@deepraxis/cli 0.1.0-dev.45dc412 → 0.1.0-dev.67c7f3b

package/COMMANDS.md

@@ -2,7 +2,7 @@
 
 Generated by `bun run commands`. DO NOT EDIT.
 
-346 HTTP operations; 348 commands including aliases.
+365 HTTP operations; 367 commands including aliases.
 
 Environment: `PRAXIS_ENV=develop|production` (dev package defaults to `develop`; stable package defaults to `production`). No `--env` option.
 
@@ -27,6 +27,8 @@ Handwritten commands: `login`, `logout`, `whoami`, `org list`, `org switch <orga
 | `praxis agent computer file get-content` | `agent.computers.files.retrieveContent` | GET `/agent/v1/computers/{computer_id}/files/content` | `--computer`, `--path` |
 | `praxis agent computer file list` | `agent.computers.files.list` | GET `/agent/v1/computers/{computer_id}/files` | `--computer`, `--path` |
 | `praxis agent computer get <computer_id>` | `agent.computers.retrieve` | GET `/agent/v1/computers/{computer_id}` |  |
+| `praxis agent computer lease delete <lease_id>` | `agent.computers.leases.delete` | DELETE `/agent/v1/computers/{computer_id}/leases/{lease_id}` | `--computer` |
+| `praxis agent computer lease renew create` | `agent.computers.leases.renew.create` | POST `/agent/v1/computers/{computer_id}/leases/{lease_id}/renew` | `--computer`, `--lease` |
 | `praxis agent computer list` | `agent.computers.list` | GET `/agent/v1/computers` | `--param-limit`, `--page` |
 | `praxis agent computer update <computer_id>` | `agent.computers.update` | POST `/agent/v1/computers/{computer_id}` | `--name` |
 | `praxis agent create` | `agent.agents.create` | POST `/agent/v1/agents` | `--name`, `--description`, `--system`, `--kind`, `--computer-id`, `--subagent-model` |
@@ -40,9 +42,19 @@ Handwritten commands: `login`, `logout`, `whoami`, `org list`, `org switch <orga
 | `praxis agent deployment update <deployment_id>` | `agent.deployments.update` | POST `/agent/v1/deployments/{deployment_id}` | `--description`, `--environment-id`, `--name`, `--vault-ids` |
 | `praxis agent deployment-run get <deployment_run_id>` | `agent.deploymentRuns.retrieve` | GET `/agent/v1/deployment_runs/{deployment_run_id}` |  |
 | `praxis agent deployment-run list` | `agent.deploymentRuns.list` | GET `/agent/v1/deployment_runs` | `--created-at-gt`, `--created-at-gte`, `--created-at-lt`, `--created-at-lte`, `--deployment-id`, `--has-error`, `--trigger-type`, `--param-limit`, `--page` |
-| `praxis agent embed-token create` | `agent.embedTokens.create` | POST `/agent/v1/embed_tokens` | `--agent`, `--param-version`, `--external-user-id`, `--ttl-seconds`, `--budget-cents`, `--allowed-origins` |
+| `praxis agent embed exchange create` | `agent.embed.exchange.create` | POST `/agent/v1/embed/exchange` | `--code` |
+| `praxis agent embed get-appearance` | `agent.embed.retrieveAppearance` | GET `/agent/v1/embed/appearance` |  |
+| `praxis agent embed-token anonymous create` | `agent.embedTokens.anonymous.create` | POST `/agent/v1/embed_tokens/anonymous` | `--publishable-key`, `--visitor-secret` |
+| `praxis agent embed-token create` | `agent.embedTokens.create` | POST `/agent/v1/embed_tokens` | `--hosted`, `--agent`, `--param-version`, `--external-user-id`, `--ttl-seconds`, `--budget-cents`, `--allowed-origins` |
 | `praxis agent embed-token list` | `agent.embedTokens.list` | GET `/agent/v1/embed_tokens` | `--agent-id`, `--external-user-id`, `--param-limit`, `--page` |
 | `praxis agent embed-token revoke create` | `agent.embedTokens.revoke.create` | POST `/agent/v1/embed_tokens/{id}/revoke` | `--embed-token` |
+| `praxis agent end-user block create` | `agent.agents.endUsers.block.create` | POST `/agent/v1/agents/{agent_id}/end_users/{external_user_id}/block` | `--agent`, `--end-user` |
+| `praxis agent end-user delete <external_user_id>` | `agent.agents.endUsers.delete` | DELETE `/agent/v1/agents/{agent_id}/end_users/{external_user_id}` | `--agent`, `--confirm` |
+| `praxis agent end-user get <external_user_id>` | `agent.agents.endUsers.retrieve` | GET `/agent/v1/agents/{agent_id}/end_users/{external_user_id}` | `--agent` |
+| `praxis agent end-user get-deletion <external_user_id>` | `agent.agents.endUsers.retrieveDeletion` | GET `/agent/v1/agents/{agent_id}/end_users/{external_user_id}/deletion` | `--agent` |
+| `praxis agent end-user list` | `agent.agents.endUsers.list` | GET `/agent/v1/agents/{agent_id}/end_users` | `--agent`, `--param-limit`, `--page`, `--q` |
+| `praxis agent end-user revoke-token create` | `agent.agents.endUsers.revokeTokens.create` | POST `/agent/v1/agents/{agent_id}/end_users/{external_user_id}/revoke_tokens` | `--agent`, `--end-user` |
+| `praxis agent end-user unblock create` | `agent.agents.endUsers.unblock.create` | POST `/agent/v1/agents/{agent_id}/end_users/{external_user_id}/unblock` | `--agent`, `--end-user` |
 | `praxis agent environment archive <environment_id>` | `agent.environments.archive` | POST `/agent/v1/environments/{environment_id}/archive` |  |
 | `praxis agent environment create` | `agent.environments.create` | POST `/agent/v1/environments` | `--name`, `--description`, `--scope` |
 | `praxis agent environment get <environment_id>` | `agent.environments.retrieve` | GET `/agent/v1/environments/{environment_id}` |  |
@@ -64,11 +76,13 @@ Handwritten commands: `login`, `logout`, `whoami`, `org list`, `org switch <orga
 | `praxis agent session get <session_id>` | `agent.sessions.retrieve` | GET `/agent/v1/sessions/{session_id}` |  |
 | `praxis agent session get-compact <operation_id>` | `agent.sessions.retrieveCompact` | GET `/agent/v1/sessions/{session_id}/compact/{operation_id}` | `--session` |
 | `praxis agent session get-context <session_id>` | `agent.sessions.retrieveContext` | GET `/agent/v1/sessions/{session_id}/context` |  |
-| `praxis agent session list` | `agent.sessions.list` | GET `/agent/v1/sessions` | `--agent-id`, `--agent-version`, `--created-at-gt`, `--created-at-gte`, `--created-at-lt`, `--created-at-lte`, `--deployment-id`, `--include-archived`, `--memory-store-id`, `--order`, `--statuses`, `--param-limit`, `--page` |
+| `praxis agent session list` | `agent.sessions.list` | GET `/agent/v1/sessions` | `--agent-id`, `--agent-version`, `--created-at-gt`, `--created-at-gte`, `--created-at-lt`, `--created-at-lte`, `--deployment-id`, `--include-archived`, `--memory-store-id`, `--order`, `--statuses`, `--param-limit`, `--page`, `--external-user-id`, `--source` |
 | `praxis agent session resource create` | `agent.sessions.resources.create` | POST `/agent/v1/sessions/{session_id}/resources` | `--session`, `--type`, `--file-id`, `--mount-path` |
 | `praxis agent session resource delete <resource_id>` | `agent.sessions.resources.delete` | DELETE `/agent/v1/sessions/{session_id}/resources/{resource_id}` | `--session`, `--query-session-id` |
 | `praxis agent session resource get <resource_id>` | `agent.sessions.resources.retrieve` | GET `/agent/v1/sessions/{session_id}/resources/{resource_id}` | `--session`, `--query-session-id` |
 | `praxis agent session resource list` | `agent.sessions.resources.list` | GET `/agent/v1/sessions/{session_id}/resources` | `--session`, `--param-limit`, `--page` |
+| `praxis agent session run delete-feedback <run_id>` | `agent.sessions.runs.deleteFeedback` | DELETE `/agent/v1/sessions/{session_id}/runs/{run_id}/feedback` | `--session` |
+| `praxis agent session run feedback create` | `agent.sessions.runs.feedback.create` | POST `/agent/v1/sessions/{session_id}/runs/{run_id}/feedback` | `--session`, `--run`, `--rating`, `--comment` |
 | `praxis agent session thread archive <thread_id>` | `agent.sessions.threads.archive` | POST `/agent/v1/sessions/{session_id}/threads/{thread_id}/archive` | `--session`, `--query-session-id` |
 | `praxis agent session thread event list` | `agent.sessions.threads.events.list` | GET `/agent/v1/sessions/{session_id}/threads/{thread_id}/events` | `--session`, `--thread`, `--query-session-id`, `--param-limit`, `--page` |
 | `praxis agent session thread get <thread_id>` | `agent.sessions.threads.retrieve` | GET `/agent/v1/sessions/{session_id}/threads/{thread_id}` | `--session`, `--query-session-id` |
@@ -303,7 +317,12 @@ Handwritten commands: `login`, `logout`, `whoami`, `org list`, `org switch <orga
 | `praxis organization cost list` | `organization.costs.list` | GET `/organization/v1/costs` | `--starting-at`, `--ending-at`, `--bucket-width`, `--time-zone`, `--group-by`, `--page` |
 | `praxis organization event get <id>` | `organization.events.retrieve` | GET `/organization/v1/events/{id}` |  |
 | `praxis organization event list` | `organization.events.list` | GET `/organization/v1/events` | `--starting-at`, `--ending-at`, `--param-limit`, `--page` |
-| `praxis organization feedback create` | `organization.feedback.create` | POST `/organization/v1/feedback` | `--message`, `--contact-email`, `--name`, `--url`, `--associated-event-id`, `--source` |
+| `praxis organization feedback count list` | `organization.feedback.counts.list` | GET `/organization/v1/feedback/counts` |  |
+| `praxis organization feedback create` | `organization.feedback.create` | POST `/organization/v1/feedback` | `--message`, `--contact-email`, `--name`, `--url`, `--associated-event-id`, `--title`, `--type`, `--source` |
+| `praxis organization feedback get <id>` | `organization.feedback.retrieve` | GET `/organization/v1/feedback/{id}` |  |
+| `praxis organization feedback list` | `organization.feedback.list` | GET `/organization/v1/feedback` | `--phase`, `--query`, `--param-limit`, `--page` |
+| `praxis organization feedback message create` | `organization.feedback.messages.create` | POST `/organization/v1/feedback/{id}/messages` | `--feedback`, `--body` |
+| `praxis organization feedback message list` | `organization.feedback.messages.list` | GET `/organization/v1/feedback/{id}/messages` | `--feedback`, `--param-limit`, `--page` |
 | `praxis organization usage list` | `organization.usage.list` | GET `/organization/v1/usage` | `--starting-at`, `--ending-at`, `--bucket-width`, `--time-zone`, `--group-by`, `--page` |
 | `praxis sandbox command run <sandbox_id>` | `sandbox.sandboxes.commands.run` | POST `/sandbox/v1/sandboxes/{sandbox_id}/commands` | `--cmd`, `--cwd`, `--timeout-ms` |
 | `praxis sandbox connect <sandboxID>` | `sandbox.sandboxes.connect` | POST `/sandbox/v1/sandboxes/{sandboxID}/connect` | `--timeout`, `--memory` |

package/README.md

@@ -7,8 +7,8 @@
 The official command line for [知行云 Praxis](https://deepraxis.com), the cloud where AI agents are built, run and hosted.
 
 [![npm](https://img.shields.io/npm/v/@deepraxis/cli?label=npm&color=2e8555)](https://www.npmjs.com/package/@deepraxis/cli)
-[![Node.js](https://img.shields.io/node/v/@deepraxis/cli?color=2e8555)](https://nodejs.org)
-[![License](https://img.shields.io/badge/license-Apache--2.0-2e8555)](./LICENSE)
+[![Node.js](https://img.shields.io/badge/node-%E2%89%A520-2e8555)](https://nodejs.org)
+[![License](https://img.shields.io/badge/license-Apache--2.0-2e8555)](https://www.apache.org/licenses/LICENSE-2.0)
 
 [Website](https://deepraxis.com) · [Documentation](https://docs.deepraxis.com) · [API reference](https://docs.deepraxis.com/docs/api) · [Console](https://console.deepraxis.com)
 
@@ -20,7 +20,7 @@ The official command line for [知行云 Praxis](https://deepraxis.com), the clo
 npm install -g @deepraxis/cli
 praxis login
 praxis model chat completion create --model deepseek-flash \
-  --data '{"messages":[{"role":"user","content":"Say hello in three languages"}]}'
+  --data '{"messages":[{"role":"user","content":"Hello!"}]}'
 ```
 
 Every operation of the Praxis API is a command: about 350 of them across models, agents,
@@ -57,8 +57,8 @@ npx @deepraxis/cli model list
 ## Sign in
 
 ```sh
-praxis login      # opens the device page; type the code shown in your terminal
-praxis whoami     # who you are, which organization, where the credential is stored
+praxis login    # approve in the browser with the code shown
+praxis whoami   # account, organization, credential storage
 ```
 
 You need a Praxis account; sign up at [deepraxis.com](https://deepraxis.com).
@@ -68,7 +68,7 @@ Belong to several organizations? Every call runs in the active one:
 ```sh
 praxis org list
 praxis org switch <organization_id>
-praxis model list --org <organization_id>   # one call in another organization
+praxis model list --org <organization_id>   # just this call
 ```
 
 For CI and other headless environments, create an API key in the
@@ -86,9 +86,11 @@ export PRAXIS_API_KEY=<your-api-key>
 ```sh
 praxis model list
 praxis model chat completion create --model deepseek-flash \
-  --data '{"messages":[{"role":"user","content":"Write a haiku about the sea"}]}'
-praxis model embedding create --model <embedding-model> --data '{"input":"hello world"}'
-praxis model image generation create --model <image-model> --prompt "a lighthouse at dawn"
+  --data '{"messages":[{"role":"user","content":"A haiku"}]}'
+praxis model embedding create --model <embedding_model> \
+  --data '{"input":"hello world"}'
+praxis model image generation create --model <image_model> \
+  --prompt "a lighthouse at dawn"
 ```
 
 ### Agents
@@ -103,7 +105,10 @@ praxis agent create --data '{
 }'
 praxis agent session create --data '{"agent": "<agent_id>"}'
 praxis agent session event send <session_id> --data '{
-  "events": [{"type": "user.message", "content": [{"type": "text", "text": "List the files in your home directory"}]}]
+  "events": [{
+    "type": "user.message",
+    "content": [{"type": "text", "text": "What can you do?"}]
+  }]
 }'
 praxis agent session event stream --session <session_id>
 ```
@@ -112,23 +117,24 @@ praxis agent session event stream --session <session_id>
 
 ```sh
 praxis sandbox create --template-id base
-praxis sandbox command run <sandbox_id> --cmd "python3 -c 'print(6 * 7)'"
+praxis sandbox command run <sandbox_id> \
+  --cmd "python3 -c 'print(6 * 7)'"
 praxis sandbox delete <sandbox_id> --yes
 ```
 
 ### Search, data and automation
 
 ```sh
-praxis search create --query "latest Cloudflare Workers announcements" --max-results 5
+praxis search create --query "AI agent frameworks" --max-results 5
 praxis database create --name notes
 praxis automation run create --data '{
-  "source": "export default async (input: { n: number }) => ({ answer: input.n + 1 })",
+  "source": "export default async (i) => ({ answer: i.n + 1 })",
   "language": "ts", "input": {"n": 41}, "wait": 30
 }'
 ```
 
 Browse everything with `praxis --help`, `praxis <domain> --help`, or the full
-[command reference](./COMMANDS.md) in the package.
+[command reference](https://unpkg.com/@deepraxis/cli/COMMANDS.md) that ships in the package.
 
 ## How commands work
 
@@ -170,8 +176,8 @@ The CLI writes its own skill file: the general rules plus one line per command,
 the API contract.
 
 ```sh
-praxis skill --install ~/.claude/skills     # writes praxis-cli/SKILL.md
-praxis skill > SKILL.md                      # or print it anywhere
+praxis skill --install ~/.claude/skills   # praxis-cli/SKILL.md
+praxis skill > SKILL.md                    # or print it
 ```
 
 After that, an agent such as Claude Code can drive every Praxis capability through the CLI and
@@ -200,7 +206,7 @@ Linux. Without a keychain they are written to `~/.praxis/cli/<env>.json` with mo
 ## Resources
 
 - [Documentation](https://docs.deepraxis.com) and [API reference](https://docs.deepraxis.com/docs/api)
-- [Command reference](./COMMANDS.md)
+- [Command reference](https://unpkg.com/@deepraxis/cli/COMMANDS.md)
 - TypeScript SDK: [`@deepraxis/sdk`](https://www.npmjs.com/package/@deepraxis/sdk), the same API as code
 - Already using the OpenAI or Anthropic SDK? Point its `baseURL` at
   `https://api.deepraxis.com/openai/v1` or the Anthropic-compatible endpoint, as the
@@ -208,7 +214,7 @@ Linux. Without a keychain they are written to `~/.praxis/cli/<env>.json` with mo
 
 ## License
 
-[Apache-2.0](./LICENSE). Copyright 2026 南京深度实践人工智能科技有限公司 (Deepractice).
+[Apache-2.0](https://www.apache.org/licenses/LICENSE-2.0). Copyright 2026 南京深度实践人工智能科技有限公司 (Deepractice).
 
 "Praxis", "知行云" and "Deepraxis" are trademarks of Deepractice; the license does not grant
 rights to use them.

package/dist/praxis.js

@@ -68,7 +68,7 @@ var operations = [
     resource: "agent.agents",
     method: "create",
     summary: "Create agent",
-    description: 'Create a reusable agent definition, then pass its returned id to sessions.create to start a conversation. The definition includes model, system prompt, tools, MCP servers and an optional multiagent roster. It is saved as version 1; real updates create new versions. Unlike Anthropic Managed Agents, nonempty skills attachments and custom tool entries return 400; the native skill tool is separate from the skills field. Use tools: [{type: "agent_toolset_20260401"}] for built-in tools including codemode, skill and agent; inspect toolsets.list for names and schemas, and keep bash enabled for native additions. To offer only some tools, set default_config: {enabled: false} and list the tools to keep in configs, e.g. tools: [{type: "agent_toolset_20260401", default_config: {enabled: false}, configs: [{name: "codemode", enabled: true}, {name: "bash", enabled: true, permission_policy: {type: "always_ask"}}]}]; every tool not listed, including todo_write, enter_plan_mode, ask_user_question and goal_read, follows default_config, and the response echoes it. codemode runs through bash, so enabling codemode while bash is disabled returns 400. Optional mcp_toolset entries pair with mcp_servers. model accepts platform model IDs such as deepseek-flash, not only the Claude IDs in the protocol examples. model.settings.reasoning sets default thinking; other extra model controls return 400. Example: {"name":"helper","model":{"id":"deepseek-flash"},"tools":[{"type":"agent_toolset_20260401"}]}.',
+    description: 'Create a reusable agent definition, then pass its returned id to sessions.create to start a conversation. The definition includes model, system prompt, tools, MCP servers and an optional multiagent roster. It is saved as version 1; real updates create new versions. Unlike Anthropic Managed Agents, nonempty skills attachments return 400; the native skill tool is separate from the skills field. Use tools: [{type: "agent_toolset_20260401"}] for built-in tools including codemode, skill and agent; inspect toolsets.list for names and schemas, and keep bash enabled for native additions. To offer only some tools, set default_config: {enabled: false} and list the tools to keep in configs, e.g. tools: [{type: "agent_toolset_20260401", default_config: {enabled: false}, configs: [{name: "codemode", enabled: true}, {name: "bash", enabled: true, permission_policy: {type: "always_ask"}}]}]; every tool not listed, including todo_write, enter_plan_mode, ask_user_question and goal_read, follows default_config, and the response echoes it. codemode runs through bash, so enabling codemode while bash is disabled returns 400. Optional mcp_toolset entries pair with mcp_servers. model accepts platform model IDs such as deepseek-flash, not only the Claude IDs in the protocol examples. model.settings.reasoning sets default thinking; other extra model controls return 400. Example: {"name":"helper","model":{"id":"deepseek-flash"},"tools":[{"type":"agent_toolset_20260401"}]}.',
     http: "POST",
     path: "/agent/v1/agents",
     streaming: "no",
@@ -101,7 +101,7 @@ var operations = [
           type: "array",
           itemType: "object",
           required: false,
-          description: "MCP servers this agent connects to. Maximum 20. Names must be unique\nwithin the array. Every server must be referenced by an `mcp_toolset` in\n`tools`; unreferenced servers are rejected. See the\n[MCP connector guide](https://platform.claude.com/docs/en/managed-agents/mcp-connector)."
+          description: "Praxis extension: HTTP, SSE or trusted stdio MCP servers paired with mcp_toolset entries and saved with the agent version."
         },
         {
           name: "metadata",
@@ -215,7 +215,7 @@ across all toolsets allowed.`
     resource: "agent.agents",
     method: "update",
     summary: "Update agent",
-    description: "Update an agent. Send the current version in the body for optimistic concurrency: a stale version returns 409, and an update that changes nothing keeps the version number. Any real change saves a new version; existing sessions keep the version they were created with. Omitted fields keep their value. multiagent takes null or a coordinator roster; subagent_model keeps its value when omitted and is cleared by null. Archived agents cannot be updated. Unlike Anthropic Managed Agents, nonempty skills attachments and custom tools return 400; use the native skill tool for available runtime skills.",
+    description: "Update an agent. Send the current version in the body for optimistic concurrency: a stale version returns 409, and an update that changes nothing keeps the version number. Any real change saves a new version; existing sessions keep the version they were created with. Omitted fields keep their value. multiagent takes null or a coordinator roster; subagent_model keeps its value when omitted and is cleared by null. Archived agents cannot be updated. Unlike Anthropic Managed Agents, nonempty skills attachments return 400; use the native skill tool for available runtime skills.",
     http: "POST",
     path: "/agent/v1/agents/{agent_id}",
     streaming: "no",
@@ -241,7 +241,7 @@ across all toolsets allowed.`
           type: "array",
           itemType: "object",
           required: false,
-          description: "MCP servers. Full replacement. Omit to preserve; send empty array or\n`null` to clear. Names must be unique. Maximum 20. Every server must be\nreferenced by an `mcp_toolset` in the agent's resulting `tools`; unreferenced\nservers are rejected. See the\n[MCP connector guide](https://platform.claude.com/docs/en/managed-agents/mcp-connector)."
+          description: "Praxis extension: HTTP, SSE or trusted stdio MCP servers paired with mcp_toolset entries and saved with the agent version."
         },
         {
           name: "metadata",
@@ -369,6 +369,189 @@ current version; omit to apply the update unconditionally.`
     ],
     query: []
   },
+  {
+    resource: "agent.agents.endUsers",
+    method: "list",
+    summary: "List End Users",
+    description: `List users who have sessions or token issuance history on a service agent.
+
+Ordered by last_active_at and external_user_id descending. q is a case-sensitive literal prefix, including underscores. limit is 1–100, default 20. Reuse next_page with the same organization, agent, q and limit. Preemptively blocked users without history do not appear. End-user credentials and inaccessible or personal agents return 404.`,
+    http: "GET",
+    path: "/agent/v1/agents/{agent_id}/end_users",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      }
+    ],
+    query: [
+      {
+        name: "limit",
+        type: "integer",
+        required: false,
+        description: "Maximum users per page; defaults to 20."
+      },
+      {
+        name: "page",
+        type: "string",
+        required: false,
+        description: "next_page from the previous response with the same agent, q and limit."
+      },
+      {
+        name: "q",
+        type: "string",
+        required: false,
+        description: "Case-sensitive literal prefix of external_user_id; omit or use an empty string for all users."
+      }
+    ]
+  },
+  {
+    resource: "agent.agents.endUsers",
+    method: "delete",
+    summary: "Delete end-user data",
+    description: `Delete a host application's end-user data from one service agent after explicit confirmation.
+
+Develop only. Set confirm to the exact external_user_id; missing or mismatched confirmation returns 400. Returns 202 with a pending task id, not completion. Poll the deletion endpoint. Concurrent requests reuse the unfinished task; retry DELETE after failure to resume it. Tokens are revoked and the user is blocked before a seven-day recovery snapshot is verified. Sessions including child sessions, conversation data, grants and feedback are then removed. A pre-existing block remains; a temporary block is removed on success. Attachment metadata is recorded and File attachments are retained. No charge is introduced by this operation. Example: DELETE /agent/v1/agents/agent_example/end_users/customer_123?confirm=customer_123.`,
+    http: "DELETE",
+    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      },
+      {
+        name: "external_user_id",
+        sdkName: "external_user_id"
+      }
+    ],
+    query: [
+      {
+        name: "confirm",
+        type: "string",
+        required: true,
+        description: "Must exactly equal the external_user_id path parameter to confirm destructive deletion."
+      }
+    ]
+  },
+  {
+    resource: "agent.agents.endUsers",
+    method: "retrieve",
+    summary: "Get End User",
+    description: `Inspect one end user and their twenty most recently updated sessions.
+
+Use external_user_id from listing or your host application. Users without session or issuance history return 404, including preemptively blocked users. End-user credentials and inaccessible or personal agents return 404.`,
+    http: "GET",
+    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      },
+      {
+        name: "external_user_id",
+        sdkName: "external_user_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.agents.endUsers.block",
+    method: "create",
+    summary: "Block End User",
+    description: `Block token issuance and session creation, then revoke existing tokens for an end user.
+
+May block a user before any history exists; timestamps are then null and counts and cost are zero. Requires an embed policy, otherwise returns 409 with setup guidance. Deduplicates the policy blocklist and retains its 1000-user maximum. If revocation returns 502, the user remains blocked; retry to finish revocation. Repeats keep the user blocked and revoke any remaining grants. End-user credentials and inaccessible or personal agents return 404.`,
+    http: "POST",
+    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/block",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      },
+      {
+        name: "external_user_id",
+        sdkName: "external_user_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.agents.endUsers",
+    method: "retrieveDeletion",
+    summary: "Get end-user deletion",
+    description: `Poll the latest deletion task for an end user, including after the user data has been removed.
+
+Use the same agent_id and external_user_id as the confirmed DELETE. Status is pending, snapshotting, deleting, done or failed. Counts are empty until a verified snapshot exists. A failed task remains blocked and resumes when DELETE is retried with matching confirmation. snapshot_key is an operator recovery reference retained for seven days, not a public download URL. End-user credentials, inaccessible or personal agents, and missing tasks return 404. This read does not create a task or charge usage.`,
+    http: "GET",
+    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/deletion",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      },
+      {
+        name: "external_user_id",
+        sdkName: "external_user_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.agents.endUsers.revokeTokens",
+    method: "create",
+    summary: "Revoke End User Tokens",
+    description: `Revoke all issued tokens for an end user and terminate their open embed streams.
+
+Revokes credentials before marking grants revoked. Upstream failure returns 502 without changing grant revocation timestamps. Returns the count of newly revoked grants; a repeat without new grants returns zero. Does not block future issuance. End-user credentials and inaccessible or personal agents return 404.`,
+    http: "POST",
+    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/revoke_tokens",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      },
+      {
+        name: "external_user_id",
+        sdkName: "external_user_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.agents.endUsers.unblock",
+    method: "create",
+    summary: "Unblock End User",
+    description: `Allow an end user to receive new tokens and create new sessions again.
+
+Removes the user from the blocklist; previously revoked tokens stay revoked. Idempotent. Requires an embed policy, otherwise returns 409 with setup guidance. Returns null timestamps and zero counts and cost when no session or issuance history exists. End-user credentials and inaccessible or personal agents return 404.`,
+    http: "POST",
+    path: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/unblock",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "agent_id",
+        sdkName: "agent_id"
+      },
+      {
+        name: "external_user_id",
+        sdkName: "external_user_id"
+      }
+    ],
+    query: []
+  },
   {
     resource: "agent.agents.versions",
     method: "list",
@@ -580,7 +763,7 @@ Own-face superset: Managed Agents has no persistent Computer attachment director
     summary: "Connect computer",
     description: `Resume the computer and issue a sandbox connection.
 
-Own-face extension: Managed Agents has no persistent Computer connection. Returns the public SDK sandbox_id, envd_access_token and template_id. Archived computers remain accessible; foreign or absent computers return 404. Never cache credentials.`,
+Own-face extension: Managed Agents has no persistent Computer connection. Returns the public SDK sandbox_id, envd_access_token and template_id, plus the machine tier the computer is on now (light or heavy) and the lease that keeps it there (lease_id, lease_expires_at; lease_id is null when no lease exists). Keep the lease while the connection stays open: renew it about every 20 seconds (POST .../leases/{lease_id}/renew) and release it on close (DELETE .../leases/{lease_id}). An unrenewed lease simply expires, and the full machine is reclaimed only after that. Archived computers remain accessible; foreign or absent computers return 404. Never cache credentials.`,
     http: "POST",
     path: "/agent/v1/computers/{computer_id}/connect",
     streaming: "no",
@@ -645,6 +828,52 @@ Praxis extension: MA only has session-scoped temporary containers and memory_sto
       }
     ]
   },
+  {
+    resource: "agent.computers.leases",
+    method: "delete",
+    summary: "Release computer lease",
+    description: `Give the lease back when a connection closes so the full machine can be reclaimed without waiting for it to expire.
+
+Own-face extension. Idempotent: an unknown or already released lease succeeds as well. Foreign or absent computers return 404.`,
+    http: "DELETE",
+    path: "/agent/v1/computers/{computer_id}/leases/{lease_id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "computer_id",
+        sdkName: "computer_id"
+      },
+      {
+        name: "lease_id",
+        sdkName: "lease_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.computers.leases.renew",
+    method: "create",
+    summary: "Renew computer lease",
+    description: `Extend the lease a connection holds so the full machine stays in service while the connection is open.
+
+Own-face extension. A lease that is no longer valid (released, expired, or the computer moved to another machine) returns 409 LEASE_STALE; call connect again for a new connection and lease. Foreign or absent computers return 404.`,
+    http: "POST",
+    path: "/agent/v1/computers/{computer_id}/leases/{lease_id}/renew",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "computer_id",
+        sdkName: "computer_id"
+      },
+      {
+        name: "lease_id",
+        sdkName: "lease_id"
+      }
+    ],
+    query: []
+  },
   {
     resource: "agent.deploymentRuns",
     method: "list",
@@ -1074,6 +1303,43 @@ null to clear. Maximum 50.`
     ],
     query: []
   },
+  {
+    resource: "agent.embed",
+    method: "retrieveAppearance",
+    summary: "Read chat appearance",
+    description: "Load saved appearance for an iframe or Hosted chat page. Supply an end-user embed token as Bearer authorization, or a console-issued publishable key in Praxis-Publishable-Key before anonymous token issuance. The credential selects the agent; identity_number and agent_id query parameters are rejected with 400. Missing appearance returns an empty object. Kit option names retain camelCase. Responses are private and cacheable for 60 seconds. Component hosts configure Kit in their own code instead.",
+    http: "GET",
+    path: "/agent/v1/embed/appearance",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: []
+  },
+  {
+    resource: "agent.embed.exchange",
+    method: "create",
+    summary: "Exchange Hosted Code",
+    description: `Redeem a single-use hosted link credential for an end-user token.
+
+Read code from the c fragment parameter of hosted_url returned by embed token creation with hosted true, then remove the fragment before exchanging. No Authorization header is required; the code authenticates this request. The code expires after 60 seconds and is consumed atomically on exchange, so concurrent attempts have only one winner. Expired, used and unknown codes return the same 404 body. Keep the token in memory and return to the host website for a fresh link when it expires; exchange cannot refresh it. Requests are IP limited per minute using the anonymous entrypoint budget (default 20). Example body is {"code":"<code from hosted_url>"}.`,
+    http: "POST",
+    path: "/agent/v1/embed/exchange",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "code",
+          type: "string",
+          required: true,
+          description: "Single-use credential from the c fragment parameter of hosted_url returned by embed token creation. Valid for 60 seconds."
+        }
+      ]
+    }
+  },
   {
     resource: "agent.embedTokens",
     method: "list",
@@ -1119,7 +1385,7 @@ Includes expired and revoked grants; returns neither token nor token_id. Sorts b
     summary: "Create Embed Token",
     description: `Issue a short-lived credential on your backend for an end user of a service agent.
 
-Requires an active service agent in your organization with an embed policy. Pins the requested version or the latest version and snapshots the policy environment, vaults and resources; metadata comes from the request. Blocked users cannot receive tokens. Keep your API key on the backend and pass only the returned token to the frontend. Every call creates a new grant; issuance is not idempotent. The hosted field is not supported.`,
+Requires an active service agent in your organization with an embed policy. Pins the requested version or the latest version and snapshots the policy environment, vaults and resources; metadata comes from the request. Blocked users cannot receive tokens. Keep your API key on the backend and pass only the returned token to the frontend. Every call creates a new grant; issuance is not idempotent. Set hosted to true to also receive hosted_url; redirect the user there within 60 seconds. The agent must have an identity_number. The URL fragment contains a single-use exchange credential, not the token. Omit hosted or set false for ordinary token issuance.`,
     http: "POST",
     path: "/agent/v1/embed_tokens",
     streaming: "no",
@@ -1129,6 +1395,12 @@ Requires an active service agent in your organization with an embed policy. Pins
     body: {
       required: true,
       fields: [
+        {
+          name: "hosted",
+          type: "boolean",
+          required: false,
+          description: "Set true to also return a hosted chat URL with a single-use credential valid for 60 seconds. Defaults to false; the agent must have an identity_number."
+        },
         {
           name: "agent",
           type: "string",
@@ -1188,6 +1460,37 @@ Requires an active service agent in your organization with an embed policy. Pins
       ]
     }
   },
+  {
+    resource: "agent.embedTokens.anonymous",
+    method: "create",
+    summary: "Issue anonymous visitor token",
+    description: `Obtain a short-lived embedding token for a visitor without an account using the agent owner's publishable key.
+
+No Authorization header is required. Send the browser Origin allowed by the agent policy. Save a returned visitor_secret and reuse it for refreshes; only new visitors receive one. Unknown secrets create new visitors, and extra fields including visitor_id return 400. Issuance uses the key creator's organization membership, the key session budget and the smaller of the policy TTL maximum and 3600 seconds. IP requests are limited per minute (default 20); UTC daily session and spending caps are checked across the key's primary sessions created that day. Token issuance itself does not create a session or charge usage; subsequent sessions bill the host organization. Example body: {"publishable_key":"pk_praxis_example"}.`,
+    http: "POST",
+    path: "/agent/v1/embed_tokens/anonymous",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "publishable_key",
+          type: "string",
+          required: true,
+          description: "Public key created by the service agent owner; safe to include in browser code."
+        },
+        {
+          name: "visitor_secret",
+          type: "string",
+          required: false,
+          description: "Secret returned by a previous anonymous issuance for this key. Omit for a new visitor; an unknown secret creates a new visitor."
+        }
+      ]
+    }
+  },
   {
     resource: "agent.embedTokens.revoke",
     method: "create",
@@ -1492,6 +1795,25 @@ owning account only.`
         type: "string",
         required: false,
         description: "Opaque pagination cursor: pass the next_page value of the previous response unchanged. Omit it for the first page. A cursor from a different query or a malformed one returns 400."
+      },
+      {
+        name: "external_user_id",
+        type: "string",
+        required: false,
+        description: "Filter by an exact end-user identifier (1–128 characters: A-Z, a-z, 0-9, underscore, dot, colon, at sign or hyphen). Keep this filter unchanged when following page."
+      },
+      {
+        name: "source",
+        type: "string",
+        enum: [
+          "kit",
+          "iframe",
+          "hosted",
+          "api",
+          "automation"
+        ],
+        required: false,
+        description: "Filter by session origin: kit, iframe, hosted, api or automation. Keep this filter unchanged when following page."
       }
     ]
   },
@@ -1499,7 +1821,7 @@ owning account only.`
     resource: "agent.sessions",
     method: "create",
     summary: "Create session",
-    description: `Create a session: one conversation with an agent, running on a machine. Pass agent as an agent id (latest version) or {id, version, type:"agent"}. Unlike Anthropic Managed Agents, omit environment_id to get a light machine, unless computer_id (explicit, or the agent's default) selects a Computer; pass environment_id for a sandbox recipe. Optional model must be one of the agent's allowed models; optional thinking is {effort: low|medium|high|xhigh|none} or null, where null inherits the agent default and then the model default (none requires the model to allow disabling thinking). Selections are saved before initial_events run; invalid ones return 400 invalid_request_error. Inline agent overrides are not supported. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. Omitted budget defaults to USD 20; null removes the limit, and a limit object uses a positive integer string of USD cents. Up to 500 file resources can be attached. Use initial_events to send a first user.message in this request, or send messages afterwards with sessions.events.send. The returned status can still be idle before initial events run; read agent.message and the subsequent session.status_idle event to confirm completion.`,
+    description: `Create a session: one conversation with an agent, running on a machine. Pass agent as an agent id (latest version) or {id, version, type:"agent"}. Unlike Anthropic Managed Agents, omit environment_id to get a light machine, unless computer_id (explicit, or the agent's default) selects a Computer; pass environment_id for a sandbox recipe. Optional model must be one of the agent's allowed models; optional thinking is {effort: low|medium|high|xhigh|max|none} or null, where null inherits the agent default and then the model default (none requires the model to allow disabling thinking). Selections are saved before initial_events run; invalid ones return 400 invalid_request_error. Inline agent overrides are not supported. Supports vault_ids, up to 50, owned by the current organization and not archived; credential injection is deferred to a later version. Omitted budget defaults to USD 20; null removes the limit, and a limit object uses a positive integer string of USD cents. Up to 500 file resources can be attached. Use initial_events to send a first user.message in this request, or send messages afterwards with sessions.events.send. The returned status can still be idle before initial events run; read agent.message and the subsequent session.status_idle event to confirm completion.`,
     http: "POST",
     path: "/agent/v1/sessions",
     streaming: "no",
@@ -1872,7 +2194,7 @@ Praxis extension available only on /agent/v1, following Claude Agent SDK getCont
     resource: "agent.sessions.events",
     method: "list",
     summary: "List session events",
-    description: "Read the event history of a session as a page of events, oldest first by default (order=desc for newest first). Use it after sending a message to collect the reply, to find tool calls that wait for approval (session.status_idle with stop_reason requires_action lists their event_ids), or to audit a run; to follow a running session live use sessions.events.stream instead. Filter by types and by a created_at range on processed_at; pages hold at most 100 events (default 20) and next_page continues. A failed run emits session.error before session.status_terminated. Native history also includes user.steer, user.withdraw, system.notification, session.forked, session.goal_changed and session.goal_verification; these are not accepted by the /anthropic/v1 event-type filter.",
+    description: "Read the event history of a session as a page of events, oldest first by default (order=desc for newest first). Use it after sending a message to collect the reply, to find tool calls that wait for approval or client custom tool results (session.status_idle with stop_reason requires_action lists their event_ids), or to audit a run; to follow a running session live use sessions.events.stream instead. Filter by types and by a created_at range on processed_at; pages hold at most 100 events (default 20) and next_page continues. A failed run emits session.error before session.status_terminated. Native history also includes user.steer, user.withdraw, system.notification, session.forked, session.goal_changed and session.goal_verification; these are not accepted by the /anthropic/v1 event-type filter.",
     http: "GET",
     path: "/agent/v1/sessions/{session_id}/events",
     streaming: "no",
@@ -1943,7 +2265,7 @@ Praxis extension available only on /agent/v1, following Claude Agent SDK getCont
     resource: "agent.sessions.events",
     method: "send",
     summary: "Send session events",
-    description: 'Send events to a session: user.message (exactly one nonempty text block), user.interrupt, user.tool_confirmation to allow or deny a pending tool call, user.steer to inject a queued user.message into a turn that is still running, and user.withdraw to retract a queued message. The response only acknowledges the inputs; read replies with sessions.events.list or sessions.events.stream. A message sent while the session waits for tool approval is queued (processed_at null) and runs in order after the approval is resolved. Archived sessions reject new messages. To approve, read a pending agent.tool_use or agent.mcp_tool_use event and send {type: "user.tool_confirmation", tool_use_id: <that event id>, result: "allow"} (or deny); include session_thread_id for a child approval. Native confirmations also accept updated_permissions, answers and annotations, which /anthropic/v1 rejects.',
+    description: 'Attach optional praxis_context={items:[{name,value}]} to user.message for untrusted page context on this turn only (maximum 32 items, 4096 UTF-8 JSON bytes). /anthropic/v1 rejects this field. Send events to a session: user.message (exactly one nonempty text block), user.interrupt, user.tool_confirmation to allow or deny a pending tool call, user.custom_tool_result to return a custom tool result, user.steer to inject a queued user.message into a turn that is still running, and user.withdraw to retract a queued message. The response only acknowledges the inputs; read replies with sessions.events.list or sessions.events.stream. A message sent while the session waits for tool approval is queued (processed_at null) and runs in order after the approval is resolved. Archived sessions reject new messages. To approve, read a pending agent.tool_use or agent.mcp_tool_use event and send {type: "user.tool_confirmation", tool_use_id: <that event id>, result: "allow"} (or deny); include session_thread_id for a child approval. Native confirmations also accept updated_permissions, answers and annotations, which /anthropic/v1 rejects. Both faces accept user.custom_tool_result with custom_tool_use_id from agent.custom_tool_use.id or the requires_action stop_reason.event_ids. Unlike Anthropic, result content accepts only text blocks (omit it for an empty array). Omitted or null is_error means false. The server routes child calls by id; session_thread_id is rejected in this input. Unknown call ids return 400; duplicate results or calls no longer waiting return 409.',
     http: "POST",
     path: "/agent/v1/sessions/{session_id}/events",
     streaming: "no",
@@ -2159,6 +2481,73 @@ Available only on /agent/v1. Use the message_id field from own-face events, not
       }
     ]
   },
+  {
+    resource: "agent.sessions.runs",
+    method: "deleteFeedback",
+    summary: "Delete Run Feedback",
+    description: `Remove the rating and comment for a run.
+
+Own-face extension. Use the session id from session creation or listing and the run_id from its events. Requires a readable session and a run belonging to it. Idempotent; returns 204 even when no feedback exists. End users can delete feedback only for their own sessions. Does not delete the run or messages, enter model context, or start another run.`,
+    http: "DELETE",
+    path: "/agent/v1/sessions/{session_id}/runs/{run_id}/feedback",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "session_id",
+        sdkName: "session_id"
+      },
+      {
+        name: "run_id",
+        sdkName: "run_id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "agent.sessions.runs.feedback",
+    method: "create",
+    summary: "Set Run Feedback",
+    description: `Submit thumbs up or thumbs down for a run, with an optional comment.
+
+Own-face extension. Use a readable session and a run_id from its events. Each submission replaces the previous rating and comment; omitted or null comment clears it, while created_at is preserved. Comments allow at most 2000 Unicode characters. End users can submit only for their own sessions. Feedback never enters model context or starts a run. For example, submit {"rating":"positive","comment":"Helpful"}. POST follows Managed Agents resource update conventions; the resource remains unique per session and run.`,
+    http: "POST",
+    path: "/agent/v1/sessions/{session_id}/runs/{run_id}/feedback",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "session_id",
+        sdkName: "session_id"
+      },
+      {
+        name: "run_id",
+        sdkName: "run_id"
+      }
+    ],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "rating",
+          type: "string",
+          enum: [
+            "positive",
+            "negative"
+          ],
+          required: true,
+          description: "positive means thumbs up; negative means thumbs down for this run."
+        },
+        {
+          name: "comment",
+          type: "string",
+          required: false,
+          description: "Optional comment, at most 2000 Unicode characters. Omit or send null to clear the previous comment."
+        }
+      ]
+    }
+  },
   {
     resource: "agent.sessions.threads",
     method: "list",
@@ -11599,6 +11988,43 @@ for more details.`
     ],
     query: []
   },
+  {
+    resource: "organization.feedback",
+    method: "list",
+    summary: "List your organization's feedback",
+    description: "Feedback submitted by your organization, newest first, with phase and unread state. Filter by phase and search titles and message text (case-insensitive). Page with next_page. Requires a valid API key, Console session, or machine token of the organization.",
+    http: "GET",
+    path: "/organization/v1/feedback",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: [
+      {
+        name: "phase",
+        type: "string",
+        required: false,
+        description: "Only feedback in these phases: a comma-separated list of open, awaiting_customer, in_progress, resolved or closed, for example open,in_progress; see the phase field of a feedback for what each means."
+      },
+      {
+        name: "query",
+        type: "string",
+        required: false,
+        description: "Case-insensitive text matched against titles and message bodies."
+      },
+      {
+        name: "limit",
+        type: "integer",
+        required: false,
+        description: "Items per page, 1 to 100."
+      },
+      {
+        name: "page",
+        type: "string",
+        required: false,
+        description: "Opaque cursor from next_page of the previous response."
+      }
+    ]
+  },
   {
     resource: "organization.feedback",
     method: "create",
@@ -11643,6 +12069,18 @@ for more details.`
           required: false,
           description: "X-Request-Id from the failed response or the related error event ID."
         },
+        {
+          name: "title",
+          type: "string",
+          required: false,
+          description: "Short summary shown in the feedback list; at most 200 Unicode code points."
+        },
+        {
+          name: "type",
+          type: "string",
+          required: false,
+          description: "Feedback type key enabled in the help settings, such as issue, suggestion, billing or other. Unknown or disabled keys are rejected with INVALID_PARAMS."
+        },
         {
           name: "tags",
           type: "object",
@@ -11656,21 +12094,115 @@ for more details.`
           description: "Structured diagnostic context; contexts.praxis can contain session_id, agent_id, model, and request_ids."
         },
         {
-          name: "source",
+          name: "source",
+          type: "string",
+          enum: [
+            "console",
+            "api"
+          ],
+          required: false,
+          description: "Use console for Console reports or api for API callers (default); machine tokens always store codemode regardless of this value."
+        },
+        {
+          name: "attachments",
+          type: "array",
+          itemType: "object",
+          required: false,
+          description: "Up to five attachments; decoded bytes must not exceed 10 MiB per attachment or 20 MiB in total."
+        }
+      ]
+    }
+  },
+  {
+    resource: "organization.feedback.counts",
+    method: "list",
+    summary: "Count your organization's feedback by phase",
+    description: "How many of your organization's feedback are in each phase, for status tabs. Counts never include another organization's feedback.",
+    http: "GET",
+    path: "/organization/v1/feedback/counts",
+    streaming: "no",
+    pagination: false,
+    pathParams: [],
+    query: []
+  },
+  {
+    resource: "organization.feedback",
+    method: "retrieve",
+    summary: "Get one of your organization's feedback",
+    description: "Read one feedback submitted by your organization with its current phase and first-response timing. Another organization's feedback answers 404 FEEDBACK_NOT_FOUND exactly like a missing one.",
+    http: "GET",
+    path: "/organization/v1/feedback/{id}",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "id",
+        sdkName: "id"
+      }
+    ],
+    query: []
+  },
+  {
+    resource: "organization.feedback.messages",
+    method: "list",
+    summary: "List the messages of a feedback",
+    description: "The conversation of one feedback in time order: your messages, support replies and system events. Internal support notes are never returned. Page with next_page.",
+    http: "GET",
+    path: "/organization/v1/feedback/{id}/messages",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "id",
+        sdkName: "id"
+      }
+    ],
+    query: [
+      {
+        name: "limit",
+        type: "integer",
+        required: false,
+        description: "Items per page, 1 to 100."
+      },
+      {
+        name: "page",
+        type: "string",
+        required: false,
+        description: "Opaque cursor from next_page of the previous response."
+      }
+    ]
+  },
+  {
+    resource: "organization.feedback.messages",
+    method: "create",
+    summary: "Reply on a feedback",
+    description: "Add your message to a feedback conversation, for example to answer a question from support. A reply while the phase is awaiting_customer moves it to in_progress and notifies support.",
+    http: "POST",
+    path: "/organization/v1/feedback/{id}/messages",
+    streaming: "no",
+    pagination: false,
+    pathParams: [
+      {
+        name: "id",
+        sdkName: "id"
+      }
+    ],
+    query: [],
+    body: {
+      required: true,
+      fields: [
+        {
+          name: "body",
           type: "string",
-          enum: [
-            "console",
-            "api"
-          ],
-          required: false,
-          description: "Use console for Console reports or api for API callers (default); machine tokens always store codemode regardless of this value."
+          required: true,
+          description: "Markdown text; at most 4096 Unicode code points."
         },
         {
           name: "attachments",
           type: "array",
           itemType: "object",
           required: false,
-          description: "Up to five attachments; decoded bytes must not exceed 10 MiB per attachment or 20 MiB in total."
+          description: "Up to five attachments; decoded bytes must not exceed 10 MiB each or 20 MiB in total."
         }
       ]
     }
@@ -14897,6 +15429,143 @@ var createClient = (config = {}) => {
 var client = createClient(createConfig({ baseUrl: "https://api.deepraxis.com" }));
 
 // ../../packages/sdk/typescript/src/generated/sdk.gen.ts
+var deleteRunFeedback = (options) => (options.client ?? client).delete({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/sessions/{session_id}/runs/{run_id}/feedback",
+  ...options
+});
+var setRunFeedback = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/sessions/{session_id}/runs/{run_id}/feedback",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var listEndUsers = (options) => (options.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/end_users",
+  ...options
+});
+var deleteEndUser = (options) => (options.client ?? client).delete({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}",
+  ...options
+});
+var getEndUser = (options) => (options.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}",
+  ...options
+});
+var getEndUserDeletion = (options) => (options.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/deletion",
+  ...options
+});
+var revokeEndUserTokens = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/revoke_tokens",
+  ...options
+});
+var blockEndUser = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/block",
+  ...options
+});
+var unblockEndUser = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/agents/{agent_id}/end_users/{external_user_id}/unblock",
+  ...options
+});
+var exchangeEmbedCode = (options) => (options.client ?? client).post({
+  url: "/agent/v1/embed/exchange",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
+var createAnonymousEmbedToken = (options) => (options.client ?? client).post({
+  url: "/agent/v1/embed_tokens/anonymous",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
 var listEmbedTokens = (options) => (options?.client ?? client).get({
   security: [{
     key: "BearerAuth",
@@ -15083,6 +15752,32 @@ var connectComputer = (options) => (options.client ?? client).post({
   url: "/agent/v1/computers/{computer_id}/connect",
   ...options
 });
+var renewComputerLease = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/computers/{computer_id}/leases/{lease_id}/renew",
+  ...options
+});
+var releaseComputerLease = (options) => (options.client ?? client).delete({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/agent/v1/computers/{computer_id}/leases/{lease_id}",
+  ...options
+});
 var listToolsets = (options) => (options?.client ?? client).get({
   security: [{
     key: "BearerAuth",
@@ -15208,6 +15903,15 @@ var listSessionCompactions = (options) => (options.client ?? client).get({
   url: "/agent/v1/sessions/{session_id}/compactions",
   ...options
 });
+var getEmbedAppearance = (options) => (options?.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, { name: "Praxis-Publishable-Key", type: "apiKey" }],
+  url: "/agent/v1/embed/appearance",
+  ...options
+});
 var createAudioSpeech = (options) => (options.client ?? client).post({
   security: [{
     key: "BearerAuth",
@@ -15946,6 +16650,19 @@ var countResponseInputTokens = (options) => (options.client ?? client).post({
     ...options.headers
   }
 });
+var listOrganizationFeedback = (options) => (options?.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/organization/v1/feedback",
+  ...options
+});
 var createOrganizationFeedback = (options) => (options.client ?? client).post({
   security: [{
     key: "BearerAuth",
@@ -15963,6 +16680,62 @@ var createOrganizationFeedback = (options) => (options.client ?? client).post({
     ...options.headers
   }
 });
+var getOrganizationFeedbackCounts = (options) => (options?.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/organization/v1/feedback/counts",
+  ...options
+});
+var getOrganizationFeedback = (options) => (options.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/organization/v1/feedback/{id}",
+  ...options
+});
+var listOrganizationFeedbackMessages = (options) => (options.client ?? client).get({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/organization/v1/feedback/{id}/messages",
+  ...options
+});
+var createOrganizationFeedbackMessage = (options) => (options.client ?? client).post({
+  security: [{
+    key: "BearerAuth",
+    scheme: "bearer",
+    type: "http"
+  }, {
+    key: "ApiKeyAuth",
+    name: "X-API-Key",
+    type: "apiKey"
+  }],
+  url: "/organization/v1/feedback/{id}/messages",
+  ...options,
+  headers: {
+    "Content-Type": "application/json",
+    ...options.headers
+  }
+});
 var listOrganizationCosts = (options) => (options.client ?? client).get({
   security: [{
     key: "BearerAuth",
@@ -19715,6 +20488,21 @@ function createAgent(transport) {
     agents: {
       archive: bind(transport, agentsArchive),
       create: bind(transport, agentsCreate),
+      endUsers: {
+        block: {
+          create: bind(transport, blockEndUser)
+        },
+        delete: bind(transport, deleteEndUser),
+        list: bind(transport, listEndUsers),
+        retrieve: bind(transport, getEndUser),
+        retrieveDeletion: bind(transport, getEndUserDeletion),
+        revokeTokens: {
+          create: bind(transport, revokeEndUserTokens)
+        },
+        unblock: {
+          create: bind(transport, unblockEndUser)
+        }
+      },
       list: bind(transport, agentsList),
       retrieve: bind(transport, agentsRetrieve),
       update: bind(transport, agentsUpdate),
@@ -19734,6 +20522,12 @@ function createAgent(transport) {
         list: bind(transport, computersFilesList),
         retrieveContent: bind(transport, computersFilesContent)
       },
+      leases: {
+        delete: bind(transport, releaseComputerLease),
+        renew: {
+          create: bind(transport, renewComputerLease)
+        }
+      },
       list: bind(transport, computersList),
       retrieve: bind(transport, computersRetrieve),
       update: bind(transport, computersUpdate)
@@ -19756,7 +20550,16 @@ function createAgent(transport) {
       },
       update: bind(transport, deploymentsUpdate)
     },
+    embed: {
+      exchange: {
+        create: bind(transport, exchangeEmbedCode)
+      },
+      retrieveAppearance: bind(transport, getEmbedAppearance)
+    },
     embedTokens: {
+      anonymous: {
+        create: bind(transport, createAnonymousEmbedToken)
+      },
       create: bind(transport, createEmbedToken),
       list: bind(transport, listEmbedTokens),
       revoke: {
@@ -19798,6 +20601,12 @@ function createAgent(transport) {
       retrieve: bind(transport, sessionsRetrieve),
       retrieveCompact: bind(transport, getSessionCompaction),
       retrieveContext: bind(transport, getSessionContext),
+      runs: {
+        deleteFeedback: bind(transport, deleteRunFeedback),
+        feedback: {
+          create: bind(transport, setRunFeedback)
+        }
+      },
       threads: {
         archive: bind(transport, aliasOperation(sessionsThreadsArchive, { query: { session_id: "query_session_id" } })),
         events: {
@@ -20272,7 +21081,16 @@ function createOrganization(transport) {
       retrieve: bind(transport, getOrganizationEvent)
     },
     feedback: {
-      create: bind(transport, createOrganizationFeedback)
+      counts: {
+        list: bind(transport, getOrganizationFeedbackCounts)
+      },
+      create: bind(transport, createOrganizationFeedback),
+      list: bind(transport, listOrganizationFeedback),
+      messages: {
+        create: bind(transport, createOrganizationFeedbackMessage),
+        list: bind(transport, listOrganizationFeedbackMessages)
+      },
+      retrieve: bind(transport, getOrganizationFeedback)
     },
     usage: {
       list: bind(transport, listOrganizationUsage)
@@ -22462,7 +23280,7 @@ function startProgress(ctx, write = (text) => writeOutput({ stderr: text })) {
 }
 
 // src/main.ts
-var version = "0.1.0-dev.45dc412";
+var version = "0.1.0-dev.67c7f3b";
 var commands = commandTree(operations);
 var manual = [["login"], ["logout"], ["whoami"], ["org", "list"], ["org", "switch"], ["api"], ["skill"]];
 function route(argv) {

package/package.json

@@ -1,23 +1,15 @@
 {
   "name": "@deepraxis/cli",
-  "version": "0.1.0-dev.45dc412",
+  "version": "0.1.0-dev.67c7f3b",
   "type": "module",
   "bin": {
     "praxis": "dist/praxis.js"
   },
   "description": "The official command line for Praxis (知行云): models, agents, sandboxes, search and data from one terminal.",
   "license": "Apache-2.0",
-  "repository": {
-    "type": "git",
-    "url": "git+https://github.com/Deepraxis/Praxis.git",
-    "directory": "apps/cli"
-  },
   "engines": {
     "node": ">=20"
   },
-  "publishConfig": {
-    "access": "public"
-  },
   "files": [
     "dist",
     "README.md",
@@ -36,5 +28,8 @@
     "ai-agents",
     "claude-code"
   ],
-  "author": "Deepractice"
+  "author": "Deepractice",
+  "publishConfig": {
+    "access": "public"
+  }
 }