@lambdacurry/arbor 0.21.3 → 0.21.4

package/dist/arbor.js

@@ -2404,6 +2404,31 @@ var appBundles = sqliteTable("app_bundles", {
   spaceIdx: index("app_bundles_space_idx").on(t.spaceId, t.createdAt),
   idempotencyUq: uniqueIndex("app_bundles_idempotency_uq").on(t.computerSessionId, t.createdByProfileId, t.idempotencyKey)
 }));
+var previewApps = sqliteTable("preview_apps", {
+  id: text("id").primaryKey(),
+  threadId: text("thread_id").notNull().references(() => threads.id),
+  spaceId: text("space_id").notNull().references(() => spaces.id),
+  artifactId: text("artifact_id").notNull().references(() => artifacts.id),
+  artifactVersionId: text("artifact_version_id").notNull().references(() => artifactVersions.id),
+  bundleId: text("bundle_id").references(() => appBundles.id),
+  hostLabel: text("host_label").notNull(),
+  lifecycle: text("lifecycle").$type().notNull().default("active"),
+  roomsEnabled: integer("rooms_enabled", { mode: "boolean" }).notNull().default(false),
+  expiresAt: ts("expires_at").notNull(),
+  createdByProfileId: text("created_by_profile_id").notNull().references(() => profiles.id),
+  createdExecutionContextId: text("created_execution_context_id").notNull().references(() => executionContexts.id),
+  idempotencyKey: text("idempotency_key").notNull(),
+  idempotencyFingerprint: text("idempotency_fingerprint").notNull(),
+  createdAt: ts("created_at").notNull(),
+  retiredAt: ts("retired_at"),
+  retireReason: text("retire_reason").$type()
+}, (t) => ({
+  hostUq: uniqueIndex("preview_apps_host_uq").on(t.hostLabel),
+  creatorIdempotencyUq: uniqueIndex("preview_apps_creator_idempotency_uq").on(t.createdByProfileId, t.idempotencyKey),
+  threadIdx: index("preview_apps_thread_idx").on(t.threadId, t.lifecycle, t.createdAt),
+  artifactIdx: index("preview_apps_artifact_idx").on(t.artifactId, t.lifecycle, t.createdAt),
+  expiryIdx: index("preview_apps_expiry_idx").on(t.lifecycle, t.expiresAt)
+}));
 var apps = sqliteTable("apps", {
   id: text("id").primaryKey(),
   orgId: text("org_id").notNull().references(() => orgs.id),
@@ -2786,6 +2811,9 @@ var PREVIEW_MIME_TYPES = new Set([
   "font/woff",
   "font/woff2"
 ]);
+// ../core/src/ops/preview-app.ts
+var PREVIEW_APP_DEFAULT_TTL_SECONDS = 60 * 60;
+var PREVIEW_APP_MAX_TTL_SECONDS = 24 * 60 * 60;
 // ../core/src/ops/app.ts
 var APP_MAX_MODULE_BYTES = 10 * 1024 * 1024;
 var APP_MAX_ASSET_BYTES = 25 * 1024 * 1024;
@@ -18065,6 +18093,35 @@ var MCP_OUTPUT_SCHEMAS = {
     bindingName: exports_external.string().optional(),
     unbound: exports_external.boolean().optional()
   }),
+  preview_app_create: exports_external.looseObject({
+    id,
+    artifactId: id,
+    artifactVersionId: id,
+    bundleId: id.nullable(),
+    hostLabel: exports_external.string(),
+    lifecycle: exports_external.string(),
+    roomsEnabled: exports_external.boolean(),
+    expiresAt: timestamp,
+    url: exports_external.string(),
+    replayed: exports_external.boolean()
+  }),
+  preview_app_get: exports_external.looseObject({
+    id,
+    artifactId: id,
+    artifactVersionId: id,
+    bundleId: id.nullable(),
+    lifecycle: exports_external.string(),
+    roomsEnabled: exports_external.boolean(),
+    expiresAt: timestamp,
+    url: exports_external.string(),
+    effectiveStatus: exports_external.string()
+  }),
+  preview_app_retire: exports_external.looseObject({
+    id,
+    lifecycle: exports_external.string(),
+    url: exports_external.string(),
+    replayed: exports_external.boolean()
+  }),
   app_list: exports_external.object({ result: exports_external.array(app2) }),
   app_get: exports_external.looseObject({
     app: app2,
@@ -18696,6 +18753,9 @@ var MCP_TOOL_ANNOTATIONS = {
   artifact_transition: additive,
   artifact_delete: destructive,
   secrets: destructive,
+  preview_app_get: readOnly,
+  preview_app_create: idempotent,
+  preview_app_retire: destructiveIdempotent,
   app_get: readOnly,
   app_list: readOnly,
   app_deployment_get: readOnly,
@@ -18782,7 +18842,7 @@ ${ARBOR_FEEDBACK_GUIDANCE}
 4. CHECKPOINT COMPLETE PARENT UNITS. computer_checkpoint advances immutable parent lineage after an intermediate complete unit; computer_stop performs the final checkpoint before teardown. An isolated Run Preview is durable review output, not adoption or a checkpoint. The internal provider-handle publication operations are not agent tools.
 5. GIT AND GITHUB ARE ORDINARY COMMANDS AFTER AUTHORIZATION. Clone, fetch, pull, push, and gh run through computer_exec using a connected human's just-in-time ambient GitHub identity. Credentials never enter argv, workspace files, Git config, checkpoints, Events, logs, or receipts. A restored Computer deliberately keeps the checkout age of its snapshot, so fetch/pull before trusting remote state.
 6. VERIFY, PREVIEW, AND EXPORT. computer_verify captures a public URL directly without opening a project runtime. computer_publish_preview preserves immutable static output from either the parent or an active isolated write Run. computer_export moves bounded files into durable Thread Attachments; place returned Markdown exactly where the media belongs and cite the matching attachment ids.
-7. PACKAGE, DEPLOY, ACTIVATE, AND OPERATE APPS HERE. computer_publish_app_bundle creates the immutable executable bundle from verified parent bytes. Then use app_create, app_config_apply, app_deploy, app_deployment_get, app_activate, app_get, app_fetch/app_request, app_rollback, app_set_access, app_reset_state/app_restore_state, and app_archive as one workflow-closed release surface. First-class Organization/Profile Secrets remain on Arbor's collaboration MCP because they are broader identity-owned resources; App configuration here references existing Secret ids and never accepts or returns secret material.
+7. PACKAGE, DEPLOY, ACTIVATE, AND OPERATE APPS HERE. computer_publish_app_bundle creates the immutable executable bundle from verified parent bytes. For short-lived public Artifact experiments use preview_app_create/get/retire; for published Space Apps use app_create, app_config_apply, app_deploy, app_deployment_get, app_activate, app_get, app_fetch/app_request, app_rollback, app_set_access, app_reset_state/app_restore_state, and app_archive as one workflow-closed release surface. First-class Organization/Profile Secrets remain on Arbor's collaboration MCP because they are broader identity-owned resources; App configuration here references existing Secret ids and never accepts or returns secret material.
 8. FINISH WHAT YOU START. Stop the parent after its final complete unit, finish every Run, and preserve evidence before teardown. When reporting collaboration conclusions through Arbor, pass the producing computerSessionId and attachmentIds to contribute or respond.
 9. CLOSE OUT ARBOR DOGFOOD. When developing Arbor through Arbor, ask: “Did Arbor itself create meaningful friction or require an Arbor-specific workaround?” If yes, apply the classifier above and privately capture one bounded report before closing the development loop; keep unrelated product friction out of the implementation Thread. If no, close normally without manufacturing feedback.`;
 var PROSE_LISTS = exports_external.registry();
@@ -20846,6 +20906,39 @@ var ACTION_DEFINITIONS = [
     toolset: "apps",
     run: forward("app.get")
   },
+  {
+    name: "preview_app_create",
+    title: "Create a public Preview App",
+    description: "Mint a short-lived public no-login Preview App from one Artifact's exact current version, optionally executing a same-version fetch AppBundle with bounded Preview-scoped WebSocket rooms. It stays Thread/Artifact scoped, TTL-bounded, and out of the Space App catalog.",
+    inputSchema: {
+      artifactId: exports_external.string().describe("source Artifact, art_…; its current version is pinned"),
+      bundleId: exports_external.string().optional().describe("optional fetch AppBundle, bnd_…, built from that exact current ArtifactVersion"),
+      roomsEnabled: exports_external.boolean().optional().describe("allow named WebSocket rooms backed by preview-scoped SQLite Durable Object facets"),
+      ttlSeconds: exports_external.number().int().min(60).max(86400).optional().describe("Preview lifetime in seconds; default 3600, hard max 86400"),
+      idempotencyKey: exports_external.string().min(1).max(200).describe("stable retry key for this one logical Preview App mint")
+    },
+    surfaces: ["computer-mcp", "cli"],
+    toolset: "apps",
+    run: forward("preview_app.create")
+  },
+  {
+    name: "preview_app_get",
+    title: "Read a Preview App",
+    description: "READ ONLY: Inspect one Preview App's public URL, pinned ArtifactVersion/AppBundle lineage, absolute expiry, Thread status, and bounded WebSocket room contract. It is not a Space App catalog read.",
+    inputSchema: { previewAppId: exports_external.string().describe("the Preview App, papp_…") },
+    surfaces: ["computer-mcp", "cli"],
+    toolset: "apps",
+    run: forward("preview_app.get")
+  },
+  {
+    name: "preview_app_retire",
+    title: "Retire a Preview App",
+    description: "Retire one short-lived Preview App immediately, stopping its public gateway and tearing down bounded room Durable Objects. Artifact/AppBundle history stays intact, and Thread close performs the same retirement automatically.",
+    inputSchema: { previewAppId: exports_external.string().describe("the Preview App, papp_…") },
+    surfaces: ["computer-mcp", "cli"],
+    toolset: "apps",
+    run: forward("preview_app.retire")
+  },
   {
     name: "app_create",
     title: "Create an App",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.21.3",
+  "version": "0.21.4",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",