@breign/client 1.0.127 → 1.0.129

package/dist/openapi.json

@@ -5666,6 +5666,205 @@
         "tags" : [ "conversations" ]
       }
     },
+    "/conversations/{conversationId}/workspace/files" : {
+      "delete" : {
+        "description" : "Manual purge by the user. Deletes the path and, when it is a directory, everything below it. Any running sandbox session for this conversation is discarded at the same time, so the agent cannot write the file back from a stale in-memory copy.",
+        "operationId" : "deleteConversationWorkspaceFile",
+        "parameters" : [ {
+          "description" : "The ID of the conversation",
+          "in" : "path",
+          "name" : "conversationId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        }, {
+          "description" : "Absolute path of the workspace file, always under /home/user. Rejected with 400 when it leaves that root, contains a traversal, or uses characters outside [A-Za-z0-9._-].",
+          "example" : "/home/user/rapport.md",
+          "in" : "query",
+          "name" : "path",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        } ],
+        "responses" : {
+          "204" : {
+            "description" : "Successfully deleted the workspace file."
+          },
+          "400" : {
+            "description" : "Missing or invalid path"
+          },
+          "401" : {
+            "description" : "Unauthorized"
+          },
+          "403" : {
+            "description" : "Forbidden - User cannot access this conversation"
+          },
+          "404" : {
+            "description" : "Conversation not found"
+          },
+          "500" : {
+            "description" : "Server error"
+          }
+        },
+        "summary" : "Delete a file from a conversation workspace",
+        "tags" : [ "conversations" ]
+      },
+      "get" : {
+        "description" : "Reads the persisted workspace of the conversation directly from the store — no sandbox is started. The content is never returned here; use the content endpoint for that. Files whose name starts with a dot are persisted but hidden from this listing. The current usage is returned in the X-Workspace-File-Count and X-Workspace-Total-Bytes headers.",
+        "operationId" : "listConversationWorkspaceFiles",
+        "parameters" : [ {
+          "description" : "The ID of the conversation",
+          "in" : "path",
+          "name" : "conversationId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        } ],
+        "responses" : {
+          "200" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "items" : {
+                    "$ref" : "#/components/schemas/WorkspaceFileEntry"
+                  },
+                  "type" : "array"
+                }
+              }
+            },
+            "description" : "Successfully retrieved the workspace listing.",
+            "headers" : {
+              "X-Workspace-File-Count" : {
+                "description" : "Number of files currently persisted for this workspace.",
+                "schema" : {
+                  "type" : "integer"
+                }
+              },
+              "X-Workspace-Total-Bytes" : {
+                "description" : "Total UTF-8 byte size currently persisted for this workspace.",
+                "schema" : {
+                  "type" : "integer"
+                }
+              }
+            }
+          },
+          "401" : {
+            "description" : "Unauthorized"
+          },
+          "403" : {
+            "description" : "Forbidden - User cannot access this conversation"
+          },
+          "404" : {
+            "description" : "Conversation not found"
+          },
+          "500" : {
+            "description" : "Server error"
+          }
+        },
+        "summary" : "List the files of a conversation workspace",
+        "tags" : [ "conversations" ]
+      }
+    },
+    "/conversations/{conversationId}/workspace/files/content" : {
+      "get" : {
+        "description" : "Returns the CURRENT state of the file, read straight from the store. There is no versioning, so consulting an older message still returns the file as it is now. The content is always UTF-8 text.",
+        "operationId" : "getConversationWorkspaceFileContent",
+        "parameters" : [ {
+          "description" : "The ID of the conversation",
+          "in" : "path",
+          "name" : "conversationId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        }, {
+          "description" : "Absolute path of the workspace file, always under /home/user. Rejected with 400 when it leaves that root, contains a traversal, or uses characters outside [A-Za-z0-9._-].",
+          "example" : "/home/user/rapport.md",
+          "in" : "query",
+          "name" : "path",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        } ],
+        "responses" : {
+          "200" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/WorkspaceFileContent"
+                }
+              }
+            },
+            "description" : "Successfully retrieved the file content."
+          },
+          "400" : {
+            "description" : "Missing or invalid path"
+          },
+          "401" : {
+            "description" : "Unauthorized"
+          },
+          "403" : {
+            "description" : "Forbidden - User cannot access this conversation"
+          },
+          "404" : {
+            "description" : "Conversation or workspace file not found"
+          },
+          "500" : {
+            "description" : "Server error"
+          }
+        },
+        "summary" : "Read the content of a conversation workspace file",
+        "tags" : [ "conversations" ]
+      }
+    },
+    "/conversations/{conversationId}/anonymization" : {
+      "get" : {
+        "description" : "Retrieve the list of anonymized messages for a given conversation.",
+        "operationId" : "getAnonymizedMessages",
+        "parameters" : [ {
+          "description" : "The ID of the conversation",
+          "in" : "path",
+          "name" : "conversationId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        } ],
+        "responses" : {
+          "200" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "items" : {
+                    "$ref" : "#/components/schemas/MessageAnonymization"
+                  },
+                  "type" : "array"
+                }
+              }
+            },
+            "description" : "Successfully retrieved the list of anonymized messages."
+          },
+          "401" : {
+            "description" : "Unauthorized"
+          },
+          "403" : {
+            "description" : "Forbidden - User cannot access this conversation"
+          },
+          "404" : {
+            "description" : "Conversation not found"
+          },
+          "500" : {
+            "description" : "Server error"
+          }
+        },
+        "summary" : "Get the anonymized messages of a conversation",
+        "tags" : [ "conversations" ]
+      }
+    },
     "/engines/default" : {
       "put" : {
         "description" : "Update the default engine for an organization",
@@ -7021,6 +7220,60 @@
         "tags" : [ "guardians" ]
       }
     },
+    "/guardians/{guardianId}/anonymize" : {
+      "post" : {
+        "description" : "Test the Anonymization of a guardian",
+        "operationId" : "testAnonymize",
+        "parameters" : [ {
+          "description" : "ID of the guardian",
+          "in" : "path",
+          "name" : "guardianId",
+          "required" : true,
+          "schema" : {
+            "type" : "string"
+          }
+        } ],
+        "requestBody" : {
+          "content" : {
+            "application/json" : {
+              "schema" : {
+                "$ref" : "#/components/schemas/AnonymizeRequest"
+              }
+            }
+          },
+          "required" : true
+        },
+        "responses" : {
+          "200" : {
+            "content" : {
+              "application/json" : {
+                "schema" : {
+                  "$ref" : "#/components/schemas/AnonymizeResponse"
+                }
+              }
+            },
+            "description" : "Text anonymized successfully"
+          },
+          "400" : {
+            "description" : "Invalid request body"
+          },
+          "401" : {
+            "description" : "Unauthorized"
+          },
+          "403" : {
+            "description" : "Forbidden - User doesn't have permission"
+          },
+          "404" : {
+            "description" : "Guardian not found"
+          },
+          "500" : {
+            "description" : "Server error"
+          }
+        },
+        "summary" : "Test the Anonymization of a guardian",
+        "tags" : [ "guardians" ]
+      }
+    },
     "/organizations" : {
       "get" : {
         "description" : "Lists all organizations for the current user. Admins see all organizations.",
@@ -12848,6 +13101,16 @@
           "type" : "string"
         }
       },
+      "workspacePathQuery" : {
+        "description" : "Absolute path of the workspace file, always under /home/user. Rejected with 400 when it leaves that root, contains a traversal, or uses characters outside [A-Za-z0-9._-].",
+        "example" : "/home/user/rapport.md",
+        "in" : "query",
+        "name" : "path",
+        "required" : true,
+        "schema" : {
+          "type" : "string"
+        }
+      },
       "organizationIdPath" : {
         "description" : "ID of the organization",
         "in" : "path",
@@ -13336,6 +13599,12 @@
           "speechToText" : {
             "$ref" : "#/components/schemas/SpeechToTextConfig"
           },
+          "sandboxConfiguration" : {
+            "allOf" : [ {
+              "$ref" : "#/components/schemas/AgentSandboxConfiguration"
+            } ],
+            "nullable" : true
+          },
           "creator" : {
             "$ref" : "#/components/schemas/Agent_creator"
           },
@@ -13478,6 +13747,52 @@
         "required" : [ "backend", "enabled", "ttlDays" ],
         "type" : "object"
       },
+      "AgentSandboxConfiguration" : {
+        "description" : "Per-agent activation of the bash sandbox and of its two risky capabilities. Three separate switches because the three risk surfaces are unrelated. The server configuration can only narrow this: an agent may enable, never widen.",
+        "properties" : {
+          "enabled" : {
+            "description" : "Enables the Bash_exec tool for this agent.",
+            "type" : "boolean"
+          },
+          "pythonEnabled" : {
+            "description" : "Enables python3 inside the sandbox. Also requires the server-side lock; the cost is arbitrary code execution.",
+            "type" : "boolean"
+          },
+          "network" : {
+            "$ref" : "#/components/schemas/AgentSandboxNetworkConfiguration"
+          },
+          "workspaceScope" : {
+            "description" : "Scope of the persisted workspace. Defaults to conversation, which is the only value accepted today: storage supports an agent-and-user scope so enabling it later needs no migration, but the API keeps it closed until that path has run against real traffic.",
+            "enum" : [ "conversation" ],
+            "type" : "string"
+          }
+        },
+        "type" : "object"
+      },
+      "AgentSandboxNetworkConfiguration" : {
+        "description" : "Enables curl inside the sandbox. Without at least one entry in allowedUrlPrefixes the network stays cut. Private address ranges are always denied, server-side.",
+        "properties" : {
+          "enabled" : {
+            "type" : "boolean"
+          },
+          "allowedUrlPrefixes" : {
+            "items" : {
+              "description" : "Full origin, path prefix allowed (e.g. https://api.exemple.com/v1/).",
+              "type" : "string"
+            },
+            "maxItems" : 20,
+            "type" : "array"
+          },
+          "allowedMethods" : {
+            "items" : {
+              "enum" : [ "GET", "HEAD", "POST", "PUT", "DELETE", "PATCH", "OPTIONS" ],
+              "type" : "string"
+            },
+            "type" : "array"
+          }
+        },
+        "type" : "object"
+      },
       "AgentTool" : {
         "properties" : {
           "id" : {
@@ -13643,6 +13958,12 @@
           },
           "speechToText" : {
             "$ref" : "#/components/schemas/SpeechToTextConfig"
+          },
+          "sandboxConfiguration" : {
+            "allOf" : [ {
+              "$ref" : "#/components/schemas/AgentSandboxConfiguration"
+            } ],
+            "nullable" : true
           }
         },
         "type" : "object"
@@ -14617,6 +14938,9 @@
           "askConfirmation" : {
             "type" : "boolean"
           },
+          "anonymizedContent" : {
+            "type" : "string"
+          },
           "confirmationLink" : {
             "type" : "string"
           },
@@ -14632,6 +14956,13 @@
             },
             "type" : "array"
           },
+          "workspaceFiles" : {
+            "description" : "Workspace paths written or deleted during the turn that produced this message. Granularity is the turn, not the tool call. Only the last state of a file is kept, so the file reads as it is now, not as it was at this message.",
+            "items" : {
+              "type" : "string"
+            },
+            "type" : "array"
+          },
           "flowNode" : {
             "type" : "string"
           },
@@ -16552,6 +16883,102 @@
         "required" : [ "latitude", "longitude" ],
         "type" : "object"
       },
+      "WorkspaceFileEntry" : {
+        "description" : "One file of a persisted agent workspace. Listing entry only — it never carries the content.",
+        "properties" : {
+          "path" : {
+            "description" : "Absolute path inside the sandbox, always under /home/user.",
+            "example" : "/home/user/rapport.md",
+            "type" : "string"
+          },
+          "size" : {
+            "description" : "UTF-8 byte length of the content.",
+            "type" : "integer"
+          },
+          "mimeType" : {
+            "description" : "Derived from the extension. Always a text type.",
+            "example" : "text/markdown",
+            "type" : "string"
+          },
+          "version" : {
+            "description" : "Incremented on every write. Doubles as an ETag: a client already holding this version does not need to fetch the content again.",
+            "type" : "integer"
+          },
+          "updatedAt" : {
+            "type" : "string"
+          }
+        },
+        "required" : [ "mimeType", "path", "size", "updatedAt", "version" ],
+        "type" : "object"
+      },
+      "WorkspaceFileContent" : {
+        "description" : "The current state of a workspace file. There is no versioning: consulting an older message still returns the file as it is now.",
+        "properties" : {
+          "path" : {
+            "type" : "string"
+          },
+          "content" : {
+            "description" : "UTF-8 text. Binary is never stored in a workspace.",
+            "type" : "string"
+          },
+          "mimeType" : {
+            "type" : "string"
+          },
+          "size" : {
+            "type" : "integer"
+          },
+          "version" : {
+            "type" : "integer"
+          },
+          "updatedAt" : {
+            "type" : "string"
+          }
+        },
+        "required" : [ "content", "mimeType", "path", "size", "updatedAt", "version" ],
+        "type" : "object"
+      },
+      "MessageAnonymization" : {
+        "additionalProperties" : false,
+        "properties" : {
+          "id" : {
+            "type" : "string"
+          },
+          "conversationId" : {
+            "type" : "string"
+          },
+          "messageId" : {
+            "type" : "string"
+          },
+          "guardianId" : {
+            "type" : "string"
+          },
+          "originalContent" : {
+            "type" : "string"
+          },
+          "anonymizedContent" : {
+            "type" : "string"
+          },
+          "deanonymizedContent" : {
+            "type" : "string"
+          },
+          "anonymizedReasoning" : {
+            "type" : "string"
+          },
+          "status" : {
+            "$ref" : "#/components/schemas/AnonymizationStatus"
+          },
+          "createdAt" : {
+            "format" : "date-time",
+            "type" : "string"
+          },
+          "updatedAt" : {
+            "format" : "date-time",
+            "type" : "string"
+          }
+        },
+        "required" : [ "conversationId", "createdAt", "guardianId", "id", "messageId", "originalContent", "status", "updatedAt" ],
+        "type" : "object"
+      },
       "DefaultEngineRequest" : {
         "properties" : {
           "providerId" : {
@@ -16932,11 +17359,41 @@
               "type" : "string"
             },
             "type" : "array"
+          },
+          "useFaker" : {
+            "type" : "boolean"
+          },
+          "regexPatterns" : {
+            "items" : {
+              "$ref" : "#/components/schemas/RegexPattern"
+            },
+            "type" : "array"
           }
         },
         "required" : [ "createdAt", "engine", "id", "organisationId", "role", "type" ],
         "type" : "object"
       },
+      "RegexPattern" : {
+        "properties" : {
+          "id" : {
+            "type" : "string"
+          },
+          "name" : {
+            "type" : "string"
+          },
+          "expression" : {
+            "type" : "string"
+          },
+          "entityType" : {
+            "type" : "string"
+          },
+          "enabled" : {
+            "type" : "boolean"
+          }
+        },
+        "required" : [ "enabled", "entityType", "expression", "id", "name" ],
+        "type" : "object"
+      },
       "GuardianCreateRequest" : {
         "properties" : {
           "role" : {
@@ -17008,6 +17465,32 @@
           "excludedAgents" : {
             "items" : { },
             "type" : "array"
+          },
+          "regexPatterns" : {
+            "items" : {
+              "$ref" : "#/components/schemas/RegexPattern"
+            },
+            "type" : "array"
+          },
+          "useFaker" : {
+            "type" : "boolean"
+          }
+        },
+        "type" : "object"
+      },
+      "AnonymizeRequest" : {
+        "properties" : {
+          "prompt" : {
+            "type" : "string"
+          }
+        },
+        "required" : [ "prompt" ],
+        "type" : "object"
+      },
+      "AnonymizeResponse" : {
+        "properties" : {
+          "anonymizedPrompt" : {
+            "type" : "string"
           }
         },
         "type" : "object"
@@ -19019,6 +19502,10 @@
         "required" : [ "ext", "id", "key", "mimeType", "name", "size", "status", "type" ],
         "type" : "object"
       },
+      "AnonymizationStatus" : {
+        "enum" : [ "pending", "anonymized", "deanonymized", "error" ],
+        "type" : "string"
+      },
       "ProviderType" : {
         "enum" : [ "ollama", "openai", "mistral", "other", "gemini", "vllm", "vllm-responses", "anthropic" ],
         "type" : "string"
@@ -19028,7 +19515,7 @@
         "type" : "string"
       },
       "GuardianRole" : {
-        "enum" : [ "PROMPTCHECK", "WORDCHECK", "INTENTIONCHECK", "ATTACKCHECK", "ANONIMIZE" ],
+        "enum" : [ "PROMPTCHECK", "WORDCHECK", "INTENTIONCHECK", "ATTACKCHECK", "ANONYMIZE" ],
         "type" : "string"
       },
       "GuardianEngine" : {
@@ -20216,6 +20703,12 @@
               "$ref" : "#/components/schemas/ToolResults"
             },
             "type" : "array"
+          },
+          "workspaceFiles" : {
+            "items" : {
+              "type" : "string"
+            },
+            "type" : "array"
           }
         },
         "required" : [ "content", "id", "role", "timestamp" ],

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@breign/client",
-  "version": "1.0.127",
+  "version": "1.0.129",
   "main": "dist/index.js",
   "exports": {
     ".": "./dist/index.js",