@lambdacurry/arbor 0.23.32 → 0.23.35

package/dist/arbor.js

@@ -2,7 +2,7 @@
 // package.json
 var package_default = {
   name: "@lambdacurry/arbor",
-  version: "0.23.32",
+  version: "0.23.35",
   description: "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   keywords: [
     "agents",
@@ -6908,6 +6908,11 @@ var computerRuns = sqliteTable("computer_runs", {
   f1Authority: text("f1_authority", { mode: "json" }).$type(),
   workspaceState: text("workspace_state", { mode: "json" }).$type(),
   finishRequest: text("finish_request", { mode: "json" }).$type(),
+  retentionPolicy: text("retention_policy").$type().notNull().default("none"),
+  retentionDeadlineAt: ts("retention_deadline_at"),
+  retentionMeaningfulUseAt: ts("retention_meaningful_use_at"),
+  retentionKeep: integer2("retention_keep", { mode: "boolean" }).notNull().default(false),
+  retentionRevision: integer2("retention_revision").notNull().default(0),
   status: text("status").$type().notNull().default("active"),
   label: text("label"),
   reason: text("reason"),
@@ -6918,7 +6923,8 @@ var computerRuns = sqliteTable("computer_runs", {
   threadIdx: index("computer_runs_thread_idx").on(t.threadId, t.startedAt),
   sessionIdx: index("computer_runs_session_idx").on(t.computerSessionId, t.startedAt),
   statusIdx: index("computer_runs_status_idx").on(t.computerId, t.status),
-  runtimeIdx: index("computer_runs_runtime_idx").on(t.computerId, t.runtimeState)
+  runtimeIdx: index("computer_runs_runtime_idx").on(t.computerId, t.runtimeState),
+  retentionDueIdx: index("computer_runs_retention_due_idx").on(t.retentionPolicy, t.status, t.retentionDeadlineAt)
 }));
 var packageCacheObjects = sqliteTable("package_cache_objects", {
   key: text("key").primaryKey(),
@@ -7893,6 +7899,8 @@ var events = sqliteTable("events", {
   createdAt: ts("created_at").notNull()
 }, (t) => ({
   objectIdx: index("events_object_idx").on(t.objectType, t.objectId, t.createdAt),
+  retentionMutationIdx: index("events_retention_mutation_idx").on(t.objectType, t.objectId, t.type, sql`trim(json_extract(${t.payload}, '$.mutationId'))`).where(sql`json_valid(${t.payload})`),
+  retentionProcessIdx: index("events_retention_process_idx").on(t.objectType, t.objectId, t.type, sql`trim(json_extract(${t.payload}, '$.processId'))`).where(sql`json_valid(${t.payload})`),
   createdIdx: index("events_created_idx").on(t.createdAt)
 }));
 var notifications = sqliteTable("notifications", {
@@ -8175,6 +8183,9 @@ var MAX_WAY_LEN = WAYS_TO_HELP_LIMITS.maxItemLength;
 // ../core/src/ops/computer-output.ts
 var COMPUTER_OUTPUT_DEFAULT_STALE_MS = 24 * 60 * 60 * 1000;
 
+// ../core/src/ops/computer-run-retention.ts
+var COMPUTER_RUN_RETENTION_WARNING_MS = 24 * 60 * 60 * 1000;
+
 // ../core/src/ops/computer-run.ts
 var COMPUTER_RUN_START_CHECKPOINT_RESERVATION_STALE_MS = 12 * 60 * 1000;
 var COMPUTER_RUN_F1_FINAL_FAILURE_CODES = new Set([
@@ -9316,6 +9327,14 @@ var MCP_OUTPUT_SCHEMAS = {
       durable: number2().int().min(0).nullable()
     }).nullable().optional()
   }),
+  computer_audit_access: looseObject({
+    binding: jsonObject,
+    access: object({
+      token: string2(),
+      expiresAt: timestamp,
+      operations: array(literal("computer:audit-read"))
+    })
+  }),
   computer_inventory: looseObject({
     computers: array(jsonObject),
     nextCursor: string2().nullable()
@@ -10045,6 +10064,39 @@ var MCP_OUTPUT_SCHEMAS = {
       })
     ])
   }),
+  computer_run_retention: looseObject({
+    runId: id,
+    destructiveExpiration: literal("disabled"),
+    report: looseObject({
+      policy: _enum(["none", "isolated-run-14d"]),
+      deadlineAt: timestamp.nullable(),
+      meaningfulUseAt: timestamp.nullable(),
+      keep: boolean2(),
+      revision: number2().int().min(0),
+      warningDelivery: literal("advisory-only"),
+      destructiveExpiration: literal("disabled"),
+      decision: _enum(["excluded", "not-due", "kept", "deferred", "eligible"]),
+      reasonCode: string2(),
+      warningDue: boolean2(),
+      warningLossScope: string2(),
+      warningAction: literal("computer_run_keep")
+    })
+  }),
+  computer_run_keep: looseObject({
+    runId: id,
+    keep: boolean2(),
+    revision: number2().int().min(0),
+    replayed: boolean2(),
+    retention: looseObject({
+      policy: _enum(["none", "isolated-run-14d"]),
+      deadlineAt: timestamp.nullable(),
+      meaningfulUseAt: timestamp.nullable(),
+      keep: boolean2(),
+      revision: number2().int().min(0),
+      warningDelivery: literal("advisory-only"),
+      destructiveExpiration: literal("disabled")
+    })
+  }),
   computer_runs: looseObject({
     computerId: id,
     threadId: id,
@@ -10640,6 +10692,7 @@ var MCP_TOOL_ANNOTATIONS = {
   set_thread_computer: destructiveIdempotent,
   get_computer: readOnly,
   computer_inventory: readOnly,
+  computer_audit_access: additive,
   transition_thread: additive,
   request: additive,
   respond: additive,
@@ -10719,6 +10772,8 @@ var MCP_TOOL_ANNOTATIONS = {
   computer_repo_work_status: readOnly,
   computer_run_finish: idempotent,
   computer_run_receipt: readOnly,
+  computer_run_retention: readOnly,
+  computer_run_keep: idempotent,
   computer_runs: readOnly,
   computer_exec: destructiveOpenWorld,
   computer_run_setup: destructiveIdempotentOpenWorld,
@@ -11851,9 +11906,10 @@ var ACTION_DEFINITIONS = [
   {
     name: "computer_open",
     title: "Open a Thread computer",
-    description: "Deprecated by AD-306: start work with computer_run_start(threadId, mode) instead; this alias remains one release and boots the parent Thread Computer, returning a computerSessionId. Use it only for a legacy client that still addresses the parent by cms_ id; unsafe recovery is refused and unresolved newer workspace state stays fail-closed.",
+    description: "Deprecated by AD-306: start work with computer_run_start(threadId, mode) instead; this alias remains one release and boots the parent Thread Computer, returning a computerSessionId. An optional owned active runId records a successful session attach as Run retention activity. Use it only for a legacy client that still addresses the parent by cms_ id; unsafe recovery is refused and unresolved newer workspace state stays fail-closed.",
     inputSchema: {
       threadId: string2().describe("the Arbor Thread whose stable computer to open, thr_…"),
+      runId: string2().optional().describe("optional owned active Run; successful open renews its retention deadline"),
       idempotencyKey: string2().trim().min(1).max(200).optional().describe("optional explicit key for ONE distinct logical open; omission reuses the durable profile/Thread/recipe identity; changed options require a distinct intent; retry unchanged after response loss and never mint a new key to bypass unresolved work"),
       vcpus: number2().int().min(1).max(4).optional().describe("optional container vCPU request"),
       label: string2().optional().describe("short runtime label for operator diagnostics")
@@ -11943,6 +11999,30 @@ var ACTION_DEFINITIONS = [
     toolset: "loop",
     run: forward("computer_runtime.run_receipt")
   },
+  {
+    name: "computer_run_retention",
+    title: "Inspect Run retention",
+    description: "Report the deadline, last meaningful use, Keep flag, and advisory warning for one isolated Run. Expiry is disabled; this read sends no warning and releases nothing.",
+    inputSchema: {
+      runId: string2().describe("the Run to inspect, run_…")
+    },
+    surfaces: ["computer-mcp", "computer-cli"],
+    toolset: "loop",
+    run: forward("computer_runtime.run_retention")
+  },
+  {
+    name: "computer_run_keep",
+    title: "Keep Run data",
+    description: "The Run owner or an organization admin can set or clear Keep for a newly created isolated Run, using expectedRevision to guard races. It protects restorable Run data without keeping provider compute alive; expiry remains disabled.",
+    inputSchema: {
+      runId: string2().describe("the Run to protect, run_…"),
+      keep: boolean2().describe("true to retain the Run's restorable data; false to resume the policy"),
+      expectedRevision: number2().int().nonnegative().optional().describe("optional retention revision read from computer_run_receipt")
+    },
+    surfaces: ["computer-mcp", "computer-cli"],
+    toolset: "loop",
+    run: forward("computer_runtime.run_keep")
+  },
   {
     name: "computer_run_setup",
     title: "Run the declared setup",
@@ -12235,6 +12315,18 @@ var ACTION_DEFINITIONS = [
     toolset: "loop",
     run: forward("computer.get")
   },
+  {
+    name: "computer_audit_access",
+    title: "Issue a Computer audit grant",
+    description: "Issue a five-minute read-only retirement-audit grant for an exact existing Computer and attachment receipt. Organization owner/admin only, including archived Spaces. Role is checked at issuance only: an already-issued grant remains valid for up to 300 seconds after owner/admin role revocation. Does not attach, restore, or contact a provider. Keep the returned capability private and consume it immediately.",
+    inputSchema: {
+      computerId: string2().describe("the exact Computer, cmp_…"),
+      sessionId: string2().describe("an existing attachment receipt for that Computer, cms_…")
+    },
+    surfaces: ["cli"],
+    toolset: "admin",
+    run: Object.assign((ex, input) => ex.call("computer.access", { ...input, operations: ["computer:audit-read"] }), { operation: "computer.access" })
+  },
   {
     name: "computer_inventory",
     title: "Inventory organization Computers",

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@lambdacurry/arbor",
-  "version": "0.23.32",
+  "version": "0.23.35",
   "description": "The Arbor CLI — a shared workspace for people and agents. The human + headless-agent write path over Arbor's guarded operation surface.",
   "keywords": [
     "agents",