@breign/client 1.0.148 → 1.0.149

package/dist/models/AgentSandboxConfigurationUio.d.ts

@@ -11,7 +11,7 @@
  */
 import type { AgentSandboxNetworkConfigurationUio } from './AgentSandboxNetworkConfigurationUio';
 /**
- * Per-agent activation of the bash sandbox and of its two risky capabilities. Three separate switches because the three risk surfaces are unrelated. The server configuration can only narrow this: an agent may enable, never widen.
+ * Per-agent activation of the bash sandbox and of its three risky capabilities. Separate switches because the risk surfaces are unrelated. The server configuration can only narrow this: an agent may enable, never widen.
  * @export
  * @interface AgentSandboxConfigurationUio
  */
@@ -23,11 +23,17 @@ export interface AgentSandboxConfigurationUio {
      */
     enabled?: boolean;
     /**
-     * Enables python3 inside the sandbox. Also requires the server-side lock; the cost is arbitrary code execution.
+     * Enables python3 inside the sandbox. Also requires the server-side lock; the cost is arbitrary code execution, so every python command is approved by the user before it runs.
      * @type {boolean}
      * @memberof AgentSandboxConfigurationUio
      */
     pythonEnabled?: boolean;
+    /**
+     * Enables js-exec (JavaScript and TypeScript, in QuickJS) inside the sandbox. Same two extra locks as pythonEnabled, and the same per-command approval: running code IS the effect, so there is nothing to refuse afterwards.
+     * @type {boolean}
+     * @memberof AgentSandboxConfigurationUio
+     */
+    javascriptEnabled?: boolean;
     /**
      *
      * @type {AgentSandboxNetworkConfigurationUio}

package/dist/models/AgentSandboxConfigurationUio.js

@@ -42,6 +42,7 @@ function AgentSandboxConfigurationUioFromJSONTyped(json, ignoreDiscriminator) {
     return {
         'enabled': json['enabled'] == null ? undefined : json['enabled'],
         'pythonEnabled': json['pythonEnabled'] == null ? undefined : json['pythonEnabled'],
+        'javascriptEnabled': json['javascriptEnabled'] == null ? undefined : json['javascriptEnabled'],
         'network': json['network'] == null ? undefined : (0, AgentSandboxNetworkConfigurationUio_1.AgentSandboxNetworkConfigurationUioFromJSON)(json['network']),
         'workspaceScope': json['workspaceScope'] == null ? undefined : json['workspaceScope'],
     };
@@ -56,6 +57,7 @@ function AgentSandboxConfigurationUioToJSONTyped(value, ignoreDiscriminator = fa
     return {
         'enabled': value['enabled'],
         'pythonEnabled': value['pythonEnabled'],
+        'javascriptEnabled': value['javascriptEnabled'],
         'network': (0, AgentSandboxNetworkConfigurationUio_1.AgentSandboxNetworkConfigurationUioToJSON)(value['network']),
         'workspaceScope': value['workspaceScope'],
     };

package/dist/models/ConversationMessageApprovalUio.d.ts

@@ -16,7 +16,7 @@
  */
 export interface ConversationMessageApprovalUio {
     /**
-     * The tool whose use was submitted for approval. It also says which family the decision belongs to: bash_network_approval an address, bash_python_approval a command.
+     * The tool whose use was submitted for approval. It also says which family the decision belongs to: bash_network_approval an address, bash_command_approval a command (and bash_python_approval, its former name, on decisions taken before the rename).
      * @type {string}
      * @memberof ConversationMessageApprovalUio
      */

package/dist/models/ToolApprovalUio.d.ts

@@ -10,7 +10,7 @@
  * Do not edit the class manually.
  */
 /**
- * One operation the user has authorised an agent to perform. Two families share this shape: an address the agent sandbox may reach, and a python command it may run. An address is stored normalised — query string, fragment and credentials removed — so a token carried by the URL the user saw is not kept here; a command is stored as it was approved, since the command itself is what was judged.
+ * One operation the user has authorised an agent to perform. Two families share this shape: an address the agent sandbox may reach, and a command it may run through one of its interpreters — python3 or js-exec. An address is stored normalised — query string, fragment and credentials removed — so a token carried by the URL the user saw is not kept here; a command is stored as it was approved, since the command itself is what was judged.
  * @export
  * @interface ToolApprovalUio
  */

package/dist/models/ToolCallResultRequestUio.d.ts

@@ -41,13 +41,13 @@ export interface ToolCallResultRequestUio {
      */
     error?: string;
     /**
-     * Only read when resolving a bash_network_approval or bash_python_approval call with status completed: how far the approval reaches. once — the suspended reply and nothing after it, so the same request is asked about again next time — is the default, and nothing is stored. agentUser covers this agent, for this user, across all of their conversations, and is kept until revoked. Any other value is refused with a 400. Never widens what the agent is allowed to do: the server-side lock and the per-agent switch remain prerequisites. Only the user the question was asked of may answer it: an approval is a personal consent, so another caller — an admin included — gets a 403.
+     * Only read when resolving a bash_network_approval or bash_command_approval call with status completed: how far the approval reaches. once — the suspended reply and nothing after it, so the same request is asked about again next time — is the default, and nothing is stored. agentUser covers this agent, for this user, across all of their conversations, and is kept until revoked. Any other value is refused with a 400. Never widens what the agent is allowed to do: the server-side lock and the per-agent switch remain prerequisites. Only the user the question was asked of may answer it: an approval is a personal consent, so another caller — an admin included — gets a 403.
      * @type {string}
      * @memberof ToolCallResultRequestUio
      */
     approvalScope?: ToolCallResultRequestUioApprovalScopeEnum;
     /**
-     * Only read when resolving a bash_network_approval call with status completed: how wide the approval is. prefix (the default) grants the prefix shown in the request — origin plus first path segment; origin grants the whole domain. Nothing narrower is offered: nobody can predict the paths an API will serve, and an approval that is too fine is paid for in repeated questions. The server recomputes both from the URL it recorded, so a client cannot submit a prefix of its own. Ignored on a bash_python_approval call, which has a single width: the exact command the server already recorded.
+     * Only read when resolving a bash_network_approval call with status completed: how wide the approval is. prefix (the default) grants the prefix shown in the request — origin plus first path segment; origin grants the whole domain. Nothing narrower is offered: nobody can predict the paths an API will serve, and an approval that is too fine is paid for in repeated questions. The server recomputes both from the URL it recorded, so a client cannot submit a prefix of its own. Ignored on a bash_command_approval call, which has a single width: the exact command the server already recorded.
      * @type {string}
      * @memberof ToolCallResultRequestUio
      */

package/dist/models/ToolCallUio.d.ts

@@ -22,7 +22,7 @@ export interface ToolCallUio {
      */
     callId: string;
     /**
-     * Name of the tool the model called. Three values are produced by the server today. take_screenshot asks the client to capture the screen. bash_network_approval is an agent sandbox asking permission to reach an address: arguments carries url (the full address, to be shown as-is), urlPrefix (what a yes actually grants), origin, host and method. bash_python_approval is an agent sandbox asking permission to run a python command: arguments carries command, which is both what has to be shown in full and exactly what a yes grants — nothing ran, so a refusal leaves the sandbox untouched.
+     * Name of the tool the model called. Three values are produced by the server today. take_screenshot asks the client to capture the screen. bash_network_approval is an agent sandbox asking permission to reach an address: arguments carries url (the full address, to be shown as-is), urlPrefix (what a yes actually grants), origin, host and method. bash_command_approval is an agent sandbox asking permission to run a command through one of its interpreters — python3 or js-exec: arguments carries command, which is both what has to be shown in full and exactly what a yes grants — nothing ran, so a refusal leaves the sandbox untouched. Calls named bash_python_approval, the name this last one carried while python was the only interpreter, may still be waiting in older conversations and resolve exactly the same way.
      * @type {string}
      * @memberof ToolCallUio
      */

package/dist/openapi.json

@@ -16033,14 +16033,18 @@
         "type" : "object"
       },
       "AgentSandboxConfiguration" : {
-        "description" : "Per-agent activation of the bash sandbox and of its two risky capabilities. Three separate switches because the three risk surfaces are unrelated. The server configuration can only narrow this: an agent may enable, never widen.",
+        "description" : "Per-agent activation of the bash sandbox and of its three risky capabilities. Separate switches because the risk surfaces are unrelated. The server configuration can only narrow this: an agent may enable, never widen.",
         "properties" : {
           "enabled" : {
             "description" : "Enables the Bash_exec tool for this agent.",
             "type" : "boolean"
           },
           "pythonEnabled" : {
-            "description" : "Enables python3 inside the sandbox. Also requires the server-side lock; the cost is arbitrary code execution.",
+            "description" : "Enables python3 inside the sandbox. Also requires the server-side lock; the cost is arbitrary code execution, so every python command is approved by the user before it runs.",
+            "type" : "boolean"
+          },
+          "javascriptEnabled" : {
+            "description" : "Enables js-exec (JavaScript and TypeScript, in QuickJS) inside the sandbox. Same two extra locks as pythonEnabled, and the same per-command approval: running code IS the effect, so there is nothing to refuse afterwards.",
             "type" : "boolean"
           },
           "network" : {
@@ -17422,7 +17426,7 @@
         "description" : "One authorisation decision taken during this message: which tool, over what, by whom, when. Carried by the message so the history reads as it stands, with no extra request. For a decision granted once it is the only lasting trace there is — a one-off creates no standing approval. Deliberately beside toolResults rather than inside it: toolResults is replayed to the model every turn, and a one-off appearing there would later suggest a right that has expired.",
         "properties" : {
           "tool" : {
-            "description" : "The tool whose use was submitted for approval. It also says which family the decision belongs to: bash_network_approval an address, bash_python_approval a command.",
+            "description" : "The tool whose use was submitted for approval. It also says which family the decision belongs to: bash_network_approval an address, bash_command_approval a command (and bash_python_approval, its former name, on decisions taken before the rename).",
             "type" : "string"
           },
           "granted" : {
@@ -20246,7 +20250,7 @@
       },
       "ToolApproval" : {
         "additionalProperties" : false,
-        "description" : "One operation the user has authorised an agent to perform. Two families share this shape: an address the agent sandbox may reach, and a python command it may run. An address is stored normalised — query string, fragment and credentials removed — so a token carried by the URL the user saw is not kept here; a command is stored as it was approved, since the command itself is what was judged.",
+        "description" : "One operation the user has authorised an agent to perform. Two families share this shape: an address the agent sandbox may reach, and a command it may run through one of its interpreters — python3 or js-exec. An address is stored normalised — query string, fragment and credentials removed — so a token carried by the URL the user saw is not kept here; a command is stored as it was approved, since the command itself is what was judged.",
         "properties" : {
           "id" : {
             "description" : "Identifier to revoke the approval with.",
@@ -22085,7 +22089,7 @@
             "type" : "string"
           },
           "tool" : {
-            "description" : "Name of the tool the model called. Three values are produced by the server today. take_screenshot asks the client to capture the screen. bash_network_approval is an agent sandbox asking permission to reach an address: arguments carries url (the full address, to be shown as-is), urlPrefix (what a yes actually grants), origin, host and method. bash_python_approval is an agent sandbox asking permission to run a python command: arguments carries command, which is both what has to be shown in full and exactly what a yes grants — nothing ran, so a refusal leaves the sandbox untouched.",
+            "description" : "Name of the tool the model called. Three values are produced by the server today. take_screenshot asks the client to capture the screen. bash_network_approval is an agent sandbox asking permission to reach an address: arguments carries url (the full address, to be shown as-is), urlPrefix (what a yes actually grants), origin, host and method. bash_command_approval is an agent sandbox asking permission to run a command through one of its interpreters — python3 or js-exec: arguments carries command, which is both what has to be shown in full and exactly what a yes grants — nothing ran, so a refusal leaves the sandbox untouched. Calls named bash_python_approval, the name this last one carried while python was the only interpreter, may still be waiting in older conversations and resolve exactly the same way.",
             "type" : "string"
           },
           "status" : {
@@ -22148,12 +22152,12 @@
             "type" : "string"
           },
           "approvalScope" : {
-            "description" : "Only read when resolving a bash_network_approval or bash_python_approval call with status completed: how far the approval reaches. once — the suspended reply and nothing after it, so the same request is asked about again next time — is the default, and nothing is stored. agentUser covers this agent, for this user, across all of their conversations, and is kept until revoked. Any other value is refused with a 400. Never widens what the agent is allowed to do: the server-side lock and the per-agent switch remain prerequisites. Only the user the question was asked of may answer it: an approval is a personal consent, so another caller — an admin included — gets a 403.",
+            "description" : "Only read when resolving a bash_network_approval or bash_command_approval call with status completed: how far the approval reaches. once — the suspended reply and nothing after it, so the same request is asked about again next time — is the default, and nothing is stored. agentUser covers this agent, for this user, across all of their conversations, and is kept until revoked. Any other value is refused with a 400. Never widens what the agent is allowed to do: the server-side lock and the per-agent switch remain prerequisites. Only the user the question was asked of may answer it: an approval is a personal consent, so another caller — an admin included — gets a 403.",
             "enum" : [ "once", "agentUser" ],
             "type" : "string"
           },
           "approvalWidth" : {
-            "description" : "Only read when resolving a bash_network_approval call with status completed: how wide the approval is. prefix (the default) grants the prefix shown in the request — origin plus first path segment; origin grants the whole domain. Nothing narrower is offered: nobody can predict the paths an API will serve, and an approval that is too fine is paid for in repeated questions. The server recomputes both from the URL it recorded, so a client cannot submit a prefix of its own. Ignored on a bash_python_approval call, which has a single width: the exact command the server already recorded.",
+            "description" : "Only read when resolving a bash_network_approval call with status completed: how wide the approval is. prefix (the default) grants the prefix shown in the request — origin plus first path segment; origin grants the whole domain. Nothing narrower is offered: nobody can predict the paths an API will serve, and an approval that is too fine is paid for in repeated questions. The server recomputes both from the URL it recorded, so a client cannot submit a prefix of its own. Ignored on a bash_command_approval call, which has a single width: the exact command the server already recorded.",
             "enum" : [ "prefix", "origin" ],
             "type" : "string"
           }

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@breign/client",
-  "version": "1.0.148",
+  "version": "1.0.149",
   "main": "dist/index.js",
   "exports": {
     ".": "./dist/index.js",