@aexhq/sdk 0.35.0 → 0.36.0

package/docs/credentials.md

@@ -4,142 +4,100 @@ title: Credentials
 
 # Credentials
 
-aex treats provider keys, MCP credentials, and proxy endpoint auth as per-run
-credentials. Reusable env secrets are documented separately in
-[Secrets](secrets.md).
+aex uses explicit, per-session credentials:
 
-The caller passes a workspace-scoped SDK token and the provider key inline on every `openSession` / `run` call. aex holds the bundle in run-scoped custody for the session lifecycle and attempts terminal cleanup/revocation for the aex-controlled references. MCP credentials and proxy endpoint auth values travel the same way.
+- `AEX_API_TOKEN` authenticates the SDK or CLI to aex.
+- `apiKeys` carries BYOK provider keys for the model provider.
+- `McpServer.remote(..., { headers })` carries MCP auth when a remote MCP server needs it.
+- `environment.secrets` carries runtime secrets for your own code.
 
-A session selects one upstream `provider` (default `anthropic`) and must carry a BYOK
-key for it. Keys are supplied per-provider so a session can also hold keys for the
-**other** providers its subagents may use:
+Secrets never belong in reusable run config, files, prompts, or examples.
 
-| Field | Required secret |
-| --- | --- |
-| Provider API keys | `apiKeys` (top-level, keyed by provider) |
+## Provider keys
+
+A session selects one upstream provider and must carry a BYOK key for it. Include
+additional provider keys only when subagents may use those providers.
 
 ```ts
-// The session's own provider key, plus extra keys its subagents can use.
-apiKeys: {
-  anthropic: process.env.ANTHROPIC_API_KEY!, // the session's provider
-  deepseek: process.env.DEEPSEEK_API_KEY!     // for a cross-provider subagent
-}
+const result = await aex.run({
+  model: Models.CLAUDE_HAIKU_4_5,
+  message: "Write a short report and save it as a file.",
+  apiKeys: {
+    anthropic: process.env.ANTHROPIC_API_KEY!
+  }
+});
 ```
 
-A `subagent` spawned with a different-family model **inherits the parent's keys
-server-side** from the session's vaulted bundle — the keys never transit the
-container. If the parent holds no key for the child's provider, the child is
-rejected with `parent_missing_provider_key`.
-
-MCP credential types:
-
-- `static_bearer`;
-- `oauth_access_token`.
+Provider keys are used by the managed runtime for model calls. They are not saved
+as client defaults.
 
-Unsupported:
+## Runtime secrets
 
-- arbitrary headers;
-- OAuth refresh;
-- persisted aex vault.
-
-For managed-runtime runs, aex injects the matching BYOK provider key at the hosted provider-proxy. Provider-side sessions and data remain subject to the selected provider account's retention and deletion policies.
-
-## Proxy endpoints (per-run custom HTTP credentials)
-
-Some skills need to call non-MCP HTTP services (e.g. Stripe, internal APIs). Embedding the credential in the skill content puts the raw secret on disk in the agent container and in the model's context — both prompt-injection-readable.
-
-The platform's managed HTTP proxy is the agent-first alternative. Declare each endpoint with a `ProxyEndpoint.*` constructor: the instance carries the non-secret **policy** (hashed for idempotency) and its **auth token** together at the call site. The SDK splits the token into the vaulted secrets channel server-side (not hashed, so key rotation does not collapse onto a stale run), and the raw credential value never enters the container.
+Use `environment.secrets` for credentials your code needs at runtime. The value
+can be ephemeral with `Secret.value(...)` or a workspace secret reference with
+`Secret.ref(...)`.
 
 ```ts
-import { Aex, Models, ProxyEndpoint } from "@aexhq/sdk";
+import { Aex, Models, Secret } from "@aexhq/sdk";
 
-const aex = new Aex({
-  apiToken: "ant_..."
-});
-
-const stripe = ProxyEndpoint.bearer({
-  name: "stripe",
-  baseUrl: "https://api.stripe.com",
-  token: process.env.STRIPE_API_KEY!,
-  allowMethods: ["GET", "POST"],
-  allowPathPrefixes: ["/v1/charges", "/v1/refunds"],
-  maxRequestBytes: 65_536,
-  maxResponseBytes: 65_536,
-  timeoutMs: 10_000,
-  responseMode: "headers_only",
-  retry: {
-    maxAttempts: 3,
-    initialDelayMs: 250,
-    maxDelayMs: 5000,
-    jitter: "full",
-    retryOnStatuses: [408, 425, 429, 500, 502, 503, 504],
-    retryOnMethods: ["GET", "HEAD"],
-    respectRetryAfter: true
-  }
-});
+const aex = new Aex({ apiToken: process.env.AEX_API_TOKEN! });
 
 await aex.run({
   model: Models.CLAUDE_HAIKU_4_5,
-  message: "…",
-  proxyEndpoints: [stripe],
+  message: "Call https://api.example.com/v1/status with INTERNAL_API_TOKEN and summarize it.",
+  environment: {
+    secrets: {
+      INTERNAL_API_TOKEN: Secret.value(process.env.INTERNAL_API_TOKEN!)
+    },
+    networking: {
+      mode: "limited",
+      allowedHosts: ["api.example.com"]
+    }
+  },
   apiKeys: { anthropic: process.env.ANTHROPIC_API_KEY! }
 });
 ```
 
-The five constructors — `ProxyEndpoint.none` / `bearer` / `header` / `basic` / `query` — put the auth secret on the same call as the policy, so any drift (wrong `responseMode`, misnamed auth field) is a TypeScript error at the call site instead of an HTTP 400 a round-trip later.
-
-Inside the run container, every session has the platform CLI mounted at `/mnt/session/uploads/aex/aex` (a Bun-compatible ESM bundle) and a manifest at `/mnt/session/uploads/aex/index.json` describing the declared endpoints. The skill invokes the CLI through `bun` (the mount has no execute permission so direct invocation fails with `bad interpreter: Permission denied`):
+Inside the run, use normal HTTP code for the service:
 
 ```bash
-bun /mnt/session/uploads/aex/aex proxy stripe \
-  --method GET \
-  --path /v1/charges/ch_123 \
-  --response-mode headers_only
+curl -sS \
+  -H "Authorization: Bearer $INTERNAL_API_TOKEN" \
+  https://api.example.com/v1/status
 ```
 
-The CLI reads the per-run bearer from `/mnt/session/uploads/aex/run-token`, attaches the `X-Aex-Proxy-Protocol` header, and the hosted proxy injects the bearer/header/query/basic credential before dispatching the outbound call. Only the response (subject to `responseMode` and `maxResponseBytes`) reaches the container. `--response-mode` can only narrow below the policy ceiling.
+## Workspace secrets
 
-Retries are declaration-based. Add `retry` to the endpoint policy when safe for that upstream; runs without `retry` keep single-attempt behavior. `maxAttempts` counts the initial request, and defaults apply only when `retry` is present: `maxAttempts: 3`, `initialDelayMs: 250`, `maxDelayMs: 5000`, `jitter: "full"`, `retryOnStatuses: [408, 425, 429, 500, 502, 503, 504]`, `retryOnMethods: ["GET", "HEAD"]`, and `respectRetryAfter: true`. There are no per-call `aex proxy` retry flags.
-
-#### Keyless upstreams (`authShape: { type: "none" }`)
-
-For public APIs that take no credential (Wikimedia Commons, Internet Archive, Library of Congress, NASA Images, NARA, GDELT, etc.), declare the endpoint with `ProxyEndpoint.none(...)` — it produces only a declaration, no auth token:
+Store reusable values once, then reference them by name:
 
 ```ts
-import { ProxyEndpoint } from "@aexhq/sdk";
-
-const wikimedia = ProxyEndpoint.none({
-  name: "wikimedia",
-  baseUrl: "https://commons.wikimedia.org",
-  allowMethods: ["GET"],
-  allowPathPrefixes: ["/wiki/", "/w/api.php"]
+await aex.secrets.set({
+  name: "internal-api-token",
+  value: process.env.INTERNAL_API_TOKEN!
 });
 
 await aex.run({
   model: Models.CLAUDE_HAIKU_4_5,
-  message: "…",
-  proxyEndpoints: [wikimedia],
+  message: "Use INTERNAL_API_TOKEN for the status request.",
+  environment: {
+    secrets: {
+      INTERNAL_API_TOKEN: Secret.ref("internal-api-token")
+    }
+  },
   apiKeys: { anthropic: process.env.ANTHROPIC_API_KEY! }
 });
 ```
 
-The keyless endpoint still routes through the aex managed proxy: every call is allow-listed, audited, and redacted. The hosted proxy injects no `Authorization` header and no query-string credential.
+Secret reads return metadata only; they never return the stored value.
 
-`bun /mnt/session/uploads/aex/aex --help` reads endpoint details from `/mnt/session/uploads/aex/index.json`. Runs that do not declare any `proxyEndpoints` still have the CLI and an empty manifest mounted, so agents never need to introspect whether the surface exists.
+## Networking
 
-### Networking
-
-Networking is open by default. When a run explicitly uses `limited` networking,
-the platform host must appear in `allowed_hosts`. aex injects it
-automatically; for advance validation use:
-
-```ts
-const allowedHosts = buildPlatformAllowedHosts({
-  baseUrl: "https://api.aex.dev",
-  extraHosts: ["api.stripe.com"]
-});
-```
+Networking is open by default. Use `environment.networking.mode: "limited"` with
+`allowedHosts` when you want a run to reach only named public hosts. See
+[Networking](networking.md).
 
-### Secrets are always explicit at the call site
+## Explicit call-site rule
 
-There is no `defaultSecrets` and no client-held secret state. Every `openSession` / `run` call carries its own credentials at the call site: the top-level `apiKeys` map (one provider key, plus any subagent keys), MCP auth on each `McpServer` instance, and proxy auth on each `ProxyEndpoint` instance. This is the agent-first invariant: the credentials being used on any given call are visible in the same code that opens the session.
+There is no `defaultSecrets` and no client-held secret state. Each
+`openSession(...)` or `run(...)` call should show the provider keys, MCP auth, and
+runtime secrets needed for that call.

package/docs/defaults.md

@@ -39,14 +39,6 @@ For the hard ceilings and who can raise them, see
 | MCP connect timeout (register + initialize + discover) | 30 seconds | Per-port via `connectTimeoutMs`. | `RUN_DEFAULT_MCP_CONNECT_TIMEOUT_MS` |
 | MCP `tools/call` timeout | 30 minutes | Per-port via `callTimeoutMs`. | `RUN_DEFAULT_MCP_CALL_TIMEOUT_MS` |
 
-## Proxy endpoints
-
-| Option | Default | How to override | Source |
-| --- | --- | --- | --- |
-| `maxRequestBytes` | 10 MiB | Per-endpoint via the endpoint's `maxRequestBytes`. | `REQUEST_PROXY_DEFAULT_MAX_REQUEST_BYTES` |
-| `maxResponseBytes` | `0` (unlimited — the response is streamed unbuffered) | Per-endpoint via the endpoint's `maxResponseBytes`. | `REQUEST_PROXY_DEFAULT_MAX_RESPONSE_BYTES` |
-| `timeoutMs` (upstream) | 5 minutes | Per-endpoint via the endpoint's `timeoutMs`. | `REQUEST_PROXY_DEFAULT_TIMEOUT_MS` |
-
 ## Links (signed URLs and tickets)
 
 | Option | Default | How to override | Source |

package/docs/events.md

@@ -53,9 +53,9 @@ for the string:
 const lastText = (await session.messages().last())?.text;
 ```
 
-`decodeAssistantText`, `textOf`, and `summarizeRunTrace` remain exported as the
-power-user escape hatch over a raw `RunEvent` list, but "get the last message"
-is now `await session.messages().last()`.
+Prefer `session.messages().list()` or the collected `result.messages` /
+`result.text` fields for assistant text. Low-level event helpers remain exported
+for callers that build custom collectors.
 
 The CLI mirrors the same surface:
 
@@ -162,7 +162,7 @@ const jsonl = await response.text();
 
 ## Event shape
 
-Events are typed as the discriminated `RunEvent` union for compatibility and as the versioned coordinator envelope for live consumers. aex records raw runtime/provider payloads **after** secret redaction and structural sanitization, so the bytes you see never contain the provider key, MCP credentials, or proxy bearer that were supplied when the session was opened.
+Events are typed as the discriminated `RunEvent` union for compatibility and as the versioned coordinator envelope for live consumers. aex records raw runtime/provider payloads **after** secret redaction and structural sanitization, so the bytes you see never contain provider keys, MCP credentials, or runtime secrets supplied when the session was opened.
 
 ## Typed helpers
 
@@ -180,8 +180,7 @@ import {
   isToolCallResult,
   isCustom,
   isLog,
-  isEventChannel,
-  textOf
+  isEventChannel
 } from "@aexhq/sdk";
 ```
 
@@ -191,6 +190,6 @@ All guards test the `type` discriminant at runtime. `isTextMessage`,
 `event.data` to the fields that event type carries — e.g. inside
 `if (isTextMessage(e))`, `e.data.text` is typed `string`. The lifecycle/channel
 guards (`isRunStarted`, `isRunError`, `isCustom`, `isLog`, …) operate on the
-coordinator envelope and narrow only the discriminant. `textOf(events)` returns
-the run's final assistant text concatenated from the `TEXT_MESSAGE_CONTENT`
-blocks.
+coordinator envelope and narrow only the discriminant. Use `result.text` or
+`session.messages.all()` when you need assistant text without inspecting the
+event stream directly.

package/docs/limits-and-quotas.md

@@ -96,12 +96,9 @@ Default values; each is overridable per-plane via the matching
 | API token create | 10 | Workspace default | `WORKSPACE_RATE_LIMIT_DEFAULTS` |
 | API token delete | 30 | Workspace default | `WORKSPACE_RATE_LIMIT_DEFAULTS` |
 
-## Request scope (proxy and egress)
+## Request Scope
 
 | Limit | Value | Source | Raisable? | Constant |
 | --- | --- | --- | --- | --- |
-| Proxy request body | 10 MiB | aex policy | Per-endpoint via `maxRequestBytes` | `REQUEST_PROXY_DEFAULT_MAX_REQUEST_BYTES` |
-| Proxy response body | `0` = unlimited (streamed unbuffered) | aex policy | Per-endpoint via `maxResponseBytes` | `REQUEST_PROXY_DEFAULT_MAX_RESPONSE_BYTES` |
-| Proxy upstream timeout | 5 minutes | aex policy | Per-endpoint via `timeoutMs` | `REQUEST_PROXY_DEFAULT_TIMEOUT_MS` |
 | Signed output URL TTL | 300 seconds | aex policy | Per-call via `expiresSeconds` | `REQUEST_PRESIGN_URL_DEFAULT_TTL_SECONDS` |
 | Event-stream connection ticket TTL | 60 seconds | aex policy | Per-mint via `ttlMs` | `REQUEST_TICKET_DEFAULT_TTL_MS` |

package/docs/limits.md

@@ -17,9 +17,6 @@ For the current provider/model set, see the generated
 | Area | Default |
 | --- | --- |
 | Workspace storage | 50 GiB per workspace for captured outputs and workspace artifacts. aex-maintainer admin workspaces may be unlimited for internal dogfooding; this is not a customer entitlement. |
-| Proxy request body | 10 MiB per proxy endpoint unless the endpoint declares a different `maxRequestBytes`. |
-| Proxy timeout | 5 minutes per proxy endpoint unless the endpoint declares a different `timeoutMs`. |
-| Proxy telemetry | Proxy calls emit report-only usage telemetry for call count, failed calls, request bytes, response bytes when known, and duration. Public proxy pricing is not shipped unless documented later. |
 
 ## Product Boundaries
 
@@ -27,14 +24,13 @@ For the current provider/model set, see the generated
 | --- | --- |
 | Runtime | New submissions run on the managed runtime. There is no public runtime selector. |
 | Provider policy | Provider retention, training exclusion, HIPAA/BAA, data residency, abuse policy, and pricing belong to the selected provider account, endpoint, and contract. |
-| Secrets | Provider keys, MCP credentials, proxy auth, and env secrets are caller-owned. aex excludes secret values from idempotency and uses the explicit secret surfaces described in [Secrets](secrets.md). |
+| Secrets | Provider keys, MCP credentials, and env secrets are caller-owned. aex excludes secret values from idempotency and uses the explicit secret surfaces described in [Secrets](secrets.md). |
 | MCP servers | Remote MCP servers are customer-trusted systems. aex validates declarations and routes credentials; it does not make an untrusted MCP server safe. |
-| Proxy endpoints | The proxy enforces declared host/path/method/auth policy for calls routed through it. Upstream side effects and data handling remain with the upstream service and customer. |
 | Outputs | Captured outputs, events, and metadata are stored under the run record and downloaded through auth-gated routes. Output content is customer content. |
 | Human review | Runs execute after submission. Cancellation is available, but aex does not pause a run for platform-mediated approval or interactive clarification. |
 | Sessions | The durable product primitive is the session/run record. Sessions can be resumed by id and auto-suspend after the configured idle window; persistent named agent profiles and saved agent definitions are out of scope. |
 | Deployment | The supported product is the hosted aex service plus the SDK and CLI. Alternate `baseUrl` values are for local, staging, or hosted aex API planes, not a self-host product promise. |
-| Cost | BYOK provider-token charges accrue to the customer's provider account. aex records report-only telemetry for runtime, storage, and proxy usage; free trials, billing-grade invoices, and public pricing documents are not shipped unless documented later. |
+| Cost | BYOK provider-token charges accrue to the customer's provider account. aex records report-only telemetry for runtime and storage usage; free trials, billing-grade invoices, and public pricing documents are not shipped unless documented later. |
 
 ## Provider Policy Links
 

package/docs/mcp.md

@@ -25,14 +25,13 @@ server, so we cannot elide MCP responses or write them to the session
 filesystem on the user's behalf. Anything an MCP tool returns lands
 directly in the model's context.
 
-For ingestion-style tools that return large JSON blobs (search results,
-catalogue dumps, bulk reads), use the **CLI-as-skill + managed proxy**
-pattern instead of MCP:
+For ingestion-style MCP servers that return large JSON blobs (search results,
+catalogue dumps, bulk reads), prefer a skill that writes files instead of
+putting the whole response in model context:
 
 1. Package the upstream as a skill-tool (`Tools.fromSkillDir` /
    `Tools.fromSkillUrl`) — a CLI binary the agent invokes with its bash tool.
-2. Route every upstream HTTPS call through a per-run `ProxyEndpoint`
-   (audit, byte caps, budget enforcement).
+2. Keep any upstream HTTPS credentials in `environment.secrets`.
 3. Have the CLI write the full payload to the session filesystem. By default,
    files it creates or modifies are captured automatically; pass
    `outputs.allowedDirs` only when you want to narrow capture to specific roots.

package/docs/networking.md

@@ -26,7 +26,6 @@ These reach the network over managed paths and are **not** subject to
 - The model / provider call for the run (and its subagents).
 - The built-in `web_search` and `web_fetch` tools (still SSRF-guarded).
 - Any remote MCP servers you declare in `mcpServers` — see [MCP](mcp.md).
-- Any `proxyEndpoints` you declare — see [Credentials](credentials.md).
 - The package registries for any `environment.packages` you declare (pip → PyPI,
   apt → the distribution mirrors). Declaring a package implicitly allows the
   registry it installs from.
@@ -70,17 +69,8 @@ non-default port when you need one (`api.example.com:8443`); a bare host name
 covers HTTPS on 443. Matching is exact per host — it is not a wildcard or suffix
 match, so list each host you need.
 
-To validate your allowlist before submitting, `buildPlatformAllowedHosts` returns
-the host set the platform will enforce given a base URL plus your extra hosts:
-
-```ts
-import { buildPlatformAllowedHosts } from "@aexhq/sdk";
-
-const allowedHosts = buildPlatformAllowedHosts({
-  baseUrl: "https://api.aex.dev",
-  extraHosts: ["api.example.com"]
-});
-```
+Keep the allowlist in your session options so the submitted network policy is
+visible at the same call site as the code that needs it.
 
 ## Open mode
 
@@ -135,7 +125,7 @@ your client succeeds without extra setup.
 - **`allowedHosts` only applies in `limited` mode.** It is ignored in `open`
   mode, where the SSRF deny-list is the only gate.
 
-For routing credentialed HTTP calls through the managed proxy without putting the
-secret in the container, use proxy endpoints — see
-[Credentials](credentials.md). For remote tool servers, see [MCP](mcp.md). For
-the full set of run-config fields, see [Run configuration](run-config.md).
+For credentialed HTTP calls, pass the credential as an `environment.secrets`
+entry and let your code use its normal HTTP client. For remote tool servers, see
+[MCP](mcp.md). For the full set of run-config fields, see
+[Run configuration](run-config.md).

package/docs/outputs.md

@@ -100,10 +100,6 @@ if (truncated) {
 
 Check `truncated` before treating `text` as complete. Pass `options.grep` (a substring or `RegExp`) to keep only matching lines of the capped text. The returned `output` is the matched `Output` record, and `totalBytes` is the file's full size when the server reports it.
 
-### Chatting over a workspace's outputs
-
-`createDataTools(client)` packages the read surface (`sessions.list` + `sessions.outputs(id).list` + `sessions.outputs(id).read`) as a vendor-neutral LLM tool set (`{ tools, instructions, execute }`) so you can build a search-then-fetch chat over your sessions and their outputs in a few lines on top of the public SDK. The `tools` are plain JSON-Schema definitions (the shape every major LLM tool API accepts); `execute(name, input)` dispatches a tool call against the workspace-scoped client. See the runnable `examples/data-chat/` example.
-
 ## Finding outputs
 
 `session.outputs().list(query?)` can filter the captured output list client-side. Use `session.outputs().find(query)` when you want discovery to be explicit, or `session.outputs().findOne(query)` when exactly one file is expected:

package/docs/public-surface.json

@@ -2,7 +2,7 @@
   "brand": "aex",
   "productName": "Agent Executor",
   "oneLine": "aex is an agent execution platform for launching autonomous agents from a simple TypeScript SDK and CLI.",
-  "description": "Open durable agent sessions, send turns, stream events, capture outputs, and compose agents with skills, files, MCP, proxy endpoints, and subagents across the managed runtime.",
+  "description": "Open durable agent sessions, send turns, stream events, capture outputs, and compose agents with skills, files, MCP, secrets, networking controls, and subagents across the managed runtime.",
   "alpha": {
     "label": "Alpha testing",
     "description": "Access is limited to invited testers while we harden the hosted runtime, dashboard, and SDK workflows."
@@ -61,7 +61,7 @@
       "slug": "agent-composition",
       "href": "/docs/features/#agent-composition",
       "title": "Agent composition",
-      "description": "Skills, files, AGENTS.md, remote MCP servers, proxy endpoints, environment variables, packages, and networking controls."
+      "description": "Skills, files, AGENTS.md, remote MCP servers, environment variables, packages, secrets, and networking controls."
     },
     {
       "slug": "subagents",
@@ -79,7 +79,7 @@
       "slug": "typed-control-surface",
       "href": "/docs/features/#typed-control-surface",
       "title": "Typed control surface",
-      "description": "Strongly typed SDK inputs, CLI parity, BYOK secrets, scoped proxy auth, redaction, and output modes."
+      "description": "Strongly typed SDK inputs, CLI parity, BYOK provider keys, workspace secrets, redaction, and output modes."
     }
   ]
 }

package/docs/quickstart.md

@@ -83,11 +83,8 @@ for await (const event of turn) {
 }
 await turn.done();
 
-// Reads/streams/downloads are grouped into accessor sub-resources:
-// session.messages() / events() / outputs() / webhooks(). Grab the last
-// assistant message (an AssistantTextEntry; use ?.text for the string).
-const lastText = (await session.messages().last())?.text;
-console.log(lastText);
+const messages = await session.messages().list();
+console.log(messages.at(-1)?.text);
 
 // Poll the record until the session parks (idle / suspended / error).
 const record = await session.wait();
@@ -110,8 +107,7 @@ aex run \
 
 ## Add capabilities
 
-- Add files, skills, AGENTS.md, MCP servers, proxy endpoints, packages, and networking controls with [Composition](concepts/composition.md).
-- Inspect runtime tools with [Agent tools](concepts/agent-tools.md).
+- Add files, skills, AGENTS.md, MCP servers, packages, and networking controls with [Composition](concepts/composition.md).
 - Use parent/child run delegation from the [Features](https://aex.dev/docs/features/#subagents) page.
 - Narrow output capture or download individual files with [Outputs](outputs.md).
 - Check supported providers and models in the [provider/runtime capability matrix](provider-runtime-capabilities.md).

package/docs/run-config.md

@@ -13,13 +13,16 @@ Allowed fields:
 - `mcpServers` - array of `McpServerRef`; headers are split into the vaulted secrets channel server-side.
 - `environment` - `{ networking?, packages?, variables? }`. Networking is open by default; set `networking.mode` to `limited` only when you want an allowlist. `variables` are merged into the in-container `RUNTIME.env` / `RUNTIME.json` mounts. (Run secrets go in `environment.secrets`, which carries live `Secret` instances and is not part of a shareable config.)
 - `runtime` - optional managed-runtime preset. Prefer `Sizes` in TypeScript.
-- `proxyEndpoints` - array of `ProxyEndpoint` instances; endpoint-level `retry` is allowed here and remains declaration-based.
 - `metadata` - non-secret structured metadata.
 - `overrides` - `{ idleTtl?, timeout?, maxSpendUsd? }`. `timeout` is an optional session deadline (e.g. `"30m"`, `"2h"`); `maxSpendUsd` stops the session once its spend would exceed the cap (see [Limits & quotas](limits-and-quotas.md)).
 
 `message` (the one-shot `run` input), `agentsMd`, `files`, `outputs`, `tools`, `includeBuiltinTools`, and `outputMode` are `openSession` / `run` options, not reusable run-config fields. They carry the turn input, bytes, capture behavior, or agent tool/output controls that belong on a concrete call. Skill bundles are `tools` entries built with `Tools.fromSkillDir(...)` / `Tools.fromSkillUrl(...)`, so they too are SDK-code options rather than config fields. Subagents run in-process; there is no `limits` / `parentRunId` option.
 
-Secrets never live in run config. Pass provider keys through the top-level `apiKeys` map (and run secrets through `environment.secrets`) in the SDK, or the equivalent host-mode flags (`--anthropic-api-key`, `--mcp-auth`, `--proxy-auth`) in the CLI. See [Secrets](secrets.md) for secret lifecycles and [Credentials](credentials.md) for the proxy endpoint policy/auth split and retry fields.
+Secrets never live in run config. Pass provider keys through the top-level
+`apiKeys` map and runtime secrets through `environment.secrets` in the SDK, or
+the equivalent host-mode flags (`--anthropic-api-key`, `--mcp-auth`) in the CLI.
+See [Secrets](secrets.md) for secret lifecycles and [Credentials](credentials.md)
+for credential handling.
 
 ## Reuse in code
 
@@ -52,4 +55,4 @@ aex run --config ./run.json \
   --anthropic-api-key "$ANTHROPIC_API_KEY"
 ```
 
-...or as explicit flags (`--model`, `--system`, `--prompt`, `--mcp`, `--mcp-auth`, `--runtime-size`, `--run-timeout`, `--proxy-endpoint`, `--proxy-auth`, `--metadata`). The two modes are mutually exclusive.
+...or as explicit flags (`--model`, `--system`, `--prompt`, `--mcp`, `--mcp-auth`, `--runtime-size`, `--run-timeout`, `--metadata`). The two modes are mutually exclusive.

package/docs/secrets.md

@@ -111,5 +111,5 @@ await aex.run({
 await aex.secrets.delete("serper-api-key");
 ```
 
-The CLI supports per-run provider, MCP, and proxy credentials. Workspace secret
+The CLI supports per-run provider and MCP credentials. Workspace secret
 administration is exposed through the SDK.

package/docs/skills.md

@@ -72,9 +72,9 @@ files into the workspace under `/workspace/skills/<name>/`. So the `SKILL.md` bo
 and every supporting file are on disk from the first turn; the load-tool call is
 how that body enters the model's context, not how the files get written.
 
-The platform also mounts the `aex` CLI and a per-run manifest into every run.
-Skills call managed HTTP proxy endpoints through the mounted CLI
-(`aex proxy ...`); see [Credentials](credentials.md) for the policy and auth model.
+Skills that call external HTTP APIs should read credentials from
+`environment.secrets` and use the normal client for that service. See
+[Credentials](credentials.md) for the secret model.
 
 Run-scoped asset copies are part of the run record and are removed by run deletion
 or retention cleanup.