@ellipsis-dev/sdk 0.28.0 → 0.30.0

package/dist/index.d.ts

@@ -1,12 +1,127 @@
-import { c as components } from './types-B-jIFh4_.js';
-export { A as AttributionType, a as AutomationConfig, b as AutomationIdentity, B as BudgetConfig, d as BudgetSource, C as ClaudeAssistantEvent, e as ClaudeAssistantMessage, f as ClaudeConfig, g as ClaudeConversationResetEvent, h as ClaudeNativeEvent, i as ClaudeNativeSessionRecord, j as ClaudeNativeUsage, k as ClaudeRateLimitEvent, l as ClaudeRateLimitInfo, m as ClaudeResultEvent, n as ClaudeSessionRecord, o as ClaudeSystemEvent, p as ClaudeUserEvent, q as ClaudeUserMessage, r as CodexAgentMessage, s as CodexAgentMessageItem, t as CodexAppServerError, u as CodexAppServerEvent, v as CodexAppServerItem, w as CodexAppServerNotification, x as CodexAppServerSessionRecord, y as CodexCommandExecution, z as CodexCommandExecutionItem, D as CodexConfig, E as CodexContextCompaction, F as CodexEffortLevel, G as CodexErrorEvent, H as CodexErrorItem, I as CodexErrorParams, J as CodexEvent, K as CodexFileChange, L as CodexFileChangeItem, M as CodexFileUpdate, N as CodexItem, O as CodexItemCompleted, P as CodexItemCompletedEvent, Q as CodexItemParams, R as CodexItemStarted, S as CodexItemStartedEvent, T as CodexItemUpdatedEvent, U as CodexLocalImageInput, V as CodexMcpToolCall, W as CodexMcpToolCallAppContext, X as CodexMcpToolCallError, Y as CodexMcpToolCallItem, Z as CodexMcpToolCallResult, _ as CodexPlan, $ as CodexReasoning, a0 as CodexReasoningItem, a1 as CodexSessionRecord, a2 as CodexTextInput, a3 as CodexThread, a4 as CodexThreadStarted, a5 as CodexThreadStartedEvent, a6 as CodexThreadStartedParams, a7 as CodexThreadTokenUsage, a8 as CodexTodoListItem, a9 as CodexTokenUsageBreakdown, aa as CodexTokenUsageParams, ab as CodexTokenUsageUpdated, ac as CodexTurn, ad as CodexTurnCompleted, ae as CodexTurnCompletedEvent, af as CodexTurnError, ag as CodexTurnFailedEvent, ah as CodexTurnParams, ai as CodexTurnStarted, aj as CodexTurnStartedEvent, ak as CodexUsage, al as CodexUserInput, am as CodexUserMessage, an as CodexWebSearch, ao as CodexWebSearchItem, ap as ComputeConfig, aq as ConfigMetadata, ar as CreateReviewRequest, as as CronTrigger, at as DeltaFrame, au as DoneFrame, av as Duration, aw as EffortLevel, ax as EllipsisGrant, ay as EllipsisPermissions, az as EnvironmentConfig, aA as EnvironmentHooks, aB as EnvironmentImage, aC as EnvironmentSource, aD as EnvironmentVariable, aE as ErrorFrame, aF as ExecutionResult, aG as Finding, aH as GithubAccountFilter, aI as GithubAccountSelector, aJ as GithubAccountSnippet, aK as GithubAccountType, aL as GithubPermissions, aM as Harness, aN as HeartbeatFrame, aO as InputContract, aP as IssueAction, aQ as LegacyAssistantPayload, aR as LegacyNativeUsage, aS as LegacyResultPayload, aT as Level, aU as LifecycleSessionRecord, aV as LinearIssueAction, aW as McpRemoteServer, aX as McpServerRef, aY as McpStdioServer, aZ as MemorySize, a_ as MessageDeliveredPayload, a$ as MessageDeliveredRecord, b0 as MessageReceivedPayload, b1 as MessageReceivedRecord, b2 as MessageRequeuedPayload, b3 as MessageRequeuedRecord, b4 as OutboxCollectedPayload, b5 as OutboxCollectedRecord, b6 as OutputConfig, b7 as ParentKind, b8 as PermissionsConfig, b9 as PlatformSessionRecord, ba as PromptBlockedReason, bb as PullRequestAction, bc as ReactIssue, bd as ReactLinearIssue, be as ReactPullRequest, bf as ReactPush, bg as ReactSentry, bh as ReactSlackChannel, bi as ReactTrigger, bj as RecordsAppendFrame, bk as RepositoryFilter, bl as RepositoryRef, bm as ResolvedReviewScope, bn as Review, bo as ReviewConfiguration, bp as ReviewCounters, bq as ReviewFinding, br as ReviewRequester, bs as ReviewScope, bt as ReviewScopeKind, bu as ReviewStage, bv as ReviewedCommit, bw as ReviewsListResponse, bx as RunStatus, by as SandboxOutputPayload, bz as SandboxOutputRecord, bA as SandboxPhasePayload, bB as SandboxPhaseRecord, bC as SandboxReadyPayload, bD as SandboxReadyRecord, bE as SandboxStartingPayload, bF as SandboxStartingRecord, bG as SdkAssistantRecord, bH as SdkCacheCreation, bI as SdkContentBlock, bJ as SdkRateLimitRecord, bK as SdkRecord, bL as SdkResultRecord, bM as SdkServerToolResultBlock, bN as SdkServerToolUseBlock, bO as SdkSystemRecord, bP as SdkTextBlock, bQ as SdkThinkingBlock, bR as SdkToolResultBlock, bS as SdkToolUseBlock, bT as SdkUserRecord, bU as SendSessionMessageRequest, bV as SentryAction, bW as Session, bX as Session1, bY as SessionAttribution, bZ as SessionAutomation, b_ as SessionBudget, b$ as SessionCancelledPayload, c0 as SessionCancelledRecord, c1 as SessionClosedPayload, c2 as SessionClosedRecord, c3 as SessionConfig, c4 as SessionConfig1, c5 as SessionCost, c6 as SessionEnvironment, c7 as SessionExecution, c8 as SessionExecutionsListResponse, c9 as SessionExitStatus, ca as SessionFrame, cb as SessionGit, cc as SessionGitCommit, cd as SessionGitFile, ce as SessionGitPr, cf as SessionGitRepo, cg as SessionIdlePayload, ch as SessionIdleRecord, ci as SessionLiveness, cj as SessionMessage, ck as SessionMessageImage, cl as SessionMessageResponse, cm as SessionMessageStatus, cn as SessionParent, co as SessionPrompting, cp as SessionRecord, cq as SessionRecordsListResponse, cr as SessionResponse, cs as SessionResumedPayload, ct as SessionResumedRecord, cu as SessionRetryingPayload, cv as SessionRetryingRecord, cw as SessionScheduledPayload, cx as SessionScheduledRecord, cy as SessionSource, cz as SessionStartingPayload, cA as SessionStartingRecord, cB as SessionState, cC as SessionStatus, cD as SessionStopped, cE as SessionStreamFrame, cF as SessionSummary, cG as SessionSurface, cH as SessionTokens, cI as SessionTrigger, cJ as SessionTriggerActor, cK as SessionsListResponse, cL as SettingsRef, cM as SkillRef, cN as SnapshotFrame, cO as StreamFrame, cP as SystemFileRef, cQ as TokensInfo, cR as TurnCompletedPayload, cS as TurnCompletedRecord, cT as TurnFailedPayload, cU as TurnFailedRecord, cV as TurnStartedPayload, cW as TurnStartedRecord, cX as UnknownSessionRecord, cY as paths } from './types-B-jIFh4_.js';
+import { c as components } from './types-DrPhhfOb.js';
+export { A as AgentConfig, a as AgentIdentity, b as AttributionType, B as BudgetConfig, C as ClaudeAssistantEvent, d as ClaudeAssistantMessage, e as ClaudeConfig, f as ClaudeConversationResetEvent, g as ClaudeNativeEvent, h as ClaudeNativeSessionRecord, i as ClaudeNativeUsage, j as ClaudeRateLimitEvent, k as ClaudeRateLimitInfo, l as ClaudeResultEvent, m as ClaudeSessionRecord, n as ClaudeSystemEvent, o as ClaudeUserEvent, p as ClaudeUserMessage, q as CodexAgentMessage, r as CodexAgentMessageItem, s as CodexAppServerError, t as CodexAppServerEvent, u as CodexAppServerItem, v as CodexAppServerNotification, w as CodexAppServerSessionRecord, x as CodexCommandExecution, y as CodexCommandExecutionItem, z as CodexConfig, D as CodexContextCompaction, E as CodexEffortLevel, F as CodexErrorEvent, G as CodexErrorItem, H as CodexErrorParams, I as CodexEvent, J as CodexFileChange, K as CodexFileChangeItem, L as CodexFileUpdate, M as CodexItem, N as CodexItemCompleted, O as CodexItemCompletedEvent, P as CodexItemParams, Q as CodexItemStarted, R as CodexItemStartedEvent, S as CodexItemUpdatedEvent, T as CodexLocalImageInput, U as CodexMcpToolCall, V as CodexMcpToolCallAppContext, W as CodexMcpToolCallError, X as CodexMcpToolCallItem, Y as CodexMcpToolCallResult, Z as CodexPlan, _ as CodexReasoning, $ as CodexReasoningItem, a0 as CodexSessionRecord, a1 as CodexTextInput, a2 as CodexThread, a3 as CodexThreadStarted, a4 as CodexThreadStartedEvent, a5 as CodexThreadStartedParams, a6 as CodexThreadTokenUsage, a7 as CodexTodoListItem, a8 as CodexTokenUsageBreakdown, a9 as CodexTokenUsageParams, aa as CodexTokenUsageUpdated, ab as CodexTurn, ac as CodexTurnCompleted, ad as CodexTurnCompletedEvent, ae as CodexTurnError, af as CodexTurnFailedEvent, ag as CodexTurnParams, ah as CodexTurnStarted, ai as CodexTurnStartedEvent, aj as CodexUsage, ak as CodexUserInput, al as CodexUserMessage, am as CodexWebSearch, an as CodexWebSearchItem, ao as ComputeConfig, ap as ComputeConfig1, aq as ConfigMetadata, ar as ConversationState, as as CreateReviewRequest, at as CronTrigger, au as DeltaFrame, av as DoneFrame, aw as Duration, ax as EffortLevel, ay as EllipsisGrant, az as EllipsisPermissions, aA as EnvironmentBaseBuild, aB as EnvironmentConfig, aC as EnvironmentHooks, aD as EnvironmentHooks1, aE as EnvironmentScript, aF as EnvironmentSource, aG as EnvironmentVariable, aH as ErrorFrame, aI as ExecutionResult, aJ as Finding, aK as GithubAccountFilter, aL as GithubAccountSelector, aM as GithubAccountSnippet, aN as GithubAccountType, aO as GithubIssueEvent, aP as GithubPermissions, aQ as GithubPullRequestEvent, aR as GithubPushEvent, aS as HandlerService, aT as HeartbeatFrame, aU as InputContract, aV as IssueAction, aW as LegacyAssistantPayload, aX as LegacyNativeUsage, aY as LegacyResultPayload, aZ as Level, a_ as LifecycleSessionRecord, a$ as LinearIssueAction, b0 as LinearIssueEvent, b1 as McpRemoteServer, b2 as McpServerRef, b3 as McpStdioServer, b4 as MemorySize, b5 as MessageDeliveredPayload, b6 as MessageDeliveredRecord, b7 as MessageReceivedPayload, b8 as MessageReceivedRecord, b9 as MessageRequeuedPayload, ba as MessageRequeuedRecord, bb as OutboxCollectedPayload, bc as OutboxCollectedRecord, bd as OutputConfig, be as PermissionsConfig, bf as PermissionsConfig1, bg as PlatformSessionRecord, bh as PromptBlockedReason, bi as PullRequestAction, bj as ReactIssue, bk as ReactLinearIssue, bl as ReactPullRequest, bm as ReactPush, bn as ReactSentry, bo as ReactSlackChannel, bp as ReactTrigger, bq as RecordsAppendFrame, br as RepositoryFilter, bs as RepositoryRef, bt as ResolvedReviewScope, bu as Review, bv as ReviewConfiguration, bw as ReviewCounters, bx as ReviewFinding, by as ReviewRequester, bz as ReviewScope, bA as ReviewScopeKind, bB as ReviewStage, bC as ReviewedCommit, bD as ReviewsListResponse, bE as SandboxOutputPayload, bF as SandboxOutputRecord, bG as SandboxPhasePayload, bH as SandboxPhaseRecord, bI as SandboxReadyPayload, bJ as SandboxReadyRecord, bK as SandboxStartingPayload, bL as SandboxStartingRecord, bM as SdkAssistantRecord, bN as SdkCacheCreation, bO as SdkContentBlock, bP as SdkRateLimitRecord, bQ as SdkRecord, bR as SdkResultRecord, bS as SdkServerToolResultBlock, bT as SdkServerToolUseBlock, bU as SdkSystemRecord, bV as SdkTextBlock, bW as SdkThinkingBlock, bX as SdkToolResultBlock, bY as SdkToolUseBlock, bZ as SdkUserRecord, b_ as SendSessionMessageRequest, b$ as SentryAction, c0 as SentryAlertEvent, c1 as Session, c2 as Session1, c3 as SessionAgent, c4 as SessionArchived, c5 as SessionAttribution, c6 as SessionCancelledPayload, c7 as SessionCancelledRecord, c8 as SessionClosedPayload, c9 as SessionClosedRecord, ca as SessionConfig, cb as SessionCost, cc as SessionEnvironment, cd as SessionEventActor, ce as SessionExecution, cf as SessionExecutionResult, cg as SessionExecutionsListResponse, ch as SessionExitStatus, ci as SessionFrame, cj as SessionGit, ck as SessionGitCommit, cl as SessionGitFile, cm as SessionGitPr, cn as SessionGitRepo, co as SessionHandler, cp as SessionIdlePayload, cq as SessionIdleRecord, cr as SessionLifecycle, cs as SessionLifecycleStatus, ct as SessionMessage, cu as SessionMessageImage, cv as SessionMessageResponse, cw as SessionMessageStatus, cx as SessionParent, cy as SessionPrompting, cz as SessionRecord, cA as SessionRecordsListResponse, cB as SessionResponse, cC as SessionResumedPayload, cD as SessionResumedRecord, cE as SessionRetryingPayload, cF as SessionRetryingRecord, cG as SessionScheduledPayload, cH as SessionScheduledRecord, cI as SessionSource, cJ as SessionStartingPayload, cK as SessionStartingRecord, cL as SessionStopped, cM as SessionStreamFrame, cN as SessionSummary, cO as SessionTimestamps, cP as SessionTokens, cQ as SessionsListResponse, cR as SettingsRef, cS as SkillRef, cT as SlackChannelCreatedEvent, cU as SlackMessageEvent, cV as SnapshotFrame, cW as StreamFrame, cX as TokensInfo, cY as TurnCompletedPayload, cZ as TurnCompletedRecord, c_ as TurnFailedPayload, c$ as TurnFailedRecord, d0 as TurnStartedPayload, d1 as TurnStartedRecord, d2 as UnknownSessionRecord, d3 as UpdateSessionRequest, d4 as paths } from './types-DrPhhfOb.js';
 
 /**
- * Frames on /v1/sessions/stream, /v1/automations/stream and /v1/sandboxes/{id}/stream. Ignore unknown frame types.
+ * Frames on /v1/sessions/stream, /v1/agents/stream and /v1/vm-executions/{id}/stream. Ignore unknown frame types.
  */
-type CollectionStreamFrame = SessionListStreamMessage | AutomationListStreamMessage | CollectionStreamHeartbeat | SandboxSnapshotFrame | SandboxUpdateFrame;
-type AttributionType = 'github_user' | 'linear_user' | 'slack_user' | 'api_key';
-type GithubAccountType = 'User' | 'Organization' | 'Bot' | 'Mannequin';
+type CollectionStreamFrame = SessionListStreamMessage | AgentListStreamMessage | CollectionStreamHeartbeat | SandboxSnapshotFrame | SandboxUpdateFrame;
+/**
+ * An agent session: one conversation with an agent, from trigger to
+ * terminal state. Returned by `GET /v1/sessions/{id}` and carried by the
+ * session stream's `session`/`snapshot` frames — REST and stream never
+ * disagree about what a session looks like.
+ */
+type Session = {
+    /**
+     * The agent the session was started from, or null for a raw session started with POST /v1/sessions.
+     */
+    agent: SessionAgent | null;
+    attribution: SessionAttribution;
+    /**
+     * The spend budget enforced for this session, in US dollars, after resolving defaults and ceilings.
+     */
+    budget: number;
+    /**
+     * Claude Code input and native options. Set exactly one of claude_code or codex.
+     */
+    claude_code: ClaudeConfig | null;
+    /**
+     * Codex input and native options. Set exactly one of claude_code or codex.
+     */
+    codex: CodexConfig | null;
+    cost: SessionCost;
+    environment: SessionEnvironment;
+    /**
+     * The typed external event that started the session; null for direct and scheduled starts.
+     */
+    event: (GithubPullRequestEvent | GithubIssueEvent | GithubPushEvent | LinearIssueEvent | SlackMessageEvent | SlackChannelCreatedEvent | SentryAlertEvent) | null;
+    /**
+     * What the session did to git, one entry per repository in its workspace: the commit and branch it sits on, per-file line counts for its uncommitted changes, and the pull requests it opened. Null if nothing was ever captured.
+     */
+    git: SessionGit | null;
+    /**
+     * The saved handler and its effective display name when this session started, frozen at creation. Null for built-in responders, legacy sessions, and sessions started without a handler.
+     */
+    handler: SessionHandler | null;
+    /**
+     * Unique identifier of the session.
+     */
+    id: string;
+    lifecycle: SessionLifecycle;
+    /**
+     * Caller-supplied metadata key-value pairs.
+     */
+    metadata: {
+        [k: string]: string;
+    };
+    /**
+     * The structured-output exit contract for this session.
+     */
+    output: OutputConfig | null;
+    /**
+     * The predecessor session this session continues; null when there is none.
+     */
+    parent: SessionParent | null;
+    permissions: PermissionsConfig1;
+    /**
+     * Skills installed for this session.
+     */
+    skills: SkillRef[];
+    source: SessionSource;
+    /**
+     * The latest live summary of the session's progress while it runs, and when it was generated.
+     */
+    summary: SessionSummary | null;
+    tokens: SessionTokens;
+} & ({
+    claude_code: {
+        [k: string]: unknown;
+    };
+    codex: null;
+} | {
+    claude_code: null;
+    codex: {
+        [k: string]: unknown;
+    };
+});
+/**
+ * What one session runs on: its selected harness, where it runs, what it
+ * may touch, its skills, its exit contract, and its spend cap. Every session
+ * freezes one of these (`sessions.session_config`); an agent
+ * carries one under `session:` (`AgentConfig.session`); and
+ * `POST /v1/sessions` is this shape flattened onto the request body, plus the
+ * run settings. Nothing in here is an agent's identity or trigger —
+ * those belong to `AgentConfig`.
+ *
+ * Field order is the canonical key order for `session:` blocks and YAML
+ * exports: what runs (`claude_code` or `codex`), where (`environment`), what it may
+ * touch (`permissions`), then the rest.
+ */
+type SessionConfig = {
+    budget: BudgetConfig;
+    /**
+     * Claude Code input and native options. Set exactly one of claude_code or codex.
+     */
+    claude_code: ClaudeConfig | null;
+    /**
+     * Codex input and native options. Set exactly one of claude_code or codex.
+     */
+    codex: CodexConfig | null;
+    environment: string | EnvironmentConfig;
+    output: OutputConfig | null;
+    permissions: PermissionsConfig;
+    skills: SkillRef[];
+} & ({
+    claude_code: {
+        [k: string]: unknown;
+    };
+    codex: null;
+} | {
+    claude_code: null;
+    codex: {
+        [k: string]: unknown;
+    };
+});
 type EffortLevel = 'low' | 'medium' | 'high' | 'xhigh' | 'max';
 type CodexEffortLevel = 'none' | 'low' | 'medium' | 'high' | 'xhigh' | 'max';
 /**
@@ -16,21 +131,19 @@ type CodexEffortLevel = 'none' | 'low' | 'medium' | 'high' | 'xhigh' | 'max';
  */
 type Level = 'read' | 'write' | 'delete';
 type GithubAccountFilter = {
-    exclude?: string[];
-    include?: string[] | boolean;
+    exclude: string[];
+    include: string[] | boolean;
 } | boolean | string[];
 type IssueAction = 'opened' | 'closed' | 'commented';
 type RepositoryFilter = {
-    exclude?: string[];
-    include?: string[];
+    exclude: string[];
+    include: string[];
 } | string[];
 type LinearIssueAction = 'opened';
 type PullRequestAction = 'opened' | 'pushed' | 'merged' | 'closed' | 'review_submitted' | 'commented';
 type SentryAction = 'issue_alert' | 'metric_alert';
-/**
- * Where the resolved budget came from.
- */
-type BudgetSource = 'system' | 'account' | 'config' | 'run';
+type AttributionType = 'github_user' | 'linear_user' | 'slack_user' | 'api_key';
+type GithubAccountType = 'User' | 'Organization' | 'Bot' | 'Mannequin';
 /**
  * How a session's environment was chosen. None (the field is nullable)
  * when the config carried an inline environment block and no resolution ran —
@@ -39,61 +152,33 @@ type BudgetSource = 'system' | 'account' | 'config' | 'run';
  * Not derivable from the row: `environment_id` says WHICH environment, not
  * how it was chosen, and is null for the built-in basic sandbox.
  */
-type EnvironmentSource = 'request' | 'automation' | 'repo_default' | 'account_default' | 'platform_default';
+type EnvironmentSource = 'request' | 'agent' | 'repo_default' | 'account_default' | 'platform_default';
 /**
- * Why a terminal agent session ended — a finer-grained reason than `status`.
- *
- * `status` (SessionStatus) is the lifecycle state: COMPLETED / ERROR /
- * CANCELLED. `exit_status` explains *why* a run reached that terminal state, so
- * the UI and metrics can tell a budget cutoff apart from a crashed tool call or
- * a deliberate cancellation. It is None until the run reaches a terminal state.
+ * The service the handler responds to.
  */
-type SessionExitStatus = 'completed' | 'budget_hit' | 'payment_required' | 'tool_call_failed' | 'lifecycle_hook_failed' | 'missing_repo_access' | 'missing_token_permissions' | 'missing_sandbox_variables' | 'blocked' | 'contact_email_required' | 'cancelled' | 'interrupted' | 'error' | 'stopped';
+type HandlerService = 'slack' | 'github' | 'linear' | 'sentry';
 /**
- * The coding-agent harness the session runs on.
+ * Whether the conversation is open or permanently closed. Open does not imply direct messages are permitted.
  */
-type Harness = 'claude_code' | 'codex';
+type ConversationState = 'open' | 'closed';
 /**
- * How a session relates to its predecessor (parent_agent_session_id) —
- * the ONE "preceded-by" chain for every predecessor relationship. Routing
- * reads this when the distinction matters.
- *
- * CONTINUATION — a follow-up in the same conversation surface (e.g. a Slack
- * thread reply spawning a fresh session on the same thread).
- * RESUME — a conversation re-hosted on a new box after its sandbox was torn
- * down (interactive platform; later phase).
+ * Why the last execution ended; completed also includes parking an open conversation.
  */
-type ParentKind = 'continuation' | 'resume';
+type SessionExitStatus = 'completed' | 'budget_hit' | 'payment_required' | 'tool_call_failed' | 'lifecycle_hook_failed' | 'missing_repo_access' | 'missing_token_permissions' | 'missing_sandbox_variables' | 'blocked' | 'contact_email_required' | 'cancelled' | 'interrupted' | 'error' | 'stopped';
 /**
  * Why direct prompting is refused. Absent when prompting is allowed.
  */
 type PromptBlockedReason = 'mention_surface' | 'ephemeral_trigger' | 'non_interactive' | 'harness_single_turn' | 'closed';
 /**
- * Lifecycle of a keyed (multi-turn) session — the durable conversation.
- * Distinct from SessionStatus, which is per-execution (one turn's run) and
- * moves to agent_turns in a later slice. IDLE: alive, waiting for the next
- * message. RUNNING: a turn is executing. CLOSED: the conversation is done and
- * its sandbox/snapshots are torn down.
+ * Canonical current activity. working means a turn is in progress; waiting means the worker is warm and awaiting input; idle means parked. A failed, stopped, or cancelled execution may leave an open conversation.
  */
-type SessionState = 'idle' | 'running' | 'closed';
+type SessionLifecycleStatus = 'scheduled' | 'starting' | 'working' | 'waiting' | 'retrying' | 'idle' | 'closed' | 'failed' | 'stopped' | 'cancelled';
 /**
  * Where the session came from (e.g. react, web, api, cli, mention, cron).
  */
 type SessionSource = 'react' | 'web' | 'api' | 'cli' | 'mention' | 'cron';
 /**
- * Execution status of the session.
- */
-type SessionStatus = 'scheduled' | 'creating_sandbox' | 'running' | 'retrying' | 'completed' | 'error' | 'cancelled' | 'stopped';
-/**
- * What the current (or most recent) execution is doing (backs `run`).
- */
-type RunStatus = 'scheduled' | 'starting' | 'working' | 'waiting' | 'done' | 'failed' | 'stopped' | 'cancelled' | 'retrying';
-/**
- * The durable conversation axis (backs the surfaced `session` field).
- */
-type SessionLiveness = 'alive' | 'idle' | 'closed';
-/**
- * Which writer owns this automation. "github" automations are defined by a file in a repository and are changed by editing that file; "api" automations have no file and are changed through this API.
+ * Which writer owns this agent. "github" agents are defined by a file in a repository and are changed by editing that file; "api" agents have no file and are changed through this API.
  */
 type ConfigManagedBy = 'github' | 'api';
 /**
@@ -102,7 +187,7 @@ type ConfigManagedBy = 'github' | 'api';
  * Rides on `Sandbox.cache_tier` and the sandbox_ready lifecycle record.
  */
 type SandboxCacheTier = 'exact' | 'incremental' | 'full';
-type SandboxSource = 'cli' | 'web_ui' | 'ingest_pull_request_job_run' | 'agent_session' | 'image_refresh' | 'test' | 'script';
+type SandboxSource = 'cli' | 'web_ui' | 'ingest_pull_request_job_run' | 'session' | 'image_refresh' | 'test' | 'script';
 type SandboxStatus = 'scheduled' | 'building' | 'running' | 'released' | 'terminating' | 'terminated' | 'failed';
 type SandboxType = 'claude_code';
 interface SessionListStreamMessage {
@@ -110,136 +195,23 @@ interface SessionListStreamMessage {
     type: 'session';
 }
 /**
- * An agent session: one conversation with an agent, from trigger to
- * terminal state. Returned by `GET /v1/sessions/{id}` and carried by the
- * session stream's `session`/`snapshot` frames — REST and stream never
- * disagree about what a session looks like.
- */
-interface Session {
-    attribution: SessionAttribution;
-    /**
-     * The automation the session was started from, or null for a raw session started with POST /v1/sessions.
-     */
-    automation: SessionAutomation | null;
-    budget: SessionBudget;
-    config: SessionConfig1;
-    /**
-     * The "owner/name" repository context the session was started in, if any.
-     */
-    context_repository: string | null;
-    cost: SessionCost;
-    /**
-     * When the session was created.
-     */
-    created_at: string;
-    environment: SessionEnvironment;
-    /**
-     * How the session ended; null until it is terminal.
-     */
-    exit_status: SessionExitStatus | null;
-    /**
-     * What the session did to git, one entry per repository in its workspace: the commit and branch it sits on, per-file line counts for its uncommitted changes, and the pull requests it opened. Null if nothing was ever captured.
-     */
-    git: SessionGit | null;
-    harness: Harness;
-    /**
-     * Unique identifier of the session.
-     */
-    id: string;
-    /**
-     * When the session last showed activity.
-     */
-    last_activity_at: string | null;
-    /**
-     * When the session last received a message.
-     */
-    last_message_at: string | null;
-    /**
-     * Caller-supplied metadata key-value pairs.
-     */
-    metadata: {
-        [k: string]: string;
-    };
-    parent: SessionParent;
-    /**
-     * The per-session prompt the session was started with.
-     */
-    prompt: string | null;
-    prompting: SessionPrompting;
-    /**
-     * Lifecycle state of the durable conversation, or null for sessions without one.
-     */
-    session_state: SessionState | null;
-    source: SessionSource;
-    status: SessionStatus;
-    /**
-     * Human-readable reason for the current status, when there is one.
-     */
-    status_reason: string | null;
-    stopped: SessionStopped;
-    /**
-     * The latest live summary of the session's progress while it runs, and when it was generated.
-     */
-    summary: SessionSummary | null;
-    surface: SessionSurface;
-    tokens: SessionTokens;
-    /**
-     * The external event that started the session.
-     */
-    trigger: SessionTrigger | null;
-    /**
-     * When the session was last updated.
-     */
-    updated_at: string;
-}
-/**
- * The principal this session is attributed to.
- */
-interface SessionAttribution {
-    /**
-     * Identifier of the principal the session is attributed to.
-     */
-    id: string | null;
-    /**
-     * Kind of principal the session is attributed to (e.g. a GitHub user or an API key).
-     */
-    type: AttributionType | null;
-    /**
-     * The GitHub user the session is attributed to, resolved at read time. Null when the attribution is not a GitHub user.
-     */
-    user: GithubAccountSnippet | null;
-}
-/**
- * Sometimes the GitHub API returns a user of github (can include bots)
- * using this snippet instead of the full GithubAccount model. One example,
- * is when the API returns a pull request.
- *
- * This is the least amount of info we need to represent a GitHub account.
- */
-interface GithubAccountSnippet {
-    avatar_url: string;
-    id: number;
-    login: string;
-    type: GithubAccountType;
-}
-/**
- * The automation this session was started from: the definition frozen
- * when the session was created, and the saved automation it came from as it
+ * The agent this session was started from: the definition frozen
+ * when the session was created, and the saved agent it came from as it
  * exists NOW. They diverge legitimately — a YAML edit after the session
  * started leaves the pointer describing something the session never ran.
  */
-interface SessionAutomation {
-    config: AutomationConfig;
+interface SessionAgent {
+    config: AgentConfig;
     /**
-     * Identifier of the saved automation this session's snapshot was taken from. Null for a routing-file agent, a code-review stage agent, or the built-in mention agent, which have no saved automation behind them. Points at the automation as it exists now, which may have changed since.
+     * Identifier of the saved agent this session's snapshot was taken from. Null for a routing-file agent, a code-review stage agent, or the built-in mention agent, which have no saved agent behind them. Points at the agent as it exists now, which may have changed since.
      */
     id: string | null;
 }
 /**
- * The automation definition the session was started from, frozen when the session was created.
+ * The agent definition the session was started from, frozen when the session was created.
  */
-interface AutomationConfig {
-    ellipsis: AutomationIdentity;
+interface AgentConfig {
+    ellipsis: AgentIdentity;
     input: InputContract | null;
     session: SessionConfig;
     trigger: (CronTrigger | ReactTrigger) | null;
@@ -249,7 +221,7 @@ interface AutomationConfig {
  * (`version`), the human-facing identity (`name`/`description`), freeform
  * organizational `metadata`, and whether the agent is `enabled`. The
  * presence of a top-level `ellipsis:` mapping is what marks a YAML file as
- * an Ellipsis automation (vs arbitrary YAML that merely lives under a
+ * an Ellipsis agent (vs arbitrary YAML that merely lives under a
  * config directory) — see `yaml_is_ellipsis_config`.
  *
  * `enabled` is agent behavior, not freeform metadata, so it stays inside
@@ -257,9 +229,10 @@ interface AutomationConfig {
  * accepts messages is a per-run choice (POST /v1/sessions `interactive`),
  * not a config one.
  */
-interface AutomationIdentity {
+interface AgentIdentity {
     description: string | null;
     enabled: boolean;
+    kind: 'agent';
     metadata: ConfigMetadata;
     name: string | null;
     version: string;
@@ -274,15 +247,15 @@ interface ConfigMetadata {
  * The typed input contract: what goes INTO a session (the trigger is
  * when it happens; this is what goes in).
  *
- * `json_schema` types the payload a caller-started session takes
- * (`POST /v1/sessions` `input`, validated at the door; required when
- * declared). It is illegal on a react-triggered agent — react payloads are
- * platform-shaped (the published surface field sets), not caller-shaped.
+ * `json_schema` validates customer data sent as `input` to
+ * `POST /v1/agents/{id}/sessions` and stored as `session.input`.
+ * Invocations require input when a schema is declared. React agents
+ * cannot declare schemas: the platform defines their event payloads.
  *
  * `message` is the initial-message template: exact `{{path}}` substitution
  * over the caller payload (or, on a react agent, over the surface's
  * published fields), no conditionals/loops/filters. Refs are validated at
- * deploy time against the governing field set (see AutomationConfig's
+ * deploy time against the governing field set (see AgentConfig's
  * `_check_input`).
  */
 interface InputContract {
@@ -291,44 +264,64 @@ interface InputContract {
     } | null;
     message: string | null;
 }
+interface BudgetConfig {
+    day: number | null;
+    month: number | null;
+    session: number | null;
+    week: number | null;
+}
 /**
- * What one session runs on: its selected harness, where it runs, what it
- * may touch, its skills, its exit contract, and its spend cap. Every session
- * freezes one of these (`agent_sessions.session_config`); an automation
- * carries one under `session:` (`AutomationConfig.session`); and
- * `POST /v1/sessions` is this shape flattened onto the request body, plus the
- * run settings. Nothing in here is an automation's identity or trigger —
- * those belong to `AutomationConfig`.
+ * Native Claude Code options for an explicitly selected harness.
+ */
+interface ClaudeConfig {
+    effort: EffortLevel | null;
+    fallback_model: string | null;
+    max_turns: number | null;
+    model: string | null;
+    /**
+     * The initial user message, passed verbatim. Omit to start an interactive session idle.
+     */
+    prompt: string | null;
+    settings: SettingsRef | null;
+}
+/**
+ * A config-declared Claude Code settings.json, resolved at run start and
+ * passed to `claude --settings <path>`. That is the CLI settings tier — BELOW
+ * Ellipsis's managed-settings.json floor — so it customizes behavior (model
+ * permissions, includeCoAuthoredBy, statusLine, ...) but can never weaken a
+ * security setting. Lets a team point the cloud agent at the same settings file
+ * they already use with Claude Code locally instead of re-encoding it as YAML.
+ */
+interface SettingsRef {
+    path: string;
+    repository: RepositoryRef | null;
+}
+interface RepositoryRef {
+    name: string;
+    owner: string | null;
+    ref: string | null;
+}
+/**
+ * Native options supported by the current Codex adapter.
  *
- * Field order is the canonical key order for `session:` blocks and YAML
- * exports: what runs (`harness`, `instructions`), where (`environment`), what it may
- * touch (`permissions`), then the rest.
+ * Options and capabilities expand only when their runtime behavior is tested.
+ * Unknown options are rejected instead of silently ignored.
  */
-interface SessionConfig {
-    budget: BudgetConfig;
-    environment: string | EnvironmentConfig;
+interface CodexConfig {
     /**
-     * The explicitly selected harness and its native options.
+     * Reasoning effort for every turn. Omit to use the model default.
      */
-    harness: ClaudeConfig | CodexConfig;
+    effort: CodexEffortLevel | null;
+    model: string;
     /**
-     * Instructions appended to the harness's own prompt. Text and repository file references are resolved in order.
+     * The initial user message, passed verbatim. Omit to start an interactive session idle.
      */
-    instructions: string | SystemFileRef | (string | SystemFileRef)[];
-    output: OutputConfig | null;
-    permissions: PermissionsConfig;
-    skills: SkillRef[];
-}
-interface BudgetConfig {
-    day: number | null;
-    month: number | null;
-    session: number | null;
-    week: number | null;
+    prompt: string | null;
 }
 /**
  * Everything about the environment (the sandbox) the agent runs in: which
  * `repositories` are cloned into it, which environment `variables` it gets,
- * its `compute` sizing, how its `image` is customized, and lifecycle `hooks`.
+ * its `compute` sizing, and lifecycle `hooks`.
  * What the agent may *do* from that environment is the top-level
  * `permissions:` block, not this one.
  *
@@ -341,7 +334,6 @@ interface BudgetConfig {
 interface EnvironmentConfig {
     compute: ComputeConfig;
     hooks: EnvironmentHooks;
-    image: EnvironmentImage;
     mcp_servers: (string | McpServerRef | McpStdioServer | McpRemoteServer)[];
     repositories: RepositoryRef[];
     variables: EnvironmentVariable[];
@@ -349,7 +341,7 @@ interface EnvironmentConfig {
 /**
  * Sandbox compute sizing. Every field is optional; None inherits the
  * platform default (2 vCPU / 4096 MiB / 3600s — see DEFAULT_SANDBOX_* in
- * models/ellipsis/sandboxes/sandbox.py). A resolved value outside the platform
+ * models/ellipsis/vms/vm_execution.py). A resolved value outside the platform
  * bounds fails validation loudly (a sync error on the config) rather than
  * being clamped silently.
  *
@@ -393,45 +385,58 @@ interface Duration {
     seconds: number | null;
 }
 /**
- * Shell scripts run at points in the sandbox lifecycle, each as the sandbox
- * user with the sandbox's environment variables available. A non-zero exit
- * fails the run (exit_status = LIFECYCLE_HOOK_FAILED) and is not retried.
+ * Environment lifecycle scripts, in order: build_base, after_checkout,
+ * before_start. The first two produce reusable snapshots; before_start runs
+ * before an agent starts or resumes its session. Scripts run as the sandbox
+ * user in /sandbox. A nonzero exit fails the session.
  *
- * `post_start` runs after the container starts, before any repo is cloned —
- * repo-independent setup (authenticate a CLI, e.g. `doppler setup`). On Freestyle
- * the repo is baked into the image so it is incidentally present, but
- * `post_start` must not depend on repo contents (that's `post_clone`).
- *
- * `post_clone` runs after all repos are cloned/checked out, before the agent —
- * repo-dependent setup (`pip install -r requirements.txt`, codegen).
- *
- * Hooks run on every run and their output is never cached. A dependency
- * install whose result should be reused across runs belongs in `image.setup`
- * (baked into the cached image) instead; keep hooks for per-run work — e.g.
- * anything that touches run-scoped credentials.
+ * Legacy post_start/post_clone scripts remain supported for existing configs;
+ * both run after workspace preparation, before the agent starts or resumes.
+ * They cannot be combined with the new lifecycle fields.
  */
 interface EnvironmentHooks {
+    /**
+     * Prepare the requested source revision after Ellipsis checks out all repositories, before saving the prepared sandbox. Skipped when that prepared sandbox is reused.
+     */
+    after_checkout: EnvironmentScript | string | null;
+    /**
+     * Run before the agent starts or resumes a session, after the sandbox is ready. This hook is not cached and adds to session startup time.
+     */
+    before_start: EnvironmentScript | string | null;
+    /**
+     * Build a reusable environment before full checkout. Cached by declared inputs, script, toolchain, resources, and build configuration. A string is shorthand for run with all repositories as inputs.
+     */
+    build_base: EnvironmentBaseBuild | string | null;
+    /**
+     * Legacy session startup script. Use before_start for session setup or after_checkout for cached source preparation.
+     */
     post_clone: string | null;
+    /**
+     * Legacy session startup script. Use before_start in new configurations.
+     */
     post_start: string | null;
 }
 /**
- * How to customize the container image the agent runs in. You
- * contribute appended layers (`dockerfile_append`) and a build-time script
- * (`setup`) only — Ellipsis owns FROM / base tooling / entrypoint / user.
- * Today only inline bodies are supported; a file reference (resolved at the
- * run's SHA) will come later.
- *
- * The split: `dockerfile_append` runs when the image is assembled, before any
- * repo exists — toolchain installs (a package manager binary, apt packages).
- * `setup` runs at image-build time *after* the configured repositories are
- * checked out, and its output is captured by the filesystem snapshot that
- * becomes the cached image — dependency installs (`poetry install`,
- * `npm install`), so later runs start with deps already on disk. Neither runs
- * per run; that's `hooks.post_start` / `hooks.post_clone`.
+ * An inline shell script run as the sandbox user, with /sandbox as cwd.
  */
-interface EnvironmentImage {
-    dockerfile_append: string | null;
-    setup: string | null;
+interface EnvironmentScript {
+    /**
+     * Shell script to run in /sandbox.
+     */
+    run: string;
+}
+/**
+ * Create a reusable base, optionally using only selected repository files.
+ */
+interface EnvironmentBaseBuild {
+    /**
+     * Exact files relative to /sandbox, including the repository name. Only these files are available during build_base and their contents and modes determine reuse. Omit to use all repositories and invalidate on any source change; [] means no repository files.
+     */
+    inputs: string[] | null;
+    /**
+     * Shell script to run in /sandbox.
+     */
+    run: string;
 }
 /**
  * One built-in MCP server this agent opts into by name (`linear`/`slack`).
@@ -448,8 +453,8 @@ interface McpServerRef {
 /**
  * A bring-your-own stdio MCP server: the harness spawns `command` inside
  * the sandbox and speaks JSON-RPC over its stdin/stdout. The command must be
- * runnable in the sandbox image — install its runtime via `image.setup` /
- * `image.dockerfile_append` if the base image lacks it.
+ * runnable in the sandbox image — install its runtime via `hooks.build_base` /
+ * `hooks.after_checkout` if the managed environment lacks it.
  *
  * `env` values may embed `${NAME}` references, resolved at run time from the
  * account's secrets store (see `mcp_secret_refs`); everything else is passed
@@ -476,11 +481,6 @@ interface McpRemoteServer {
     name: string;
     url: string;
 }
-interface RepositoryRef {
-    name: string;
-    owner: string | null;
-    ref: string | null;
-}
 /**
  * One environment variable injected into the agent's sandbox.
  *
@@ -495,47 +495,6 @@ interface EnvironmentVariable {
     name: string;
     value: string | null;
 }
-/**
- * Native Claude Code options for an explicitly selected harness.
- */
-interface ClaudeConfig {
-    effort: EffortLevel | null;
-    fallback_model: string | null;
-    max_turns: number | null;
-    model: string | null;
-    settings: SettingsRef | null;
-    type: 'claude_code';
-}
-/**
- * A config-declared Claude Code settings.json, resolved at run start and
- * passed to `claude --settings <path>`. That is the CLI settings tier — BELOW
- * Ellipsis's managed-settings.json floor — so it customizes behavior (model
- * permissions, includeCoAuthoredBy, statusLine, ...) but can never weaken a
- * security setting. Lets a team point the cloud agent at the same settings file
- * they already use with Claude Code locally instead of re-encoding it as YAML.
- */
-interface SettingsRef {
-    path: string;
-    repository: RepositoryRef | null;
-}
-/**
- * Native options supported by the current Codex adapter.
- *
- * Options and capabilities expand only when their runtime behavior is tested.
- * Unknown options are rejected instead of silently ignored.
- */
-interface CodexConfig {
-    /**
-     * Reasoning effort for every turn. Omit to use the model default.
-     */
-    effort: CodexEffortLevel | null;
-    model: string;
-    type: 'codex';
-}
-interface SystemFileRef {
-    file: string;
-    repository: RepositoryRef | null;
-}
 /**
  * JSON Schema for the harness's structured result, when certified.
  */
@@ -672,83 +631,210 @@ interface ReactSentry {
 interface ReactSlackChannel {
 }
 /**
- * The spend budget enforced for this session.
+ * The principal this session is attributed to.
  */
-interface SessionBudget {
+interface SessionAttribution {
+    /**
+     * Identifier of the principal the session is attributed to.
+     */
+    id: string | null;
+    /**
+     * Kind of principal the session is attributed to (e.g. a GitHub user or an API key).
+     */
+    type: AttributionType | null;
     /**
-     * The spend budget resolved for this session, in cents.
+     * The GitHub user the session is attributed to, resolved at read time. Null when the attribution is not a GitHub user.
      */
-    cents: number;
-    source: BudgetSource;
+    user: GithubAccountSnippet | null;
 }
 /**
- * What one session runs on: its selected harness, where it runs, what it
- * may touch, its skills, its exit contract, and its spend cap. Every session
- * freezes one of these (`agent_sessions.session_config`); an automation
- * carries one under `session:` (`AutomationConfig.session`); and
- * `POST /v1/sessions` is this shape flattened onto the request body, plus the
- * run settings. Nothing in here is an automation's identity or trigger —
- * those belong to `AutomationConfig`.
+ * Sometimes the GitHub API returns a user of github (can include bots)
+ * using this snippet instead of the full GithubAccount model. One example,
+ * is when the API returns a pull request.
  *
- * Field order is the canonical key order for `session:` blocks and YAML
- * exports: what runs (`harness`, `instructions`), where (`environment`), what it may
- * touch (`permissions`), then the rest.
+ * This is the least amount of info we need to represent a GitHub account.
  */
-interface SessionConfig1 {
-    budget: BudgetConfig;
-    environment: string | EnvironmentConfig;
+interface GithubAccountSnippet {
+    avatar_url: string;
+    id: number;
+    login: string;
+    type: GithubAccountType;
+}
+/**
+ * What the session cost, in millicents, broken down by leg and carrying its own total.
+ */
+interface SessionCost {
     /**
-     * The explicitly selected harness and its native options.
+     * Sandbox CPU spend in millicents.
      */
-    harness: ClaudeConfig | CodexConfig;
+    cpu: number;
     /**
-     * Instructions appended to the harness's own prompt. Text and repository file references are resolved in order.
+     * Platform fee in millicents.
      */
-    instructions: string | SystemFileRef | (string | SystemFileRef)[];
-    output: OutputConfig | null;
-    permissions: PermissionsConfig;
-    skills: SkillRef[];
+    fee: number;
+    /**
+     * LLM spend in millicents.
+     */
+    llm: number;
+    /**
+     * Sandbox memory spend in millicents.
+     */
+    memory: number;
+    /**
+     * The grand total in millicents: llm + cpu + memory + fee.
+     */
+    total: number;
+}
+/**
+ * The full environment configuration frozen when the session was created, with the saved environment's id and how it was chosen.
+ */
+interface SessionEnvironment {
+    compute: ComputeConfig1;
+    hooks: EnvironmentHooks1;
+    /**
+     * Identifier of the saved environment the session's config resolved. Null for an inline environment block or the built-in basic sandbox.
+     */
+    id: string | null;
+    mcp_servers: (string | McpServerRef | McpStdioServer | McpRemoteServer)[];
+    repositories: RepositoryRef[];
+    /**
+     * How the environment was chosen (request, agent, platform_default; repo_default and account_default on sessions from before those ladders were removed). An inline request uses request; an inline environment declared in session configuration has no source.
+     */
+    source: EnvironmentSource | null;
+    variables: EnvironmentVariable[];
+}
+/**
+ * Sandbox compute sizing. Every field is optional; None inherits the
+ * platform default (2 vCPU / 4096 MiB / 3600s — see DEFAULT_SANDBOX_* in
+ * models/ellipsis/vms/vm_execution.py). A resolved value outside the platform
+ * bounds fails validation loudly (a sync error on the config) rather than
+ * being clamped silently.
+ *
+ * `memory` and `timeout` each accept a shorthand string ("8GB", "30m") or an
+ * explicit units object ({gb: 8}, {minutes: 30}); the `memory_mib` /
+ * `timeout_seconds` properties resolve either form to the canonical integer
+ * the sandbox driver consumes.
+ *
+ * `timeout` is the max wall-clock the agent may run before its execution is
+ * stopped, capped at 1h (MAX_SANDBOX_TIMEOUT_SECONDS — equal to the default, so
+ * today the knob only shortens a session; the cap matches the 1-hour validity
+ * of the sandbox's GitHub token). The worker's lease/visibility heartbeat
+ * ceiling is derived from that cap, so a run at the max stays owned by its
+ * worker for its whole life.
+ *
+ * Compute currently uses a temporary flat one-cent amount per allocated
+ * execution, subject to the account's existing free-compute exemptions.
+ */
+interface ComputeConfig1 {
+    cpu: number | null;
+    memory: string | MemorySize | null;
+    timeout: string | Duration | null;
 }
 /**
- * What the session cost, in millicents, broken down by leg and carrying its own total.
+ * Environment lifecycle scripts, in order: build_base, after_checkout,
+ * before_start. The first two produce reusable snapshots; before_start runs
+ * before an agent starts or resumes its session. Scripts run as the sandbox
+ * user in /sandbox. A nonzero exit fails the session.
+ *
+ * Legacy post_start/post_clone scripts remain supported for existing configs;
+ * both run after workspace preparation, before the agent starts or resumes.
+ * They cannot be combined with the new lifecycle fields.
  */
-interface SessionCost {
+interface EnvironmentHooks1 {
     /**
-     * Platform fee in millicents.
+     * Prepare the requested source revision after Ellipsis checks out all repositories, before saving the prepared sandbox. Skipped when that prepared sandbox is reused.
      */
-    fee: number;
+    after_checkout: EnvironmentScript | string | null;
     /**
-     * LLM spend in millicents.
+     * Run before the agent starts or resumes a session, after the sandbox is ready. This hook is not cached and adds to session startup time.
      */
-    llm: number;
+    before_start: EnvironmentScript | string | null;
     /**
-     * Sandbox CPU spend in millicents.
+     * Build a reusable environment before full checkout. Cached by declared inputs, script, toolchain, resources, and build configuration. A string is shorthand for run with all repositories as inputs.
      */
-    sandbox_cpu: number;
+    build_base: EnvironmentBaseBuild | string | null;
     /**
-     * Sandbox memory spend in millicents.
+     * Legacy session startup script. Use before_start for session setup or after_checkout for cached source preparation.
      */
-    sandbox_memory: number;
+    post_clone: string | null;
     /**
-     * The grand total in millicents: llm + sandbox_cpu + sandbox_memory + fee.
+     * Legacy session startup script. Use before_start in new configurations.
      */
-    total: number;
+    post_start: string | null;
+}
+interface GithubPullRequestEvent {
+    action: PullRequestAction | 'review_commented';
+    actor: SessionEventActor | null;
+    branch: string;
+    number: number;
+    repository: string;
+    title: string;
+    type: 'github.pull_request';
+    url: string;
 }
 /**
- * The environment the session resolved: the saved environment's id and how it was chosen. The environment's frozen body is `config.environment`.
+ * The event's initiator, when known; never inferred from resource ownership.
  */
-interface SessionEnvironment {
-    /**
-     * Identifier of the saved environment the session's config resolved. Null for an inline environment block or the built-in basic sandbox.
-     */
-    environment_id: string | null;
-    /**
-     * How the environment was chosen (request, automation, platform_default; repo_default and account_default on sessions from before those ladders were removed). Null when the config carried its own inline environment.
-     */
-    source: EnvironmentSource | null;
+interface SessionEventActor {
+    avatar_url: string | null;
+    is_bot: boolean | null;
+    name: string;
+}
+interface GithubIssueEvent {
+    action: IssueAction;
+    actor: SessionEventActor | null;
+    number: number;
+    repository: string;
+    title: string;
+    type: 'github.issue';
+    url: string;
+}
+interface GithubPushEvent {
+    actor: SessionEventActor | null;
+    after: string;
+    before: string;
+    branch: string;
+    repository: string;
+    type: 'github.push';
+    url: string;
+}
+interface LinearIssueEvent {
+    action: LinearIssueAction | 'commented';
+    actor: SessionEventActor | null;
+    identifier: string | null;
+    number: number;
+    title: string;
+    type: 'linear.issue';
+    url: string;
+}
+interface SlackMessageEvent {
+    action: 'message' | 'app_mention';
+    actor: SessionEventActor | null;
+    channel_id: string;
+    channel_name: string | null;
+    message_ts: string;
+    thread_ts: string | null;
+    type: 'slack.message';
+    url: string;
+}
+interface SlackChannelCreatedEvent {
+    actor: SessionEventActor | null;
+    channel_id: string;
+    channel_name: string | null;
+    type: 'slack.channel_created';
+    url: string;
+}
+interface SentryAlertEvent {
+    action: SentryAction;
+    actor: SessionEventActor | null;
+    organization_slug: string;
+    project_slug: string | null;
+    title: string | null;
+    type: 'sentry.alert';
+    url: string | null;
 }
 /**
- * Every repo the session touched. Small enough to ride on `agent_sessions`
+ * Every repo the session touched. Small enough to ride on `sessions`
  * and be returned by every session read.
  */
 interface SessionGit {
@@ -804,24 +890,81 @@ interface SessionGitPr {
     url: string;
 }
 /**
- * What preceded this session, if anything.
+ * The saved handler and its display name when the session started.
  */
-interface SessionParent {
+interface SessionHandler {
     /**
-     * How this session relates to its parent session, if any.
+     * The handler's effective display name when the session started: ellipsis.name, or the service default (Slack, GitHub, Linear, or sentry).
      */
-    kind: ParentKind | null;
+    agent_name: string;
     /**
-     * Identifier of the original session this one was replayed from, if it was started via replay.
+     * Identifier of the saved handler.
      */
-    replayed_from_session_id: string | null;
+    id: string;
+    service: HandlerService;
     /**
-     * Identifier of the parent session that spawned this one, if any.
+     * Content fingerprint of the validated handler configuration used when the session started. This is not the Git commit SHA.
      */
-    session_id: string | null;
+    sha: string;
+}
+/**
+ * The session's activity, conversation state, messaging policy, outcomes, and timestamps.
+ */
+interface SessionLifecycle {
+    /**
+     * When and by whom the session was archived; null when unarchived. Archiving does not stop or close a session.
+     */
+    archived: SessionArchived | null;
+    conversation: ConversationState;
+    /**
+     * Explanation of the current status, when applicable.
+     */
+    detail: string | null;
+    /**
+     * Whether the session stays open after its first turn.
+     */
+    interactive: boolean;
+    /**
+     * The last finished execution's outcome, retained across resumes; null until an outcome has been recorded.
+     */
+    last_execution_result: SessionExecutionResult | null;
+    prompting: SessionPrompting;
+    status: SessionLifecycleStatus;
+    /**
+     * When and by whom a stop was requested; null when no stop is pending for this execution.
+     */
+    stopped: SessionStopped | null;
+    timestamps: SessionTimestamps;
 }
 /**
- * Whether a client may send this session a message and, when it may not, the reason to show instead of a composer.
+ * When the session was archived and the GitHub user who archived it.
+ */
+interface SessionArchived {
+    /**
+     * When the session was archived.
+     */
+    at: string;
+    /**
+     * The GitHub user who archived the session; null if unknown or unavailable.
+     */
+    by: GithubAccountSnippet | null;
+}
+/**
+ * Outcome of the last finished execution, retained across subsequent resumes.
+ *
+ * An execution spans a start or resume through parking or termination, and may
+ * contain several turns. Admission failures also produce a result, even when
+ * provisioning never starts.
+ */
+interface SessionExecutionResult {
+    completion_reason: SessionExitStatus;
+    /**
+     * Human-readable explanation of that outcome.
+     */
+    detail: string | null;
+}
+/**
+ * The session's policy for direct messages. Caller authorization and message validation are checked separately.
  */
 interface SessionPrompting {
     blocked_reason: PromptBlockedReason | null;
@@ -830,21 +973,51 @@ interface SessionPrompting {
     surface_name: string | null;
 }
 /**
- * The stop request, if the session was stopped.
+ * When a stop was requested and the GitHub user who requested it.
  */
 interface SessionStopped {
     /**
-     * When a stop was requested, if one was.
+     * When a stop was requested.
+     */
+    at: string;
+    /**
+     * The GitHub user who stopped the session, resolved at read time. Null if the user is unknown or unavailable.
      */
-    at: string | null;
+    by: GithubAccountSnippet | null;
+}
+interface SessionTimestamps {
+    /**
+     * When the session was created.
+     */
+    created_at: string;
+    /**
+     * When the session last showed agent activity.
+     */
+    last_activity_at: string | null;
     /**
-     * GitHub account id of the user who stopped the session, if known.
+     * When the session last received a message.
+     */
+    last_message_at: string | null;
+    /**
+     * When the session was last updated.
      */
-    by: number | null;
+    updated_at: string;
+}
+/**
+ * The predecessor session this session continues.
+ */
+interface SessionParent {
     /**
-     * The GitHub user who stopped the session, resolved at read time.
+     * Identifier of the predecessor session this session continues, if any.
      */
-    by_user: GithubAccountSnippet | null;
+    session_id: string | null;
+}
+/**
+ * What the session may touch, per minted credential.
+ */
+interface PermissionsConfig1 {
+    ellipsis: (true | 'all') | EllipsisPermissions;
+    github: GithubPermissions;
 }
 /**
  * A live one-line summary of what the session is working on, refreshed
@@ -860,14 +1033,6 @@ interface SessionSummary {
      */
     description: string;
 }
-/**
- * The public status projection: the durable conversation (`session`), the current execution (`run`), and the one derived `status` word.
- */
-interface SessionSurface {
-    run: RunStatus | null;
-    session: SessionLiveness | null;
-    status: string | null;
-}
 /**
  * The tokens the session spent and the model they went to. `total` includes the prompt-cache lanes.
  */
@@ -897,36 +1062,18 @@ interface SessionTokens {
      */
     total: number;
 }
-/**
- * The external event that started a session, without raw webhook payloads.
- */
-interface SessionTrigger {
-    action: string | null;
-    actor: SessionTriggerActor | null;
-    branch: string | null;
-    number: number | null;
-    repository: string | null;
-    surface: string | null;
-    title: string | null;
-    url: string | null;
-}
-interface SessionTriggerActor {
-    avatar_url: string | null;
-    is_bot: boolean;
-    name: string;
-}
-interface AutomationListStreamMessage {
-    automations: Automation[];
-    type: 'automations';
+interface AgentListStreamMessage {
+    agents: Agent[];
+    type: 'agents';
 }
 /**
- * An automation: a saved agent definition that runs on its trigger or
+ * An agent: a saved agent definition that runs on its trigger or
  * when invoked, plus where it syncs from and the state of that sync.
  */
-interface Automation {
-    config: AutomationConfig1;
+interface Agent {
+    config: AgentConfig1;
     /**
-     * When the automation was created.
+     * When the agent was created.
      */
     created_at: string;
     /**
@@ -934,11 +1081,11 @@ interface Automation {
      */
     display_name: string | null;
     /**
-     * The GitHub account that last edited the automation, when the edit came from a known user.
+     * The GitHub account that last edited the agent, when the edit came from a known user.
      */
     edited_by: GithubAccountSnippet | null;
     /**
-     * Unique identifier of the automation.
+     * Unique identifier of the agent.
      */
     id: string;
     /**
@@ -946,24 +1093,24 @@ interface Automation {
      */
     last_session_created_at: string | null;
     /**
-     * The most recent session this automation started, or null if it has never run.
+     * The most recent session this agent started, or null if it has never run.
      */
     last_session_id: string | null;
     /**
-     * The parse or validation error from the most recent sync attempt, or null when it succeeded. A non-null value means the automation is not running the YAML currently on the branch.
+     * The parse or validation error from the most recent sync attempt, or null when it succeeded. A non-null value means the agent is not running the YAML currently on the branch.
      */
     last_sync_error: string | null;
     /**
-     * The last commit the automation was synced from.
+     * The last commit the agent was synced from.
      */
     last_synced_commit_sha: string | null;
     managed_by: ConfigManagedBy;
     /**
-     * The automation's account-unique addressable name (a slug of its display name); usable anywhere an automation is referenced, interchangeably with the id.
+     * The agent's account-unique addressable name (a slug of its display name); usable anywhere an agent is referenced, interchangeably with the id.
      */
     name: string | null;
     /**
-     * The open pull request that adds this automation's file. Non-null means the automation is not live yet: it starts running once the pull request merges and syncs.
+     * The open pull request that adds this agent's file. Non-null means the agent is not live yet: it starts running once the pull request merges and syncs.
      */
     pending_pull_request_url: string | null;
     /**
@@ -971,25 +1118,25 @@ interface Automation {
      */
     sha: string;
     /**
-     * The repository, path, and branch the automation syncs from. Null only transiently, before the creating pull request's file lands on the branch.
+     * The repository, path, and branch the agent syncs from. Null only transiently, before the creating pull request's file lands on the branch.
      */
     source_details: GithubSourceDetails | null;
     /**
-     * When the automation was last updated.
+     * When the agent was last updated.
      */
     updated_at: string;
 }
 /**
- * The automation definition itself, in the same schema as its YAML file: identity, trigger, input contract, and the session block.
+ * The agent definition itself, in the same schema as its YAML file: identity, trigger, input contract, and the session block.
  */
-interface AutomationConfig1 {
-    ellipsis: AutomationIdentity;
+interface AgentConfig1 {
+    ellipsis: AgentIdentity;
     input: InputContract | null;
     session: SessionConfig;
     trigger: (CronTrigger | ReactTrigger) | null;
 }
 /**
- * Identifies the file a GitHub-sourced automation is synced from.
+ * Identifies the file a GitHub-sourced agent is synced from.
  *
  * Keyed on the repository ID (not owner/name) so repository and org renames
  * don't orphan the config; resolve display names from gh_repositories at
@@ -1004,20 +1151,19 @@ interface CollectionStreamHeartbeat {
     type: 'heartbeat';
 }
 interface SandboxSnapshotFrame {
-    sandbox: SandboxResponse;
+    sandbox: VMExecutionResponse;
     type: 'snapshot';
 }
-interface SandboxResponse {
+interface VMExecutionResponse {
     cache_tier: SandboxCacheTier | null;
     cost_sandbox_cpu: number;
     cost_sandbox_memory: number;
     cpu: number;
-    dockerfile: string | null;
     encrypted_ports: number[];
     environment_variable_keys: string[];
     failed_at: string | null;
+    hooks: EnvironmentHooks2;
     id: string;
-    image_setup: string | null;
     memory_mib: number;
     phase_timings: {
         [k: string]: number;
@@ -1037,6 +1183,38 @@ interface SandboxResponse {
     type: SandboxType;
     unencrypted_ports: number[];
 }
+/**
+ * Environment lifecycle scripts, in order: build_base, after_checkout,
+ * before_start. The first two produce reusable snapshots; before_start runs
+ * before an agent starts or resumes its session. Scripts run as the sandbox
+ * user in /sandbox. A nonzero exit fails the session.
+ *
+ * Legacy post_start/post_clone scripts remain supported for existing configs;
+ * both run after workspace preparation, before the agent starts or resumes.
+ * They cannot be combined with the new lifecycle fields.
+ */
+interface EnvironmentHooks2 {
+    /**
+     * Prepare the requested source revision after Ellipsis checks out all repositories, before saving the prepared sandbox. Skipped when that prepared sandbox is reused.
+     */
+    after_checkout: EnvironmentScript | string | null;
+    /**
+     * Run before the agent starts or resumes a session, after the sandbox is ready. This hook is not cached and adds to session startup time.
+     */
+    before_start: EnvironmentScript | string | null;
+    /**
+     * Build a reusable environment before full checkout. Cached by declared inputs, script, toolchain, resources, and build configuration. A string is shorthand for run with all repositories as inputs.
+     */
+    build_base: EnvironmentBaseBuild | string | null;
+    /**
+     * Legacy session startup script. Use before_start for session setup or after_checkout for cached source preparation.
+     */
+    post_clone: string | null;
+    /**
+     * Legacy session startup script. Use before_start in new configurations.
+     */
+    post_start: string | null;
+}
 interface SandboxRepository {
     id: number;
     name: string;
@@ -1055,7 +1233,7 @@ interface SandboxPort {
     unencrypted_port: number | null;
 }
 interface SandboxUpdateFrame {
-    sandbox: SandboxResponse;
+    sandbox: VMExecutionResponse;
     type: 'sandbox';
 }
 
@@ -1139,18 +1317,36 @@ declare class EllipsisAccountApiKeys {
      *
      * Authenticate as a dashboard user or with a user token. An organization
      * API key cannot create other keys. The secret is returned only once.
+     *
+     * Required permissions: write:tokens.
+     * API key: Requires a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     create(options: {
         name: string;
     }): Promise<S['CreateApiKeyResponse']>;
     /**
      * List Api Keys
+     *
+     * Required permissions: read:tokens.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['ListApiKeysResponse']>;
     /**
      * Revoke Api Key
      *
      * Revoke an organization key as a verified GitHub administrator.
+     *
+     * Required permissions: delete:tokens.
+     * API key: Requires a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     revoke(api_key_id: string): Promise<S['TokenRevokedResponse']>;
 }
@@ -1164,6 +1360,12 @@ declare class EllipsisAccountBillingAutoRecharge {
      *
      * An account without saved settings returns disabled defaults and no
      * card. No payment-method identifier or card details are exposed.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(): Promise<S['AutoRechargeSettings']>;
     /**
@@ -1176,6 +1378,12 @@ declare class EllipsisAccountBillingAutoRecharge {
      * with enabled=false keeps recharge off; enabling requires a saved card.
      * A recharge buys amount_cents of credit and charges the platform fee
      * in addition. Amounts and thresholds preserve exact cents.
+     *
+     * Required permissions: write:account.
+     * API key: Requires a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     set(options: {
         amount_cents: number;
@@ -1195,6 +1403,12 @@ declare class EllipsisAccountBilling {
      * Requires a human account administrator. Open the returned URL to
      * finish setup and return to Billing. Saving a card does not enable
      * auto-recharge or buy credit.
+     *
+     * Required permissions: write:account.
+     * API key: Requires a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     cardSetup(): Promise<S['BillingCheckout']>;
     /**
@@ -1206,6 +1420,12 @@ declare class EllipsisAccountBilling {
      * complete payment. Credit is granted only after payment succeeds;
      * the platform fee is charged in addition to amount_cents. Returning
      * to Billing carries the checkout session ID for receipt lookup.
+     *
+     * Required permissions: write:account.
+     * API key: Requires a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     checkout(options: {
         amount_cents: number;
@@ -1217,12 +1437,24 @@ declare class EllipsisAccountBilling {
      * bootstrap that otherwise fires lazily at the first session (Stripe
      * customer + usage subscription + the signup grant). A repeat call is
      * a no-op that returns the current state.
+     *
+     * Required permissions: write:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     claimSignupCredit(): Promise<S['BillingStatus']>;
     /**
      * Get Fee Schedule
      *
      * Get the account's rate card, in US dollars.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     feeSchedule(): Promise<S['FeeScheduleResponse']>;
     /**
@@ -1232,6 +1464,12 @@ declare class EllipsisAccountBilling {
      *
      * Returns only your account's grants. The total is before usage;
      * /v1/account/budget reports the available balance.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     grants(): Promise<S['CreditGrantsResponse']>;
     /**
@@ -1241,6 +1479,12 @@ declare class EllipsisAccountBilling {
      *
      * The amount includes the platform fee and comes from Stripe. An
      * incomplete, missing, or other-account purchase returns 404.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     purchase(checkout_id: string): Promise<S['CreditPurchaseReceipt']>;
     /**
@@ -1250,6 +1494,12 @@ declare class EllipsisAccountBilling {
      *
      * All amounts are integer US cents. The fee is added to the credit
      * amount; it does not reduce the credit granted.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     purchaseOptions(): Promise<S['CreditPurchaseOptions']>;
     /**
@@ -1260,6 +1510,12 @@ declare class EllipsisAccountBilling {
      * Uses the same account gate as session admission, including credit,
      * contact email, and personal Claude subscription eligibility. Scoped
      * spend limits are reported separately by /v1/account/budget.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     status(): Promise<S['BillingStatus']>;
 }
@@ -1279,6 +1535,12 @@ declare class EllipsisAccountModels {
      * Reads the same registry as the dashboard's rate table, so a
      * client's model picker can never drift from what's offered. The
      * selectable set is global; only the flag is account-scoped.
+     *
+     * Required permissions: read:templates.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['ModelsListResponse']>;
 }
@@ -1291,30 +1553,100 @@ declare class EllipsisAccountNotifications {
      * Send the alert email template to one address with sample data,
      * so a typo'd finance alias is caught by a human instead of failing
      * silently when a real alert fires.
+     *
+     * Required permissions: write:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     testEmail(options: {
         email: string;
     }): Promise<S['AccountActionResponse']>;
 }
+declare class EllipsisAccountOnboarding {
+    private readonly transport;
+    constructor(transport: Transport);
+    /**
+     * Get Account Onboarding
+     *
+     * Read the account's saved onboarding answers, or null before setup.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    get(): Promise<S['AccountOnboardingResponse']>;
+    /**
+     * Update Account Onboarding
+     *
+     * Save supplied onboarding answers, preserving omitted answers.
+     *
+     * Organizations can save their work email before selecting use cases.
+     * Saving use cases requires a valid organization work email and at
+     * least one choice. When Other is the only choice, describe it.
+     * Personal accounts save a null work email. This does not change the
+     * billing contact email. Sandbox credentials cannot update answers.
+     * Supplying an organization work email requires a human user and sends
+     * a Slack Connect invitation. Slack failures do not undo saved answers.
+     *
+     * Required permissions: write:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    update(options?: {
+        other_use_case?: string | null;
+        use_cases?: (S['AccountOnboardingUseCase'])[];
+        work_email?: string | null;
+    }): Promise<S['AccountOnboardingResponse']>;
+}
 declare class EllipsisAccountProvidersAnthropic {
     private readonly transport;
     constructor(transport: Transport);
     /**
      * Delete Anthropic Config
+     *
+     * Required permissions: delete:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(): Promise<void>;
     /**
      * Get Anthropic Config
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(): Promise<S['AnthropicConfigResponse']>;
     /**
      * Put Anthropic Config
+     *
+     * Required permissions: write:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     set(options: {
         api_key: string;
     }): Promise<S['AnthropicConfigResponse']>;
     /**
      * Validate Anthropic Config
+     *
+     * Required permissions: write:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     validate(): Promise<S['ValidateAnthropicConfigResponse']>;
 }
@@ -1323,14 +1655,32 @@ declare class EllipsisAccountProvidersBedrock {
     constructor(transport: Transport);
     /**
      * Delete Bedrock Config
+     *
+     * Required permissions: delete:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(): Promise<void>;
     /**
      * Get Bedrock Config
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(): Promise<S['BedrockConfigResponse']>;
     /**
      * Put Bedrock Config
+     *
+     * Required permissions: write:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     set(options: {
         model_map: Record<string, string>;
@@ -1339,6 +1689,12 @@ declare class EllipsisAccountProvidersBedrock {
     }): Promise<S['BedrockConfigResponse']>;
     /**
      * Validate Bedrock Config
+     *
+     * Required permissions: write:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     validate(): Promise<S['ValidateBedrockConfigResponse']>;
 }
@@ -1359,6 +1715,12 @@ declare class EllipsisAccountSettings {
      * Session model and budget defaults, code review and mention behavior,
      * analytics, retention, and notification contacts. PATCH replaces
      * supplied sections; PUT preserves its model-and-budget-only behavior.
+     *
+     * Required permissions: read:defaults.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(): Promise<S['AccountSettings']>;
     /**
@@ -1373,6 +1735,12 @@ declare class EllipsisAccountSettings {
      * ceiling, and null clears it.
      * Refused for sandbox tokens (potentially prompt-injected code must
      * not repoint the organization's defaults).
+     *
+     * Required permissions: write:defaults.
+     * API key: Requires a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     set(options: {
         budget_ceiling?: S['BudgetCeiling'];
@@ -1384,6 +1752,12 @@ declare class EllipsisAccountSettings {
      * Replace supplied settings sections without changing omitted sections.
      *
      * Changes to model or budget defaults require a GitHub administrator.
+     *
+     * Required permissions: write:defaults.
+     * API key: Cannot set budget_ceiling, default_model to a non-null value; those changes require a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator when setting budget_ceiling, default_model to a non-null value.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     update(options?: {
         analytics?: S['AnalyticsSettings'] | null;
@@ -1391,7 +1765,6 @@ declare class EllipsisAccountSettings {
         code_review?: S['CodeReviewSettings'] | null;
         data_retention?: S['DataRetentionSettings'] | null;
         default_model?: string | null;
-        mention?: S['MentionSettings'] | null;
         notifications?: S['NotificationSettings'] | null;
     }): Promise<S['AccountSettings']>;
 }
@@ -1401,6 +1774,7 @@ declare class EllipsisAccount {
     readonly billing: EllipsisAccountBilling;
     readonly models: EllipsisAccountModels;
     readonly notifications: EllipsisAccountNotifications;
+    readonly onboarding: EllipsisAccountOnboarding;
     readonly providers: EllipsisAccountProviders;
     readonly settings: EllipsisAccountSettings;
     constructor(transport: Transport);
@@ -1410,10 +1784,22 @@ declare class EllipsisAccount {
      * All-time per-surface activity flags: the dashboards' demo-data
      * fallback reads these instead of inferring "no history" from a
      * windowed, filtered response.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     activity(): Promise<S['AccountActivity']>;
     /**
      * Get Customer Audit Log
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     auditLog(): Promise<S['AccountAuditLogResponse']>;
     /**
@@ -1424,12 +1810,24 @@ declare class EllipsisAccount {
      * Budgets cover the trailing 1, 7 and 28 days; they do not replenish
      * prepaid credit. Amounts include measured usage from active sessions.
      * Each paid LLM request requires positive credit and budget headroom.
-     * An admitted request can overshoot; concurrency is limited to five
-     * paid requests per account and one per session.
+     * An admitted request can overshoot; concurrent paid requests are limited
+     * by your account and per-session allowances.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     budget(): Promise<S['BudgetSummary']>;
     /**
      * Update Customer
+     *
+     * Required permissions: write:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     update(options?: {
         can_start_job_runs?: boolean | null;
@@ -1447,6 +1845,12 @@ declare class EllipsisAccount {
      * request, including sessions already running. API keys and sandbox
      * credentials cannot edit budgets. The session ceiling remains at
      * /account/settings; purchasing credits is separate from budget policy.
+     *
+     * Required permissions: write:defaults.
+     * API key: Requires a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     updateBudget(options?: {
         alerts?: S['BudgetAlerts'] | null;
@@ -1462,11 +1866,199 @@ declare class EllipsisAccount {
      * rated token usage through BYOK, customer Bedrock, or a developer's
      * Claude subscription. Rated usage estimates are not provider invoices.
      * Pending and unresolved requests identify missing measurements.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     usage(options?: {
         period_start?: string | null;
     }): Promise<S['GetUsageOverTimeResponse']>;
 }
+declare class EllipsisAgents {
+    private readonly transport;
+    constructor(transport: Transport);
+    /**
+     * Create Agent
+     *
+     * Create an agent, managed through the API: no file, live
+     * immediately. To put its definition in a repository instead, create
+     * it here and then POST /v1/agents/{agent_id}/link.
+     *
+     * 409 when another live agent already holds the name.
+     *
+     * Required permissions: write:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    create(options: {
+        agent: S['AgentConfig-Input'];
+    }): Promise<S['AgentResponse']>;
+    /**
+     * Delete Agent
+     *
+     * Delete an agent, by id or by name.
+     *
+     * It stops running and its name is freed immediately; its past
+     * sessions remain readable. Only for agents managed through
+     * this API — delete the file to remove one defined by a repository.
+     *
+     * Required permissions: write:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    delete(agent_id: string): Promise<void>;
+    /**
+     * Get Agent
+     *
+     * Return one agent, by id or by name.
+     *
+     * Required permissions: read:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    get(agent_id: string): Promise<S['AgentResponse']>;
+    /**
+     * Link Agent
+     *
+     * Move an agent into a repository, by id or by name.
+     *
+     * Opens a pull request adding its definition file. The agent
+     * keeps running unchanged meanwhile; merging hands it over to the
+     * file, after which the file is what changes it. Nothing happens
+     * if the pull request is never merged.
+     *
+     * Required permissions: write:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    link(agent_id: string, options: {
+        path?: string | null;
+        repository: string;
+    }): Promise<S['LinkAgentResponse']>;
+    /**
+     * List Agents
+     *
+     * List agents.
+     *
+     * Required permissions: read:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    list(): Promise<S['AgentsListResponse']>;
+    /**
+     * Get Agent Metrics
+     *
+     * Return an agent's session distribution and trailing spend,
+     * by id or by name.
+     *
+     * `samples` carries one entry per finished session (duration, cost,
+     * tokens) for distributions; `spend_windows` carries what the
+     * agent's sessions cost over the last 1, 7, and 28 days against
+     * its budget for each window.
+     *
+     * Required permissions: read:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    metrics(agent_id: string): Promise<S['AgentMetricsResponse']>;
+    /**
+     * Start Agent Session
+     *
+     * Invoke an agent.
+     *
+     * Runs a certified agent with its configured instructions, model,
+     * environment, permissions, skills, and budget, and returns
+     * the session it started. The session runs once and does not accept
+     * follow-up messages. If the agent declares input.json_schema,
+     * send only `input` for its initial message. Otherwise send a non-empty
+     * `prompt`, which becomes the initial message verbatim. Both fields
+     * together, neither field, and input that renders an empty message are
+     * rejected with 422. An optional `budget` lowers the session cap;
+     * `metadata` tags the session. Codex invocations are not supported.
+     *
+     * Required permissions: write:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    run(agent_id: string, options?: {
+        budget?: number | null;
+        input?: Record<string, unknown> | null;
+        metadata?: Record<string, string>;
+        prompt?: string | null;
+    }): Promise<S['SessionResponse']>;
+    /**
+     * Get Agents Stream Ticket
+     *
+     * Required permissions: read:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    streamTicket(): Promise<S['StreamTicketResponse']>;
+    /**
+     * Unlink Agent
+     *
+     * Take over an agent from its file, by id or by name.
+     *
+     * The file stops governing it immediately and further changes go
+     * through this API. The file is left in place, inert — delete it
+     * whenever you like.
+     *
+     * Required permissions: write:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    unlink(agent_id: string): Promise<S['AgentResponse']>;
+    /**
+     * Update Agent
+     *
+     * Replace an agent's definition, by id or by name.
+     *
+     * The whole definition is replaced, and the change is live at
+     * once. Only for agents managed through this API: one defined
+     * by a repository file is a 409, since the next push to that file
+     * would revert the change — unlink it first to take ownership.
+     *
+     * Required permissions: write:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    update(agent_id: string, options: {
+        agent: S['AgentConfig-Input'];
+    }): Promise<S['AgentResponse']>;
+}
 declare class EllipsisAlerts {
     private readonly transport;
     constructor(transport: Transport);
@@ -1476,6 +2068,12 @@ declare class EllipsisAlerts {
      * Dismiss an open alert and return it.
      *
      * 409 when the alert is not open; 404 when it doesn't exist.
+     *
+     * Required permissions: write:alerts.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     dismiss(alert_id: string): Promise<S['AlertResponse']>;
     /**
@@ -1484,6 +2082,12 @@ declare class EllipsisAlerts {
      * Return one alert by id.
      *
      * 404 if it doesn't exist or belongs to another organization.
+     *
+     * Required permissions: read:alerts.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(alert_id: string): Promise<S['AlertResponse']>;
     /**
@@ -1495,6 +2099,12 @@ declare class EllipsisAlerts {
      *
      * Available to all credential types, so an agent can check "is
      * this org near budget?" mid-task.
+     *
+     * Required permissions: read:alerts.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(options?: {
         status?: S['AlertStatus'] | null;
@@ -1518,6 +2128,12 @@ declare class EllipsisAnalytics {
      * the apps/agents). Available to all credential types: the
      * responses expose the organization's own GitHub PR/review activity,
      * no secrets.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     metrics(options?: {
         days?: number | null;
@@ -1535,6 +2151,12 @@ declare class EllipsisAnalytics {
      *
      * Windowing: pass explicit start/end, or days (default: the last
      * 30 days). account_type in all|user|bot scopes the authors.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     pullRequests(options?: {
         days?: number | null;
@@ -1554,6 +2176,12 @@ declare class EllipsisAnalytics {
      * review the most PRs?" is the reviewer facets here with
      * account_type=bot. Windowing: pass explicit start/end, or days
      * (default: the last 30 days).
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     reviews(options?: {
         days?: number | null;
@@ -1574,6 +2202,8 @@ declare class EllipsisAuthCli {
      * Poll a device-code auth flow for its token.
      *
      * Unauthenticated; the device code identifies the flow.
+     *
+     * Authentication: No token required.
      */
     poll(options: {
         device_code: string;
@@ -1586,6 +2216,8 @@ declare class EllipsisAuthCli {
      * Unauthenticated: the CLI has no credential yet — that's what
      * it's obtaining. The human authorizes out-of-band in the
      * dashboard.
+     *
+     * Authentication: No token required.
      */
     start(): Promise<S['StartCliAuthResponse']>;
 }
@@ -1594,118 +2226,6 @@ declare class EllipsisAuth {
     readonly cli: EllipsisAuthCli;
     constructor(transport: Transport);
 }
-declare class EllipsisAutomations {
-    private readonly transport;
-    constructor(transport: Transport);
-    /**
-     * Create Automation
-     *
-     * Create an automation, managed through the API: no file, live
-     * immediately. To put its definition in a repository instead, create
-     * it here and then POST /v1/automations/{automation_id}/link.
-     *
-     * 409 when another live automation already holds the name.
-     */
-    create(options: {
-        automation: S['AutomationConfig'];
-    }): Promise<S['AutomationResponse']>;
-    /**
-     * Delete Automation
-     *
-     * Delete an automation, by id or by name.
-     *
-     * It stops running and its name is freed immediately; its past
-     * sessions remain readable. Only for automations managed through
-     * this API — delete the file to remove one defined by a repository.
-     */
-    delete(automation_id: string): Promise<void>;
-    /**
-     * Get Automation
-     *
-     * Return one automation, by id or by name.
-     */
-    get(automation_id: string): Promise<S['AutomationResponse']>;
-    /**
-     * Link Automation
-     *
-     * Move an automation into a repository, by id or by name.
-     *
-     * Opens a pull request adding its definition file. The automation
-     * keeps running unchanged meanwhile; merging hands it over to the
-     * file, after which the file is what changes it. Nothing happens
-     * if the pull request is never merged.
-     */
-    link(automation_id: string, options: {
-        path?: string | null;
-        repository: string;
-    }): Promise<S['LinkAutomationResponse']>;
-    /**
-     * List Automations
-     *
-     * List automations.
-     */
-    list(): Promise<S['AutomationsListResponse']>;
-    /**
-     * Get Automation Metrics
-     *
-     * Return an automation's session distribution and trailing spend,
-     * by id or by name.
-     *
-     * `samples` carries one entry per finished session (duration, cost,
-     * tokens) for distributions; `spend_windows` carries what the
-     * automation's sessions cost over the last 1, 7, and 28 days against
-     * its budget for each window.
-     */
-    metrics(automation_id: string): Promise<S['AutomationMetricsResponse']>;
-    /**
-     * Start Automation Session
-     *
-     * Invoke an automation.
-     *
-     * Runs a certified automation with its configured instructions, model,
-     * environment, permissions, skills, and budget, and returns
-     * the session it started. The session runs once and does not accept
-     * follow-up messages. If the automation declares input.json_schema,
-     * send only `input` for its initial message. Otherwise send a non-empty
-     * `prompt`, which becomes the initial message verbatim. Both fields
-     * together, neither field, and input that renders an empty message are
-     * rejected with 422. An optional `budget` lowers the session cap;
-     * `metadata` tags the session. Codex invocations are not supported.
-     */
-    run(automation_id: string, options?: {
-        budget?: number | null;
-        input?: Record<string, unknown> | null;
-        metadata?: Record<string, string>;
-        prompt?: string | null;
-    }): Promise<S['SessionResponse']>;
-    /**
-     * Get Automations Stream Ticket
-     */
-    streamTicket(): Promise<S['StreamTicketResponse']>;
-    /**
-     * Unlink Automation
-     *
-     * Take over an automation from its file, by id or by name.
-     *
-     * The file stops governing it immediately and further changes go
-     * through this API. The file is left in place, inert — delete it
-     * whenever you like.
-     */
-    unlink(automation_id: string): Promise<S['AutomationResponse']>;
-    /**
-     * Update Automation
-     *
-     * Replace an automation's definition, by id or by name.
-     *
-     * The whole definition is replaced, and the change is live at
-     * once. Only for automations managed through this API: one defined
-     * by a repository file is a 409, since the next push to that file
-     * would revert the change — unlink it first to take ownership.
-     */
-    update(automation_id: string, options: {
-        automation: S['AutomationConfig'];
-    }): Promise<S['AutomationResponse']>;
-}
 declare class EllipsisEnvironments {
     private readonly transport;
     constructor(transport: Transport);
@@ -1717,9 +2237,15 @@ declare class EllipsisEnvironments {
      * `kind: environment` YAML under an agents directory.
      *
      * 409 when another live environment already holds the name.
+     *
+     * Required permissions: write:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     create(options: {
-        environment: S['EnvironmentDocument'];
+        environment: S['EnvironmentDocument-Input'];
     }): Promise<S['EnvironmentResponse']>;
     /**
      * Delete Environment
@@ -1731,18 +2257,36 @@ declare class EllipsisEnvironments {
      * environment. Past sessions remain readable. Only for environments
      * managed through this API — delete the file to remove one defined
      * by a repository.
+     *
+     * Required permissions: delete:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(environment_id: string): Promise<void>;
     /**
      * Get Environment
      *
      * Return one saved environment, by id or by name.
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(environment_id: string): Promise<S['EnvironmentResponse']>;
     /**
      * List Environments
      *
      * List saved environments.
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['EnvironmentsListResponse']>;
     /**
@@ -1754,9 +2298,15 @@ declare class EllipsisEnvironments {
      * resolve the new body; running sessions keep the one frozen at
      * their start. Only for environments managed through this API: one
      * defined by a repository file is a 409.
+     *
+     * Required permissions: write:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     update(environment_id: string, options: {
-        environment: S['EnvironmentDocument'];
+        environment: S['EnvironmentDocument-Input'];
     }): Promise<S['EnvironmentResponse']>;
 }
 declare class EllipsisFiles {
@@ -1772,6 +2322,13 @@ declare class EllipsisFiles {
      * agent persisting a screenshot to link on a PR), but all
      * credential types work. Returns the org-membership-gated
      * dashboard URL so callers never hard-code URL shapes.
+     *
+     * Required permissions: write:files.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     create(options: {
         content_type: string;
@@ -1789,6 +2346,13 @@ declare class EllipsisFiles {
      * potentially-untrusted code and must not be able to destroy the
      * account's files — uploading is fine, destruction is not); API
      * keys and user tokens may delete.
+     *
+     * Required permissions: delete:files.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     delete(file_id: string): Promise<void>;
     /**
@@ -1807,6 +2371,13 @@ declare class EllipsisFiles {
      * To fetch the bytes locally, call this and then GET download_url
      * immediately — the JSON API never carries the file. The CLI's
      * `agent file get` wraps exactly that two-step.
+     *
+     * Required permissions: read:files.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     get(file_id: string): Promise<S['GetFileResponse']>;
     /**
@@ -1818,6 +2389,13 @@ declare class EllipsisFiles {
      * a download_urls map keyed by file id for thumbnails or batch
      * downloads. URLs expire within about a minute. session_id scopes
      * the list to one session's uploads.
+     *
+     * Required permissions: read:files.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     list(options?: {
         session_id?: string | null;
@@ -1826,6 +2404,61 @@ declare class EllipsisFiles {
         include_download_urls?: boolean;
     }): Promise<Page<S['File'], S['FilesListResponse']>>;
 }
+declare class EllipsisHandlers {
+    private readonly transport;
+    constructor(transport: Transport);
+    /**
+     * List Handlers
+     *
+     * List the account's Slack, GitHub, Linear, and Sentry handlers.
+     *
+     * Returns at most one handler per service, from the current .ellipsis
+     * repository. Disabled handlers and last valid definitions with sync
+     * errors are included. Missing handlers are omitted. This reads saved
+     * state without fetching GitHub or triggering synchronization.
+     *
+     * Requires configs:read; scoped grants match handlers/{service}.
+     * Sandbox credentials with that grant may read handlers.
+     *
+     * Required permissions: read:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    list(): Promise<S['HandlersListResponse']>;
+    /**
+     * Get Handler Metrics
+     *
+     * Return session counts and accumulated spend for a saved handler.
+     *
+     * Filters only by session creation time. Omitted bounds include all
+     * history. Counts use the current conversation outcome, so an idle
+     * session remains active. Spend includes the selected sessions' full
+     * accumulated cost, including activity after the creation-time window.
+     * Only sessions carrying this exact saved handler id are counted;
+     * legacy sessions without handler provenance are excluded.
+     *
+     * spend_windows reports current trailing 1-, 7-, and 28-day credit
+     * debits and effective handler budgets across all attributed sessions.
+     * Those windows use usage timestamps and are independent of start/end.
+     *
+     * Requires configs:read matching handlers/{service} and unrestricted
+     * sessions:read. Sandbox tokens with both grants may read metrics.
+     *
+     * Required permissions: read:sessions, read:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    metrics(handler_id: string, options?: {
+        start?: string | null;
+        end?: string | null;
+    }): Promise<S['HandlerMetricsResponse']>;
+}
 declare class EllipsisIntegrationsGithub {
     private readonly transport;
     constructor(transport: Transport);
@@ -1839,16 +2472,34 @@ declare class EllipsisIntegrationsGithub {
      *
      * Members carry their linked Slack identity when a Slack-GitHub
      * link exists, and /slack/members carries the reverse link.
+     *
+     * Required permissions: read:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     members(): Promise<S['GithubMembersListResponse']>;
     /**
      * List Github Repositories
      *
      * List GitHub repositories connected to the installation.
+     *
+     * Required permissions: read:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     repos(): Promise<S['GithubRepositoriesListResponse']>;
     /**
      * Uninstall Github App
+     *
+     * Required permissions: write:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     uninstall(options: {
         confirm_account_login: string;
@@ -1859,16 +2510,34 @@ declare class EllipsisIntegrationsLinear {
     constructor(transport: Transport);
     /**
      * Delete Linear Integration
+     *
+     * Required permissions: delete:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(): Promise<S['AccountActionResponse']>;
     /**
      * List Linear Teams
      *
      * List the teams of the connected Linear workspace.
+     *
+     * Required permissions: read:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     teams(): Promise<S['LinearTeamsListResponse']>;
     /**
      * Update Linear Teams
+     *
+     * Required permissions: write:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     updateSettings(options: {
         mcp_inclusion?: S['McpInclusionMode'] | null;
@@ -1880,12 +2549,24 @@ declare class EllipsisIntegrationsSentry {
     constructor(transport: Transport);
     /**
      * Delete Sentry Integration
+     *
+     * Required permissions: delete:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(integration_id: string): Promise<S['AccountActionResponse']>;
     /**
      * List Sentry Organizations
      *
      * List the connected Sentry organizations.
+     *
+     * Required permissions: read:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     organizations(): Promise<S['SentryOrganizationsListResponse']>;
 }
@@ -1897,14 +2578,32 @@ declare class EllipsisIntegrationsSlack {
      *
      * List the channels of the connected Slack workspace, fetched
      * live from the Slack API.
+     *
+     * Required permissions: read:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     channels(): Promise<S['SlackChannelsListResponse']>;
     /**
      * Create Operations Channel
+     *
+     * Required permissions: write:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     createOperationsChannel(): Promise<S['SlackChannel']>;
     /**
      * Delete Slack Integration
+     *
+     * Required permissions: delete:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(): Promise<S['AccountActionResponse']>;
     /**
@@ -1912,10 +2611,22 @@ declare class EllipsisIntegrationsSlack {
      *
      * List the members of the connected Slack workspace, fetched
      * live from the Slack API.
+     *
+     * Required permissions: read:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     members(): Promise<S['SlackMembersListResponse']>;
     /**
      * Update Slack Settings
+     *
+     * Required permissions: write:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     updateSettings(options: {
         mcp_inclusion: S['McpInclusionMode'];
@@ -1935,10 +2646,16 @@ declare class EllipsisIntegrations {
      *
      * A read-only view, so an agent authoring another agent's
      * config can learn which repositories, channels, teams, and
-     * organizations it may name before POST /automations.
+     * organizations it may name before POST /agents.
      *
      * Available to all credential types including sandbox tokens: the
      * responses never include OAuth tokens or any other secret.
+     *
+     * Required permissions: read:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['GetIntegrationsResponse']>;
 }
@@ -1957,6 +2674,13 @@ declare class EllipsisMemories {
      *
      * Creating never overwrites: a path that already exists is a 409, so
      * correcting an existing memory is an explicit edit.
+     *
+     * Required permissions: write:memories.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     create(options: {
         content: string;
@@ -1971,6 +2695,13 @@ declare class EllipsisMemories {
      * Available to every credential type, agents included — a wrong
      * memory is worse than a missing one. The deleted content is kept in
      * the memory's history for forensics, not for an undo API.
+     *
+     * Required permissions: delete:memories.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     delete(memory_id: string, options?: {
         if_sha256?: string | null;
@@ -1986,6 +2717,13 @@ declare class EllipsisMemories {
      *
      * Pass `if_sha256` (from a previous read) to make a concurrent write
      * a 409 instead of silently overwriting it.
+     *
+     * Required permissions: write:memories.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     edit(memory_id: string, options?: {
         content?: string | null;
@@ -1998,6 +2736,13 @@ declare class EllipsisMemories {
      * Read one memory's full content.
      *
      * The id comes from the index returned by listing memories.
+     *
+     * Required permissions: read:memories.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     get(memory_id: string): Promise<S['MemoryResponse']>;
     /**
@@ -2009,6 +2754,13 @@ declare class EllipsisMemories {
      * memory, carrying its id, path, and description) plus the same
      * entries structured, each with every field except `content`. Read
      * the index, then fetch the ids whose content you want.
+     *
+     * Required permissions: read:memories.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     list(options?: {
         prefix?: string | null;
@@ -2019,6 +2771,12 @@ declare class EllipsisReviews {
     constructor(transport: Transport);
     /**
      * List Review Configs
+     *
+     * Required permissions: read:reviews.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     configs(): Promise<S['GetCodeReviewConfigsResponse']>;
     /**
@@ -2036,6 +2794,12 @@ declare class EllipsisReviews {
      * `stages[].session_id` is where a client streams
      * (/sessions/{id}/stream on a stage session), since the review
      * itself is a pipeline rather than one process.
+     *
+     * Required permissions: write:reviews.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     create(options: {
         owner: string;
@@ -2055,6 +2819,12 @@ declare class EllipsisReviews {
      * Findings only exist after a stage session finalizes — a running
      * review honestly reports [] / null, which is why a client
      * streams a stage session and then re-fetches the review.
+     *
+     * Required permissions: read:reviews.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(review_id: string): Promise<S['Review']>;
     /**
@@ -2069,6 +2839,12 @@ declare class EllipsisReviews {
      *
      * Webhook-created reviews appear here too, so this answers "show
      * me every review on this PR".
+     *
+     * Required permissions: read:reviews.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(options?: {
         repository?: (string)[];
@@ -2080,22 +2856,6 @@ declare class EllipsisReviews {
         cursor?: string | null;
     }): Promise<Page<S['Review'], S['ReviewsListResponse']>>;
 }
-declare class EllipsisSandboxes {
-    private readonly transport;
-    constructor(transport: Transport);
-    /**
-     * Get Single Sandbox
-     */
-    get(sandbox_id: string): Promise<S['SandboxResponse']>;
-    /**
-     * Get Sandboxes
-     */
-    list(): Promise<void>;
-    /**
-     * Get Sandbox Stream Ticket
-     */
-    streamTicket(sandbox_id: string): Promise<S['StreamTicketResponse']>;
-}
 declare class EllipsisSecrets {
     private readonly transport;
     constructor(transport: Transport);
@@ -2106,6 +2866,13 @@ declare class EllipsisSecrets {
      *
      * Refused for sandbox tokens; mutations require an API key or
      * user token.
+     *
+     * Required permissions: delete:secrets.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     delete(name: string): Promise<void>;
     /**
@@ -2115,6 +2882,13 @@ declare class EllipsisSecrets {
      *
      * Values are write-only: the response carries only names and
      * timestamps, never the stored value.
+     *
+     * Required permissions: read:secrets.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     list(): Promise<S['SecretsListResponse']>;
     /**
@@ -2126,6 +2900,13 @@ declare class EllipsisSecrets {
      * only — values are write-only. Refused for sandbox tokens (held by
      * potentially-untrusted in-sandbox code); mutations require an
      * API key or user token.
+     *
+     * Required permissions: write:secrets.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     set(options: {
         secrets: (S['SecretInput'])[];
@@ -2135,7 +2916,7 @@ declare class EllipsisSessions {
     private readonly transport;
     constructor(transport: Transport);
     /**
-     * Get Agent Session Analytics
+     * Get Session Analytics
      *
      * Measured tokens and spend over time, plus estimated content cost.
      *
@@ -2146,10 +2927,17 @@ declare class EllipsisSessions {
      * or unsupported context remains explicitly unattributed. No raw
      * prompts or tool results are returned. Sandbox tokens may read only
      * their own session's analytics.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own session.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     analytics(session_id: string): Promise<S['SessionAnalytics']>;
     /**
-     * Get Agent Session Diff
+     * Get Session Diff
      *
      * Return the session's uncommitted changes as a patch.
      *
@@ -2158,23 +2946,19 @@ declare class EllipsisSessions {
      * counts ride on the session itself (`git.repos[].files`); this
      * is the text behind them. Empty when the tree was clean. A
      * sandbox token may read only its own session's diff.
-     */
-    diff(session_id: string): Promise<S['SessionDiffResponse']>;
-    /**
-     * List Session Executions
-     *
-     * Return the session's execution attempts, oldest first.
      *
-     * Includes the selected harness, model, resolved instructions, initial
-     * query, and common result summary. Complete native outputs remain in
-     * the session's records. Internal launch options and checkpoint storage
-     * references are excluded.
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own session.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
-    executions(session_id: string): Promise<S['SessionExecutionsListResponse']>;
+    diff(session_id: string): Promise<S['SessionDiffResponse']>;
     /**
-     * Export Agent Session
+     * Download Session
      *
-     * Export the complete session history.
+     * Download the complete session history.
      *
      * The complete, ordered history of the session (agent output, tool calls, thinking,
      * lifecycle events, sandbox output, message events) as an ordered
@@ -2184,32 +2968,71 @@ declare class EllipsisSessions {
      * for one file. The JSON API never carries the bytes (same
      * two-step as files). /records is the paged live view of the
      * same data.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    download(session_id: string): Promise<S['GetSessionLogResponse']>;
+    /**
+     * List Session Executions
+     *
+     * Return the session's execution attempts, oldest first.
+     *
+     * Includes the selected harness, model, resolved instructions, initial
+     * query, and common result summary. Complete native outputs remain in
+     * the session's records. Internal launch options and checkpoint storage
+     * references are excluded.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
-    export(session_id: string): Promise<S['GetSessionLogResponse']>;
+    executions(session_id: string): Promise<S['SessionExecutionsListResponse']>;
     /**
-     * Get Agent Session
+     * Get Session
      *
      * Return one session.
      *
      * The public wire shape — the same shape the stream's session
-     * frames carry, with attributed_user and stopped_by_user resolved
+     * frames carry, with attribution, stop, and archive actors resolved
      * at read time.
      *
      * The heavy near-static blobs (config snapshot, input/output)
      * live on the detail endpoints, not here.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     get(session_id: string): Promise<S['SessionResponse']>;
     /**
-     * Get Agent Session Git
+     * Get Session Git
      *
      * The session's GitHub-side git view: its commits, and each PR it
      * opened joined to the live gh_prs row and reviews. The identity list
      * (output_git) rides the session itself over the WebSocket; this is
      * the join a "run" notify tells an open pane to refetch.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     git(session_id: string): Promise<S['SessionGitResponse']>;
     /**
-     * Ingest Agent Session Transcript
+     * Ingest Session Transcript
      *
      * Append transcript lines to a session's record.
      *
@@ -2217,23 +3040,39 @@ declare class EllipsisSessions {
      *
      * A sandbox token may only push its own session's transcript.
      * Idempotent by transcript line uuid; tolerant of malformed lines.
+     *
+     * Required permissions: write:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own session.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     ingestTranscript(session_id: string, options: {
         lines: (string)[];
         offset?: number;
     }): Promise<S['TranscriptIngestResult']>;
     /**
-     * List Agent Sessions
+     * List Sessions
      *
      * List cloud agent sessions, newest first.
      *
-     * Optionally filtered by automation (id or name), source, time
+     * Optionally filtered by agent (id or name), source, service, handler, time
      * window, attributed author, repository, and whether the session is
      * still going.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     list(options?: {
-        automation?: string | null;
+        agent?: string | null;
         source?: (S['SessionSource'])[] | null;
+        service?: S['HandlerService'] | null;
+        handler?: string | null;
         days?: number | null;
         start?: string | null;
         end?: string | null;
@@ -2245,7 +3084,7 @@ declare class EllipsisSessions {
         exclude_code_review?: boolean;
     }): Promise<Page<S['Session'], S['SessionsListResponse']>>;
     /**
-     * Get Agent Session Output
+     * Get Session Output
      *
      * Return the session's typed output.
      *
@@ -2254,10 +3093,17 @@ declare class EllipsisSessions {
      * while the session is still running (poll GET /v1/sessions/{id}),
      * when the agent declares no output block, or when no execution
      * produced output.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     output(session_id: string): Promise<Record<string, unknown>>;
     /**
-     * Get Agent Session Records
+     * Get Session Records
      *
      * Return the session's stored transcript records, oldest first.
      *
@@ -2266,29 +3112,45 @@ declare class EllipsisSessions {
      * agent answering "did X look into Y?" needs to read the sessions
      * it finds, and any org member sees the same transcript in the
      * dashboard.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     records(session_id: string, options?: {
         cursor?: string | null;
         limit?: number | null;
     }): Promise<Page<S['SessionRecord'], S['SessionRecordsListResponse']>>;
     /**
-     * Search Agent Sessions
+     * Search Sessions
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     search(options?: {
         q?: string;
         scope?: S['SessionSearchScope'];
         source?: (S['SessionSource'])[] | null;
+        service?: S['HandlerService'] | null;
+        handler?: string | null;
         author_id?: (number)[] | null;
-        automation_id?: (string)[] | null;
+        agent_id?: (string)[] | null;
         session_ids?: (string)[] | null;
         repo?: (string)[] | null;
-        status?: (S['SessionStatus'])[] | null;
+        status?: (S['SessionLifecycleStatus'])[] | null;
         start?: string | null;
         end?: string | null;
         limit?: number;
     }): Promise<S['SessionSearchResponse']>;
     /**
-     * Send Agent Session Message
+     * Send Session Message
      *
      * Send a message to a session.
      *
@@ -2296,6 +3158,13 @@ declare class EllipsisSessions {
      * Returns the created message so the caller can track it by id; a
      * retried send with the same idempotency_key returns the original
      * message.
+     *
+     * Required permissions: write:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     sendMessage(session_id: string, options: {
         idempotency_key?: string | null;
@@ -2304,52 +3173,103 @@ declare class EllipsisSessions {
     }): Promise<S['SessionMessageResponse']>;
     /**
      * Get Session Stream Ticket
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     sessionStreamTicket(session_id: string): Promise<S['StreamTicketResponse']>;
     /**
-     * Start Agent Session
+     * Start Session
      *
      * Start a cloud agent session.
      *
      * The daily driver: a prompt, optionally where to run it
-     * (`environment`) and the run's own settings, in the AutomationConfig
+     * (`environment`) and the run's own settings, in the AgentConfig
      * vocabulary. What you send is what runs: omit `environment` and the
      * session runs in the built-in basic sandbox. A missing model or
      * budget comes from the organization's settings, so
-     * `{"prompt": "..."}` alone is a complete request. `prompt` is the
-     * first message; omit it and the session starts idle, waiting for
-     * one. 400 when `interactive` is false and there is no prompt, or
+     * `{"claude_code": {"prompt": "..."}}` is a complete request.
+     * Set exactly one of `claude_code` or `codex`. Its `prompt` is the
+     * first message; omit the prompt and the session starts idle, waiting for
+     * one. 400 when `lifecycle.interactive` is false and there is no prompt, or
      * when `budget` exceeds the organization's per-session ceiling. To
-     * run a saved automation, use POST /v1/automations/{automation_id}/sessions.
+     * run a saved agent, use POST /v1/agents/{agent_id}/sessions.
+     *
+     * Required permissions: write:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
-    start(options: {
+    start(options?: {
         budget?: number | null;
-        environment?: string | S['EnvironmentConfig'] | null;
+        claude_code?: S['ClaudeConfig-Input'] | null;
+        codex?: S['CodexConfig-Input'] | null;
+        environment?: string | S['EnvironmentConfig-Input'] | null;
         force_rebuild?: boolean;
-        harness: S['HarnessOptions'];
         images?: (S['ImageAttachment'])[];
-        instructions?: S['Instructions'];
-        interactive?: boolean;
+        lifecycle?: S['SessionLifecycleConfig'];
         metadata?: Record<string, string>;
         output?: S['OutputConfig'] | null;
-        permissions?: S['PermissionsConfig'] | null;
-        prompt?: string | null;
+        permissions?: S['PermissionsConfig-Input'] | null;
         repositories?: (string)[] | null;
-        skills?: (S['SkillRef'])[] | null;
+        skills?: (S['SkillRef-Input'])[] | null;
     }): Promise<S['SessionResponse']>;
     /**
-     * Stop Agent Session
+     * Stop Session
      *
      * Stop an in-flight session and return it.
      *
      * stopped_by is recorded only when the caller's credential maps
      * to a GitHub account.
+     *
+     * Required permissions: write:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     stop(session_id: string): Promise<S['SessionResponse']>;
     /**
      * Get Sessions Stream Ticket
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     streamTicket(): Promise<S['StreamTicketResponse']>;
+    /**
+     * Update Session
+     *
+     * Archive or unarchive a session and return it.
+     *
+     * Set archived to true to record the current server time and the
+     * authenticated GitHub user. API-key requests record no user.
+     * Repeated archive requests preserve the original time and user.
+     * Set archived to false to clear both fields. Archiving is available
+     * in any session state and does not stop a running session.
+     *
+     * Changes are delivered to session and session-list streams.
+     *
+     * Required permissions: write:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    update(session_id: string, options: {
+        archived: boolean;
+    }): Promise<S['SessionResponse']>;
     /** Start a session and return a handle over it. */
     run(options: Parameters<EllipsisSessions['start']>[0]): Promise<SessionHandle>;
     /** A handle over an existing session. */
@@ -2360,6 +3280,12 @@ declare class EllipsisSupportSlack {
     constructor(transport: Transport);
     /**
      * Request Slack Help
+     *
+     * Required permissions: write:account.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     create(options: {
         emails: (string)[];
@@ -2367,10 +3293,22 @@ declare class EllipsisSupportSlack {
     }): Promise<S['SlackHelpResponse']>;
     /**
      * Get Slack Help
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(): Promise<void>;
     /**
      * Invite To Slack Help
+     *
+     * Required permissions: write:account.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     invite(options: {
         emails: (string)[];
@@ -2389,6 +3327,12 @@ declare class EllipsisTemplates {
      * Get Agent Template
      *
      * Return one built-in agent template by slug.
+     *
+     * Required permissions: read:templates.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(template_id: string): Promise<S['AgentTemplate']>;
     /**
@@ -2398,6 +3342,12 @@ declare class EllipsisTemplates {
      *
      * Behind auth but not account-scoped — the data is static
      * product content shared by the dashboard, landing site, and CLI.
+     *
+     * Required permissions: read:templates.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['AgentTemplatesListResponse']>;
 }
@@ -2411,6 +3361,12 @@ declare class EllipsisUserSubscriptionTokens {
      *
      * Your sessions stop billing your subscription immediately, and the
      * usage reading goes with it — it described that token's plan.
+     *
+     * Required permissions: delete:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(provider: S['SubscriptionProvider']): Promise<void>;
     /**
@@ -2420,6 +3376,12 @@ declare class EllipsisUserSubscriptionTokens {
      *
      * `configured` is false when nothing is saved. The token itself is
      * never returned, only `token_last4`.
+     *
+     * Required permissions: read:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(provider: S['SubscriptionProvider']): Promise<S['SubscriptionToken']>;
     /**
@@ -2430,6 +3392,12 @@ declare class EllipsisUserSubscriptionTokens {
      * One entry per supported provider, whether or not you have saved a
      * token for it. Tokens are write-only: the response carries only
      * `token_last4`, never the token.
+     *
+     * Required permissions: read:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['SubscriptionTokensListResponse']>;
     /**
@@ -2442,6 +3410,12 @@ declare class EllipsisUserSubscriptionTokens {
      * succeeds. For Claude, use `claude setup-token`. For Codex, paste
      * the auth.json credentials from a ChatGPT login. Each subscription
      * pays only for models from its corresponding provider.
+     *
+     * Required permissions: write:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     set(provider: S['SubscriptionProvider'], options: {
         token: string;
@@ -2456,6 +3430,12 @@ declare class EllipsisUserSubscriptionTokens {
      * real windows without us seeing them. Null unless a token is
      * enabled for the provider: a disabled token routes nothing, so any
      * reading behind it is stale by construction.
+     *
+     * Required permissions: read:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     usage(provider: S['SubscriptionProvider']): Promise<S['SubscriptionUsageResponse']>;
     /**
@@ -2469,6 +3449,12 @@ declare class EllipsisUserSubscriptionTokens {
      * token is how you stop it routing. A 200 with `ok: false` is the
      * normal way a bad token is reported — it is an answer, not a
      * transport failure.
+     *
+     * Required permissions: write:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     verify(provider: S['SubscriptionProvider']): Promise<S['VerifySubscriptionTokenResponse']>;
 }
@@ -2477,10 +3463,22 @@ declare class EllipsisUserTokens {
     constructor(transport: Transport);
     /**
      * List User Tokens
+     *
+     * Required permissions: read:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['ListUserTokensResponse']>;
     /**
      * Revoke User Token
+     *
+     * Required permissions: delete:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     revoke(token_id: string): Promise<S['TokenRevokedResponse']>;
 }
@@ -2490,6 +3488,106 @@ declare class EllipsisUser {
     readonly tokens: EllipsisUserTokens;
     constructor(transport: Transport);
 }
+declare class EllipsisVmExecutions {
+    private readonly transport;
+    constructor(transport: Transport);
+    /**
+     * Get Single Vm Execution
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own sandbox.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    get(vm_execution_id: string): Promise<S['VMExecutionResponse']>;
+    /**
+     * Get Vm Executions
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own sandbox.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    list(): Promise<void>;
+    /**
+     * Get Vm Execution Stream Ticket
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own sandbox.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    streamTicket(vm_execution_id: string): Promise<S['StreamTicketResponse']>;
+}
+declare class EllipsisVmImages {
+    private readonly transport;
+    constructor(transport: Transport);
+    /**
+     * Get Vm Image
+     *
+     * Get metadata for a reusable VM image.
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    get(image_id: string): Promise<S['VMImageResponse']>;
+    /**
+     * List Vm Images
+     *
+     * List reusable VM images.
+     *
+     * Includes expiration, repository revisions, and build identity.
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    list(options?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<S['VMImageListResponse']>;
+}
+declare class EllipsisVms {
+    private readonly transport;
+    constructor(transport: Transport);
+    /**
+     * Get Vm
+     *
+     * Get a VM and its most recent execution.
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own VM.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    get(vm_id: string): Promise<S['VM']>;
+    /**
+     * List Vms
+     *
+     * List VMs and their last recorded state.
+     *
+     * Each machine appears once, including paused and deleted VMs, newest execution first.
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own VM.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    list(options?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<S['VMListResponse']>;
+}
 declare class EllipsisWebhooksDeliveries {
     private readonly transport;
     constructor(transport: Transport);
@@ -2500,6 +3598,12 @@ declare class EllipsisWebhooksDeliveries {
      *
      * Payloads are immutable across retries. Attempt details include HTTP
      * status, timing, and errors. Response bodies are not retained.
+     *
+     * Required permissions: read:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(delivery_id: string): Promise<S['WebhookDeliveryResponse']>;
     /**
@@ -2509,6 +3613,12 @@ declare class EllipsisWebhooksDeliveries {
      *
      * Includes verification pings and deliveries for deleted webhooks.
      * History is retained for 30 days. Retries belong to the same delivery.
+     *
+     * Required permissions: read:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(options?: {
         webhook_id?: string | null;
@@ -2530,9 +3640,15 @@ declare class EllipsisWebhooks {
      * Create a webhook and send a verification ping.
      *
      * Save the signing secret from this response; it is returned once.
-     * Accounts can have three webhooks, including unverified and pending
-     * ones. A ping returning HTTP 200 moves unverified to pending. Contact
+     * Accounts default to three webhook slots, including unverified and
+     * pending ones; your account may have a custom allowance. A ping returning HTTP 200 moves unverified to pending. Contact
      * Ellipsis to activate it and receive session.create events.
+     *
+     * Required permissions: write:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     create(options: {
         description?: string | null;
@@ -2545,19 +3661,37 @@ declare class EllipsisWebhooks {
      * Delete a webhook and cancel outstanding deliveries.
      *
      * An HTTP request already in flight may finish. Delivery history remains
-     * available for 30 days. Deletion frees one of the account's three slots.
+     * available for 30 days. Deletion frees a webhook slot.
+     *
+     * Required permissions: delete:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(webhook_id: string): Promise<void>;
     /**
      * Get Webhook
      *
      * Get a webhook's configuration and approval state.
+     *
+     * Required permissions: read:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(webhook_id: string): Promise<S['WebhookResponse']>;
     /**
      * List Webhooks
      *
      * List your webhooks and their delivery summaries.
+     *
+     * Required permissions: read:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['WebhooksListResponse']>;
     /**
@@ -2566,8 +3700,15 @@ declare class EllipsisWebhooks {
      * Send a signed verification or test ping.
      *
      * Available in every state. Only HTTP 200 verifies a destination;
-     * successful pings never activate it. At most five pings per account
-     * per minute, including pings from creation and URL changes.
+     * successful pings never activate it. The default limit is five pings per
+     * account per minute, including creation and URL changes. Custom
+     * account allowances apply.
+     *
+     * Required permissions: write:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     ping(webhook_id: string): Promise<void>;
     /**
@@ -2578,6 +3719,12 @@ declare class EllipsisWebhooks {
      * Changing the URL cancels outstanding deliveries, clears verification
      * and approval, and sends another ping. State and signing secret cannot
      * be set here. Updating description or subscriptions preserves approval.
+     *
+     * Required permissions: write:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Not supported by sandbox tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     update(webhook_id: string, options: {
         description?: string | null;
@@ -2588,27 +3735,36 @@ declare class EllipsisWebhooks {
 declare class Ellipsis {
     private readonly transport;
     readonly account: EllipsisAccount;
+    readonly agents: EllipsisAgents;
     readonly alerts: EllipsisAlerts;
     readonly analytics: EllipsisAnalytics;
     readonly auth: EllipsisAuth;
-    readonly automations: EllipsisAutomations;
     readonly environments: EllipsisEnvironments;
     readonly files: EllipsisFiles;
+    readonly handlers: EllipsisHandlers;
     readonly integrations: EllipsisIntegrations;
     readonly memories: EllipsisMemories;
     readonly reviews: EllipsisReviews;
-    readonly sandboxes: EllipsisSandboxes;
     readonly secrets: EllipsisSecrets;
     readonly sessions: EllipsisSessions;
     readonly support: EllipsisSupport;
     readonly templates: EllipsisTemplates;
     readonly user: EllipsisUser;
+    readonly vmExecutions: EllipsisVmExecutions;
+    readonly vmImages: EllipsisVmImages;
+    readonly vms: EllipsisVms;
     readonly webhooks: EllipsisWebhooks;
     constructor(options: TransportOptions);
     /**
      * Current Identity
      *
      * Return the identity behind the caller's credential.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Sandbox token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     identity(): Promise<S['Identity']>;
 }
@@ -2645,4 +3801,4 @@ declare class RateLimitError extends APIError {
 declare class ServerError extends APIError {
 }
 
-export { APIError, AuthenticationError, type AutomationListStreamMessage, type CollectionStreamFrame, type CollectionStreamHeartbeat, ConflictError, DEFAULT_BASE_URL, Ellipsis, EllipsisError, ForbiddenError, NotFoundError, Page, RateLimitError, type SandboxSnapshotFrame, type SandboxUpdateFrame, ServerError, SessionHandle, type SessionListStreamMessage, TERMINAL_STATUSES, Transport, TransportError, type TransportOptions, UnprocessableError, components, isSettled };
+export { APIError, type AgentListStreamMessage, AuthenticationError, type CollectionStreamFrame, type CollectionStreamHeartbeat, ConflictError, DEFAULT_BASE_URL, Ellipsis, EllipsisError, ForbiddenError, NotFoundError, Page, RateLimitError, type SandboxSnapshotFrame, type SandboxUpdateFrame, ServerError, SessionHandle, type SessionListStreamMessage, TERMINAL_STATUSES, Transport, TransportError, type TransportOptions, UnprocessableError, components, isSettled };