@aexhq/sdk 0.31.0 → 0.33.0

package/README.md

@@ -8,7 +8,8 @@ aex is an agent execution platform for launching autonomous agents from a simple
 
 The package ships:
 
-- `AgentExecutor` for submit, run, wait, stream, inspect, download, cancel, and delete.
+- `Aex` / `AgentExecutor` for sessions, one-shot runs, inspect, download, cancel, and delete.
+- `sessions` / `openSession()` for durable, resumable agent sessions.
 - Typed run primitives: `Models`, `Providers`, `RuntimeSizes`, `Skill`, `AgentsMd`, `File`, `McpServer`, `ProxyEndpoint`, and `Secret`.
 - A bundled `aex` CLI with the same run, status, events, outputs, download, cancel, delete, whoami, and skills operations.
 
@@ -27,56 +28,53 @@ export AEX_API_TOKEN="<your-aex-token>"
 export ANTHROPIC_API_KEY="<your-anthropic-api-key>"
 ```
 
-## First Run
+## First Session
 
 ```ts
-import { AgentExecutor, Models } from "@aexhq/sdk";
+import { Aex, Models, Sizes } from "@aexhq/sdk";
 
-const aex = new AgentExecutor({ apiToken: process.env.AEX_API_TOKEN! });
+const aex = new Aex({ apiToken: process.env.AEX_API_TOKEN! });
 
-// run() submits, waits for the run to settle, and returns the result —
-// no manual poll loop. `provider` is derived from the model.
-const { text, ok } = await aex.run({
+const session = await aex.openSession({
   model: Models.CLAUDE_HAIKU_4_5,
-  secrets: { apiKeys: { anthropic: process.env.ANTHROPIC_API_KEY! } },
-  prompt: "Summarize this repo."
+  system: "You are a concise engineering assistant.",
+  runtime: Sizes.SHARED_0_25X_1GB,
+  // Default is "3m"; set it explicitly when you want a different idle window.
+  overrides: { idleTtl: "3m" },
+  apiKeys: { anthropic: process.env.ANTHROPIC_API_KEY! }
 });
 
-console.log(ok, text);
+const first = await session.send("Summarize this repo.").done();
+console.log(first.status, first.text);
+
+const resumed = await aex.openSession(session.id);
+await resumed.send("Continue with the follow-up validation.").done();
 ```
 
-Need the run id, live events, or downloads? Use `submit` + `stream` + `wait`:
+Need a one-shot convenience? `run()` opens a session, sends `message` as one
+turn, and returns the collected result. The returned `runId` is the session id,
+so it can be resumed later with `openSession(runId)`.
 
 ```ts
-const runId = await aex.submit({
+const result = await aex.run({
   model: Models.CLAUDE_HAIKU_4_5,
-  secrets: { apiKeys: { anthropic: process.env.ANTHROPIC_API_KEY! } },
-  prompt: "Write the report and save outputs."
+  apiKeys: { anthropic: process.env.ANTHROPIC_API_KEY! },
+  message: "Write the report and save outputs."
 });
 
-for await (const event of aex.stream(runId)) {
-  console.log(event.type);
-}
-
-const run = await aex.wait(runId);
-console.log(run.status);
-
-await aex.download(runId, { to: "./run.zip" });
+console.log(result.runId, result.status, result.text);
 ```
 
-For multiple providers (e.g. subagents on a different model family), include
-each BYOK key in `secrets.apiKeys`:
+For multiple providers, include each BYOK key in `apiKeys`:
 
 ```ts
 await aex.run({
   model: Models.CLAUDE_HAIKU_4_5,
-  secrets: {
-    apiKeys: {
-      anthropic: process.env.ANTHROPIC_API_KEY!,
-      openai: process.env.OPENAI_API_KEY!
-    }
+  apiKeys: {
+    anthropic: process.env.ANTHROPIC_API_KEY!,
+    openai: process.env.OPENAI_API_KEY!
   },
-  prompt: "Delegate research to a subagent."
+  message: "Delegate research to a subagent."
 });
 ```
 
@@ -144,7 +142,7 @@ finds output files across runs and returns references (no bytes) you then
 
 ## Feature Areas
 
-- **Agent runtime:** managed autonomous runs with filesystem read/edit, grep/glob/head/tail, open web fetch/search defaults, optional notebook tools, and post-hook repair.
+- **Agent runtime:** managed autonomous runs with filesystem read/edit, grep/glob/head/tail, open web fetch/search defaults, and optional notebook tools.
 - **Durable infrastructure:** run records, status, wait/cancel/delete, idempotency, typed events, output capture, downloads, timeouts, and runtime sizes.
 - **Agent composition:** skills, files, AGENTS.md, remote MCP servers, proxy endpoints, environment variables, packages, and networking controls.
 - **Subagents:** typed parent/child lineage for async child runs, output handoff, and bounded agent delegation.

package/dist/_contracts/event-stream-client.d.ts

@@ -12,7 +12,7 @@
  * A silently half-open socket (no close/error, no frames) is the dangerous
  * case: the read loop would block forever and MISS a terminal that was already
  * persisted server-side. So the client sends a tiny keep-alive ping the
- * coordinator auto-responds to (hibernation-safe, no DO wake) and runs an idle
+ * coordinator answers with a matching pong, and runs an idle
  * watchdog: if no frame arrives within {@link CoordinatorStreamOptions.idleTimeoutMs},
  * the socket is treated as dead and reconnected — resume-from-cursor then
  * replays the terminal.
@@ -65,7 +65,7 @@ export interface CoordinatorStreamOptions {
     readonly idleTimeoutMs?: number;
     /**
      * Client keep-alive ping cadence. The client sends {@link COORDINATOR_PING},
-     * which the coordinator auto-responds to WITHOUT waking the stateful coordinator, so
+     * which the coordinator answers with a matching pong, so
      * a legitimately quiet run keeps the socket measurably alive and does not trip
      * the watchdog. Default 15s. Set 0 to disable (then only real events reset the
      * watchdog → quiet runs may reconnect).

package/dist/_contracts/event-stream-client.js

@@ -12,7 +12,7 @@
  * A silently half-open socket (no close/error, no frames) is the dangerous
  * case: the read loop would block forever and MISS a terminal that was already
  * persisted server-side. So the client sends a tiny keep-alive ping the
- * coordinator auto-responds to (hibernation-safe, no DO wake) and runs an idle
+ * coordinator answers with a matching pong, and runs an idle
  * watchdog: if no frame arrives within {@link CoordinatorStreamOptions.idleTimeoutMs},
  * the socket is treated as dead and reconnected — resume-from-cursor then
  * replays the terminal.
@@ -26,8 +26,8 @@
  */
 const isTerminalType = (e) => e.type === "RUN_FINISHED" || e.type === "RUN_ERROR";
 /**
- * Keep-alive ping the client sends; the coordinator answers it via
- * `setWebSocketAutoResponse` without waking the DO. Must stay byte-identical to
+ * Keep-alive ping the client sends; the coordinator answers it with the matching
+ * pong in its WebSocket message handler. Must stay byte-identical to
  * the coordinator's pair (aex-platform `packages/shared/src/event-stream-client.ts`).
  */
 const COORDINATOR_PING = "aex:ping";

package/dist/_contracts/index.d.ts

@@ -4,7 +4,6 @@ export * from "./models.js";
 export * from "./status.js";
 export * from "./submission.js";
 export * from "./runtime-sizes.js";
-export * from "./post-hook.js";
 export * from "./runner-event.js";
 export * from "./event-envelope.js";
 export * from "./connection-ticket.js";

package/dist/_contracts/index.js

@@ -4,7 +4,6 @@ export * from "./models.js";
 export * from "./status.js";
 export * from "./submission.js";
 export * from "./runtime-sizes.js";
-export * from "./post-hook.js";
 export * from "./runner-event.js";
 export * from "./event-envelope.js";
 export * from "./connection-ticket.js";

package/dist/_contracts/models.d.ts

@@ -36,12 +36,6 @@ export declare const MODEL_PROVIDER_IDS: {
     readonly "deepseek-v4-pro": {
         readonly deepseek: "deepseek-v4-pro";
     };
-    readonly "deepseek-chat": {
-        readonly deepseek: "deepseek-chat";
-    };
-    readonly "deepseek-reasoner": {
-        readonly deepseek: "deepseek-reasoner";
-    };
     readonly "gpt-4.1": {
         readonly openai: "gpt-4.1";
     };
@@ -102,76 +96,6 @@ export declare const Models: {
     readonly DEEPSEEK_V4_FLASH: "deepseek-v4-flash";
     /** DeepSeek V4 Pro — DeepSeek (reasoning-heavy). */
     readonly DEEPSEEK_V4_PRO: "deepseek-v4-pro";
-    /**
-     * @deprecated Legacy alias DeepSeek routes to `deepseek-v4-flash` (non-thinking).
-     * DeepSeek removes this name on 2026-07-24 15:59 UTC — migrate to
-     * {@link Models.DEEPSEEK_V4_FLASH}.
-     */
-    readonly DEEPSEEK_CHAT: "deepseek-chat";
-    /**
-     * @deprecated Legacy alias DeepSeek routes to `deepseek-v4-flash` (thinking).
-     * DeepSeek removes this name on 2026-07-24 15:59 UTC — migrate to
-     * {@link Models.DEEPSEEK_V4_FLASH} (or {@link Models.DEEPSEEK_V4_PRO} for
-     * heavier reasoning).
-     */
-    readonly DEEPSEEK_REASONER: "deepseek-reasoner";
-    /** GPT-4.1 — OpenAI. */
-    readonly GPT_4_1: "gpt-4.1";
-    /** GPT-4o mini — OpenAI, or via OpenRouter (`provider: Providers.OPENROUTER`). */
-    readonly GPT_4O_MINI: "gpt-4o-mini";
-    /** GPT-4o — via OpenRouter (`provider: Providers.OPENROUTER`). */
-    readonly GPT_4O: "gpt-4o";
-    /** Gemini 2.0 Flash — Gemini, or via OpenRouter (`provider: Providers.OPENROUTER`). */
-    readonly GEMINI_2_0_FLASH: "gemini-2.0-flash";
-    /** Gemini 2.5 Flash — Gemini. */
-    readonly GEMINI_2_5_FLASH: "gemini-2.5-flash";
-    /** Mistral Large (latest) — Mistral. */
-    readonly MISTRAL_LARGE_LATEST: "mistral-large-latest";
-    /** Mistral Small (latest) — Mistral. */
-    readonly MISTRAL_SMALL_LATEST: "mistral-small-latest";
-    /**
-     * Doubao Seed 1.8 — ByteDance, via the official Ark API. Default routes
-     * through the international BytePlus gateway (`Providers.DOUBAO`); pair with
-     * `Providers.DOUBAO_CN` for the China Volcengine gateway.
-     */
-    readonly DOUBAO_SEED_PRO: "doubao-seed-pro";
-    /**
-     * Doubao Seed 1.6 Flash — ByteDance, via the official Ark API (fast/cheap).
-     * Default `Providers.DOUBAO` (international); pair with `Providers.DOUBAO_CN`
-     * for China.
-     */
-    readonly DOUBAO_SEED_FLASH: "doubao-seed-flash";
-};
-/**
- * Back-compat alias for {@link Models}. Existing imports of `RunModels`
- * keep working; new code should prefer `Models`.
- */
-export declare const RunModels: {
-    /** Claude Haiku 4.5 — Anthropic. */
-    readonly CLAUDE_HAIKU_4_5: "claude-haiku-4-5";
-    /** Claude 3.5 Haiku (latest) — Anthropic. */
-    readonly CLAUDE_3_5_HAIKU_LATEST: "claude-3-5-haiku-latest";
-    /** Claude 3.5 Sonnet (latest) — Anthropic. */
-    readonly CLAUDE_3_5_SONNET_LATEST: "claude-3-5-sonnet-latest";
-    /** Claude Sonnet 4.6 — Anthropic (1M context, reasoning-capable). */
-    readonly CLAUDE_SONNET_4_6: "claude-sonnet-4-6";
-    /** DeepSeek V4 Flash — DeepSeek (non-thinking, fast). */
-    readonly DEEPSEEK_V4_FLASH: "deepseek-v4-flash";
-    /** DeepSeek V4 Pro — DeepSeek (reasoning-heavy). */
-    readonly DEEPSEEK_V4_PRO: "deepseek-v4-pro";
-    /**
-     * @deprecated Legacy alias DeepSeek routes to `deepseek-v4-flash` (non-thinking).
-     * DeepSeek removes this name on 2026-07-24 15:59 UTC — migrate to
-     * {@link Models.DEEPSEEK_V4_FLASH}.
-     */
-    readonly DEEPSEEK_CHAT: "deepseek-chat";
-    /**
-     * @deprecated Legacy alias DeepSeek routes to `deepseek-v4-flash` (thinking).
-     * DeepSeek removes this name on 2026-07-24 15:59 UTC — migrate to
-     * {@link Models.DEEPSEEK_V4_FLASH} (or {@link Models.DEEPSEEK_V4_PRO} for
-     * heavier reasoning).
-     */
-    readonly DEEPSEEK_REASONER: "deepseek-reasoner";
     /** GPT-4.1 — OpenAI. */
     readonly GPT_4_1: "gpt-4.1";
     /** GPT-4o mini — OpenAI, or via OpenRouter (`provider: Providers.OPENROUTER`). */

package/dist/_contracts/models.js

@@ -23,8 +23,6 @@ export const MODEL_PROVIDER_IDS = {
     "claude-sonnet-4-6": { anthropic: "claude-sonnet-4-6" },
     "deepseek-v4-flash": { deepseek: "deepseek-v4-flash" },
     "deepseek-v4-pro": { deepseek: "deepseek-v4-pro" },
-    "deepseek-chat": { deepseek: "deepseek-chat" },
-    "deepseek-reasoner": { deepseek: "deepseek-reasoner" },
     "gpt-4.1": { openai: "gpt-4.1" },
     "gpt-4o-mini": { openai: "gpt-4o-mini", openrouter: "openai/gpt-4o-mini" },
     "gpt-4o": { openrouter: "openai/gpt-4o" },
@@ -69,19 +67,6 @@ export const Models = {
     DEEPSEEK_V4_FLASH: "deepseek-v4-flash",
     /** DeepSeek V4 Pro — DeepSeek (reasoning-heavy). */
     DEEPSEEK_V4_PRO: "deepseek-v4-pro",
-    /**
-     * @deprecated Legacy alias DeepSeek routes to `deepseek-v4-flash` (non-thinking).
-     * DeepSeek removes this name on 2026-07-24 15:59 UTC — migrate to
-     * {@link Models.DEEPSEEK_V4_FLASH}.
-     */
-    DEEPSEEK_CHAT: "deepseek-chat",
-    /**
-     * @deprecated Legacy alias DeepSeek routes to `deepseek-v4-flash` (thinking).
-     * DeepSeek removes this name on 2026-07-24 15:59 UTC — migrate to
-     * {@link Models.DEEPSEEK_V4_FLASH} (or {@link Models.DEEPSEEK_V4_PRO} for
-     * heavier reasoning).
-     */
-    DEEPSEEK_REASONER: "deepseek-reasoner",
     /** GPT-4.1 — OpenAI. */
     GPT_4_1: "gpt-4.1",
     /** GPT-4o mini — OpenAI, or via OpenRouter (`provider: Providers.OPENROUTER`). */
@@ -109,11 +94,6 @@ export const Models = {
      */
     DOUBAO_SEED_FLASH: "doubao-seed-flash"
 };
-/**
- * Back-compat alias for {@link Models}. Existing imports of `RunModels`
- * keep working; new code should prefer `Models`.
- */
-export const RunModels = Models;
 /**
  * Per-model provider lists, in declaration order. Derived from
  * {@link MODEL_PROVIDER_IDS} so the two never drift.

package/dist/_contracts/operations.d.ts

@@ -1,6 +1,6 @@
 import type { HttpClient } from "./http.js";
 import type { RunUnit } from "./run-unit.js";
-import type { AgentsMdRecord, FileRecord, Output, OutputLink, OutputLinkOptions, OutputFileDownload, OutputFileSelector, OutputFileType, OutputQuery, OutputText, ReadOutputTextOptions, Run, RunEvent, RunListPage, RunListQuery, RunWebhookDelivery, SecretRecord, SecretReveal, Skill, WhoAmI } from "./runtime-types.js";
+import type { AgentsMdRecord, FileRecord, Output, OutputLink, OutputLinkOptions, OutputFileDownload, OutputFileSelector, OutputFileType, OutputQuery, OutputText, ReadOutputTextOptions, Run, RunEvent, RunListPage, RunListQuery, Session, SessionCreateRequest, SessionEvent, SessionListPage, SessionListQuery, SessionMessageAccepted, SessionMessageRequest, SessionStateChangeAccepted, RunWebhookDelivery, SecretRecord, SecretReveal, Skill, WhoAmI } from "./runtime-types.js";
 import type { PlatformRunSubmissionInput } from "./submission.js";
 /**
  * The single source of truth for SDK<->BFF transport. The SDK class
@@ -37,6 +37,20 @@ export declare function getRunUnit(http: HttpClient, runId: string): Promise<Run
  * For a single page; callers wanting every run loop on `nextCursor` themselves.
  */
 export declare function listRuns(http: HttpClient, query?: RunListQuery): Promise<RunListPage>;
+export interface IdempotencyOptions {
+    readonly idempotencyKey?: string;
+}
+export declare function createSession(http: HttpClient, request: SessionCreateRequest, options?: IdempotencyOptions): Promise<Session>;
+export declare function getSession(http: HttpClient, sessionId: string): Promise<Session>;
+export declare function listSessions(http: HttpClient, query?: SessionListQuery): Promise<SessionListPage>;
+export declare function sendSessionMessage(http: HttpClient, sessionId: string, request: SessionMessageRequest, options?: IdempotencyOptions): Promise<SessionMessageAccepted>;
+export declare function suspendSession(http: HttpClient, sessionId: string, options?: IdempotencyOptions): Promise<SessionStateChangeAccepted>;
+export declare function cancelSession(http: HttpClient, sessionId: string, options?: IdempotencyOptions): Promise<SessionStateChangeAccepted>;
+export declare function resumeSession(http: HttpClient, sessionId: string, options?: IdempotencyOptions): Promise<SessionStateChangeAccepted>;
+export declare function deleteSession(http: HttpClient, sessionId: string, options?: IdempotencyOptions): Promise<SessionStateChangeAccepted | void>;
+export declare function listSessionEvents(http: HttpClient, sessionId: string): Promise<readonly SessionEvent[]>;
+export declare function listSessionOutputs(http: HttpClient, sessionId: string, query?: OutputQuery): Promise<readonly Output[]>;
+export declare function getSessionCoordinatorTicket(http: HttpClient, sessionId: string): Promise<CoordinatorTicket>;
 /**
  * List a run's events. The read endpoint is PAGED (bounded per response so a
  * long run can't return an unbounded body); this follows `nextCursor` across
@@ -183,26 +197,9 @@ export declare function findSkillByHash(http: HttpClient, args: {
  * indexed by-hash route is reserved for `uploadIfChanged`.
  */
 export declare function findSkillByName(http: HttpClient, name: string): Promise<Skill | null>;
-/**
- * Upload a workspace AgentsMd file as a markdown string. The BFF
- * canonicalises the content into a deterministic zip with AGENTS.md at
- * root and runs the two-phase pending → ready upload.
- */
-export declare function createAgentsMd(http: HttpClient, args: {
-    readonly name: string;
-    readonly content: string;
-}): Promise<AgentsMdRecord>;
 export declare function listAgentsMd(http: HttpClient): Promise<readonly AgentsMdRecord[]>;
 export declare function getAgentsMd(http: HttpClient, agentsMdId: string): Promise<AgentsMdRecord>;
 export declare function deleteAgentsMd(http: HttpClient, agentsMdId: string): Promise<void>;
-/**
- * Upload a workspace File as a zip bundle. The BFF canonicalises the
- * content and runs the two-phase pending → ready upload.
- */
-export declare function createFile(http: HttpClient, args: {
-    readonly name: string;
-    readonly bytes: Uint8Array;
-}): Promise<FileRecord>;
 export declare function listFiles(http: HttpClient): Promise<readonly FileRecord[]>;
 export declare function getFile(http: HttpClient, fileId: string): Promise<FileRecord>;
 export declare function deleteFile(http: HttpClient, fileId: string): Promise<void>;

package/dist/_contracts/operations.js

@@ -52,6 +52,79 @@ export async function listRuns(http, query) {
         params.cursor = query.cursor;
     return http.request("/api/runs", {}, params);
 }
+function idempotencyHeaders(options) {
+    return options?.idempotencyKey ? { "Idempotency-Key": options.idempotencyKey } : undefined;
+}
+export async function createSession(http, request, options) {
+    const headers = idempotencyHeaders(options);
+    const result = await http.request("/api/sessions", {
+        method: "POST",
+        ...(headers ? { headers } : {}),
+        body: JSON.stringify(request)
+    });
+    return unwrapSession(result);
+}
+export async function getSession(http, sessionId) {
+    const result = await http.request(`/api/sessions/${encodeURIComponent(sessionId)}`);
+    return unwrapSession(result);
+}
+export async function listSessions(http, query) {
+    const params = {};
+    if (query?.status !== undefined)
+        params.status = query.status;
+    if (query?.since !== undefined)
+        params.since = query.since;
+    if (query?.limit !== undefined)
+        params.limit = String(query.limit);
+    if (query?.cursor !== undefined)
+        params.cursor = query.cursor;
+    return http.request("/api/sessions", {}, params);
+}
+export async function sendSessionMessage(http, sessionId, request, options) {
+    const headers = idempotencyHeaders(options);
+    return http.request(`/api/sessions/${encodeURIComponent(sessionId)}/messages`, {
+        method: "POST",
+        ...(headers ? { headers } : {}),
+        body: JSON.stringify(request)
+    });
+}
+export async function suspendSession(http, sessionId, options) {
+    const headers = idempotencyHeaders(options);
+    return http.request(`/api/sessions/${encodeURIComponent(sessionId)}/suspend`, { method: "POST", ...(headers ? { headers } : {}) });
+}
+export async function cancelSession(http, sessionId, options) {
+    const headers = idempotencyHeaders(options);
+    return http.request(`/api/sessions/${encodeURIComponent(sessionId)}/cancel`, { method: "POST", ...(headers ? { headers } : {}) });
+}
+export async function resumeSession(http, sessionId, options) {
+    const headers = idempotencyHeaders(options);
+    return http.request(`/api/sessions/${encodeURIComponent(sessionId)}/resume`, { method: "POST", ...(headers ? { headers } : {}) });
+}
+export async function deleteSession(http, sessionId, options) {
+    const headers = idempotencyHeaders(options);
+    return http.request(`/api/sessions/${encodeURIComponent(sessionId)}`, { method: "DELETE", ...(headers ? { headers } : {}) });
+}
+export async function listSessionEvents(http, sessionId) {
+    const path = `/api/sessions/${encodeURIComponent(sessionId)}/events`;
+    const all = [];
+    let cursor;
+    for (let page = 0; page < LIST_EVENTS_PAGE_BUDGET; page++) {
+        const query = cursor !== undefined ? { cursor: String(cursor) } : {};
+        const result = await http.request(path, {}, query);
+        all.push(...result.events);
+        if (typeof result.nextCursor !== "number")
+            break;
+        cursor = result.nextCursor;
+    }
+    return all;
+}
+export async function listSessionOutputs(http, sessionId, query) {
+    const result = await http.request(`/api/sessions/${encodeURIComponent(sessionId)}/outputs`);
+    return query === undefined ? result.outputs : filterOutputs(result.outputs, query);
+}
+export async function getSessionCoordinatorTicket(http, sessionId) {
+    return http.request(`/api/sessions/${encodeURIComponent(sessionId)}/events/ticket`, { method: "POST" });
+}
 // Bound the transparent pager: the read route caps each page at 1000, so this
 // admits up to ~1e6 events before bailing — past any real run, but bounded so a
 // server that never clears `nextCursor` can't loop forever.
@@ -707,20 +780,8 @@ export async function findSkillByName(http, name) {
     return skills.find((skill) => skill.name === name) ?? null;
 }
 // ===========================================================================
-// AgentsMd upload helpers. Launch submissions use content-addressed asset refs.
+// AgentsMd read/delete helpers. Launch submissions use content-addressed asset refs.
 // ===========================================================================
-/**
- * Upload a workspace AgentsMd file as a markdown string. The BFF
- * canonicalises the content into a deterministic zip with AGENTS.md at
- * root and runs the two-phase pending → ready upload.
- */
-export async function createAgentsMd(http, args) {
-    const form = new FormData();
-    form.append("name", args.name);
-    form.append("content", new Blob([args.content], { type: "text/plain" }), "AGENTS.md");
-    const result = await http.request("/api/agentsmd", { method: "POST", body: form });
-    return unwrapAgentsMd(result);
-}
 export async function listAgentsMd(http) {
     const result = await http.request("/api/agentsmd");
     if (Array.isArray(result)) {
@@ -744,20 +805,8 @@ function unwrapAgentsMd(result) {
     return result;
 }
 // ===========================================================================
-// File upload helpers. Launch submissions use content-addressed asset refs.
+// File read/delete helpers. Launch submissions use content-addressed asset refs.
 // ===========================================================================
-/**
- * Upload a workspace File as a zip bundle. The BFF canonicalises the
- * content and runs the two-phase pending → ready upload.
- */
-export async function createFile(http, args) {
-    const form = new FormData();
-    form.append("name", args.name);
-    const blob = toBlob(args.bytes, "application/zip");
-    form.append("bundle", blob, `${args.name}.zip`);
-    const result = await http.request("/api/files", { method: "POST", body: form });
-    return unwrapFile(result);
-}
 export async function listFiles(http) {
     const result = await http.request("/api/files");
     if (Array.isArray(result)) {
@@ -836,23 +885,15 @@ function unwrapSkill(result) {
     }
     return result;
 }
-function toBlob(input, contentType) {
-    if (input instanceof Blob) {
-        return input;
-    }
-    if (input instanceof Uint8Array) {
-        // BlobPart accepts ArrayBufferView, but lib.dom's overload set
-        // narrows on the underlying buffer kind. Slice into a fresh
-        // ArrayBuffer so a SharedArrayBuffer-backed Uint8Array works.
-        const copy = new Uint8Array(input.byteLength);
-        copy.set(input);
-        return new Blob([copy.buffer], { type: contentType });
-    }
-    return new Blob([input], { type: contentType });
-}
 function hasRun(value) {
     return Boolean(value && typeof value === "object" && "run" in value);
 }
+function unwrapSession(result) {
+    if (result && typeof result === "object" && "session" in result) {
+        return result.session;
+    }
+    return result;
+}
 /**
  * Upload bytes to the hosted API's content-addressable asset endpoint.
  * Returns a storage-neutral asset id suitable for `kind:"asset"` refs in a

package/dist/_contracts/post-hook.d.ts

@@ -3,9 +3,9 @@ export declare const DEFAULT_POST_HOOK_TIMEOUT_MS: number;
 /** Default number of repair turns after a failing hook. */
 export declare const DEFAULT_POST_HOOK_MAX_TURNS = 10;
 /**
- * Customer-facing post-agent-run verifier shape. The SDK and run-config JSON
- * send this form on the wire; the server parser normalizes it to
- * {@link PlatformPostHook}.
+ * Legacy/private post-agent-run verifier input. The public SDK no longer
+ * accepts this field; platform-internal paths may still normalize old wire
+ * records to {@link PlatformPostHook}.
  */
 export interface PlatformPostHookInput {
     readonly command: string;
@@ -21,7 +21,7 @@ export interface PlatformPostHook {
     readonly maxChars: number | null;
 }
 /**
- * Parse the public `postHook` option. An omitted hook, null hook, or hook with
+ * Parse the legacy/private `postHook` option. An omitted hook, null hook, or hook with
  * an empty/whitespace-only command is treated as omitted so callers can pre-fill
  * configs without enabling the verifier accidentally.
  */

package/dist/_contracts/post-hook.js

@@ -4,7 +4,7 @@ export const DEFAULT_POST_HOOK_TIMEOUT_MS = 5 * 60 * 1000;
 /** Default number of repair turns after a failing hook. */
 export const DEFAULT_POST_HOOK_MAX_TURNS = 10;
 /**
- * Parse the public `postHook` option. An omitted hook, null hook, or hook with
+ * Parse the legacy/private `postHook` option. An omitted hook, null hook, or hook with
  * an empty/whitespace-only command is treated as omitted so callers can pre-fill
  * configs without enabling the verifier accidentally.
  */

package/dist/_contracts/run-config.d.ts

@@ -31,7 +31,6 @@
 import { type JsonValue, type PlatformProxyEndpoint, type PlatformEnvironment } from "./submission.js";
 import { type RunModel } from "./models.js";
 import type { RuntimeSize } from "./runtime-sizes.js";
-import { type PlatformPostHookInput } from "./post-hook.js";
 /**
  * Mirrors the server-side CHECK constraint
  * `skill_bundles_id_format_chk = check (id ~ '^skl_[A-Za-z0-9_-]{8,128}$')`
@@ -299,8 +298,6 @@ export interface RunRequestConfig {
     readonly runtimeSize?: RuntimeSize;
     /** Run deadline as a duration string (`"1h"`, `"30m"`); bounded [1m, 6h] server-side. */
     readonly timeout?: string;
-    /** Post-agent-run verifier command. Empty command is treated as omitted. */
-    readonly postHook?: PlatformPostHookInput;
     readonly proxyEndpoints?: readonly PlatformProxyEndpoint[];
     readonly metadata?: Readonly<Record<string, JsonValue>>;
 }
@@ -330,7 +327,6 @@ export interface NormalisedRunRequestConfig {
     readonly environment?: PlatformEnvironment;
     readonly proxyEndpoints?: readonly PlatformProxyEndpoint[];
     readonly metadata?: Readonly<Record<string, JsonValue>>;
-    readonly postHook?: PlatformPostHookInput;
     /**
      * MCP servers whose run-config entry carried `headers`. Keyed by the `name`
      * that appears in `mcpServers` so the BFF can pair them up.

package/dist/_contracts/run-config.js

@@ -29,7 +29,6 @@
  * boundary.
  */
 import { parseRunModel } from "./models.js";
-import { parsePostHook } from "./post-hook.js";
 // ---------------------------------------------------------------------------
 // Skill ID + name format
 // ---------------------------------------------------------------------------
@@ -617,7 +616,6 @@ export function parseRunRequestConfig(input) {
         "environment",
         "runtimeSize",
         "timeout",
-        "postHook",
         "proxyEndpoints",
         "metadata"
     ]);
@@ -634,7 +632,6 @@ export function parseRunRequestConfig(input) {
     const prompt = parseRunRequestConfigPrompt(record.prompt);
     const skills = parseRunRequestConfigSkills(record.skills);
     const mcpServers = parseRunRequestConfigMcpServers(record.mcpServers);
-    const postHook = parsePostHook(record.postHook, "run request config postHook");
     return {
         model,
         ...(system !== undefined ? { system } : {}),
@@ -654,9 +651,6 @@ export function parseRunRequestConfig(input) {
         ...(record.timeout !== undefined
             ? { timeout: record.timeout }
             : {}),
-        ...(postHook !== undefined
-            ? { postHook: record.postHook }
-            : {}),
         ...(record.proxyEndpoints !== undefined
             ? { proxyEndpoints: record.proxyEndpoints }
             : {}),
@@ -734,7 +728,6 @@ export function normaliseRunRequestConfig(config) {
         ...(config.environment !== undefined ? { environment: config.environment } : {}),
         ...(config.proxyEndpoints !== undefined ? { proxyEndpoints: config.proxyEndpoints } : {}),
         ...(config.metadata !== undefined ? { metadata: config.metadata } : {}),
-        ...(config.postHook !== undefined ? { postHook: config.postHook } : {}),
         mcpServerSecrets
     };
 }

package/dist/_contracts/run-unit.js

@@ -20,7 +20,7 @@
  * detail response stays bounded). The archive zip carries the bytes.
  */
 import { parseMcpServerRef, parseSkillRef } from "./run-config.js";
-import { RunModels, parseRunModel } from "./models.js";
+import { Models, parseRunModel } from "./models.js";
 import { PLATFORM_PACKAGE_ECOSYSTEMS } from "./submission.js";
 // ---------------------------------------------------------------------------
 // Submission parser
@@ -105,7 +105,7 @@ function fallbackFlat() {
     return {
         kind: "submission",
         submission: {
-            model: RunModels.CLAUDE_HAIKU_4_5,
+            model: Models.CLAUDE_HAIKU_4_5,
             prompt: [],
             skills: [],
             agentsMd: [],
@@ -125,12 +125,12 @@ function isRecord(value) {
 }
 function coerceRunUnitModel(value) {
     if (typeof value !== "string")
-        return RunModels.CLAUDE_HAIKU_4_5;
+        return Models.CLAUDE_HAIKU_4_5;
     try {
         return parseRunModel(value, "run unit submission.model");
     }
     catch {
-        return RunModels.CLAUDE_HAIKU_4_5;
+        return Models.CLAUDE_HAIKU_4_5;
     }
 }
 function isJsonRecord(value) {