply one stable idempotencyKey per logical publication: safe retries return the original immutable URL, while reusing the key for another path/title or Run fork conflicts.",
     inputSchema: {
-      computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
+      computerSessionId: exports_external.string().optional().describe("the computerSessionId returned by computer_open, cms_…; required for parent publication, optional when runId is supplied"),
+      runId: exports_external.string().optional().describe("active isolated write Run whose static workspace bytes should be published as review output"),
       path: exports_external.string().describe("absolute path to one HTML file or static build directory under /workspace"),
       title: exports_external.string().min(1).max(160).describe("short factual Preview title"),
       idempotencyKey: exports_external.string().min(1).max(200).describe("stable key for this ONE logical publication (≤200 chars); reuse it only to retry the same path and title")
@@ -18460,7 +18494,7 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_publish_app_bundle",
     title: "Publish an immutable AppBundle",
-    description: "From the live parent Thread Computer, after a Bun container build is green, verify that entryPath bytes exactly match the referenced ArtifactVersion. This is intentionally not Run-scoped yet; isolated Run publication requires a separate integration/provenance decision. Then capture source hashes plus Git/workspace provenance, then freeze the Worker module and optional static assets into a content-addressed AppBundle. A mismatch is rejected; dirty or untracked source is allowed but returned as an explicit warning. Use the returned bundleId with app_deploy; retries require the same idempotencyKey.",
+    description: "From the live parent Thread Computer, after a Bun container build is green, verify that entryPath bytes exactly match the referenced ArtifactVersion, then capture source hashes plus Git/workspace provenance, then freeze the Worker module and optional static assets into a content-addressed AppBundle. A mismatch is rejected; dirty or untracked source is allowed but returned as an explicit warning. Use the returned bundleId with app_deploy; retries require the same idempotencyKey. AppBundle publication remains intentionally parent-only; an isolated Run Preview is review output and does not adopt the Run.",
     inputSchema: {
       computerSessionId: exports_external.string().describe("the computerSessionId returned by computer_open, cms_…"),
       artifactVersionId: exports_external.string().describe("the source ArtifactVersion, artv_…"),

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.20.9",
+  "version": "0.20.11",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",