@anthropic-ai/sdk 0.119.0 → 0.121.0

package/src/resources/beta/organization/workspaces/workspaces.ts

@@ -0,0 +1,434 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+import { APIResource } from '../../../../core/resource';
+import * as BetaAPI from '../../beta';
+import * as MembersAPI from './members';
+import {
+  MemberAddParams,
+  MemberListParams,
+  MemberRemoveParams,
+  MemberRemoveResponse,
+  MemberRetrieveParams,
+  MemberUpdateParams,
+  Members,
+} from './members';
+import * as RateLimitsAPI from './rate-limits';
+import {
+  BetaWorkspaceRateLimit,
+  BetaWorkspaceRateLimitValue,
+  BetaWorkspaceRateLimitsPageCursor,
+  RateLimitListParams,
+  RateLimits,
+} from './rate-limits';
+import * as ServiceAccountsAPI from './service-accounts';
+import {
+  ServiceAccountAddParams,
+  ServiceAccountListParams,
+  ServiceAccountRemoveParams,
+  ServiceAccountRemoveResponse,
+  ServiceAccountRetrieveParams,
+  ServiceAccountUpdateParams,
+  ServiceAccounts,
+} from './service-accounts';
+import { APIPromise } from '../../../../core/api-promise';
+import { Page, type PageParams, PagePromise } from '../../../../core/pagination';
+import { buildHeaders } from '../../../../internal/headers';
+import { RequestOptions } from '../../../../internal/request-options';
+import { path } from '../../../../internal/utils/path';
+
+export class Workspaces extends APIResource {
+  rateLimits: RateLimitsAPI.RateLimits = new RateLimitsAPI.RateLimits(this._client);
+  members: MembersAPI.Members = new MembersAPI.Members(this._client);
+  serviceAccounts: ServiceAccountsAPI.ServiceAccounts = new ServiceAccountsAPI.ServiceAccounts(this._client);
+
+  /**
+   * Create Workspace
+   *
+   * @example
+   * ```ts
+   * const betaWorkspace =
+   *   await client.beta.organization.workspaces.create({
+   *     name: 'x',
+   *   });
+   * ```
+   */
+  create(params: WorkspaceCreateParams, options?: RequestOptions): APIPromise<BetaWorkspace> {
+    const { betas, ...body } = params;
+    return this._client.post('/v1/organizations/workspaces?beta=true', {
+      body,
+      ...options,
+      headers: buildHeaders([
+        { ...(betas?.toString() != null ? { 'anthropic-beta': betas?.toString() } : undefined) },
+        options?.headers,
+      ]),
+    });
+  }
+
+  /**
+   * Get Workspace
+   *
+   * @example
+   * ```ts
+   * const betaWorkspace =
+   *   await client.beta.organization.workspaces.retrieve(
+   *     'workspace_id',
+   *   );
+   * ```
+   */
+  retrieve(workspaceID: string, options?: RequestOptions): APIPromise<BetaWorkspace> {
+    return this._client.get(path`/v1/organizations/workspaces/${workspaceID}?beta=true`, options);
+  }
+
+  /**
+   * Update Workspace
+   *
+   * @example
+   * ```ts
+   * const betaWorkspace =
+   *   await client.beta.organization.workspaces.update(
+   *     'workspace_id',
+   *   );
+   * ```
+   */
+  update(
+    workspaceID: string,
+    body: WorkspaceUpdateParams,
+    options?: RequestOptions,
+  ): APIPromise<BetaWorkspace> {
+    return this._client.post(path`/v1/organizations/workspaces/${workspaceID}?beta=true`, {
+      body,
+      ...options,
+    });
+  }
+
+  /**
+   * List Workspaces
+   *
+   * @example
+   * ```ts
+   * // Automatically fetches more pages as needed.
+   * for await (const betaWorkspace of client.beta.organization.workspaces.list()) {
+   *   // ...
+   * }
+   * ```
+   */
+  list(
+    query: WorkspaceListParams | null | undefined = {},
+    options?: RequestOptions,
+  ): PagePromise<BetaWorkspacesPage, BetaWorkspace> {
+    return this._client.getAPIList('/v1/organizations/workspaces?beta=true', Page<BetaWorkspace>, {
+      query,
+      ...options,
+    });
+  }
+
+  /**
+   * Archive Workspace
+   *
+   * @example
+   * ```ts
+   * const betaWorkspace =
+   *   await client.beta.organization.workspaces.archive(
+   *     'workspace_id',
+   *   );
+   * ```
+   */
+  archive(workspaceID: string, options?: RequestOptions): APIPromise<BetaWorkspace> {
+    return this._client.post(path`/v1/organizations/workspaces/${workspaceID}/archive?beta=true`, options);
+  }
+}
+
+export type BetaWorkspacesPage = Page<BetaWorkspace>;
+
+export type BetaWorkspaceMembersPage = Page<BetaWorkspaceMember>;
+
+export type BetaAllowedInferenceGeo = 'global' | 'us';
+
+export interface BetaDataResidency {
+  /**
+   * Permitted inference geo values. 'unrestricted' means all geos are allowed.
+   */
+  allowed_inference_geos: Array<string> | 'unrestricted';
+
+  /**
+   * Default inference geo applied when requests omit the parameter.
+   */
+  default_inference_geo: string;
+
+  /**
+   * Geographic region for workspace data storage. Immutable after creation.
+   */
+  workspace_geo: string;
+}
+
+export interface BetaDataResidencyCreateConfig {
+  /**
+   * Permitted inference geo values. Defaults to 'unrestricted' if omitted, which
+   * allows all geos. Use the string 'unrestricted' to allow all geos, or a list of
+   * specific geos.
+   */
+  allowed_inference_geos?: Array<BetaAllowedInferenceGeo> | 'unrestricted' | null;
+
+  /**
+   * Default inference geo applied when requests omit the parameter. Defaults to
+   * 'global' if omitted. Must be a member of `allowed_inference_geos` unless
+   * `allowed_inference_geos` is `"unrestricted"`.
+   */
+  default_inference_geo?: 'global' | 'us' | null;
+
+  /**
+   * Geographic region for workspace data storage. Immutable after creation. Defaults
+   * to 'us' if omitted.
+   */
+  workspace_geo?: 'us' | null;
+}
+
+export interface BetaDataResidencyUpdateConfig {
+  /**
+   * Permitted inference geo values. Use 'unrestricted' to allow all geos, or a list
+   * of specific geos.
+   */
+  allowed_inference_geos?: Array<BetaAllowedInferenceGeo> | 'unrestricted' | null;
+
+  /**
+   * Default inference geo applied when requests omit the parameter. Must be a member
+   * of `allowed_inference_geos` unless `allowed_inference_geos` is `"unrestricted"`.
+   */
+  default_inference_geo?: 'global' | 'us' | null;
+}
+
+export type BetaNoBillingWorkspaceRole =
+  | 'workspace_admin'
+  | 'workspace_developer'
+  | 'workspace_restricted_developer'
+  | 'workspace_user';
+
+export interface BetaWorkspace {
+  /**
+   * ID of the Workspace.
+   */
+  id: string;
+
+  /**
+   * RFC 3339 datetime string indicating when the Workspace was archived, or `null`
+   * if the Workspace is not archived.
+   */
+  archived_at: string | null;
+
+  /**
+   * Identifier for this Workspace's encryption compartment. When you configure a
+   * customer-managed encryption key (CMEK) on AWS, reference this value in your KMS
+   * key-policy condition so the key is scoped to this compartment. On GCP and Azure,
+   * Anthropic enforces the compartment binding automatically; you do not need to
+   * reference this value in your key configuration. See the CMEK integration guide
+   * for the required key configuration, including the value used during key
+   * validation.
+   */
+  compartment_id: string;
+
+  /**
+   * RFC 3339 datetime string indicating when the Workspace was created.
+   */
+  created_at: string;
+
+  /**
+   * Data residency configuration.
+   */
+  data_residency: BetaDataResidency;
+
+  /**
+   * Hex color code representing the Workspace in the Anthropic Console.
+   */
+  display_color: string;
+
+  /**
+   * ID of the customer-managed encryption key (CMEK) configuration to use for this
+   * Workspace. Setting this field requires CMEK to be enabled for your organization.
+   * When set, data stored for this Workspace is encrypted with the referenced key.
+   * Create key configurations with the External Keys API. This field is write-once:
+   * once a key is attached to a Workspace it cannot be detached or replaced. To
+   * rotate key material, rotate the underlying key on your cloud KMS; the
+   * `external_key_id` stays the same.
+   */
+  external_key_id: string | null;
+
+  /**
+   * Name of the Workspace.
+   */
+  name: string;
+
+  /**
+   * User-defined tags as string key-value pairs. Keys may not begin with
+   * `anthropic`.
+   */
+  tags: { [key: string]: string };
+
+  /**
+   * Object type.
+   *
+   * For Workspaces, this is always `"workspace"`.
+   */
+  type: 'workspace';
+}
+
+export interface BetaWorkspaceMember {
+  /**
+   * Object type.
+   *
+   * For Workspace Members, this is always `"workspace_member"`.
+   */
+  type: 'workspace_member';
+
+  /**
+   * ID of the User.
+   */
+  user_id: string;
+
+  /**
+   * ID of the Workspace.
+   */
+  workspace_id: string;
+
+  /**
+   * Role of the Workspace Member.
+   */
+  workspace_role: BetaWorkspaceRole;
+}
+
+export type BetaWorkspaceRole =
+  | 'workspace_admin'
+  | 'workspace_billing'
+  | 'workspace_developer'
+  | 'workspace_restricted_developer'
+  | 'workspace_user';
+
+export interface WorkspaceCreateParams {
+  /**
+   * Body param: Name of the Workspace.
+   */
+  name: string;
+
+  /**
+   * Body param: Data residency configuration for the workspace. If omitted, defaults
+   * to `workspace_geo: "us"`, `allowed_inference_geos: "unrestricted"`, and
+   * `default_inference_geo: "global"`.
+   */
+  data_residency?: BetaDataResidencyCreateConfig | null;
+
+  /**
+   * Body param: Hex color code representing the Workspace in the Anthropic Console.
+   */
+  display_color?: string | null;
+
+  /**
+   * Body param: ID of the customer-managed encryption key (CMEK) configuration to
+   * use for this Workspace. Setting this field requires CMEK to be enabled for your
+   * organization. When set, data stored for this Workspace is encrypted with the
+   * referenced key. Create key configurations with the External Keys API. This field
+   * is write-once: once a key is attached to a Workspace it cannot be detached or
+   * replaced. To rotate key material, rotate the underlying key on your cloud KMS;
+   * the `external_key_id` stays the same.
+   */
+  external_key_id?: string | null;
+
+  /**
+   * Body param: User-defined tags as string key-value pairs. Keys may not begin with
+   * `anthropic`.
+   */
+  tags?: { [key: string]: string } | null;
+
+  /**
+   * Header param: Optional header to specify the beta version(s) you want to use.
+   */
+  betas?: Array<BetaAPI.AnthropicBeta>;
+}
+
+export interface WorkspaceUpdateParams {
+  /**
+   * Data residency configuration for the workspace.
+   */
+  data_residency?: BetaDataResidencyUpdateConfig | null;
+
+  /**
+   * Hex color code representing the Workspace in the Anthropic Console.
+   */
+  display_color?: string;
+
+  /**
+   * ID of the customer-managed encryption key (CMEK) configuration to use for this
+   * Workspace. Setting this field requires CMEK to be enabled for your organization.
+   * When set, data stored for this Workspace is encrypted with the referenced key.
+   * Create key configurations with the External Keys API. This field is write-once:
+   * once a key is attached to a Workspace it cannot be detached or replaced. To
+   * rotate key material, rotate the underlying key on your cloud KMS; the
+   * `external_key_id` stays the same.
+   */
+  external_key_id?: string;
+
+  /**
+   * Name of the Workspace.
+   */
+  name?: string;
+
+  /**
+   * User-defined tags as string key-value pairs. Keys may not begin with
+   * `anthropic`.
+   */
+  tags?: { [key: string]: string | null } | null;
+}
+
+export interface WorkspaceListParams extends PageParams {
+  /**
+   * Whether to include Workspaces that have been archived in the response
+   */
+  include_archived?: boolean;
+}
+
+Workspaces.RateLimits = RateLimits;
+Workspaces.Members = Members;
+Workspaces.ServiceAccounts = ServiceAccounts;
+
+export declare namespace Workspaces {
+  export {
+    type BetaAllowedInferenceGeo as BetaAllowedInferenceGeo,
+    type BetaDataResidency as BetaDataResidency,
+    type BetaDataResidencyCreateConfig as BetaDataResidencyCreateConfig,
+    type BetaDataResidencyUpdateConfig as BetaDataResidencyUpdateConfig,
+    type BetaNoBillingWorkspaceRole as BetaNoBillingWorkspaceRole,
+    type BetaWorkspace as BetaWorkspace,
+    type BetaWorkspaceMember as BetaWorkspaceMember,
+    type BetaWorkspaceRole as BetaWorkspaceRole,
+    type BetaWorkspacesPage as BetaWorkspacesPage,
+    type WorkspaceCreateParams as WorkspaceCreateParams,
+    type WorkspaceUpdateParams as WorkspaceUpdateParams,
+    type WorkspaceListParams as WorkspaceListParams,
+  };
+
+  export {
+    RateLimits as RateLimits,
+    type BetaWorkspaceRateLimit as BetaWorkspaceRateLimit,
+    type BetaWorkspaceRateLimitValue as BetaWorkspaceRateLimitValue,
+    type BetaWorkspaceRateLimitsPageCursor as BetaWorkspaceRateLimitsPageCursor,
+    type RateLimitListParams as RateLimitListParams,
+  };
+
+  export {
+    Members as Members,
+    type MemberRemoveResponse as MemberRemoveResponse,
+    type MemberRetrieveParams as MemberRetrieveParams,
+    type MemberUpdateParams as MemberUpdateParams,
+    type MemberListParams as MemberListParams,
+    type MemberAddParams as MemberAddParams,
+    type MemberRemoveParams as MemberRemoveParams,
+  };
+
+  export {
+    ServiceAccounts as ServiceAccounts,
+    type ServiceAccountRemoveResponse as ServiceAccountRemoveResponse,
+    type ServiceAccountRetrieveParams as ServiceAccountRetrieveParams,
+    type ServiceAccountUpdateParams as ServiceAccountUpdateParams,
+    type ServiceAccountListParams as ServiceAccountListParams,
+    type ServiceAccountAddParams as ServiceAccountAddParams,
+    type ServiceAccountRemoveParams as ServiceAccountRemoveParams,
+  };
+}

package/src/resources/beta/organization/workspaces.ts

@@ -0,0 +1,3 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export * from './workspaces/index';

package/src/resources/beta/organization.ts

@@ -0,0 +1,3 @@
+// File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+export * from './organization/index';

package/src/resources/beta/sessions/threads/threads.ts

@@ -117,7 +117,8 @@ export interface BetaManagedAgentsSessionThread {
   id: string;
 
   /**
-   * A session-resolved multiagent roster entry.
+   * The resolved agent a session thread runs: a saved-agent snapshot, the platform
+   * advisor entry, or an inline-defined (ephemeral) agent snapshot.
    */
   agent: AgentsAPI.BetaManagedAgentsSessionThreadAgent | AgentsAPI.BetaManagedAgentsAdvisor;
 

package/src/resources/messages/messages.ts

@@ -2196,7 +2196,7 @@ export interface ContainerSkill {
   type: 'anthropic' | 'custom';
 
   /**
-   * Skill version or 'latest' for most recent version
+   * The resolved version: a skill version ID for custom skills.
    */
   version: string;
 }

package/src/tools/agent-toolset/fs-util.ts

@@ -15,13 +15,25 @@ export const DIR_CREATE_MODE = 0o755;
 /** Mode for files the file tools create. */
 export const FILE_CREATE_MODE = 0o644;
 
-/** `realpath` `p`, or return `p` unchanged when it cannot be resolved. */
-async function realpathOrSelf(p: string): Promise<string> {
-  try {
-    return await fs.realpath(p);
-  } catch {
-    return p;
+/** True when `p` is `root` itself or lexically contained within it. */
+export function isWithin(root: string, p: string): boolean {
+  const rel = path.relative(root, p);
+  return rel === '' || (!rel.startsWith('..' + path.sep) && rel !== '..' && !path.isAbsolute(rel));
+}
+
+/**
+ * The first entry of `roots` whose canonical form contains the
+ * already-canonical `target`, returned as configured; `undefined` when none
+ * does. Each root goes through {@link canonicalize} at check time, exactly like
+ * the workdir in {@link confineToRoot}, so granting access (`allowedRoots`)
+ * and refusing writes (`readOnlyRoots`) can never resolve the same entry two
+ * different ways.
+ */
+export async function containingRoot(roots: readonly string[], target: string): Promise<string | undefined> {
+  for (const root of roots) {
+    if (isWithin(await canonicalize(path.resolve(root)), target)) return root;
   }
+  return undefined;
 }
 
 /** Matches Linux MAXSYMLINKS, the threshold at which `realpath` itself reports ELOOP. */
@@ -79,17 +91,19 @@ export async function canonicalize(abs: string): Promise<string> {
 }
 
 /**
- * Resolve `p` and confine it to `root`.
+ * Resolve `p` against `root` and confine it to `root` or one of `allowedRoots`
+ * (absolute paths, resolved at check time exactly like `root`).
  *
  * Absolute and relative inputs go through the same canonicalise-then-contain
- * check — an absolute path that lands inside `root` is permitted, only paths
- * that resolve *outside* are rejected. Every symlink in `p` (including the
- * leaf, even a dangling one) is resolved before the confinement check, and the
- * resolved path is what the caller then operates on, so a symlink inside `root`
- * that points outside it can neither pass the check nor be followed afterwards.
- * `..` is collapsed lexically before any symlink is followed. A path that cannot
- * be resolved (symlink loop, unreadable component) is rejected with a
- * `ToolError` naming `p`, never the host's absolute path.
+ * check — an absolute path that lands inside a permitted root is accepted,
+ * only paths that resolve *outside* all of them are rejected. Every symlink in
+ * `p` (including the leaf, even a dangling one) is resolved before the
+ * confinement check, and the resolved path is what the caller then operates
+ * on, so a symlink inside `root` that points outside it can neither pass the
+ * check nor be followed afterwards. `..` is collapsed lexically before any
+ * symlink is followed. A path that cannot be resolved (symlink loop, unreadable
+ * component) is rejected with a `ToolError` naming `p`, never the host's
+ * absolute path.
  *
  * Residual TOCTOU: a component could still be swapped for a symlink between this
  * call and the eventual `fs` operation. Closing that fully needs per-component
@@ -99,22 +113,24 @@ export async function canonicalize(abs: string): Promise<string> {
 export async function confineToRoot(
   root: string,
   p: string,
-  opts?: { allowOutside?: boolean },
+  opts?: { allowedRoots?: readonly string[] },
 ): Promise<string> {
-  const allowOutside = opts?.allowOutside ?? false;
-  const realRoot = await realpathOrSelf(path.resolve(root));
-  const abs = path.resolve(realRoot, p);
-  if (allowOutside) return abs;
+  const allowedRoots = opts?.allowedRoots ?? [];
+  const realRoot = await canonicalize(path.resolve(root));
   let real: string;
   try {
-    real = await canonicalize(abs);
+    real = await canonicalize(path.resolve(realRoot, p));
   } catch (err) {
     throw new ToolError(fsErrorMessage(err, `path ${JSON.stringify(p)}`));
   }
-  if (real !== realRoot && !real.startsWith(realRoot + path.sep)) {
-    throw new ToolError(`path ${JSON.stringify(p)} escapes workdir`);
+  if (isWithin(realRoot, real) || (await containingRoot(allowedRoots, real)) !== undefined) {
+    return real;
   }
-  return real;
+  const permitted =
+    allowedRoots.length ?
+      "the session's working directory and its other permitted directories"
+    : "the session's working directory";
+  throw new ToolError(`path ${JSON.stringify(p)} is outside ${permitted}`);
 }
 
 /**