Surfaces

Every operation in arbe runs against one core, reachable four ways: the web app, the CLI (arbe), the HTTP API, and the TypeScript SDK that wraps it. Same Zod-validated payloads everywhere.

The map

Scope tags the SDK layer the method lives on: everywhere = @arbe/core/client (pure fetch, runs in browser/worker/bun); bun-only = local helpers in the CLI / @arbe/sandbox that need the Node Sprites SDK and a process (no SDK client method exists); HTTP-only = API exists before CLI/SDK wrappers.

Entity	CLI	API	SDK method	Scope
houses	arbe house {list,view,create,edit,delete,select,clear,ps}	GET/POST /api/houses, PATCH/DELETE /api/houses/:id	listHouses, getHouse, createHouse, updateHouse, deleteHouse	everywhere
house files	arbe files {add,list,search}	GET/POST /api/houses/:id/files, POST …/search, DELETE /api/houses/:id/files/:fileId	listHouseFiles, addHouseFile, searchHouseFiles	everywhere
agents	arbe agent {list,view,edit,create}	GET/POST /api/agents, GET/PATCH /api/agents/:id, POST/DELETE /api/agents/keys	searchAgents, listAgents, getAgent, createAgent, updateAgent, regenerateApiKey, revokeApiKey	everywhere
environments	arbe env {list,view,create,delete,use,bind-secret,unbind-secret,diagnose}	GET/POST /api/environments, GET/PATCH/DELETE /api/environments/:id, GET …/:id/diagnose	listEnvironments, getEnvironment, createEnvironment, updateEnvironment, deleteEnvironment, diagnoseEnvironment	everywhere
threads	arbe thread {list,view,result,diagnose,delete,prune,reconcile,create,update,label}	GET/POST /api/threads, GET/PATCH/DELETE /api/threads/:id, POST …/prune, POST …/:id/reconcile, GET …/:id/agents	listThreads, getThread, createThread, updateThread, transitionThreadStatus, deleteThread, pruneStuckThreads, reconcileThread, getThreadAgents	everywhere
entries	arbe thread entries	GET/POST /api/threads/:id/entries, GET …/:id/stream	readThreadEntries, createEntry, createEntries, observeThread, tailThreadStream	everywhere
configs	arbe config {get,set,delete}	GET/PATCH/DELETE /api/{houses,threads}/:id/config	getConfig, getConfigRaw, setConfig, deleteConfig	everywhere
secrets	arbe secret {list,view,set,delete}	GET/POST /api/secrets, GET/DELETE /api/secrets/:id, PUT …/:id/value	listSecrets, getSecret, createSecret, rotateSecret, deleteSecret	everywhere
members	arbe member {list,add,remove}	GET/POST /api/houses/:id/members, DELETE …/:id/members/:agentId	listMembers, addMember, removeMember	everywhere
invites	arbe invite {create,revoke}	POST/DELETE /api/invites	createInvite, revokeInvite	everywhere
sandboxes (daytona)	arbe sandbox {list,create,destroy,start,stop,view,diagnose} --runtime daytona	GET/POST /api/sandboxes, GET/PATCH/DELETE /api/sandboxes/:id	listHouseSandboxes, listDaytonaSandboxes, createDaytonaSandbox, getDaytonaSandbox, startDaytonaSandbox, stopDaytonaSandbox, deleteDaytonaSandbox	everywhere
sandboxes (sprite)	arbe sandbox {list,create,destroy,setup,view,ping,env,diagnose}	GET/POST /api/sprites, GET/DELETE /api/sprites/:name, POST /api/sprites/setup	listSandboxes, getSandbox, createSandbox, deleteSandbox, setupSandbox	bun-only
workflows	arbe wf {runs,show,spawn,create,proof}	GET/POST /api/workflows, GET/PATCH/DELETE /api/workflows/:id, GET/POST /api/wf (runs/spawn)	listWorkflows, createWorkflow, updateWorkflow, deleteWorkflow, wfListRuns, wfShowRun, wfSpawn	everywhere

arbe sandbox defaults to the sprite runtime; pass --runtime daytona for the daytona verbs. The sprite forensics subcommands (ping, env, diagnose) call the Node Sprites SDK directly and have no API/SDK-client equivalent.

All four surfaces resolve to one identity — see permissions.

Code: apps/www/src/routes/api/, packages/core/client.ts.
See web app, cli, api, sdk.