@lambdacurry/arbor 0.22.5 → 0.22.7

package/dist/arbor.js

@@ -2,7 +2,7 @@
 // package.json
 var package_default = {
   name: "@lambdacurry/arbor",
-  version: "0.22.5",
+  version: "0.22.7",
   description: "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   keywords: [
     "agents",
@@ -6914,6 +6914,9 @@ var artifactVersions = sqliteTable("artifact_versions", {
   artifactId: text("artifact_id").notNull().references(() => artifacts.id),
   version: integer2("version").notNull(),
   source: text("source").notNull(),
+  sourceAttachmentId: text("source_attachment_id").references(() => attachments.id),
+  sourceSha256: text("source_sha256"),
+  tldrawDocumentClock: integer2("tldraw_document_clock"),
   editorProfileId: text("editor_profile_id").notNull().references(() => profiles.id),
   executionContextId: text("execution_context_id").references(() => executionContexts.id),
   note: text("note"),
@@ -6921,6 +6924,95 @@ var artifactVersions = sqliteTable("artifact_versions", {
 }, (t) => ({
   artifactVersionUq: uniqueIndex("artifact_versions_artifact_version_uq").on(t.artifactId, t.version)
 }));
+var artifactTldrawBoards = sqliteTable("artifact_tldraw_boards", {
+  artifactId: text("artifact_id").primaryKey().references(() => artifacts.id, { onDelete: "cascade" }),
+  roomGeneration: integer2("room_generation").notNull().default(1),
+  documentClock: integer2("document_clock").notNull().default(0),
+  documentDigest: text("document_digest").notNull(),
+  currentVersion: integer2("current_version").notNull().default(0),
+  createIdempotencyKey: text("create_idempotency_key").notNull(),
+  createActorProfileId: text("create_actor_profile_id").notNull().references(() => profiles.id),
+  createThreadId: text("create_thread_id").notNull().references(() => threads.id),
+  createFingerprint: text("create_fingerprint").notNull(),
+  checkpointedAt: ts("checkpointed_at"),
+  updatedAt: ts("updated_at").notNull()
+}, (t) => ({
+  createKeyUq: uniqueIndex("artifact_tldraw_boards_create_key_uq").on(t.createActorProfileId, t.createThreadId, t.createIdempotencyKey)
+}));
+var artifactTldrawCheckpoints = sqliteTable("artifact_tldraw_checkpoints", {
+  id: text("id").primaryKey(),
+  artifactId: text("artifact_id").notNull().references(() => artifacts.id, { onDelete: "cascade" }),
+  actorProfileId: text("actor_profile_id").notNull().references(() => profiles.id),
+  idempotencyKey: text("idempotency_key").notNull(),
+  requestFingerprint: text("request_fingerprint").notNull(),
+  resultArtifactVersionId: text("result_artifact_version_id").notNull().references(() => artifactVersions.id),
+  resultVersion: integer2("result_version").notNull(),
+  createdAt: ts("created_at").notNull()
+}, (t) => ({
+  requestUq: uniqueIndex("artifact_tldraw_checkpoints_request_uq").on(t.artifactId, t.actorProfileId, t.idempotencyKey)
+}));
+var artifactTldrawScriptVersions = sqliteTable("artifact_tldraw_script_versions", {
+  id: text("id").primaryKey(),
+  artifactId: text("artifact_id").notNull().references(() => artifacts.id, { onDelete: "cascade" }),
+  version: integer2("version").notNull(),
+  attachmentId: text("attachment_id").notNull().references(() => attachments.id),
+  digest: text("digest").notNull(),
+  byteLength: integer2("byte_length").notNull(),
+  createdByProfileId: text("created_by_profile_id").notNull().references(() => profiles.id),
+  createdAt: ts("created_at").notNull()
+}, (t) => ({
+  artifactVersionUq: uniqueIndex("artifact_tldraw_script_versions_artifact_version_uq").on(t.artifactId, t.version),
+  artifactDigestUq: uniqueIndex("artifact_tldraw_script_versions_artifact_digest_uq").on(t.artifactId, t.digest)
+}));
+var artifactTldrawDocumentScripts = sqliteTable("artifact_tldraw_document_scripts", {
+  artifactId: text("artifact_id").primaryKey().references(() => artifacts.id, { onDelete: "cascade" }),
+  revision: integer2("revision").notNull().default(0),
+  currentVersion: integer2("current_version"),
+  currentAttachmentId: text("current_attachment_id").references(() => attachments.id),
+  currentDigest: text("current_digest"),
+  currentByteLength: integer2("current_byte_length"),
+  approvedVersion: integer2("approved_version"),
+  approvedDigest: text("approved_digest"),
+  approvedByProfileId: text("approved_by_profile_id").references(() => profiles.id),
+  approvedAt: ts("approved_at"),
+  enabled: integer2("enabled", { mode: "boolean" }).notNull().default(false),
+  updatedAt: ts("updated_at").notNull()
+});
+var artifactTldrawExecs = sqliteTable("artifact_tldraw_execs", {
+  id: text("id").primaryKey(),
+  artifactId: text("artifact_id").notNull().references(() => artifacts.id, { onDelete: "cascade" }),
+  requestId: text("request_id").notNull(),
+  sourceDigest: text("source_digest").notNull(),
+  requestFingerprint: text("request_fingerprint").notNull(),
+  expectedDocumentClock: integer2("expected_document_clock"),
+  settleMs: integer2("settle_ms"),
+  startDocumentClock: integer2("start_document_clock").notNull(),
+  startDocumentDigest: text("start_document_digest").notNull(),
+  endDocumentClock: integer2("end_document_clock"),
+  endDocumentDigest: text("end_document_digest"),
+  outcome: text("outcome").notNull(),
+  resultDigest: text("result_digest"),
+  error: text("error"),
+  completionFingerprint: text("completion_fingerprint"),
+  actorProfileId: text("actor_profile_id").notNull().references(() => profiles.id),
+  createdAt: ts("created_at").notNull(),
+  completedAt: ts("completed_at")
+}, (t) => ({
+  requestUq: uniqueIndex("artifact_tldraw_execs_request_uq").on(t.artifactId, t.actorProfileId, t.requestId),
+  requestLength: check("artifact_tldraw_execs_request_length", sql`length(${t.requestId}) BETWEEN 1 AND 200`),
+  digestLength: check("artifact_tldraw_execs_digest_length", sql`length(${t.sourceDigest}) BETWEEN 1 AND 200`),
+  settleNonnegative: check("artifact_tldraw_execs_settle_nonnegative", sql`${t.settleMs} IS NULL OR ${t.settleMs} >= 0`),
+  resultLength: check("artifact_tldraw_execs_result_length", sql`${t.resultDigest} IS NULL OR length(${t.resultDigest}) <= 200`),
+  errorLength: check("artifact_tldraw_execs_error_length", sql`${t.error} IS NULL OR length(${t.error}) <= 2000`)
+}));
+var artifactTldrawViewerGrantUses = sqliteTable("artifact_tldraw_viewer_grant_uses", {
+  id: text("id").primaryKey(),
+  artifactId: text("artifact_id").notNull().references(() => artifacts.id, { onDelete: "cascade" }),
+  grantId: text("grant_id").notNull(),
+  profileId: text("profile_id").notNull().references(() => profiles.id),
+  createdAt: ts("created_at").notNull(),
+  usedAt: ts("used_at")
+}, (t) => ({ grantUq: uniqueIndex("artifact_tldraw_viewer_grant_uses_grant_uq").on(t.grantId) }));
 var secrets = sqliteTable("secrets", {
   id: text("id").primaryKey(),
   orgId: text("org_id").notNull().references(() => orgs.id),
@@ -8601,6 +8693,116 @@ var MCP_OUTPUT_SCHEMAS = {
     nextLine: number2().int().min(1).nullable().optional(),
     totalLines: number2().int().nonnegative().optional()
   }),
+  tldraw_import: looseObject({
+    artifactId: id,
+    artifactVersionId: id,
+    version: number2().int().min(1),
+    sourceAttachmentId: id,
+    sourceSha256: string2(),
+    documentClock: number2().int().min(0),
+    replayed: boolean2(),
+    url: string2().optional()
+  }),
+  tldraw_get: looseObject({
+    artifactId: id,
+    title: string2(),
+    summary: string2(),
+    sourceThreadId: id,
+    version: number2().int().min(1),
+    selectedVersion: number2().int().min(1),
+    historical: boolean2(),
+    canEdit: boolean2(),
+    source: jsonObject,
+    current: jsonObject,
+    versionRefs: array(jsonObject),
+    script: jsonObject
+  }),
+  tldraw_workbench: looseObject({
+    artifactId: id,
+    runId: id,
+    TLDRAW_LOCAL_ROOT: string2(),
+    paths: looseObject({
+      board: string2(),
+      script: string2().nullable(),
+      manifest: string2()
+    }),
+    manifest: jsonObject
+  }),
+  tldraw_status: looseObject({
+    artifactId: id,
+    room: jsonObject,
+    script: jsonObject
+  }),
+  tldraw_checkpoint: looseObject({
+    artifactId: id,
+    ok: boolean2(),
+    changed: boolean2().optional(),
+    version: number2().int().min(1).optional(),
+    replayed: boolean2().optional()
+  }),
+  tldraw_publish: looseObject({
+    artifactId: id,
+    artifactVersionId: id.optional(),
+    version: number2().int().min(1).optional(),
+    sourceAttachmentId: id.optional(),
+    documentClock: number2().int().min(0).optional(),
+    replayed: boolean2().optional()
+  }),
+  tldraw_script: looseObject({
+    artifactId: id,
+    revision: number2().int().min(0),
+    status: _enum(["absent", "approval-required", "enabled", "disabled"]),
+    source: jsonObject.nullable(),
+    approval: jsonObject.nullable()
+  }),
+  tldraw_observe: looseObject({
+    artifactId: id,
+    documentClock: number2().int().min(0),
+    documentDigest: string2(),
+    scene: looseObject({
+      shapes: array(jsonObject),
+      bindings: array(jsonObject),
+      lint: array(jsonObject),
+      truncation: looseObject({
+        shapesOmitted: number2().int().nonnegative(),
+        bindingsOmitted: number2().int().nonnegative(),
+        bindingRecordsUninspected: number2().int().nonnegative(),
+        findingsOmitted: number2().int().nonnegative(),
+        textShapesTruncated: number2().int().nonnegative(),
+        pageNameCharactersOmitted: number2().int().nonnegative(),
+        serializedBytes: number2().int().nonnegative(),
+        serializedByteLimit: number2().int().positive()
+      })
+    }),
+    image: looseObject({
+      attachmentId: id.optional(),
+      downloadUrl: string2().optional(),
+      mimeType: literal("image/png"),
+      width: number2().int().positive(),
+      height: number2().int().positive(),
+      size: number2().int().nonnegative().optional(),
+      sha256: string2().optional(),
+      data: string2().optional()
+    })
+  }),
+  tldraw_exec: looseObject({
+    executionId: id,
+    artifactId: id,
+    state: _enum(["succeeded", "failed", "unknown", "running"]),
+    start: jsonObject,
+    end: jsonObject.optional(),
+    result: unknown().optional(),
+    error: string2().optional()
+  }),
+  tldraw_exec_get: looseObject({
+    executionId: id,
+    artifactId: id,
+    state: _enum(["succeeded", "failed", "unknown", "running"]),
+    start: jsonObject,
+    end: jsonObject.optional(),
+    result: unknown().optional(),
+    error: string2().optional()
+  }),
   artifact_transition: looseObject({
     artifactId: id,
     status: string2(),
@@ -9407,6 +9609,16 @@ var MCP_TOOL_ANNOTATIONS = {
   curation: additive,
   artifact: additive,
   artifact_get: readOnly,
+  tldraw_import: idempotent,
+  tldraw_get: readOnly,
+  tldraw_workbench: destructive,
+  tldraw_status: readOnly,
+  tldraw_checkpoint: idempotent,
+  tldraw_publish: idempotent,
+  tldraw_script: destructive,
+  tldraw_observe: additive,
+  tldraw_exec: destructiveOpenWorld,
+  tldraw_exec_get: readOnly,
   artifact_transition: additive,
   artifact_delete: destructive,
   secrets: destructive,
@@ -10186,7 +10398,7 @@ var ACTION_DEFINITIONS = [
     description: "DESTRUCTIVE REPLACE: Replace the organization's entire sparse Computer-default layer; omitted fields are cleared from this layer and fall back to provider defaults, while lower scopes may override. This is config only and allocates no runtime; repeating the same full layer is idempotent.",
     inputSchema: {
       backend: _enum(["worker-shell", "container"]).nullable().optional().describe("default execution tier, or null to use worker-shell"),
-      containerProfile: string2().nullable().optional().describe("logical container profile; bun-typescript-v1 guarantees Bash, Git, GitHub CLI (gh), Bun 1.4.1, bunx, Node 26.5.1, pnpm 10.33.0, Python 3.13.15 (python/python3), jq, and ripgrep (rg), or null to clear"),
+      containerProfile: string2().nullable().optional().describe("logical container profile; bun-typescript-v1 guarantees Bash, Git, GitHub CLI (gh), Bun 1.4.2, bunx, Node 26.5.1, pnpm 10.33.0, Python 3.13.15 (python/python3), jq, and ripgrep (rg), or null to clear"),
       setupScript: string2().nullable().optional().describe("optional strict Bash setup run after connected repositories materialize, or null to clear"),
       repositories: array(string2()).max(MAX_COMPUTER_REPOSITORIES).nullable().optional().describe("connected GitHub repositories to materialize into a fresh reusable base and allow for later Git calls; [] clears and null inherits")
     },
@@ -10201,7 +10413,7 @@ var ACTION_DEFINITIONS = [
     inputSchema: {
       spaceId: string2().describe("the Space, spc_…"),
       backend: _enum(["worker-shell", "container"]).nullable().optional().describe("override execution tier, or null to inherit"),
-      containerProfile: string2().nullable().optional().describe("logical container profile; bun-typescript-v1 guarantees Bash, Git, GitHub CLI (gh), Bun 1.4.1, bunx, Node 26.5.1, pnpm 10.33.0, Python 3.13.15 (python/python3), jq, and ripgrep (rg), or null to clear inherited profile"),
+      containerProfile: string2().nullable().optional().describe("logical container profile; bun-typescript-v1 guarantees Bash, Git, GitHub CLI (gh), Bun 1.4.2, bunx, Node 26.5.1, pnpm 10.33.0, Python 3.13.15 (python/python3), jq, and ripgrep (rg), or null to clear inherited profile"),
       setupScript: string2().nullable().optional().describe("optional strict Bash setup run after connected repositories materialize, or null to clear"),
       repositories: array(string2()).max(MAX_COMPUTER_REPOSITORIES).nullable().optional().describe("connected GitHub repositories to materialize into a fresh reusable base and allow for later Git calls; [] clears and null inherits")
     },
@@ -10216,7 +10428,7 @@ var ACTION_DEFINITIONS = [
     inputSchema: {
       topicId: string2().describe("the Topic, top_…"),
       backend: _enum(["worker-shell", "container"]).nullable().optional().describe("override execution tier, or null to inherit"),
-      containerProfile: string2().nullable().optional().describe("logical container profile; bun-typescript-v1 guarantees Bash, Git, GitHub CLI (gh), Bun 1.4.1, bunx, Node 26.5.1, pnpm 10.33.0, Python 3.13.15 (python/python3), jq, and ripgrep (rg), or null to clear inherited profile"),
+      containerProfile: string2().nullable().optional().describe("logical container profile; bun-typescript-v1 guarantees Bash, Git, GitHub CLI (gh), Bun 1.4.2, bunx, Node 26.5.1, pnpm 10.33.0, Python 3.13.15 (python/python3), jq, and ripgrep (rg), or null to clear inherited profile"),
       setupScript: string2().nullable().optional().describe("optional strict Bash setup run after connected repositories materialize"),
       repositories: array(string2()).max(MAX_COMPUTER_REPOSITORIES).nullable().optional().describe("connected GitHub repositories to materialize into a fresh reusable base and allow for later Git calls; [] clears and null inherits"),
       ...LIVE_PREVIEW_CONFIG_INPUT
@@ -10232,7 +10444,7 @@ var ACTION_DEFINITIONS = [
     inputSchema: {
       threadId: string2().describe("the Thread, thr_…"),
       backend: _enum(["worker-shell", "container"]).nullable().optional().describe("override execution tier, or null to inherit"),
-      containerProfile: string2().nullable().optional().describe("logical container profile; bun-typescript-v1 guarantees Bash, Git, GitHub CLI (gh), Bun 1.4.1, bunx, Node 26.5.1, pnpm 10.33.0, Python 3.13.15 (python/python3), jq, and ripgrep (rg), or null to clear inherited profile"),
+      containerProfile: string2().nullable().optional().describe("logical container profile; bun-typescript-v1 guarantees Bash, Git, GitHub CLI (gh), Bun 1.4.2, bunx, Node 26.5.1, pnpm 10.33.0, Python 3.13.15 (python/python3), jq, and ripgrep (rg), or null to clear inherited profile"),
       setupScript: string2().nullable().optional().describe("optional strict Bash setup run after connected repositories materialize"),
       repositories: array(string2()).max(MAX_COMPUTER_REPOSITORIES).nullable().optional().describe("connected GitHub repositories to materialize into a fresh reusable base and allow for later Git calls; [] clears and null inherits"),
       ...LIVE_PREVIEW_CONFIG_INPUT
@@ -11623,6 +11835,145 @@ var ACTION_DEFINITIONS = [
     toolset: "artifacts",
     run: forward("artifact.transition")
   },
+  {
+    name: "tldraw_import",
+    title: "Import a tldraw board",
+    description: "Create a durable tldraw Artifact from one uploaded .tldr source after Arbor validates the stored bytes and source thread. Retries with the same idempotencyKey return the original Artifact version.",
+    inputSchema: {
+      sourceAttachmentId: string2().describe("uploaded .tldr Attachment, att_…"),
+      title: string2().min(1).max(200).describe("the board title"),
+      summary: string2().min(1).max(500).describe("one-line description of the board"),
+      sourceThreadId: string2().describe("Thread that owns the source Attachment, thr_…"),
+      idempotencyKey: string2().min(1).max(200).describe("stable key for this import request")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "artifacts",
+    run: forward("tldraw.import")
+  },
+  {
+    name: "tldraw_get",
+    title: "Read a tldraw board",
+    description: "Read the current or one historical tldraw board version, its immutable source references, version list, edit access, and document-script state. Historical versions are read-only.",
+    inputSchema: {
+      artifactId: string2().describe("the tldraw Artifact, art_…"),
+      version: number2().int().min(1).optional().describe("optional historical version number")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "artifacts",
+    run: forward("tldraw.get")
+  },
+  {
+    name: "tldraw_workbench",
+    title: "Materialize a tldraw workbench",
+    description: "Materialize the current live tldraw board and separate document script in an active same-Thread WRITE Run, writing a manifest that pins the exact ArtifactVersion, live clock/digest, and script source tuple without approving or enabling scripts. Each call creates a fresh workbench directory; idempotencyKey makes only the live checkpoint retry-safe.",
+    inputSchema: {
+      artifactId: string2().describe("the tldraw Artifact, art_…"),
+      runId: string2().describe("active same-Thread WRITE Run, run_…"),
+      idempotencyKey: string2().min(1).max(120).describe("stable key for this workbench materialization")
+    },
+    surfaces: ["computer-mcp", "computer-cli"],
+    toolset: "loop",
+    run: forward("tldraw.workbench")
+  },
+  {
+    name: "tldraw_status",
+    title: "Check tldraw board status",
+    description: "Read the current room status and separately reported script sessions for a tldraw board. Session reports remain per-session observations and are never collapsed into global success.",
+    inputSchema: { artifactId: string2().describe("the tldraw Artifact, art_…") },
+    surfaces: ["mcp", "cli"],
+    toolset: "artifacts",
+    run: forward("tldraw.status")
+  },
+  {
+    name: "tldraw_checkpoint",
+    title: "Checkpoint a tldraw board",
+    description: "Persist a current tldraw room snapshot as the next immutable Artifact version with compare-and-swap clocks. Repeating the same idempotencyKey returns the existing checkpoint receipt.",
+    inputSchema: {
+      artifactId: string2().describe("the tldraw Artifact, art_…"),
+      idempotencyKey: string2().min(1).max(200).describe("stable key for this checkpoint"),
+      reason: _enum(["manual", "autosave", "exec"]).optional().describe("why the room is being checkpointed")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "artifacts",
+    run: forward("tldraw.checkpoint")
+  },
+  {
+    name: "tldraw_publish",
+    title: "Publish a tldraw board version",
+    description: "Publish one validated .tldr source into the current board using both the room document clock and Artifact version as compare-and-swap guards. Retries are safe with the same idempotencyKey.",
+    inputSchema: {
+      artifactId: string2().describe("the tldraw Artifact, art_…"),
+      sourceAttachmentId: string2().describe("validated .tldr Attachment, att_…"),
+      expectedDocumentClock: number2().int().min(0).describe("room clock observed before publish"),
+      expectedArtifactVersion: number2().int().min(1).describe("Artifact version observed before publish"),
+      idempotencyKey: string2().min(1).max(200).describe("stable key for this publish")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "artifacts",
+    run: forward("tldraw.publish")
+  },
+  {
+    name: "tldraw_script",
+    title: "Manage a tldraw document script",
+    description: "Set, approve, disable, or reload the separate document script for a tldraw board. Approval names the exact displayed source version and digest; scripts never run from historical views.",
+    inputSchema: {
+      verb: _enum(["set", "approve", "disable", "reload"]).describe("the script change"),
+      artifactId: string2().describe("the tldraw Artifact, art_…"),
+      attachmentId: string2().optional().describe("set: uploaded script Attachment, att_…"),
+      expectedRevision: number2().int().min(0).optional().describe("set: script revision observed before the write"),
+      version: number2().int().min(1).optional().describe("approve: exact displayed source version"),
+      digest: string2().regex(/^[a-f0-9]{64}$/).optional().describe("approve: exact displayed source digest")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "artifacts",
+    run: dispatch({
+      set: "tldraw.script",
+      approve: "tldraw.script",
+      disable: "tldraw.script",
+      reload: "tldraw.script"
+    }, (verb, input) => ({ ...input, verb }))
+  },
+  {
+    name: "tldraw_observe",
+    title: "Observe a tldraw board",
+    description: "Capture a fresh bounded tldraw scene, lint result, document clock and digest, plus a PNG attachment for visual review.",
+    inputSchema: {
+      artifactId: string2().describe("the tldraw Artifact, art_…"),
+      pageId: string2().min(1).max(200).optional().describe("optional page to observe"),
+      viewportWidth: number2().int().min(320).max(1920).optional(),
+      viewportHeight: number2().int().min(240).max(1080).optional()
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "artifacts",
+    run: forward("tldraw.observe")
+  },
+  {
+    name: "tldraw_exec",
+    title: "Run a one-shot tldraw program",
+    description: "Run bounded one-shot code against the current live tldraw board without changing its persistent document script, and return a durable execution receipt. An unknown result is reported for recovery and is never replayed automatically.",
+    inputSchema: {
+      artifactId: string2().describe("the tldraw Artifact, art_…"),
+      code: string2().min(1).max(1e5).describe("the script source to execute"),
+      idempotencyKey: string2().min(1).max(200).describe("stable key for this execution"),
+      expectedDocumentClock: number2().int().min(0).optional().describe("optional current room clock guard"),
+      boundedSettleMs: number2().int().min(400).max(3000).optional().describe("maximum settle time")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "artifacts",
+    run: forward("tldraw.exec")
+  },
+  {
+    name: "tldraw_exec_get",
+    title: "Read a tldraw execution receipt",
+    description: "Read one tldraw execution receipt by execution id. The receipt reports success, failure, running, or unknown without starting another execution.",
+    inputSchema: {
+      executionId: string2().describe("the execution receipt, tex_…"),
+      artifactId: string2().optional().describe("optional board id for a scoped lookup")
+    },
+    surfaces: ["mcp", "cli"],
+    toolset: "artifacts",
+    run: forward("tldraw.exec_get")
+  },
   {
     name: "artifact_delete",
     title: "Permanently delete an Artifact",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.22.5",
+  "version": "0.22.7",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",