computer: updates to make workspace easier to extend

.changeset/edit-diff-bounds.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": patch
+---
+
+The `edit` tool bounds its diff with `maxDiffLines` and `maxDiffBytes` and reports `diffTruncated`; see [`edit` tool documentation](https://github.com/cloudflare/computer/blob/main/docs/09_tool_interface.md#edit).

.changeset/exec-input-object.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": minor
+---
+
+The `exec` tool's `input` is an object rather than any JSON value; see [`exec` tool documentation](https://github.com/cloudflare/computer/blob/main/docs/09_tool_interface.md#exec).

.changeset/exec-input-repair.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": patch
+---
+
+The `exec` tool parses an `input` object sent as a string of JSON; see [`exec` tool documentation](https://github.com/cloudflare/computer/blob/main/docs/09_tool_interface.md#exec).

.changeset/exec-output-option.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": patch
+---
+
+Tool sets take `execOutput: { maxLines, maxBytes }` for the `exec` tool's output limits; see [tool option documentation](https://github.com/cloudflare/computer/blob/main/docs/09_tool_interface.md#options).

.changeset/find-brace-globs.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/dofs": patch
+---
+
+`find` and `grep` globs match brace alternatives such as `**/*.{ts,tsx}`; see [`find` documentation](https://github.com/cloudflare/computer/blob/main/docs/04_filesystem_interface.md#find).

.changeset/find-prune-trailing-globstar.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/dofs": minor
+---
+
+An exclusion ending in `/**` also prunes the directory it names in `find` and `grep`; see [`find` documentation](https://github.com/cloudflare/computer/blob/main/docs/04_filesystem_interface.md#find).

.changeset/module-host-assets.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": patch
+---
+
+Host module factories receive the Workspace's assets client as `host.assets`; see [host module documentation](https://github.com/cloudflare/computer/blob/main/docs/17_isolate_javascript.md#host-modules).

.changeset/module-lazy-descriptions.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": patch
+---
+
+`WorkerJavaScriptBackend` reads each host module's description whenever it describes itself, so a factory can describe something built later; see [module documentation](https://github.com/cloudflare/computer/blob/main/docs/17_isolate_javascript.md#modules).

.changeset/pi-tool-details.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": patch
+---
+
+`createPiTools` results carry each tool's own output as `details`; see [pi documentation](https://github.com/cloudflare/computer/blob/main/docs/09_tool_interface.md#pi).

.changeset/tool-glob-lists.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": patch
+---
+
+The `grep` tool's `include` and `exclude`, and the `find` tool's `exclude`, take one glob or a list; see [`grep` tool documentation](https://github.com/cloudflare/computer/blob/main/docs/09_tool_interface.md#grep).

.changeset/tools-core-entry-point.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": patch
+---
+
+Add `@cloudflare/computer/tools/core`, which exports `defineExec` without an agent library; see [tool documentation](https://github.com/cloudflare/computer/blob/main/docs/09_tool_interface.md#what-ships).

.changeset/tools-root-option.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": patch
+---
+
+Tool sets take `root` to confine the file tools to one directory and refuse symbolic links; see [root documentation](https://github.com/cloudflare/computer/blob/main/docs/09_tool_interface.md#root).

.changeset/ws-artifacts-tokens.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": patch
+---
+
+`ws:artifacts` adds `createToken` and `share` for minting git tokens and clone URLs; see [`ws:artifacts` documentation](https://github.com/cloudflare/computer/blob/main/docs/17_isolate_javascript.md#wsartifacts).

.changeset/ws-assets-module.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": patch
+---
+
+Add `ws:assets` so isolate JavaScript can publish a Workspace file to a time-limited URL; see [`ws:assets` documentation](https://github.com/cloudflare/computer/blob/main/docs/17_isolate_javascript.md#wsassets).

.changeset/ws-container-max-lines.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": patch
+---
+
+`createContainerModule({ maxOutputLines })` limits each `ws:container` stream by lines as well as bytes; see [`ws:container` documentation](https://github.com/cloudflare/computer/blob/main/docs/17_isolate_javascript.md#wscontainer).

.changeset/ws-container-prelude.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": patch
+---
+
+`createContainerModule({ prelude })` runs shell text such as `set -o pipefail` before each `ws:container` command; see [`ws:container` documentation](https://github.com/cloudflare/computer/blob/main/docs/17_isolate_javascript.md#wscontainer).

.changeset/ws-tools-module.md

@@ -0,0 +1,5 @@
+---
+"@cloudflare/computer": patch
+---
+
+Add `ws:tools` so isolate JavaScript can call the agent's own tools; see [`ws:tools` documentation](https://github.com/cloudflare/computer/blob/main/docs/17_isolate_javascript.md#wstools).

docs/04_filesystem_interface.md

@@ -336,15 +336,19 @@ matched against each candidate's path **relative to `directory`**, not
 its absolute path — so `**/*.ts` under `/workspace/src` matches
 `a/b.ts`, not `/workspace/src/a/b.ts`.
 
-The glob supports `*`, `**`, `**/`, and `?`. Character classes and
-brace expansions are matched literally.
+The glob supports `*`, `**`, `**/`, `?`, and brace alternatives:
+`**/*.{ts,tsx}` matches either extension, and groups nest. A brace with
+no comma, or with no closing brace, is matched literally, as in a
+shell. Character classes are matched literally.
 
 `exclude` takes globs of the same shape, matched against the same
 relative path. An exclusion is decided before the inclusion glob, so it
 always wins. When an excluded entry is a directory the walk prunes it:
 neither the directory nor anything beneath it is read, which is what
 makes skipping `node_modules` or `.git` cheap rather than merely quiet.
-`limit` and `offset` then paginate whatever survives.
+An exclusion ending in `/**` also excludes the directory it names, so
+`node_modules/**` prunes `node_modules` itself; a file of that name is
+kept. `limit` and `offset` then paginate whatever survives.
 
 ```ts
 // Every TypeScript file in the project.
@@ -355,7 +359,7 @@ const all = await fs.find("/workspace/notes");
 
 // Skip generated trees without descending into them.
 const sources = await fs.find("/workspace", "**/*.ts", {
-  exclude: ["node_modules", "node_modules/**", ".git", ".git/**"],
+  exclude: ["{node_modules,.git}/**"],
 });
 ```
 
@@ -424,9 +428,8 @@ paginate matching lines.
 `exclude` takes globs of the same shape as `find`'s, matched against the same
 directory-relative path and applied before `include`, so an exclusion always
 wins. An excluded directory is pruned before its children are queried, so the
-subtree costs nothing rather than being read and filtered. As with `find`, name
-both the directory and its contents to skip a whole subtree: `node_modules/**`
-matches what is below `node_modules`, not `node_modules` itself.
+subtree costs nothing rather than being read and filtered. As with `find`,
+`node_modules/**` skips the whole subtree, `node_modules` included.
 
 `path` may be a directory or a single file. Directory searches return matches
 in deterministic depth-first discovery order, then line order within each
@@ -437,7 +440,7 @@ traversal to prune, so `exclude` does not apply to it.
 const hits = await fs.grep("TODO", "/workspace/src", {
   ignoreCase: true,
   include: "**/*.ts",
-  exclude: ["node_modules", "node_modules/**"],
+  exclude: ["node_modules/**"],
 });
 for (const hit of hits) {
   console.log(`${hit.path}:${hit.line}: ${hit.text}`);
@@ -526,7 +529,7 @@ maps to `Workspace.fs`:
 | `symlink` / `readlink` | `symlink` / `readlink` | Same argument order as Node. Targets are stored verbatim and may dangle. |
 | `watch` | — | Low-level primitive in `fs/watch.ts` (`createWatcher`, `createWatchAsyncIterable`, `WatchHandle`, `WatchOptions`); not exposed on the `WorkspaceFilesystem` class. |
 | `open` / `FileHandle` | — | Use streams instead. |
-| `glob` | `find` | Limited glob support (`*`, `**`, `**/`, and `?`), plus `exclude` for pruning subtrees. |
+| `glob` | `find` | Limited glob support (`*`, `**`, `**/`, `?`, and `{a,b}`), plus `exclude` for pruning subtrees. |
 | — | `grep` | Not in `node:fs`; literal by default, with optional regular expressions. Shares `find`'s `include`/`exclude` globs. |
 | — | `find` | Recursive directory walk with an optional glob, relative-rooted. |
 | — | `ls` | Flat list of file paths under a directory (segment-aware). |