@ellipsis-dev/sdk 0.28.0 → 0.31.0

package/dist/index.d.ts

@@ -1,132 +1,39 @@
-import { c as components } from './types-B-jIFh4_.js';
-export { A as AttributionType, a as AutomationConfig, b as AutomationIdentity, B as BudgetConfig, d as BudgetSource, C as ClaudeAssistantEvent, e as ClaudeAssistantMessage, f as ClaudeConfig, g as ClaudeConversationResetEvent, h as ClaudeNativeEvent, i as ClaudeNativeSessionRecord, j as ClaudeNativeUsage, k as ClaudeRateLimitEvent, l as ClaudeRateLimitInfo, m as ClaudeResultEvent, n as ClaudeSessionRecord, o as ClaudeSystemEvent, p as ClaudeUserEvent, q as ClaudeUserMessage, r as CodexAgentMessage, s as CodexAgentMessageItem, t as CodexAppServerError, u as CodexAppServerEvent, v as CodexAppServerItem, w as CodexAppServerNotification, x as CodexAppServerSessionRecord, y as CodexCommandExecution, z as CodexCommandExecutionItem, D as CodexConfig, E as CodexContextCompaction, F as CodexEffortLevel, G as CodexErrorEvent, H as CodexErrorItem, I as CodexErrorParams, J as CodexEvent, K as CodexFileChange, L as CodexFileChangeItem, M as CodexFileUpdate, N as CodexItem, O as CodexItemCompleted, P as CodexItemCompletedEvent, Q as CodexItemParams, R as CodexItemStarted, S as CodexItemStartedEvent, T as CodexItemUpdatedEvent, U as CodexLocalImageInput, V as CodexMcpToolCall, W as CodexMcpToolCallAppContext, X as CodexMcpToolCallError, Y as CodexMcpToolCallItem, Z as CodexMcpToolCallResult, _ as CodexPlan, $ as CodexReasoning, a0 as CodexReasoningItem, a1 as CodexSessionRecord, a2 as CodexTextInput, a3 as CodexThread, a4 as CodexThreadStarted, a5 as CodexThreadStartedEvent, a6 as CodexThreadStartedParams, a7 as CodexThreadTokenUsage, a8 as CodexTodoListItem, a9 as CodexTokenUsageBreakdown, aa as CodexTokenUsageParams, ab as CodexTokenUsageUpdated, ac as CodexTurn, ad as CodexTurnCompleted, ae as CodexTurnCompletedEvent, af as CodexTurnError, ag as CodexTurnFailedEvent, ah as CodexTurnParams, ai as CodexTurnStarted, aj as CodexTurnStartedEvent, ak as CodexUsage, al as CodexUserInput, am as CodexUserMessage, an as CodexWebSearch, ao as CodexWebSearchItem, ap as ComputeConfig, aq as ConfigMetadata, ar as CreateReviewRequest, as as CronTrigger, at as DeltaFrame, au as DoneFrame, av as Duration, aw as EffortLevel, ax as EllipsisGrant, ay as EllipsisPermissions, az as EnvironmentConfig, aA as EnvironmentHooks, aB as EnvironmentImage, aC as EnvironmentSource, aD as EnvironmentVariable, aE as ErrorFrame, aF as ExecutionResult, aG as Finding, aH as GithubAccountFilter, aI as GithubAccountSelector, aJ as GithubAccountSnippet, aK as GithubAccountType, aL as GithubPermissions, aM as Harness, aN as HeartbeatFrame, aO as InputContract, aP as IssueAction, aQ as LegacyAssistantPayload, aR as LegacyNativeUsage, aS as LegacyResultPayload, aT as Level, aU as LifecycleSessionRecord, aV as LinearIssueAction, aW as McpRemoteServer, aX as McpServerRef, aY as McpStdioServer, aZ as MemorySize, a_ as MessageDeliveredPayload, a$ as MessageDeliveredRecord, b0 as MessageReceivedPayload, b1 as MessageReceivedRecord, b2 as MessageRequeuedPayload, b3 as MessageRequeuedRecord, b4 as OutboxCollectedPayload, b5 as OutboxCollectedRecord, b6 as OutputConfig, b7 as ParentKind, b8 as PermissionsConfig, b9 as PlatformSessionRecord, ba as PromptBlockedReason, bb as PullRequestAction, bc as ReactIssue, bd as ReactLinearIssue, be as ReactPullRequest, bf as ReactPush, bg as ReactSentry, bh as ReactSlackChannel, bi as ReactTrigger, bj as RecordsAppendFrame, bk as RepositoryFilter, bl as RepositoryRef, bm as ResolvedReviewScope, bn as Review, bo as ReviewConfiguration, bp as ReviewCounters, bq as ReviewFinding, br as ReviewRequester, bs as ReviewScope, bt as ReviewScopeKind, bu as ReviewStage, bv as ReviewedCommit, bw as ReviewsListResponse, bx as RunStatus, by as SandboxOutputPayload, bz as SandboxOutputRecord, bA as SandboxPhasePayload, bB as SandboxPhaseRecord, bC as SandboxReadyPayload, bD as SandboxReadyRecord, bE as SandboxStartingPayload, bF as SandboxStartingRecord, bG as SdkAssistantRecord, bH as SdkCacheCreation, bI as SdkContentBlock, bJ as SdkRateLimitRecord, bK as SdkRecord, bL as SdkResultRecord, bM as SdkServerToolResultBlock, bN as SdkServerToolUseBlock, bO as SdkSystemRecord, bP as SdkTextBlock, bQ as SdkThinkingBlock, bR as SdkToolResultBlock, bS as SdkToolUseBlock, bT as SdkUserRecord, bU as SendSessionMessageRequest, bV as SentryAction, bW as Session, bX as Session1, bY as SessionAttribution, bZ as SessionAutomation, b_ as SessionBudget, b$ as SessionCancelledPayload, c0 as SessionCancelledRecord, c1 as SessionClosedPayload, c2 as SessionClosedRecord, c3 as SessionConfig, c4 as SessionConfig1, c5 as SessionCost, c6 as SessionEnvironment, c7 as SessionExecution, c8 as SessionExecutionsListResponse, c9 as SessionExitStatus, ca as SessionFrame, cb as SessionGit, cc as SessionGitCommit, cd as SessionGitFile, ce as SessionGitPr, cf as SessionGitRepo, cg as SessionIdlePayload, ch as SessionIdleRecord, ci as SessionLiveness, cj as SessionMessage, ck as SessionMessageImage, cl as SessionMessageResponse, cm as SessionMessageStatus, cn as SessionParent, co as SessionPrompting, cp as SessionRecord, cq as SessionRecordsListResponse, cr as SessionResponse, cs as SessionResumedPayload, ct as SessionResumedRecord, cu as SessionRetryingPayload, cv as SessionRetryingRecord, cw as SessionScheduledPayload, cx as SessionScheduledRecord, cy as SessionSource, cz as SessionStartingPayload, cA as SessionStartingRecord, cB as SessionState, cC as SessionStatus, cD as SessionStopped, cE as SessionStreamFrame, cF as SessionSummary, cG as SessionSurface, cH as SessionTokens, cI as SessionTrigger, cJ as SessionTriggerActor, cK as SessionsListResponse, cL as SettingsRef, cM as SkillRef, cN as SnapshotFrame, cO as StreamFrame, cP as SystemFileRef, cQ as TokensInfo, cR as TurnCompletedPayload, cS as TurnCompletedRecord, cT as TurnFailedPayload, cU as TurnFailedRecord, cV as TurnStartedPayload, cW as TurnStartedRecord, cX as UnknownSessionRecord, cY as paths } from './types-B-jIFh4_.js';
+import { c as components } from './types-BQxZcD0_.js';
+export { A as AgentConfig, a as AgentIdentity, b as AttributionType, B as BudgetConfig, C as ClaudeAssistantEvent, d as ClaudeAssistantMessage, e as ClaudeConfig, f as ClaudeConversationResetEvent, g as ClaudeNativeEvent, h as ClaudeNativeSessionRecord, i as ClaudeNativeUsage, j as ClaudeRateLimitEvent, k as ClaudeRateLimitInfo, l as ClaudeResultEvent, m as ClaudeSessionRecord, n as ClaudeSystemEvent, o as ClaudeUserEvent, p as ClaudeUserMessage, q as CodexAgentMessage, r as CodexAgentMessageItem, s as CodexAppServerError, t as CodexAppServerEvent, u as CodexAppServerItem, v as CodexAppServerNotification, w as CodexAppServerSessionRecord, x as CodexCommandExecution, y as CodexCommandExecutionItem, z as CodexConfig, D as CodexContextCompaction, E as CodexEffortLevel, F as CodexErrorEvent, G as CodexErrorItem, H as CodexErrorParams, I as CodexEvent, J as CodexFileChange, K as CodexFileChangeItem, L as CodexFileUpdate, M as CodexItem, N as CodexItemCompleted, O as CodexItemCompletedEvent, P as CodexItemParams, Q as CodexItemStarted, R as CodexItemStartedEvent, S as CodexItemUpdatedEvent, T as CodexLocalImageInput, U as CodexMcpToolCall, V as CodexMcpToolCallAppContext, W as CodexMcpToolCallError, X as CodexMcpToolCallItem, Y as CodexMcpToolCallResult, Z as CodexPlan, _ as CodexReasoning, $ as CodexReasoningItem, a0 as CodexSessionRecord, a1 as CodexTextInput, a2 as CodexThread, a3 as CodexThreadStarted, a4 as CodexThreadStartedEvent, a5 as CodexThreadStartedParams, a6 as CodexThreadTokenUsage, a7 as CodexTodoListItem, a8 as CodexTokenUsageBreakdown, a9 as CodexTokenUsageParams, aa as CodexTokenUsageUpdated, ab as CodexTurn, ac as CodexTurnCompleted, ad as CodexTurnCompletedEvent, ae as CodexTurnError, af as CodexTurnFailedEvent, ag as CodexTurnParams, ah as CodexTurnStarted, ai as CodexTurnStartedEvent, aj as CodexUsage, ak as CodexUserInput, al as CodexUserMessage, am as CodexWebSearch, an as CodexWebSearchItem, ao as ComputeConfig, ap as ComputeConfig1, aq as ConfigMetadata, ar as CreateReviewRequest, as as CronTrigger, at as DeltaFrame, au as DoneFrame, av as Duration, aw as EffortLevel, ax as EllipsisGrant, ay as EllipsisPermissions, az as EnvironmentBaseBuild, aA as EnvironmentConfig, aB as EnvironmentHooks, aC as EnvironmentHooks1, aD as EnvironmentOutputPayload, aE as EnvironmentOutputRecord, aF as EnvironmentPhasePayload, aG as EnvironmentPhaseRecord, aH as EnvironmentReadyPayload, aI as EnvironmentReadyRecord, aJ as EnvironmentScript, aK as EnvironmentSource, aL as EnvironmentVariable, aM as ErrorFrame, aN as Finding, aO as GithubAccountFilter, aP as GithubAccountSelector, aQ as GithubAccountSnippet, aR as GithubAccountType, aS as GithubIssueEvent, aT as GithubPermissions, aU as GithubPullRequestEvent, aV as GithubPushEvent, aW as HandlerService, aX as HeartbeatFrame, aY as InputContract, aZ as IssueAction, a_ as LegacyAssistantPayload, a$ as LegacyNativeUsage, b0 as LegacyResultPayload, b1 as Level, b2 as LifecycleSessionRecord, b3 as LinearIssueAction, b4 as LinearIssueEvent, b5 as McpRemoteServer, b6 as McpServerRef, b7 as McpStdioServer, b8 as MemorySize, b9 as MessageDeliveredPayload, ba as MessageDeliveredRecord, bb as MessageReceivedPayload, bc as MessageReceivedRecord, bd as MessageRequeuedPayload, be as MessageRequeuedRecord, bf as OutboxCollectedPayload, bg as OutboxCollectedRecord, bh as OutputConfig, bi as PermissionsConfig, bj as PermissionsConfig1, bk as PlatformSessionRecord, bl as PromptBlockedReason, bm as PullRequestAction, bn as ReactIssue, bo as ReactLinearIssue, bp as ReactPullRequest, bq as ReactPush, br as ReactSentry, bs as ReactSlackChannel, bt as ReactTrigger, bu as RecordsAppendFrame, bv as RepositoryFilter, bw as RepositoryRef, bx as ResolvedReviewScope, by as Review, bz as ReviewConfiguration, bA as ReviewCounters, bB as ReviewFinding, bC as ReviewRequester, bD as ReviewScope, bE as ReviewScopeKind, bF as ReviewStage, bG as ReviewedCommit, bH as ReviewsListResponse, bI as SdkAssistantRecord, bJ as SdkCacheCreation, bK as SdkContentBlock, bL as SdkRateLimitRecord, bM as SdkRecord, bN as SdkResultRecord, bO as SdkServerToolResultBlock, bP as SdkServerToolUseBlock, bQ as SdkSystemRecord, bR as SdkTextBlock, bS as SdkThinkingBlock, bT as SdkToolResultBlock, bU as SdkToolUseBlock, bV as SdkUserRecord, bW as SendSessionMessageRequest, bX as SentryAction, bY as SentryAlertEvent, bZ as Session, b_ as Session1, b$ as SessionAgent, c0 as SessionArchived, c1 as SessionAttribution, c2 as SessionClosedPayload, c3 as SessionClosedRecord, c4 as SessionConfig, c5 as SessionConversation, c6 as SessionCost, c7 as SessionCost1, c8 as SessionEnvironment, c9 as SessionEventActor, ca as SessionFrame, cb as SessionGit, cc as SessionGitCommit, cd as SessionGitFile, ce as SessionGitPr, cf as SessionGitRepo, cg as SessionHandler, ch as SessionMessage, ci as SessionMessageImage, cj as SessionMessageResponse, ck as SessionMessageStatus, cl as SessionParent, cm as SessionPrompting, cn as SessionRecord, co as SessionRecordsListResponse, cp as SessionResponse, cq as SessionSource, cr as SessionState, cs as SessionStopped, ct as SessionStreamFrame, cu as SessionSummary, cv as SessionTokens, cw as SessionTokens1, cx as SessionTurn, cy as SessionTurnResponse, cz as SessionTurnsListResponse, cA as SessionsListResponse, cB as SettingsRef, cC as SkillRef, cD as SlackChannelCreatedEvent, cE as SlackMessageEvent, cF as SnapshotFrame, cG as StreamFrame, cH as TokensInfo, cI as TurnEndedPayload, cJ as TurnEndedRecord, cK as TurnReason, cL as TurnStartedPayload, cM as TurnStartedRecord, cN as TurnStatus, cO as UnknownSessionRecord, cP as UpdateSessionRequest, cQ as paths } from './types-BQxZcD0_.js';
 
 /**
- * Frames on /v1/sessions/stream, /v1/automations/stream and /v1/sandboxes/{id}/stream. Ignore unknown frame types.
+ * Frames on /v1/sessions/stream, /v1/agents/stream and /v1/vm-executions/{id}/stream. Ignore unknown frame types.
  */
-type CollectionStreamFrame = SessionListStreamMessage | AutomationListStreamMessage | CollectionStreamHeartbeat | SandboxSnapshotFrame | SandboxUpdateFrame;
-type AttributionType = 'github_user' | 'linear_user' | 'slack_user' | 'api_key';
-type GithubAccountType = 'User' | 'Organization' | 'Bot' | 'Mannequin';
-type EffortLevel = 'low' | 'medium' | 'high' | 'xhigh' | 'max';
-type CodexEffortLevel = 'none' | 'low' | 'medium' | 'high' | 'xhigh' | 'max';
+type CollectionStreamFrame = SessionListStreamMessage | AgentListStreamMessage | CollectionStreamHeartbeat | SandboxSnapshotFrame | SandboxUpdateFrame;
 /**
- * What may be done to a resource. Strictly ordered: a grant at one level
- * includes every level below it (write-only would be a phantom capability —
- * no real client can create what it cannot read back).
+ * An agent session: one conversation with an agent. Returned by
+ * `GET /v1/sessions/{id}` and carried by the session stream's
+ * `session`/`snapshot` frames; REST and stream never disagree about what a
+ * session looks like.
  */
-type Level = 'read' | 'write' | 'delete';
-type GithubAccountFilter = {
-    exclude?: string[];
-    include?: string[] | boolean;
-} | boolean | string[];
-type IssueAction = 'opened' | 'closed' | 'commented';
-type RepositoryFilter = {
-    exclude?: string[];
-    include?: string[];
-} | string[];
-type LinearIssueAction = 'opened';
-type PullRequestAction = 'opened' | 'pushed' | 'merged' | 'closed' | 'review_submitted' | 'commented';
-type SentryAction = 'issue_alert' | 'metric_alert';
-/**
- * Where the resolved budget came from.
- */
-type BudgetSource = 'system' | 'account' | 'config' | 'run';
-/**
- * How a session's environment was chosen. None (the field is nullable)
- * when the config carried an inline environment block and no resolution ran —
- * an inline environment is not a reference, so there is nothing to record.
- *
- * Not derivable from the row: `environment_id` says WHICH environment, not
- * how it was chosen, and is null for the built-in basic sandbox.
- */
-type EnvironmentSource = 'request' | 'automation' | 'repo_default' | 'account_default' | 'platform_default';
-/**
- * Why a terminal agent session ended — a finer-grained reason than `status`.
- *
- * `status` (SessionStatus) is the lifecycle state: COMPLETED / ERROR /
- * CANCELLED. `exit_status` explains *why* a run reached that terminal state, so
- * the UI and metrics can tell a budget cutoff apart from a crashed tool call or
- * a deliberate cancellation. It is None until the run reaches a terminal state.
- */
-type SessionExitStatus = 'completed' | 'budget_hit' | 'payment_required' | 'tool_call_failed' | 'lifecycle_hook_failed' | 'missing_repo_access' | 'missing_token_permissions' | 'missing_sandbox_variables' | 'blocked' | 'contact_email_required' | 'cancelled' | 'interrupted' | 'error' | 'stopped';
-/**
- * The coding-agent harness the session runs on.
- */
-type Harness = 'claude_code' | 'codex';
-/**
- * How a session relates to its predecessor (parent_agent_session_id) —
- * the ONE "preceded-by" chain for every predecessor relationship. Routing
- * reads this when the distinction matters.
- *
- * CONTINUATION — a follow-up in the same conversation surface (e.g. a Slack
- * thread reply spawning a fresh session on the same thread).
- * RESUME — a conversation re-hosted on a new box after its sandbox was torn
- * down (interactive platform; later phase).
- */
-type ParentKind = 'continuation' | 'resume';
-/**
- * Why direct prompting is refused. Absent when prompting is allowed.
- */
-type PromptBlockedReason = 'mention_surface' | 'ephemeral_trigger' | 'non_interactive' | 'harness_single_turn' | 'closed';
-/**
- * Lifecycle of a keyed (multi-turn) session — the durable conversation.
- * Distinct from SessionStatus, which is per-execution (one turn's run) and
- * moves to agent_turns in a later slice. IDLE: alive, waiting for the next
- * message. RUNNING: a turn is executing. CLOSED: the conversation is done and
- * its sandbox/snapshots are torn down.
- */
-type SessionState = 'idle' | 'running' | 'closed';
-/**
- * Where the session came from (e.g. react, web, api, cli, mention, cron).
- */
-type SessionSource = 'react' | 'web' | 'api' | 'cli' | 'mention' | 'cron';
-/**
- * Execution status of the session.
- */
-type SessionStatus = 'scheduled' | 'creating_sandbox' | 'running' | 'retrying' | 'completed' | 'error' | 'cancelled' | 'stopped';
-/**
- * What the current (or most recent) execution is doing (backs `run`).
- */
-type RunStatus = 'scheduled' | 'starting' | 'working' | 'waiting' | 'done' | 'failed' | 'stopped' | 'cancelled' | 'retrying';
-/**
- * The durable conversation axis (backs the surfaced `session` field).
- */
-type SessionLiveness = 'alive' | 'idle' | 'closed';
-/**
- * Which writer owns this automation. "github" automations are defined by a file in a repository and are changed by editing that file; "api" automations have no file and are changed through this API.
- */
-type ConfigManagedBy = 'github' | 'api';
-/**
- * Which image-cache tier a sandbox creation took — the customer-facing
- * names for `create_sandbox_from_default`'s exact / latest / default tiers.
- * Rides on `Sandbox.cache_tier` and the sandbox_ready lifecycle record.
- */
-type SandboxCacheTier = 'exact' | 'incremental' | 'full';
-type SandboxSource = 'cli' | 'web_ui' | 'ingest_pull_request_job_run' | 'agent_session' | 'image_refresh' | 'test' | 'script';
-type SandboxStatus = 'scheduled' | 'building' | 'running' | 'released' | 'terminating' | 'terminated' | 'failed';
-type SandboxType = 'claude_code';
-interface SessionListStreamMessage {
-    session: Session;
-    type: 'session';
-}
-/**
- * An agent session: one conversation with an agent, from trigger to
- * terminal state. Returned by `GET /v1/sessions/{id}` and carried by the
- * session stream's `session`/`snapshot` frames — REST and stream never
- * disagree about what a session looks like.
- */
-interface Session {
+type Session = {
+    /**
+     * The agent the session was started from, or null for a raw session started with POST /v1/sessions.
+     */
+    agent: SessionAgent | null;
+    /**
+     * When and by whom the session was archived; null when unarchived. Archiving does not stop or close a session.
+     */
+    archived: SessionArchived | null;
     attribution: SessionAttribution;
     /**
-     * The automation the session was started from, or null for a raw session started with POST /v1/sessions.
+     * The spend budget enforced for this session, in US dollars, after resolving defaults and ceilings.
      */
-    automation: SessionAutomation | null;
-    budget: SessionBudget;
-    config: SessionConfig1;
+    budget: number;
     /**
-     * The "owner/name" repository context the session was started in, if any.
+     * Claude Code input and native options. Set exactly one of claude_code or codex.
      */
-    context_repository: string | null;
+    claude_code: ClaudeConfig | null;
+    /**
+     * Codex input and native options. Set exactly one of claude_code or codex.
+     */
+    codex: CodexConfig | null;
+    conversation: SessionConversation;
     cost: SessionCost;
     /**
      * When the session was created.
@@ -134,112 +41,193 @@ interface Session {
     created_at: string;
     environment: SessionEnvironment;
     /**
-     * How the session ended; null until it is terminal.
+     * The typed external event that started the session; null for direct and scheduled starts.
      */
-    exit_status: SessionExitStatus | null;
+    event: (GithubPullRequestEvent | GithubIssueEvent | GithubPushEvent | LinearIssueEvent | SlackMessageEvent | SlackChannelCreatedEvent | SentryAlertEvent) | null;
     /**
      * What the session did to git, one entry per repository in its workspace: the commit and branch it sits on, per-file line counts for its uncommitted changes, and the pull requests it opened. Null if nothing was ever captured.
      */
     git: SessionGit | null;
-    harness: Harness;
     /**
-     * Unique identifier of the session.
+     * The saved handler and its effective display name when this session started, frozen at creation. Null for built-in responders, legacy sessions, and sessions started without a handler.
      */
-    id: string;
+    handler: SessionHandler | null;
     /**
-     * When the session last showed activity.
-     */
-    last_activity_at: string | null;
-    /**
-     * When the session last received a message.
+     * Unique identifier of the session.
      */
-    last_message_at: string | null;
+    id: string;
     /**
      * Caller-supplied metadata key-value pairs.
      */
     metadata: {
         [k: string]: string;
     };
-    parent: SessionParent;
     /**
-     * The per-session prompt the session was started with.
+     * The structured-output exit contract for this session.
      */
-    prompt: string | null;
-    prompting: SessionPrompting;
+    output: OutputConfig | null;
     /**
-     * Lifecycle state of the durable conversation, or null for sessions without one.
+     * The predecessor session this session continues; null when there is none.
      */
-    session_state: SessionState | null;
-    source: SessionSource;
-    status: SessionStatus;
+    parent: SessionParent | null;
+    permissions: PermissionsConfig1;
     /**
-     * Human-readable reason for the current status, when there is one.
+     * Skills installed for this session.
      */
-    status_reason: string | null;
-    stopped: SessionStopped;
+    skills: SkillRef[];
+    source: SessionSource;
     /**
      * The latest live summary of the session's progress while it runs, and when it was generated.
      */
     summary: SessionSummary | null;
-    surface: SessionSurface;
     tokens: SessionTokens;
     /**
-     * The external event that started the session.
+     * The turn in progress, or the latest one when none is running. Null until the session has a message. Wait on it: the message you sent is answered when the turn with your message's `turn_id` reaches a final status.
      */
-    trigger: SessionTrigger | null;
+    turn: SessionTurn | null;
     /**
      * When the session was last updated.
      */
     updated_at: string;
-}
+} & ({
+    claude_code: {
+        [k: string]: unknown;
+    };
+    codex: null;
+} | {
+    claude_code: null;
+    codex: {
+        [k: string]: unknown;
+    };
+});
 /**
- * The principal this session is attributed to.
+ * What one session runs on: its selected harness, where it runs, what it
+ * may touch, its skills, its exit contract, and its spend cap. Every session
+ * freezes one of these (`sessions.session_config`); an agent
+ * carries one under `session:` (`AgentConfig.session`); and
+ * `POST /v1/sessions` is this shape flattened onto the request body, plus the
+ * run settings. Nothing in here is an agent's identity or trigger —
+ * those belong to `AgentConfig`.
+ *
+ * Field order is the canonical key order for `session:` blocks and YAML
+ * exports: what runs (`claude_code` or `codex`), where (`environment`), what it may
+ * touch (`permissions`), then the rest.
  */
-interface SessionAttribution {
-    /**
-     * Identifier of the principal the session is attributed to.
-     */
-    id: string | null;
+type SessionConfig = {
+    budget: BudgetConfig;
     /**
-     * Kind of principal the session is attributed to (e.g. a GitHub user or an API key).
+     * Claude Code input and native options. Set exactly one of claude_code or codex.
      */
-    type: AttributionType | null;
+    claude_code: ClaudeConfig | null;
     /**
-     * The GitHub user the session is attributed to, resolved at read time. Null when the attribution is not a GitHub user.
+     * Codex input and native options. Set exactly one of claude_code or codex.
      */
-    user: GithubAccountSnippet | null;
-}
+    codex: CodexConfig | null;
+    environment: string | EnvironmentConfig;
+    output: OutputConfig | null;
+    permissions: PermissionsConfig;
+    skills: SkillRef[];
+} & ({
+    claude_code: {
+        [k: string]: unknown;
+    };
+    codex: null;
+} | {
+    claude_code: null;
+    codex: {
+        [k: string]: unknown;
+    };
+});
+type EffortLevel = 'low' | 'medium' | 'high' | 'xhigh' | 'max';
+type CodexEffortLevel = 'none' | 'low' | 'medium' | 'high' | 'xhigh' | 'max';
 /**
- * Sometimes the GitHub API returns a user of github (can include bots)
- * using this snippet instead of the full GithubAccount model. One example,
- * is when the API returns a pull request.
+ * What may be done to a resource. Strictly ordered: a grant at one level
+ * includes every level below it (write-only would be a phantom capability —
+ * no real client can create what it cannot read back).
+ */
+type Level = 'read' | 'write' | 'delete';
+type GithubAccountFilter = {
+    exclude: string[];
+    include: string[] | boolean;
+} | boolean | string[];
+type IssueAction = 'opened' | 'closed' | 'commented';
+type RepositoryFilter = {
+    exclude: string[];
+    include: string[];
+} | string[];
+type LinearIssueAction = 'opened';
+type PullRequestAction = 'opened' | 'pushed' | 'merged' | 'closed' | 'review_submitted' | 'commented';
+type SentryAction = 'issue_alert' | 'metric_alert';
+type GithubAccountType = 'User' | 'Organization' | 'Bot' | 'Mannequin';
+type AttributionType = 'github_user' | 'linear_user' | 'slack_user' | 'api_key';
+/**
+ * Why direct prompting is refused. Absent when prompting is allowed.
+ */
+type PromptBlockedReason = 'mention_surface' | 'ephemeral_trigger' | 'non_interactive' | 'harness_single_turn' | 'budget_exhausted' | 'closed';
+/**
+ * `open` while the session can take messages; `closed` is permanent.
+ */
+type SessionState = 'open' | 'closed';
+/**
+ * How a session's environment was chosen. None (the field is nullable)
+ * when the config carried an inline environment block and no resolution ran —
+ * an inline environment is not a reference, so there is nothing to record.
  *
- * This is the least amount of info we need to represent a GitHub account.
+ * Not derivable from the row: `environment_id` says WHICH environment, not
+ * how it was chosen, and is null for the built-in basic environment.
  */
-interface GithubAccountSnippet {
-    avatar_url: string;
-    id: number;
-    login: string;
-    type: GithubAccountType;
+type EnvironmentSource = 'request' | 'agent' | 'repo_default' | 'account_default' | 'platform_default';
+/**
+ * The service the handler responds to.
+ */
+type HandlerService = 'slack' | 'github' | 'linear' | 'sentry';
+/**
+ * Where the session came from (e.g. react, web, api, cli, mention, cron).
+ */
+type SessionSource = 'react' | 'web' | 'api' | 'cli' | 'mention' | 'cron';
+/**
+ * Why a turn failed or was cancelled. Null on every other outcome.
+ */
+type TurnReason = 'error' | 'tool_call_failed' | 'budget_hit' | 'payment_required' | 'blocked' | 'contact_email_required' | 'lifecycle_hook_failed' | 'missing_repo_access' | 'missing_token_permissions' | 'missing_environment_variables' | 'missing_github_integration' | 'agent_unavailable' | 'upstream_unavailable' | 'unsupported_configuration' | 'execution_disabled' | 'interrupted';
+/**
+ * Where the turn is.
+ */
+type TurnStatus = 'pending' | 'running' | 'completed' | 'failed' | 'stopped' | 'cancelled';
+/**
+ * Which writer owns this agent. "github" agents are defined by a file in a repository and are changed by editing that file; "api" agents have no file and are changed through this API.
+ */
+type ConfigManagedBy = 'github' | 'api';
+/**
+ * Which image-cache tier a sandbox creation took — the customer-facing
+ * names for `create_sandbox_from_default`'s exact / latest / default tiers.
+ * Rides on `Sandbox.cache_tier` and the sandbox_ready lifecycle record.
+ */
+type SandboxCacheTier = 'exact' | 'incremental' | 'full';
+type SandboxSource = 'cli' | 'web_ui' | 'ingest_pull_request_job_run' | 'session' | 'image_refresh' | 'test' | 'script';
+type SandboxStatus = 'scheduled' | 'building' | 'running' | 'released' | 'terminating' | 'terminated' | 'failed';
+type SandboxType = 'claude_code';
+interface SessionListStreamMessage {
+    session: Session;
+    type: 'session';
 }
 /**
- * The automation this session was started from: the definition frozen
- * when the session was created, and the saved automation it came from as it
+ * The agent this session was started from: the definition frozen
+ * when the session was created, and the saved agent it came from as it
  * exists NOW. They diverge legitimately — a YAML edit after the session
  * started leaves the pointer describing something the session never ran.
  */
-interface SessionAutomation {
-    config: AutomationConfig;
+interface SessionAgent {
+    config: AgentConfig;
     /**
-     * Identifier of the saved automation this session's snapshot was taken from. Null for a routing-file agent, a code-review stage agent, or the built-in mention agent, which have no saved automation behind them. Points at the automation as it exists now, which may have changed since.
+     * Identifier of the saved agent this session's snapshot was taken from. Null for a routing-file agent, a code-review stage agent, or the built-in mention agent, which have no saved agent behind them. Points at the agent as it exists now, which may have changed since.
      */
     id: string | null;
 }
 /**
- * The automation definition the session was started from, frozen when the session was created.
+ * The agent definition the session was started from, frozen when the session was created.
  */
-interface AutomationConfig {
-    ellipsis: AutomationIdentity;
+interface AgentConfig {
+    ellipsis: AgentIdentity;
     input: InputContract | null;
     session: SessionConfig;
     trigger: (CronTrigger | ReactTrigger) | null;
@@ -249,7 +237,7 @@ interface AutomationConfig {
  * (`version`), the human-facing identity (`name`/`description`), freeform
  * organizational `metadata`, and whether the agent is `enabled`. The
  * presence of a top-level `ellipsis:` mapping is what marks a YAML file as
- * an Ellipsis automation (vs arbitrary YAML that merely lives under a
+ * an Ellipsis agent (vs arbitrary YAML that merely lives under a
  * config directory) — see `yaml_is_ellipsis_config`.
  *
  * `enabled` is agent behavior, not freeform metadata, so it stays inside
@@ -257,9 +245,10 @@ interface AutomationConfig {
  * accepts messages is a per-run choice (POST /v1/sessions `interactive`),
  * not a config one.
  */
-interface AutomationIdentity {
+interface AgentIdentity {
     description: string | null;
     enabled: boolean;
+    kind: 'agent';
     metadata: ConfigMetadata;
     name: string | null;
     version: string;
@@ -274,15 +263,15 @@ interface ConfigMetadata {
  * The typed input contract: what goes INTO a session (the trigger is
  * when it happens; this is what goes in).
  *
- * `json_schema` types the payload a caller-started session takes
- * (`POST /v1/sessions` `input`, validated at the door; required when
- * declared). It is illegal on a react-triggered agent — react payloads are
- * platform-shaped (the published surface field sets), not caller-shaped.
+ * `json_schema` validates customer data sent as `input` to
+ * `POST /v1/agents/{id}/sessions` and stored as `session.input`.
+ * Invocations require input when a schema is declared. React agents
+ * cannot declare schemas: the platform defines their event payloads.
  *
  * `message` is the initial-message template: exact `{{path}}` substitution
  * over the caller payload (or, on a react agent, over the surface's
  * published fields), no conditionals/loops/filters. Refs are validated at
- * deploy time against the governing field set (see AutomationConfig's
+ * deploy time against the governing field set (see AgentConfig's
  * `_check_input`).
  */
 interface InputContract {
@@ -291,49 +280,69 @@ interface InputContract {
     } | null;
     message: string | null;
 }
+interface BudgetConfig {
+    day: number | null;
+    month: number | null;
+    session: number | null;
+    week: number | null;
+}
 /**
- * What one session runs on: its selected harness, where it runs, what it
- * may touch, its skills, its exit contract, and its spend cap. Every session
- * freezes one of these (`agent_sessions.session_config`); an automation
- * carries one under `session:` (`AutomationConfig.session`); and
- * `POST /v1/sessions` is this shape flattened onto the request body, plus the
- * run settings. Nothing in here is an automation's identity or trigger —
- * those belong to `AutomationConfig`.
+ * Native Claude Code options for an explicitly selected harness.
+ */
+interface ClaudeConfig {
+    effort: EffortLevel | null;
+    fallback_model: string | null;
+    max_turns: number | null;
+    model: string | null;
+    /**
+     * The initial user message, passed verbatim. Omit to start an interactive session with no turn, waiting for a message.
+     */
+    prompt: string | null;
+    settings: SettingsRef | null;
+}
+/**
+ * A config-declared Claude Code settings.json, resolved at run start and
+ * passed to `claude --settings <path>`. That is the CLI settings tier — BELOW
+ * Ellipsis's managed-settings.json floor — so it customizes behavior (model
+ * permissions, includeCoAuthoredBy, statusLine, ...) but can never weaken a
+ * security setting. Lets a team point the cloud agent at the same settings file
+ * they already use with Claude Code locally instead of re-encoding it as YAML.
+ */
+interface SettingsRef {
+    path: string;
+    repository: RepositoryRef | null;
+}
+interface RepositoryRef {
+    name: string;
+    owner: string | null;
+    ref: string | null;
+}
+/**
+ * Native options supported by the current Codex adapter.
  *
- * Field order is the canonical key order for `session:` blocks and YAML
- * exports: what runs (`harness`, `instructions`), where (`environment`), what it may
- * touch (`permissions`), then the rest.
+ * Options and capabilities expand only when their runtime behavior is tested.
+ * Unknown options are rejected instead of silently ignored.
  */
-interface SessionConfig {
-    budget: BudgetConfig;
-    environment: string | EnvironmentConfig;
+interface CodexConfig {
     /**
-     * The explicitly selected harness and its native options.
+     * Reasoning effort for every turn. Omit to use the model default.
      */
-    harness: ClaudeConfig | CodexConfig;
+    effort: CodexEffortLevel | null;
+    model: string;
     /**
-     * Instructions appended to the harness's own prompt. Text and repository file references are resolved in order.
+     * The initial user message, passed verbatim. Omit to start an interactive session with no turn, waiting for a message.
      */
-    instructions: string | SystemFileRef | (string | SystemFileRef)[];
-    output: OutputConfig | null;
-    permissions: PermissionsConfig;
-    skills: SkillRef[];
-}
-interface BudgetConfig {
-    day: number | null;
-    month: number | null;
-    session: number | null;
-    week: number | null;
+    prompt: string | null;
 }
 /**
- * Everything about the environment (the sandbox) the agent runs in: which
+ * Everything about the environment the agent runs in: which
  * `repositories` are cloned into it, which environment `variables` it gets,
- * its `compute` sizing, how its `image` is customized, and lifecycle `hooks`.
+ * its `compute` sizing, and lifecycle `hooks`.
  * What the agent may *do* from that environment is the top-level
  * `permissions:` block, not this one.
  *
  * Each `variables` entry names a variable to inject; with an inline `value` it
- * is hardcoded, without one it is resolved from the account's sandbox-secrets
+ * is hardcoded, without one it is resolved from the account's secrets
  * store. Only the named variables reach this agent; the rest of the account's
  * stored variables never do. This is how a config brings in the config and
  * credentials a custom CLI needs.
@@ -341,32 +350,29 @@ interface BudgetConfig {
 interface EnvironmentConfig {
     compute: ComputeConfig;
     hooks: EnvironmentHooks;
-    image: EnvironmentImage;
     mcp_servers: (string | McpServerRef | McpStdioServer | McpRemoteServer)[];
     repositories: RepositoryRef[];
     variables: EnvironmentVariable[];
 }
 /**
- * Sandbox compute sizing. Every field is optional; None inherits the
- * platform default (2 vCPU / 4096 MiB / 3600s — see DEFAULT_SANDBOX_* in
- * models/ellipsis/sandboxes/sandbox.py). A resolved value outside the platform
- * bounds fails validation loudly (a sync error on the config) rather than
- * being clamped silently.
+ * Environment compute sizing. Every field is optional; an omitted field
+ * inherits the platform default (2 vCPU / 4096 MiB / 3600s). A resolved value
+ * outside the platform bounds fails validation loudly (a sync error on the
+ * config) rather than being clamped silently.
  *
  * `memory` and `timeout` each accept a shorthand string ("8GB", "30m") or an
  * explicit units object ({gb: 8}, {minutes: 30}); the `memory_mib` /
  * `timeout_seconds` properties resolve either form to the canonical integer
- * the sandbox driver consumes.
+ * the environment is sized with.
  *
- * `timeout` is the max wall-clock the agent may run before its execution is
- * stopped, capped at 1h (MAX_SANDBOX_TIMEOUT_SECONDS — equal to the default, so
- * today the knob only shortens a session; the cap matches the 1-hour validity
- * of the sandbox's GitHub token). The worker's lease/visibility heartbeat
- * ceiling is derived from that cap, so a run at the max stays owned by its
- * worker for its whole life.
+ * `timeout` is the max wall-clock the agent may run in one environment before
+ * it is stopped, capped at 1h (equal to the default, so today the knob only
+ * shortens a session; the cap matches the 1-hour validity of the session's
+ * GitHub token).
  *
- * Compute currently uses a temporary flat one-cent amount per allocated
- * execution, subject to the account's existing free-compute exemptions.
+ * Compute currently uses a temporary flat one-cent amount each time an
+ * environment is started for a session, subject to the account's existing
+ * free-compute exemptions.
  */
 interface ComputeConfig {
     cpu: number | null;
@@ -393,45 +399,59 @@ interface Duration {
     seconds: number | null;
 }
 /**
- * Shell scripts run at points in the sandbox lifecycle, each as the sandbox
- * user with the sandbox's environment variables available. A non-zero exit
- * fails the run (exit_status = LIFECYCLE_HOOK_FAILED) and is not retried.
- *
- * `post_start` runs after the container starts, before any repo is cloned —
- * repo-independent setup (authenticate a CLI, e.g. `doppler setup`). On Freestyle
- * the repo is baked into the image so it is incidentally present, but
- * `post_start` must not depend on repo contents (that's `post_clone`).
+ * Environment lifecycle scripts, in order: build_base, after_checkout,
+ * before_start. The first two produce reusable snapshots; before_start runs
+ * before an agent starts or resumes its session. Scripts run as the environment's
+ * user in the workspace directory `/sandbox`. A nonzero exit fails the session.
  *
- * `post_clone` runs after all repos are cloned/checked out, before the agent —
- * repo-dependent setup (`pip install -r requirements.txt`, codegen).
- *
- * Hooks run on every run and their output is never cached. A dependency
- * install whose result should be reused across runs belongs in `image.setup`
- * (baked into the cached image) instead; keep hooks for per-run work — e.g.
- * anything that touches run-scoped credentials.
+ * Legacy post_start/post_clone scripts remain supported for existing configs;
+ * both run after workspace preparation, before the agent starts or resumes.
+ * They cannot be combined with the new lifecycle fields.
  */
 interface EnvironmentHooks {
+    /**
+     * Prepare the requested source revision after Ellipsis checks out all repositories, before saving the prepared environment. Skipped when that prepared environment is reused.
+     */
+    after_checkout: EnvironmentScript | string | null;
+    /**
+     * Run before the agent starts or resumes a session, after the environment is ready. This hook is not cached and adds to session startup time.
+     */
+    before_start: EnvironmentScript | string | null;
+    /**
+     * Build a reusable environment before full checkout. Cached by declared inputs, script, toolchain, resources, and build configuration. A string is shorthand for run with all repositories as inputs.
+     */
+    build_base: EnvironmentBaseBuild | string | null;
+    /**
+     * Legacy session startup script. Use before_start for session setup or after_checkout for cached source preparation.
+     */
     post_clone: string | null;
+    /**
+     * Legacy session startup script. Use before_start in new configurations.
+     */
     post_start: string | null;
 }
 /**
- * How to customize the container image the agent runs in. You
- * contribute appended layers (`dockerfile_append`) and a build-time script
- * (`setup`) only — Ellipsis owns FROM / base tooling / entrypoint / user.
- * Today only inline bodies are supported; a file reference (resolved at the
- * run's SHA) will come later.
- *
- * The split: `dockerfile_append` runs when the image is assembled, before any
- * repo exists — toolchain installs (a package manager binary, apt packages).
- * `setup` runs at image-build time *after* the configured repositories are
- * checked out, and its output is captured by the filesystem snapshot that
- * becomes the cached image — dependency installs (`poetry install`,
- * `npm install`), so later runs start with deps already on disk. Neither runs
- * per run; that's `hooks.post_start` / `hooks.post_clone`.
+ * An inline shell script run as the environment's user, with the workspace
+ * directory `/sandbox` as cwd.
+ */
+interface EnvironmentScript {
+    /**
+     * Shell script to run in the workspace directory `/sandbox`.
+     */
+    run: string;
+}
+/**
+ * Create a reusable base, optionally using only selected repository files.
  */
-interface EnvironmentImage {
-    dockerfile_append: string | null;
-    setup: string | null;
+interface EnvironmentBaseBuild {
+    /**
+     * Exact files relative to the workspace directory `/sandbox`, including the repository name. Only these files are available during build_base and their contents and modes determine reuse. Omit to use all repositories and invalidate on any source change; [] means no repository files.
+     */
+    inputs: string[] | null;
+    /**
+     * Shell script to run in the workspace directory `/sandbox`.
+     */
+    run: string;
 }
 /**
  * One built-in MCP server this agent opts into by name (`linear`/`slack`).
@@ -447,9 +467,9 @@ interface McpServerRef {
 }
 /**
  * A bring-your-own stdio MCP server: the harness spawns `command` inside
- * the sandbox and speaks JSON-RPC over its stdin/stdout. The command must be
- * runnable in the sandbox image — install its runtime via `image.setup` /
- * `image.dockerfile_append` if the base image lacks it.
+ * the environment and speaks JSON-RPC over its stdin/stdout. The command must
+ * be runnable in the environment image — install its runtime via `hooks.build_base` /
+ * `hooks.after_checkout` if the managed environment lacks it.
  *
  * `env` values may embed `${NAME}` references, resolved at run time from the
  * account's secrets store (see `mcp_secret_refs`); everything else is passed
@@ -465,7 +485,7 @@ interface McpStdioServer {
 }
 /**
  * A bring-your-own remote MCP server: the harness talks HTTP to `url`.
- * Nothing runs in the sandbox image. `headers` carry static auth (e.g.
+ * Nothing runs in the environment image. `headers` carry static auth (e.g.
  * `Authorization: Bearer ${TOKEN}`); values may embed `${NAME}` secret
  * references, resolved at run time from the account's secrets store.
  */
@@ -476,17 +496,12 @@ interface McpRemoteServer {
     name: string;
     url: string;
 }
-interface RepositoryRef {
-    name: string;
-    owner: string | null;
-    ref: string | null;
-}
 /**
- * One environment variable injected into the agent's sandbox.
+ * One environment variable injected into the session's environment.
  *
  * `value`, when set, is a literal injected as-is — use it for non-secret
  * config (LOG_LEVEL, an API base URL). When `value` is omitted the value is
- * resolved at run time from the account's sandbox-secrets store (dashboard
+ * resolved at run time from the account's secrets store (dashboard
  * / `PUT /v1/secrets`) by `name`, so a secret can be injected without
  * ever putting it in the config file. Either way the variable only reaches
  * agents that name it.
@@ -495,47 +510,6 @@ interface EnvironmentVariable {
     name: string;
     value: string | null;
 }
-/**
- * Native Claude Code options for an explicitly selected harness.
- */
-interface ClaudeConfig {
-    effort: EffortLevel | null;
-    fallback_model: string | null;
-    max_turns: number | null;
-    model: string | null;
-    settings: SettingsRef | null;
-    type: 'claude_code';
-}
-/**
- * A config-declared Claude Code settings.json, resolved at run start and
- * passed to `claude --settings <path>`. That is the CLI settings tier — BELOW
- * Ellipsis's managed-settings.json floor — so it customizes behavior (model
- * permissions, includeCoAuthoredBy, statusLine, ...) but can never weaken a
- * security setting. Lets a team point the cloud agent at the same settings file
- * they already use with Claude Code locally instead of re-encoding it as YAML.
- */
-interface SettingsRef {
-    path: string;
-    repository: RepositoryRef | null;
-}
-/**
- * Native options supported by the current Codex adapter.
- *
- * Options and capabilities expand only when their runtime behavior is tested.
- * Unknown options are rejected instead of silently ignored.
- */
-interface CodexConfig {
-    /**
-     * Reasoning effort for every turn. Omit to use the model default.
-     */
-    effort: CodexEffortLevel | null;
-    model: string;
-    type: 'codex';
-}
-interface SystemFileRef {
-    file: string;
-    repository: RepositoryRef | null;
-}
 /**
  * JSON Schema for the harness's structured result, when certified.
  */
@@ -546,18 +520,18 @@ interface OutputConfig {
 }
 /**
  * What the agent is allowed to touch, per credential the platform mints
- * into its sandbox. Distinct from `environment:`, which is where the agent
- * runs; this is what it may do from there.
+ * into its session's environment. Distinct from `environment:`, which is
+ * where the agent runs; this is what it may do from there.
  *
- * `ellipsis` scopes the sandbox's Ellipsis API token
- * (`ELLIPSIS_API_TOKEN`, what the in-sandbox `agent` CLI authenticates
- * with). `true` / the string `all` (the default) grant the full sandbox
- * ceiling — everything a sandbox token can ever do. A map narrows it per
+ * `ellipsis` scopes the session's Ellipsis API token (`ELLIPSIS_API_TOKEN`,
+ * what the `agent` CLI running inside the session authenticates with).
+ * `true` / the string `all` (the default) grant the full session token
+ * ceiling — everything a session token can ever do. A map narrows it per
  * resource (see `EllipsisPermissions`); the minted token carries
  * the intersection, so a config can only ever reduce access. `false` fails
  * validation — an agent with no API token cannot report its own progress.
  *
- * `github` scopes the sandbox's GitHub installation token (`GH_TOKEN`) —
+ * `github` scopes the session's GitHub installation token (`GH_TOKEN`) —
  * see `GithubPermissions`. GitHub enforces it at mint time.
  */
 interface PermissionsConfig {
@@ -568,8 +542,8 @@ interface PermissionsConfig {
  * `permissions.ellipsis` as a map: resource → level | grant | list of
  * grants. Levels are hierarchical (read < write < delete), so `write`
  * includes `read`. An unlisted resource is denied. The whole block is
- * intersected with the platform's sandbox ceiling at token mint — it can
- * narrow what a sandbox token may do, never exceed it.
+ * intersected with the platform's session token ceiling at token mint — it can
+ * narrow what a session token may do, never exceed it.
  */
 interface EllipsisPermissions {
     [k: string]: Level | EllipsisGrant | (Level | EllipsisGrant)[];
@@ -585,8 +559,8 @@ interface EllipsisGrant {
 }
 /**
  * The agent's GitHub access: the scope of the installation token minted for
- * its sandbox — the credential `git`, `gh`, and the GitHub MCP server
- * authenticate with.
+ * its session's environment — the credential `git`, `gh`, and the GitHub MCP
+ * server authenticate with.
  *
  * By default the token carries the installation's full permissions on all of
  * the installation's repositories. `permissions` narrows what it may do:
@@ -597,7 +571,7 @@ interface EllipsisGrant {
  * the listed repos, by name (they must belong to the installation).
  *
  * Restriction is enforced by GitHub, not by Ellipsis: the token itself is
- * minted with the reduced scope, so nothing running in the sandbox can
+ * minted with the reduced scope, so nothing running in the environment can
  * exceed it.
  */
 interface GithubPermissions {
@@ -672,47 +646,80 @@ interface ReactSentry {
 interface ReactSlackChannel {
 }
 /**
- * The spend budget enforced for this session.
+ * When the session was archived and the GitHub user who archived it.
  */
-interface SessionBudget {
+interface SessionArchived {
+    /**
+     * When the session was archived.
+     */
+    at: string;
     /**
-     * The spend budget resolved for this session, in cents.
+     * The GitHub user who archived the session; null if unknown or unavailable.
      */
-    cents: number;
-    source: BudgetSource;
+    by: GithubAccountSnippet | null;
 }
 /**
- * What one session runs on: its selected harness, where it runs, what it
- * may touch, its skills, its exit contract, and its spend cap. Every session
- * freezes one of these (`agent_sessions.session_config`); an automation
- * carries one under `session:` (`AutomationConfig.session`); and
- * `POST /v1/sessions` is this shape flattened onto the request body, plus the
- * run settings. Nothing in here is an automation's identity or trigger —
- * those belong to `AutomationConfig`.
+ * Sometimes the GitHub API returns a user of github (can include bots)
+ * using this snippet instead of the full GithubAccount model. One example,
+ * is when the API returns a pull request.
  *
- * Field order is the canonical key order for `session:` blocks and YAML
- * exports: what runs (`harness`, `instructions`), where (`environment`), what it may
- * touch (`permissions`), then the rest.
+ * This is the least amount of info we need to represent a GitHub account.
  */
-interface SessionConfig1 {
-    budget: BudgetConfig;
-    environment: string | EnvironmentConfig;
+interface GithubAccountSnippet {
+    avatar_url: string;
+    id: number;
+    login: string;
+    type: GithubAccountType;
+}
+/**
+ * The principal this session is attributed to.
+ */
+interface SessionAttribution {
     /**
-     * The explicitly selected harness and its native options.
+     * Identifier of the principal the session is attributed to.
      */
-    harness: ClaudeConfig | CodexConfig;
+    id: string | null;
     /**
-     * Instructions appended to the harness's own prompt. Text and repository file references are resolved in order.
+     * Kind of principal the session is attributed to (e.g. a GitHub user or an API key).
      */
-    instructions: string | SystemFileRef | (string | SystemFileRef)[];
-    output: OutputConfig | null;
-    permissions: PermissionsConfig;
-    skills: SkillRef[];
+    type: AttributionType | null;
+    /**
+     * The GitHub user the session is attributed to, resolved at read time. Null when the attribution is not a GitHub user.
+     */
+    user: GithubAccountSnippet | null;
+}
+/**
+ * Whether the session can take more messages, and whether an agent is warm to answer one.
+ */
+interface SessionConversation {
+    /**
+     * Whether the session stays open after its first turn.
+     */
+    interactive: boolean;
+    prompting: SessionPrompting;
+    state: SessionState;
+    /**
+     * Whether an agent is ready to answer the next message right away. When false, the next message first prepares an environment, which takes longer. A hint only; clients need no logic on it.
+     */
+    warm: boolean;
 }
 /**
- * What the session cost, in millicents, broken down by leg and carrying its own total.
+ * The session's policy for direct messages. Caller authorization and message validation are checked separately.
+ */
+interface SessionPrompting {
+    blocked_reason: PromptBlockedReason | null;
+    detail: string | null;
+    enabled: boolean;
+    surface_name: string | null;
+}
+/**
+ * What the session has cost so far, in millicents, broken down by leg and carrying its own total.
  */
 interface SessionCost {
+    /**
+     * CPU spend in millicents.
+     */
+    cpu: number;
     /**
      * Platform fee in millicents.
      */
@@ -722,41 +729,170 @@ interface SessionCost {
      */
     llm: number;
     /**
-     * Sandbox CPU spend in millicents.
-     */
-    sandbox_cpu: number;
-    /**
-     * Sandbox memory spend in millicents.
+     * Memory spend in millicents.
      */
-    sandbox_memory: number;
+    memory: number;
     /**
-     * The grand total in millicents: llm + sandbox_cpu + sandbox_memory + fee.
+     * The grand total in millicents: llm + cpu + memory + fee.
      */
     total: number;
 }
 /**
- * The environment the session resolved: the saved environment's id and how it was chosen. The environment's frozen body is `config.environment`.
+ * The full environment configuration frozen when the session was created, with the saved environment's id and how it was chosen.
  */
 interface SessionEnvironment {
+    compute: ComputeConfig1;
+    hooks: EnvironmentHooks1;
     /**
-     * Identifier of the saved environment the session's config resolved. Null for an inline environment block or the built-in basic sandbox.
+     * Identifier of the saved environment the session's config resolved. Null for an inline environment block or the built-in basic environment.
      */
-    environment_id: string | null;
+    id: string | null;
+    mcp_servers: (string | McpServerRef | McpStdioServer | McpRemoteServer)[];
+    repositories: RepositoryRef[];
     /**
-     * How the environment was chosen (request, automation, platform_default; repo_default and account_default on sessions from before those ladders were removed). Null when the config carried its own inline environment.
+     * How the environment was chosen (request, agent, platform_default; repo_default and account_default on sessions from before those ladders were removed). An inline request uses request; an inline environment declared in session configuration has no source.
      */
     source: EnvironmentSource | null;
+    variables: EnvironmentVariable[];
+}
+/**
+ * Environment compute sizing. Every field is optional; an omitted field
+ * inherits the platform default (2 vCPU / 4096 MiB / 3600s). A resolved value
+ * outside the platform bounds fails validation loudly (a sync error on the
+ * config) rather than being clamped silently.
+ *
+ * `memory` and `timeout` each accept a shorthand string ("8GB", "30m") or an
+ * explicit units object ({gb: 8}, {minutes: 30}); the `memory_mib` /
+ * `timeout_seconds` properties resolve either form to the canonical integer
+ * the environment is sized with.
+ *
+ * `timeout` is the max wall-clock the agent may run in one environment before
+ * it is stopped, capped at 1h (equal to the default, so today the knob only
+ * shortens a session; the cap matches the 1-hour validity of the session's
+ * GitHub token).
+ *
+ * Compute currently uses a temporary flat one-cent amount each time an
+ * environment is started for a session, subject to the account's existing
+ * free-compute exemptions.
+ */
+interface ComputeConfig1 {
+    cpu: number | null;
+    memory: string | MemorySize | null;
+    timeout: string | Duration | null;
+}
+/**
+ * Environment lifecycle scripts, in order: build_base, after_checkout,
+ * before_start. The first two produce reusable snapshots; before_start runs
+ * before an agent starts or resumes its session. Scripts run as the environment's
+ * user in the workspace directory `/sandbox`. A nonzero exit fails the session.
+ *
+ * Legacy post_start/post_clone scripts remain supported for existing configs;
+ * both run after workspace preparation, before the agent starts or resumes.
+ * They cannot be combined with the new lifecycle fields.
+ */
+interface EnvironmentHooks1 {
+    /**
+     * Prepare the requested source revision after Ellipsis checks out all repositories, before saving the prepared environment. Skipped when that prepared environment is reused.
+     */
+    after_checkout: EnvironmentScript | string | null;
+    /**
+     * Run before the agent starts or resumes a session, after the environment is ready. This hook is not cached and adds to session startup time.
+     */
+    before_start: EnvironmentScript | string | null;
+    /**
+     * Build a reusable environment before full checkout. Cached by declared inputs, script, toolchain, resources, and build configuration. A string is shorthand for run with all repositories as inputs.
+     */
+    build_base: EnvironmentBaseBuild | string | null;
+    /**
+     * Legacy session startup script. Use before_start for session setup or after_checkout for cached source preparation.
+     */
+    post_clone: string | null;
+    /**
+     * Legacy session startup script. Use before_start in new configurations.
+     */
+    post_start: string | null;
+}
+interface GithubPullRequestEvent {
+    action: PullRequestAction | 'review_commented';
+    actor: SessionEventActor | null;
+    branch: string;
+    number: number;
+    repository: string;
+    title: string;
+    type: 'github.pull_request';
+    url: string;
+}
+/**
+ * The event's initiator, when known; never inferred from resource ownership.
+ */
+interface SessionEventActor {
+    avatar_url: string | null;
+    is_bot: boolean | null;
+    name: string;
+}
+interface GithubIssueEvent {
+    action: IssueAction;
+    actor: SessionEventActor | null;
+    number: number;
+    repository: string;
+    title: string;
+    type: 'github.issue';
+    url: string;
+}
+interface GithubPushEvent {
+    actor: SessionEventActor | null;
+    after: string;
+    before: string;
+    branch: string;
+    repository: string;
+    type: 'github.push';
+    url: string;
+}
+interface LinearIssueEvent {
+    action: LinearIssueAction | 'commented';
+    actor: SessionEventActor | null;
+    identifier: string | null;
+    number: number;
+    title: string;
+    type: 'linear.issue';
+    url: string;
+}
+interface SlackMessageEvent {
+    action: 'message' | 'app_mention';
+    actor: SessionEventActor | null;
+    channel_id: string;
+    channel_name: string | null;
+    message_ts: string;
+    thread_ts: string | null;
+    type: 'slack.message';
+    url: string;
+}
+interface SlackChannelCreatedEvent {
+    actor: SessionEventActor | null;
+    channel_id: string;
+    channel_name: string | null;
+    type: 'slack.channel_created';
+    url: string;
+}
+interface SentryAlertEvent {
+    action: SentryAction;
+    actor: SessionEventActor | null;
+    organization_slug: string;
+    project_slug: string | null;
+    title: string | null;
+    type: 'sentry.alert';
+    url: string | null;
 }
 /**
- * Every repo the session touched. Small enough to ride on `agent_sessions`
+ * Every repo the session touched. Small enough to ride on `sessions`
  * and be returned by every session read.
  */
 interface SessionGit {
     repos: SessionGitRepo[];
 }
 /**
- * One checkout in the session's sandbox and everything the session did to
- * it, split by whether it survived the sandbox.
+ * One checkout in the session's environment and everything the session did
+ * to it, split by whether it survived the environment.
  */
 interface SessionGitRepo {
     commits: SessionGitCommit[];
@@ -770,7 +906,7 @@ interface SessionGitRepo {
 }
 /**
  * One commit the session created in this repo (everything past the
- * provisioning checkout's sha), captured from the sandbox rather than the
+ * provisioning checkout's sha), captured from the environment rather than the
  * transcript so it stays correct through amends, rebases, and commits made by
  * scripts. The repo is the parent object, so it is not repeated here.
  */
@@ -804,74 +940,167 @@ interface SessionGitPr {
     url: string;
 }
 /**
- * What preceded this session, if anything.
+ * The saved handler and its display name when the session started.
+ */
+interface SessionHandler {
+    /**
+     * The handler's effective display name when the session started: ellipsis.name, or the service default (Slack, GitHub, Linear, or sentry).
+     */
+    agent_name: string;
+    /**
+     * Identifier of the saved handler.
+     */
+    id: string;
+    service: HandlerService;
+    /**
+     * Content fingerprint of the validated handler configuration used when the session started. This is not the Git commit SHA.
+     */
+    sha: string;
+}
+/**
+ * The predecessor session this session continues.
  */
 interface SessionParent {
     /**
-     * How this session relates to its parent session, if any.
+     * Identifier of the predecessor session this session continues, if any.
      */
-    kind: ParentKind | null;
+    session_id: string | null;
+}
+/**
+ * What the session may touch, per minted credential.
+ */
+interface PermissionsConfig1 {
+    ellipsis: (true | 'all') | EllipsisPermissions;
+    github: GithubPermissions;
+}
+/**
+ * A live one-line summary of what the session is doing, refreshed
+ * every few steps while it runs.
+ */
+interface SessionSummary {
     /**
-     * Identifier of the original session this one was replayed from, if it was started via replay.
+     * When this summary line was generated. Null on summaries written before generation time was tracked.
      */
-    replayed_from_session_id: string | null;
+    created_at: string | null;
     /**
-     * Identifier of the parent session that spawned this one, if any.
+     * One-line description of what the session is doing.
      */
-    session_id: string | null;
+    description: string;
 }
 /**
- * Whether a client may send this session a message and, when it may not, the reason to show instead of a composer.
+ * The tokens the session spent and the model they went to. `total` includes the prompt-cache lanes.
  */
-interface SessionPrompting {
-    blocked_reason: PromptBlockedReason | null;
-    detail: string | null;
-    enabled: boolean;
-    surface_name: string | null;
+interface SessionTokens {
+    /**
+     * Tokens written to the prompt cache.
+     */
+    cache_creation: number;
+    /**
+     * Tokens read from the prompt cache.
+     */
+    cache_read: number;
+    /**
+     * Input tokens used.
+     */
+    input: number;
+    /**
+     * The model the token counts are attributed to.
+     */
+    model: string;
+    /**
+     * Output tokens used.
+     */
+    output: number;
+    /**
+     * Total tokens consumed, INCLUDING the prompt-cache reads and writes — the same basis the token cost is priced on.
+     */
+    total: number;
 }
 /**
- * The stop request, if the session was stopped.
+ * One message and the agent's answer to it. A turn is `pending` from the
+ * moment its message is received until the agent starts on it, `running`
+ * while the agent works, then `completed`, `failed`, `stopped`, or
+ * `cancelled`.
  */
-interface SessionStopped {
+interface SessionTurn {
+    cost: SessionCost1;
+    /**
+     * When the turn's message was received.
+     */
+    created_at: string;
+    /**
+     * A human-readable explanation of a failed, stopped, or cancelled turn.
+     */
+    detail: string | null;
+    /**
+     * When the turn reached its final status.
+     */
+    ended_at: string | null;
+    /**
+     * Unique identifier of the turn.
+     */
+    id: string;
+    /**
+     * Position in the session, starting at 0.
+     */
+    index: number;
     /**
-     * When a stop was requested, if one was.
+     * Why the turn failed or was cancelled; null on every other status.
      */
-    at: string | null;
+    reason: TurnReason | null;
     /**
-     * GitHub account id of the user who stopped the session, if known.
+     * When the agent started on the message.
      */
-    by: number | null;
+    started_at: string | null;
+    status: TurnStatus;
     /**
-     * The GitHub user who stopped the session, resolved at read time.
+     * When and by whom a stop was requested; null when none was.
      */
-    by_user: GithubAccountSnippet | null;
+    stopped: SessionStopped | null;
+    tokens: SessionTokens1;
 }
 /**
- * A live one-line summary of what the session is working on, refreshed
- * every few steps while it runs.
+ * What the turn cost so far, in millicents, broken down by leg.
  */
-interface SessionSummary {
+interface SessionCost1 {
     /**
-     * When this summary line was generated. Null on summaries written before generation time was tracked.
+     * CPU spend in millicents.
      */
-    created_at: string | null;
+    cpu: number;
     /**
-     * One-line description of what the session is working on.
+     * Platform fee in millicents.
      */
-    description: string;
+    fee: number;
+    /**
+     * LLM spend in millicents.
+     */
+    llm: number;
+    /**
+     * Memory spend in millicents.
+     */
+    memory: number;
+    /**
+     * The grand total in millicents: llm + cpu + memory + fee.
+     */
+    total: number;
 }
 /**
- * The public status projection: the durable conversation (`session`), the current execution (`run`), and the one derived `status` word.
+ * When a stop was requested and the GitHub user who requested it.
  */
-interface SessionSurface {
-    run: RunStatus | null;
-    session: SessionLiveness | null;
-    status: string | null;
+interface SessionStopped {
+    /**
+     * When a stop was requested.
+     */
+    at: string;
+    /**
+     * The GitHub user who stopped the session, resolved at read time. Null if the user is unknown or unavailable.
+     */
+    by: GithubAccountSnippet | null;
 }
 /**
- * The tokens the session spent and the model they went to. `total` includes the prompt-cache lanes.
+ * The tokens the turn spent and the model they went to.
  */
-interface SessionTokens {
+interface SessionTokens1 {
     /**
      * Tokens written to the prompt cache.
      */
@@ -897,36 +1126,18 @@ interface SessionTokens {
      */
     total: number;
 }
-/**
- * The external event that started a session, without raw webhook payloads.
- */
-interface SessionTrigger {
-    action: string | null;
-    actor: SessionTriggerActor | null;
-    branch: string | null;
-    number: number | null;
-    repository: string | null;
-    surface: string | null;
-    title: string | null;
-    url: string | null;
-}
-interface SessionTriggerActor {
-    avatar_url: string | null;
-    is_bot: boolean;
-    name: string;
-}
-interface AutomationListStreamMessage {
-    automations: Automation[];
-    type: 'automations';
+interface AgentListStreamMessage {
+    agents: Agent[];
+    type: 'agents';
 }
 /**
- * An automation: a saved agent definition that runs on its trigger or
+ * An agent: a saved agent definition that runs on its trigger or
  * when invoked, plus where it syncs from and the state of that sync.
  */
-interface Automation {
-    config: AutomationConfig1;
+interface Agent {
+    config: AgentConfig1;
     /**
-     * When the automation was created.
+     * When the agent was created.
      */
     created_at: string;
     /**
@@ -934,11 +1145,11 @@ interface Automation {
      */
     display_name: string | null;
     /**
-     * The GitHub account that last edited the automation, when the edit came from a known user.
+     * The GitHub account that last edited the agent, when the edit came from a known user.
      */
     edited_by: GithubAccountSnippet | null;
     /**
-     * Unique identifier of the automation.
+     * Unique identifier of the agent.
      */
     id: string;
     /**
@@ -946,24 +1157,24 @@ interface Automation {
      */
     last_session_created_at: string | null;
     /**
-     * The most recent session this automation started, or null if it has never run.
+     * The most recent session this agent started, or null if it has never run.
      */
     last_session_id: string | null;
     /**
-     * The parse or validation error from the most recent sync attempt, or null when it succeeded. A non-null value means the automation is not running the YAML currently on the branch.
+     * The parse or validation error from the most recent sync attempt, or null when it succeeded. A non-null value means the agent is not running the YAML currently on the branch.
      */
     last_sync_error: string | null;
     /**
-     * The last commit the automation was synced from.
+     * The last commit the agent was synced from.
      */
     last_synced_commit_sha: string | null;
     managed_by: ConfigManagedBy;
     /**
-     * The automation's account-unique addressable name (a slug of its display name); usable anywhere an automation is referenced, interchangeably with the id.
+     * The agent's account-unique addressable name (a slug of its display name); usable anywhere an agent is referenced, interchangeably with the id.
      */
     name: string | null;
     /**
-     * The open pull request that adds this automation's file. Non-null means the automation is not live yet: it starts running once the pull request merges and syncs.
+     * The open pull request that adds this agent's file. Non-null means the agent is not live yet: it starts running once the pull request merges and syncs.
      */
     pending_pull_request_url: string | null;
     /**
@@ -971,27 +1182,27 @@ interface Automation {
      */
     sha: string;
     /**
-     * The repository, path, and branch the automation syncs from. Null only transiently, before the creating pull request's file lands on the branch.
+     * The repository, path, and branch the agent syncs from. Null only transiently, before the creating pull request's file lands on the branch.
      */
     source_details: GithubSourceDetails | null;
     /**
-     * When the automation was last updated.
+     * When the agent was last updated.
      */
     updated_at: string;
 }
 /**
- * The automation definition itself, in the same schema as its YAML file: identity, trigger, input contract, and the session block.
+ * The agent definition itself, in the same schema as its YAML file: identity, trigger, input contract, and the session block.
  */
-interface AutomationConfig1 {
-    ellipsis: AutomationIdentity;
+interface AgentConfig1 {
+    ellipsis: AgentIdentity;
     input: InputContract | null;
     session: SessionConfig;
     trigger: (CronTrigger | ReactTrigger) | null;
 }
 /**
- * Identifies the file a GitHub-sourced automation is synced from.
+ * Identifies the file a GitHub-sourced agent is synced from.
  *
- * Keyed on the repository ID (not owner/name) so repository and org renames
+ * Identified by the repository ID (not owner/name) so repository and org renames
  * don't orphan the config; resolve display names from gh_repositories at
  * read time.
  */
@@ -1004,20 +1215,19 @@ interface CollectionStreamHeartbeat {
     type: 'heartbeat';
 }
 interface SandboxSnapshotFrame {
-    sandbox: SandboxResponse;
+    sandbox: VMExecutionResponse;
     type: 'snapshot';
 }
-interface SandboxResponse {
+interface VMExecutionResponse {
     cache_tier: SandboxCacheTier | null;
     cost_sandbox_cpu: number;
     cost_sandbox_memory: number;
     cpu: number;
-    dockerfile: string | null;
     encrypted_ports: number[];
     environment_variable_keys: string[];
     failed_at: string | null;
+    hooks: EnvironmentHooks2;
     id: string;
-    image_setup: string | null;
     memory_mib: number;
     phase_timings: {
         [k: string]: number;
@@ -1037,6 +1247,38 @@ interface SandboxResponse {
     type: SandboxType;
     unencrypted_ports: number[];
 }
+/**
+ * Environment lifecycle scripts, in order: build_base, after_checkout,
+ * before_start. The first two produce reusable snapshots; before_start runs
+ * before an agent starts or resumes its session. Scripts run as the environment's
+ * user in the workspace directory `/sandbox`. A nonzero exit fails the session.
+ *
+ * Legacy post_start/post_clone scripts remain supported for existing configs;
+ * both run after workspace preparation, before the agent starts or resumes.
+ * They cannot be combined with the new lifecycle fields.
+ */
+interface EnvironmentHooks2 {
+    /**
+     * Prepare the requested source revision after Ellipsis checks out all repositories, before saving the prepared environment. Skipped when that prepared environment is reused.
+     */
+    after_checkout: EnvironmentScript | string | null;
+    /**
+     * Run before the agent starts or resumes a session, after the environment is ready. This hook is not cached and adds to session startup time.
+     */
+    before_start: EnvironmentScript | string | null;
+    /**
+     * Build a reusable environment before full checkout. Cached by declared inputs, script, toolchain, resources, and build configuration. A string is shorthand for run with all repositories as inputs.
+     */
+    build_base: EnvironmentBaseBuild | string | null;
+    /**
+     * Legacy session startup script. Use before_start for session setup or after_checkout for cached source preparation.
+     */
+    post_clone: string | null;
+    /**
+     * Legacy session startup script. Use before_start in new configurations.
+     */
+    post_start: string | null;
+}
 interface SandboxRepository {
     id: number;
     name: string;
@@ -1055,7 +1297,7 @@ interface SandboxPort {
     unencrypted_port: number | null;
 }
 interface SandboxUpdateFrame {
-    sandbox: SandboxResponse;
+    sandbox: VMExecutionResponse;
     type: 'sandbox';
 }
 
@@ -1075,7 +1317,7 @@ declare class Page<ItemT, ResponseT extends CursorResponse> implements AsyncIter
 }
 
 type S$1 = components['schemas'];
-declare const TERMINAL_STATUSES: ReadonlySet<string>;
+declare function isTurnFinal(status: string): boolean;
 interface SessionsApi {
     get(sessionId: string): Promise<S$1['SessionResponse']>;
     stop(sessionId: string): Promise<S$1['SessionResponse']>;
@@ -1084,26 +1326,25 @@ interface SessionsApi {
         images?: S$1['ImageAttachment'][];
         idempotency_key?: string | null;
     }): Promise<S$1['SessionMessageResponse']>;
-    records(sessionId: string, options?: {
-        cursor?: string;
-        limit?: number;
-    }): Promise<unknown>;
+    turns: {
+        get(sessionId: string, turnId: string): Promise<S$1['SessionTurnResponse']>;
+    };
 }
-declare function isSettled(session: S$1['Session']): boolean;
 declare class SessionHandle {
     private readonly sessions;
     readonly id: string;
     session: S$1['Session'];
+    turnId: string | null;
     constructor(sessions: SessionsApi, session: S$1['Session']);
     refresh(): Promise<S$1['Session']>;
     wait(options?: {
         timeoutMs?: number;
         pollIntervalMs?: number;
-    }): Promise<S$1['Session']>;
+    }): Promise<S$1['SessionTurn'] | null>;
     send(message: string, options?: {
         images?: S$1['ImageAttachment'][];
         idempotencyKey?: string;
-    }): Promise<S$1['SessionMessage']>;
+    }): Promise<S$1['SessionMessageResponse']>;
     stop(): Promise<S$1['Session']>;
 }
 
@@ -1139,18 +1380,36 @@ declare class EllipsisAccountApiKeys {
      *
      * Authenticate as a dashboard user or with a user token. An organization
      * API key cannot create other keys. The secret is returned only once.
+     *
+     * Required permissions: write:tokens.
+     * API key: Requires a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     create(options: {
         name: string;
     }): Promise<S['CreateApiKeyResponse']>;
     /**
      * List Api Keys
+     *
+     * Required permissions: read:tokens.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['ListApiKeysResponse']>;
     /**
      * Revoke Api Key
      *
      * Revoke an organization key as a verified GitHub administrator.
+     *
+     * Required permissions: delete:tokens.
+     * API key: Requires a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     revoke(api_key_id: string): Promise<S['TokenRevokedResponse']>;
 }
@@ -1164,6 +1423,12 @@ declare class EllipsisAccountBillingAutoRecharge {
      *
      * An account without saved settings returns disabled defaults and no
      * card. No payment-method identifier or card details are exposed.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(): Promise<S['AutoRechargeSettings']>;
     /**
@@ -1171,11 +1436,17 @@ declare class EllipsisAccountBillingAutoRecharge {
      *
      * Set your automatic credit recharge policy.
      *
-     * Requires a human account administrator; API keys and sandbox tokens
+     * Requires a human account administrator; API keys and session tokens
      * cannot change this policy. Supply enabled explicitly. Saving amounts
      * with enabled=false keeps recharge off; enabling requires a saved card.
      * A recharge buys amount_cents of credit and charges the platform fee
      * in addition. Amounts and thresholds preserve exact cents.
+     *
+     * Required permissions: write:account.
+     * API key: Requires a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     set(options: {
         amount_cents: number;
@@ -1195,6 +1466,12 @@ declare class EllipsisAccountBilling {
      * Requires a human account administrator. Open the returned URL to
      * finish setup and return to Billing. Saving a card does not enable
      * auto-recharge or buy credit.
+     *
+     * Required permissions: write:account.
+     * API key: Requires a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     cardSetup(): Promise<S['BillingCheckout']>;
     /**
@@ -1206,6 +1483,12 @@ declare class EllipsisAccountBilling {
      * complete payment. Credit is granted only after payment succeeds;
      * the platform fee is charged in addition to amount_cents. Returning
      * to Billing carries the checkout session ID for receipt lookup.
+     *
+     * Required permissions: write:account.
+     * API key: Requires a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     checkout(options: {
         amount_cents: number;
@@ -1217,12 +1500,24 @@ declare class EllipsisAccountBilling {
      * bootstrap that otherwise fires lazily at the first session (Stripe
      * customer + usage subscription + the signup grant). A repeat call is
      * a no-op that returns the current state.
+     *
+     * Required permissions: write:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     claimSignupCredit(): Promise<S['BillingStatus']>;
     /**
      * Get Fee Schedule
      *
      * Get the account's rate card, in US dollars.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     feeSchedule(): Promise<S['FeeScheduleResponse']>;
     /**
@@ -1232,6 +1527,12 @@ declare class EllipsisAccountBilling {
      *
      * Returns only your account's grants. The total is before usage;
      * /v1/account/budget reports the available balance.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     grants(): Promise<S['CreditGrantsResponse']>;
     /**
@@ -1241,6 +1542,12 @@ declare class EllipsisAccountBilling {
      *
      * The amount includes the platform fee and comes from Stripe. An
      * incomplete, missing, or other-account purchase returns 404.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     purchase(checkout_id: string): Promise<S['CreditPurchaseReceipt']>;
     /**
@@ -1250,6 +1557,12 @@ declare class EllipsisAccountBilling {
      *
      * All amounts are integer US cents. The fee is added to the credit
      * amount; it does not reduce the credit granted.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     purchaseOptions(): Promise<S['CreditPurchaseOptions']>;
     /**
@@ -1260,6 +1573,12 @@ declare class EllipsisAccountBilling {
      * Uses the same account gate as session admission, including credit,
      * contact email, and personal Claude subscription eligibility. Scoped
      * spend limits are reported separately by /v1/account/budget.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     status(): Promise<S['BillingStatus']>;
 }
@@ -1279,6 +1598,12 @@ declare class EllipsisAccountModels {
      * Reads the same registry as the dashboard's rate table, so a
      * client's model picker can never drift from what's offered. The
      * selectable set is global; only the flag is account-scoped.
+     *
+     * Required permissions: read:templates.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['ModelsListResponse']>;
 }
@@ -1291,61 +1616,106 @@ declare class EllipsisAccountNotifications {
      * Send the alert email template to one address with sample data,
      * so a typo'd finance alias is caught by a human instead of failing
      * silently when a real alert fires.
+     *
+     * Required permissions: write:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     testEmail(options: {
         email: string;
     }): Promise<S['AccountActionResponse']>;
 }
+declare class EllipsisAccountOnboarding {
+    private readonly transport;
+    constructor(transport: Transport);
+    /**
+     * Get Account Onboarding
+     *
+     * Read the account's saved onboarding answers, or null before setup.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    get(): Promise<S['AccountOnboardingResponse']>;
+    /**
+     * Update Account Onboarding
+     *
+     * Save supplied onboarding answers, preserving omitted answers.
+     *
+     * Organizations can save their work email before selecting use cases.
+     * Saving use cases requires a valid organization work email and at
+     * least one choice. When Other is the only choice, describe it.
+     * Personal accounts save a null work email. This does not change the
+     * billing contact email. Session tokens cannot update answers.
+     * Supplying an organization work email requires a human user and sends
+     * a Slack Connect invitation. Slack failures do not undo saved answers.
+     *
+     * Required permissions: write:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    update(options?: {
+        other_use_case?: string | null;
+        use_cases?: (S['AccountOnboardingUseCase'])[];
+        work_email?: string | null;
+    }): Promise<S['AccountOnboardingResponse']>;
+}
 declare class EllipsisAccountProvidersAnthropic {
     private readonly transport;
     constructor(transport: Transport);
     /**
      * Delete Anthropic Config
+     *
+     * Required permissions: delete:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(): Promise<void>;
     /**
      * Get Anthropic Config
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(): Promise<S['AnthropicConfigResponse']>;
     /**
      * Put Anthropic Config
+     *
+     * Required permissions: write:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     set(options: {
         api_key: string;
     }): Promise<S['AnthropicConfigResponse']>;
     /**
      * Validate Anthropic Config
+     *
+     * Required permissions: write:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     validate(): Promise<S['ValidateAnthropicConfigResponse']>;
 }
-declare class EllipsisAccountProvidersBedrock {
-    private readonly transport;
-    constructor(transport: Transport);
-    /**
-     * Delete Bedrock Config
-     */
-    delete(): Promise<void>;
-    /**
-     * Get Bedrock Config
-     */
-    get(): Promise<S['BedrockConfigResponse']>;
-    /**
-     * Put Bedrock Config
-     */
-    set(options: {
-        model_map: Record<string, string>;
-        region: string;
-        role_arn: string;
-    }): Promise<S['BedrockConfigResponse']>;
-    /**
-     * Validate Bedrock Config
-     */
-    validate(): Promise<S['ValidateBedrockConfigResponse']>;
-}
 declare class EllipsisAccountProviders {
     private readonly transport;
     readonly anthropic: EllipsisAccountProvidersAnthropic;
-    readonly bedrock: EllipsisAccountProvidersBedrock;
     constructor(transport: Transport);
 }
 declare class EllipsisAccountSettings {
@@ -1359,6 +1729,12 @@ declare class EllipsisAccountSettings {
      * Session model and budget defaults, code review and mention behavior,
      * analytics, retention, and notification contacts. PATCH replaces
      * supplied sections; PUT preserves its model-and-budget-only behavior.
+     *
+     * Required permissions: read:defaults.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(): Promise<S['AccountSettings']>;
     /**
@@ -1371,8 +1747,14 @@ declare class EllipsisAccountSettings {
      * default a session's model resolves against);
      * `budget_ceiling.session` is in US dollars, at most the platform
      * ceiling, and null clears it.
-     * Refused for sandbox tokens (potentially prompt-injected code must
+     * Refused for session tokens (potentially prompt-injected code must
      * not repoint the organization's defaults).
+     *
+     * Required permissions: write:defaults.
+     * API key: Requires a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     set(options: {
         budget_ceiling?: S['BudgetCeiling'];
@@ -1384,6 +1766,12 @@ declare class EllipsisAccountSettings {
      * Replace supplied settings sections without changing omitted sections.
      *
      * Changes to model or budget defaults require a GitHub administrator.
+     *
+     * Required permissions: write:defaults.
+     * API key: Cannot set budget_ceiling, default_model to a non-null value; those changes require a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator when setting budget_ceiling, default_model to a non-null value.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     update(options?: {
         analytics?: S['AnalyticsSettings'] | null;
@@ -1391,7 +1779,6 @@ declare class EllipsisAccountSettings {
         code_review?: S['CodeReviewSettings'] | null;
         data_retention?: S['DataRetentionSettings'] | null;
         default_model?: string | null;
-        mention?: S['MentionSettings'] | null;
         notifications?: S['NotificationSettings'] | null;
     }): Promise<S['AccountSettings']>;
 }
@@ -1401,6 +1788,7 @@ declare class EllipsisAccount {
     readonly billing: EllipsisAccountBilling;
     readonly models: EllipsisAccountModels;
     readonly notifications: EllipsisAccountNotifications;
+    readonly onboarding: EllipsisAccountOnboarding;
     readonly providers: EllipsisAccountProviders;
     readonly settings: EllipsisAccountSettings;
     constructor(transport: Transport);
@@ -1410,10 +1798,22 @@ declare class EllipsisAccount {
      * All-time per-surface activity flags: the dashboards' demo-data
      * fallback reads these instead of inferring "no history" from a
      * windowed, filtered response.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     activity(): Promise<S['AccountActivity']>;
     /**
      * Get Customer Audit Log
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     auditLog(): Promise<S['AccountAuditLogResponse']>;
     /**
@@ -1424,15 +1824,27 @@ declare class EllipsisAccount {
      * Budgets cover the trailing 1, 7 and 28 days; they do not replenish
      * prepaid credit. Amounts include measured usage from active sessions.
      * Each paid LLM request requires positive credit and budget headroom.
-     * An admitted request can overshoot; concurrency is limited to five
-     * paid requests per account and one per session.
+     * An admitted request can overshoot; concurrent paid requests are limited
+     * by your account and per-session allowances.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     budget(): Promise<S['BudgetSummary']>;
     /**
      * Update Customer
+     *
+     * Required permissions: write:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     update(options?: {
-        can_start_job_runs?: boolean | null;
+        can_start_sessions?: boolean | null;
         contact_email?: string | null;
     }): Promise<S['AccountResponse']>;
     /**
@@ -1444,28 +1856,222 @@ declare class EllipsisAccount {
      * preserved. Set policy.developer_defaults to null to disable developer
      * limits. Null override windows inherit their default. API keys use
      * their stable ID, not their secret. Changes apply to the next paid
-     * request, including sessions already running. API keys and sandbox
-     * credentials cannot edit budgets. The session ceiling remains at
+     * request, including sessions already running. API keys and session
+     * tokens cannot edit budgets. The session ceiling remains at
      * /account/settings; purchasing credits is separate from budget policy.
+     *
+     * Required permissions: write:defaults.
+     * API key: Requires a CLI user token belonging to an account administrator.
+     * CLI user token: Requires an account administrator.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    updateBudget(options?: {
+        alerts?: S['BudgetAlerts'] | null;
+        policy?: S['BudgetPolicy'] | null;
+    }): Promise<S['BudgetSummary']>;
+    /**
+     * Get Usage
+     *
+     * Get usage for a calendar month, including its funding sources.
+     *
+     * Omit period_start for the current UTC month; select a period returned
+     * in billing_periods to view history. Credit debits are distinct from
+     * rated token usage through BYOK or a developer's Claude or Codex
+     * subscription. Rated usage estimates are not provider invoices.
+     * Pending and unresolved requests identify missing measurements.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    usage(options?: {
+        period_start?: string | null;
+    }): Promise<S['GetUsageOverTimeResponse']>;
+}
+declare class EllipsisAgents {
+    private readonly transport;
+    constructor(transport: Transport);
+    /**
+     * Create Agent
+     *
+     * Create an agent, managed through the API: no file, live
+     * immediately. To put its definition in a repository instead, create
+     * it here and then POST /v1/agents/{agent_id}/link.
+     *
+     * 409 when another live agent already holds the name.
+     *
+     * Required permissions: write:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    create(options: {
+        agent: S['AgentConfig-Input'];
+    }): Promise<S['AgentResponse']>;
+    /**
+     * Delete Agent
+     *
+     * Delete an agent, by id or by name.
+     *
+     * It stops running and its name is freed immediately; its past
+     * sessions remain readable. Only for agents managed through
+     * this API — delete the file to remove one defined by a repository.
+     *
+     * Required permissions: write:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    delete(agent_id: string): Promise<void>;
+    /**
+     * Get Agent
+     *
+     * Return one agent, by id or by name.
+     *
+     * Required permissions: read:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    get(agent_id: string): Promise<S['AgentResponse']>;
+    /**
+     * Link Agent
+     *
+     * Move an agent into a repository, by id or by name.
+     *
+     * Opens a pull request adding its definition file. The agent
+     * keeps running unchanged meanwhile; merging hands it over to the
+     * file, after which the file is what changes it. Nothing happens
+     * if the pull request is never merged.
+     *
+     * Required permissions: write:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    link(agent_id: string, options: {
+        path?: string | null;
+        repository: string;
+    }): Promise<S['LinkAgentResponse']>;
+    /**
+     * List Agents
+     *
+     * List agents.
+     *
+     * Required permissions: read:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    list(): Promise<S['AgentsListResponse']>;
+    /**
+     * Get Agent Metrics
+     *
+     * Return an agent's session distribution and trailing spend,
+     * by id or by name.
+     *
+     * `samples` carries one entry per finished session (duration, cost,
+     * tokens) for distributions; `spend_windows` carries what the
+     * agent's sessions cost over the last 1, 7, and 28 days against
+     * its budget for each window.
+     *
+     * Required permissions: read:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    metrics(agent_id: string): Promise<S['AgentMetricsResponse']>;
+    /**
+     * Start Agent Session
+     *
+     * Invoke an agent.
+     *
+     * Runs a certified agent with its configured instructions, model,
+     * environment, permissions, skills, and budget, and returns
+     * the session it started. The session runs once and does not accept
+     * follow-up messages. If the agent declares input.json_schema,
+     * send only `input` for its initial message. Otherwise send a non-empty
+     * `prompt`, which becomes the initial message verbatim. Both fields
+     * together, neither field, and input that renders an empty message are
+     * rejected with 422. An optional `budget` lowers the session cap;
+     * `metadata` tags the session. Codex invocations are not supported.
+     *
+     * Required permissions: write:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    run(agent_id: string, options?: {
+        budget?: number | null;
+        input?: Record<string, unknown> | null;
+        metadata?: Record<string, string>;
+        prompt?: string | null;
+    }): Promise<S['SessionResponse']>;
+    /**
+     * Get Agents Stream Ticket
+     *
+     * Required permissions: read:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    streamTicket(): Promise<S['StreamTicketResponse']>;
+    /**
+     * Unlink Agent
+     *
+     * Take over an agent from its file, by id or by name.
+     *
+     * The file stops governing it immediately and further changes go
+     * through this API. The file is left in place, inert — delete it
+     * whenever you like.
+     *
+     * Required permissions: write:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
-    updateBudget(options?: {
-        alerts?: S['BudgetAlerts'] | null;
-        policy?: S['BudgetPolicy'] | null;
-    }): Promise<S['BudgetSummary']>;
+    unlink(agent_id: string): Promise<S['AgentResponse']>;
     /**
-     * Get Usage
+     * Update Agent
      *
-     * Get usage for a calendar month, including its funding sources.
+     * Replace an agent's definition, by id or by name.
      *
-     * Omit period_start for the current UTC month; select a period returned
-     * in billing_periods to view history. Credit debits are distinct from
-     * rated token usage through BYOK, customer Bedrock, or a developer's
-     * Claude subscription. Rated usage estimates are not provider invoices.
-     * Pending and unresolved requests identify missing measurements.
+     * The whole definition is replaced, and the change is live at
+     * once. Only for agents managed through this API: one defined
+     * by a repository file is a 409, since the next push to that file
+     * would revert the change — unlink it first to take ownership.
+     *
+     * Required permissions: write:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
-    usage(options?: {
-        period_start?: string | null;
-    }): Promise<S['GetUsageOverTimeResponse']>;
+    update(agent_id: string, options: {
+        agent: S['AgentConfig-Input'];
+    }): Promise<S['AgentResponse']>;
 }
 declare class EllipsisAlerts {
     private readonly transport;
@@ -1476,6 +2082,12 @@ declare class EllipsisAlerts {
      * Dismiss an open alert and return it.
      *
      * 409 when the alert is not open; 404 when it doesn't exist.
+     *
+     * Required permissions: write:alerts.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     dismiss(alert_id: string): Promise<S['AlertResponse']>;
     /**
@@ -1484,6 +2096,12 @@ declare class EllipsisAlerts {
      * Return one alert by id.
      *
      * 404 if it doesn't exist or belongs to another organization.
+     *
+     * Required permissions: read:alerts.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(alert_id: string): Promise<S['AlertResponse']>;
     /**
@@ -1495,6 +2113,12 @@ declare class EllipsisAlerts {
      *
      * Available to all credential types, so an agent can check "is
      * this org near budget?" mid-task.
+     *
+     * Required permissions: read:alerts.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(options?: {
         status?: S['AlertStatus'] | null;
@@ -1518,6 +2142,12 @@ declare class EllipsisAnalytics {
      * the apps/agents). Available to all credential types: the
      * responses expose the organization's own GitHub PR/review activity,
      * no secrets.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     metrics(options?: {
         days?: number | null;
@@ -1535,6 +2165,12 @@ declare class EllipsisAnalytics {
      *
      * Windowing: pass explicit start/end, or days (default: the last
      * 30 days). account_type in all|user|bot scopes the authors.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     pullRequests(options?: {
         days?: number | null;
@@ -1554,6 +2190,12 @@ declare class EllipsisAnalytics {
      * review the most PRs?" is the reviewer facets here with
      * account_type=bot. Windowing: pass explicit start/end, or days
      * (default: the last 30 days).
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     reviews(options?: {
         days?: number | null;
@@ -1574,6 +2216,8 @@ declare class EllipsisAuthCli {
      * Poll a device-code auth flow for its token.
      *
      * Unauthenticated; the device code identifies the flow.
+     *
+     * Authentication: No token required.
      */
     poll(options: {
         device_code: string;
@@ -1586,6 +2230,8 @@ declare class EllipsisAuthCli {
      * Unauthenticated: the CLI has no credential yet — that's what
      * it's obtaining. The human authorizes out-of-band in the
      * dashboard.
+     *
+     * Authentication: No token required.
      */
     start(): Promise<S['StartCliAuthResponse']>;
 }
@@ -1594,118 +2240,6 @@ declare class EllipsisAuth {
     readonly cli: EllipsisAuthCli;
     constructor(transport: Transport);
 }
-declare class EllipsisAutomations {
-    private readonly transport;
-    constructor(transport: Transport);
-    /**
-     * Create Automation
-     *
-     * Create an automation, managed through the API: no file, live
-     * immediately. To put its definition in a repository instead, create
-     * it here and then POST /v1/automations/{automation_id}/link.
-     *
-     * 409 when another live automation already holds the name.
-     */
-    create(options: {
-        automation: S['AutomationConfig'];
-    }): Promise<S['AutomationResponse']>;
-    /**
-     * Delete Automation
-     *
-     * Delete an automation, by id or by name.
-     *
-     * It stops running and its name is freed immediately; its past
-     * sessions remain readable. Only for automations managed through
-     * this API — delete the file to remove one defined by a repository.
-     */
-    delete(automation_id: string): Promise<void>;
-    /**
-     * Get Automation
-     *
-     * Return one automation, by id or by name.
-     */
-    get(automation_id: string): Promise<S['AutomationResponse']>;
-    /**
-     * Link Automation
-     *
-     * Move an automation into a repository, by id or by name.
-     *
-     * Opens a pull request adding its definition file. The automation
-     * keeps running unchanged meanwhile; merging hands it over to the
-     * file, after which the file is what changes it. Nothing happens
-     * if the pull request is never merged.
-     */
-    link(automation_id: string, options: {
-        path?: string | null;
-        repository: string;
-    }): Promise<S['LinkAutomationResponse']>;
-    /**
-     * List Automations
-     *
-     * List automations.
-     */
-    list(): Promise<S['AutomationsListResponse']>;
-    /**
-     * Get Automation Metrics
-     *
-     * Return an automation's session distribution and trailing spend,
-     * by id or by name.
-     *
-     * `samples` carries one entry per finished session (duration, cost,
-     * tokens) for distributions; `spend_windows` carries what the
-     * automation's sessions cost over the last 1, 7, and 28 days against
-     * its budget for each window.
-     */
-    metrics(automation_id: string): Promise<S['AutomationMetricsResponse']>;
-    /**
-     * Start Automation Session
-     *
-     * Invoke an automation.
-     *
-     * Runs a certified automation with its configured instructions, model,
-     * environment, permissions, skills, and budget, and returns
-     * the session it started. The session runs once and does not accept
-     * follow-up messages. If the automation declares input.json_schema,
-     * send only `input` for its initial message. Otherwise send a non-empty
-     * `prompt`, which becomes the initial message verbatim. Both fields
-     * together, neither field, and input that renders an empty message are
-     * rejected with 422. An optional `budget` lowers the session cap;
-     * `metadata` tags the session. Codex invocations are not supported.
-     */
-    run(automation_id: string, options?: {
-        budget?: number | null;
-        input?: Record<string, unknown> | null;
-        metadata?: Record<string, string>;
-        prompt?: string | null;
-    }): Promise<S['SessionResponse']>;
-    /**
-     * Get Automations Stream Ticket
-     */
-    streamTicket(): Promise<S['StreamTicketResponse']>;
-    /**
-     * Unlink Automation
-     *
-     * Take over an automation from its file, by id or by name.
-     *
-     * The file stops governing it immediately and further changes go
-     * through this API. The file is left in place, inert — delete it
-     * whenever you like.
-     */
-    unlink(automation_id: string): Promise<S['AutomationResponse']>;
-    /**
-     * Update Automation
-     *
-     * Replace an automation's definition, by id or by name.
-     *
-     * The whole definition is replaced, and the change is live at
-     * once. Only for automations managed through this API: one defined
-     * by a repository file is a 409, since the next push to that file
-     * would revert the change — unlink it first to take ownership.
-     */
-    update(automation_id: string, options: {
-        automation: S['AutomationConfig'];
-    }): Promise<S['AutomationResponse']>;
-}
 declare class EllipsisEnvironments {
     private readonly transport;
     constructor(transport: Transport);
@@ -1717,9 +2251,15 @@ declare class EllipsisEnvironments {
      * `kind: environment` YAML under an agents directory.
      *
      * 409 when another live environment already holds the name.
+     *
+     * Required permissions: write:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     create(options: {
-        environment: S['EnvironmentDocument'];
+        environment: S['EnvironmentDocument-Input'];
     }): Promise<S['EnvironmentResponse']>;
     /**
      * Delete Environment
@@ -1731,18 +2271,36 @@ declare class EllipsisEnvironments {
      * environment. Past sessions remain readable. Only for environments
      * managed through this API — delete the file to remove one defined
      * by a repository.
+     *
+     * Required permissions: delete:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(environment_id: string): Promise<void>;
     /**
      * Get Environment
      *
      * Return one saved environment, by id or by name.
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(environment_id: string): Promise<S['EnvironmentResponse']>;
     /**
      * List Environments
      *
      * List saved environments.
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['EnvironmentsListResponse']>;
     /**
@@ -1754,77 +2312,71 @@ declare class EllipsisEnvironments {
      * resolve the new body; running sessions keep the one frozen at
      * their start. Only for environments managed through this API: one
      * defined by a repository file is a 409.
+     *
+     * Required permissions: write:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     update(environment_id: string, options: {
-        environment: S['EnvironmentDocument'];
+        environment: S['EnvironmentDocument-Input'];
     }): Promise<S['EnvironmentResponse']>;
 }
-declare class EllipsisFiles {
+declare class EllipsisHandlers {
     private readonly transport;
     constructor(transport: Transport);
     /**
-     * Create File
+     * List Handlers
      *
-     * Upload a file that outlives the sandbox.
+     * List the account's Slack, GitHub, Linear, and Sentry handlers.
      *
-     * v1: PNG images only, base64 in the JSON body, 10 MiB cap. The
-     * primary caller is the in-sandbox `agent file upload` CLI (an
-     * agent persisting a screenshot to link on a PR), but all
-     * credential types work. Returns the org-membership-gated
-     * dashboard URL so callers never hard-code URL shapes.
-     */
-    create(options: {
-        content_type: string;
-        data_b64: string;
-        filename: string;
-    }): Promise<S['CreateFileResponse']>;
-    /**
-     * Delete File
+     * Returns at most one handler per service, from the current .ellipsis
+     * repository. Disabled handlers and last valid definitions with sync
+     * errors are included. Missing handlers are omitted. This reads saved
+     * state without fetching GitHub or triggering synchronization.
      *
-     * Delete a file.
+     * Requires configs:read; scoped grants match handlers/{service}.
+     * Session tokens with that grant may read handlers.
      *
-     * A foreign, missing, or already-deleted id is an
-     * indistinguishable 404, so ids can't be enumerated. Sandbox
-     * tokens get a 403 (a sandbox token sits next to
-     * potentially-untrusted code and must not be able to destroy the
-     * account's files — uploading is fine, destruction is not); API
-     * keys and user tokens may delete.
+     * Required permissions: read:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
-    delete(file_id: string): Promise<void>;
+    list(): Promise<S['HandlersListResponse']>;
     /**
-     * Get File
+     * Get Handler Metrics
      *
-     * Return one file's metadata and download link.
+     * Return session counts and accumulated spend for a saved handler.
      *
-     * Includes the gated dashboard URL and a short-lived presigned
-     * `download_url`, plus the owning account's GitHub login.
+     * Filters only by session creation time. Omitted bounds include all
+     * history. Counts use the current turn and conversation state, so an open
+     * conversation awaiting another message remains active. Spend includes the selected sessions' full
+     * accumulated cost, including activity after the creation-time window.
+     * Only sessions carrying this exact saved handler id are counted;
+     * legacy sessions without handler provenance are excluded.
      *
-     * Signed-in dashboard users are checked against the file's owning
-     * account, regardless of their selected organization. API keys,
-     * CLI user tokens, and sandbox tokens remain restricted to their
-     * own account. Missing, deleted, and inaccessible files return 404.
-     *
-     * To fetch the bytes locally, call this and then GET download_url
-     * immediately — the JSON API never carries the file. The CLI's
-     * `agent file get` wraps exactly that two-step.
-     */
-    get(file_id: string): Promise<S['GetFileResponse']>;
-    /**
-     * List Files
+     * spend_windows reports current trailing 1-, 7-, and 28-day credit
+     * debits and effective handler budgets across all attributed sessions.
+     * Those windows use usage timestamps and are independent of start/end.
      *
-     * List uploaded files, newest first.
+     * Requires configs:read matching handlers/{service} and unrestricted
+     * sessions:read. Session tokens with both grants may read metrics.
      *
-     * Metadata only by default. Set include_download_urls=true to get
-     * a download_urls map keyed by file id for thumbnails or batch
-     * downloads. URLs expire within about a minute. session_id scopes
-     * the list to one session's uploads.
+     * Required permissions: read:sessions, read:configs.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
-    list(options?: {
-        session_id?: string | null;
-        limit?: number;
-        cursor?: string | null;
-        include_download_urls?: boolean;
-    }): Promise<Page<S['File'], S['FilesListResponse']>>;
+    metrics(handler_id: string, options?: {
+        start?: string | null;
+        end?: string | null;
+    }): Promise<S['HandlerMetricsResponse']>;
 }
 declare class EllipsisIntegrationsGithub {
     private readonly transport;
@@ -1839,16 +2391,34 @@ declare class EllipsisIntegrationsGithub {
      *
      * Members carry their linked Slack identity when a Slack-GitHub
      * link exists, and /slack/members carries the reverse link.
+     *
+     * Required permissions: read:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     members(): Promise<S['GithubMembersListResponse']>;
     /**
      * List Github Repositories
      *
      * List GitHub repositories connected to the installation.
+     *
+     * Required permissions: read:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     repos(): Promise<S['GithubRepositoriesListResponse']>;
     /**
      * Uninstall Github App
+     *
+     * Required permissions: write:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     uninstall(options: {
         confirm_account_login: string;
@@ -1859,16 +2429,34 @@ declare class EllipsisIntegrationsLinear {
     constructor(transport: Transport);
     /**
      * Delete Linear Integration
+     *
+     * Required permissions: delete:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(): Promise<S['AccountActionResponse']>;
     /**
      * List Linear Teams
      *
      * List the teams of the connected Linear workspace.
+     *
+     * Required permissions: read:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     teams(): Promise<S['LinearTeamsListResponse']>;
     /**
      * Update Linear Teams
+     *
+     * Required permissions: write:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     updateSettings(options: {
         mcp_inclusion?: S['McpInclusionMode'] | null;
@@ -1880,12 +2468,24 @@ declare class EllipsisIntegrationsSentry {
     constructor(transport: Transport);
     /**
      * Delete Sentry Integration
+     *
+     * Required permissions: delete:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(integration_id: string): Promise<S['AccountActionResponse']>;
     /**
      * List Sentry Organizations
      *
      * List the connected Sentry organizations.
+     *
+     * Required permissions: read:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     organizations(): Promise<S['SentryOrganizationsListResponse']>;
 }
@@ -1897,14 +2497,32 @@ declare class EllipsisIntegrationsSlack {
      *
      * List the channels of the connected Slack workspace, fetched
      * live from the Slack API.
+     *
+     * Required permissions: read:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     channels(): Promise<S['SlackChannelsListResponse']>;
     /**
      * Create Operations Channel
+     *
+     * Required permissions: write:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     createOperationsChannel(): Promise<S['SlackChannel']>;
     /**
      * Delete Slack Integration
+     *
+     * Required permissions: delete:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(): Promise<S['AccountActionResponse']>;
     /**
@@ -1912,10 +2530,22 @@ declare class EllipsisIntegrationsSlack {
      *
      * List the members of the connected Slack workspace, fetched
      * live from the Slack API.
+     *
+     * Required permissions: read:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     members(): Promise<S['SlackMembersListResponse']>;
     /**
      * Update Slack Settings
+     *
+     * Required permissions: write:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     updateSettings(options: {
         mcp_inclusion: S['McpInclusionMode'];
@@ -1935,10 +2565,16 @@ declare class EllipsisIntegrations {
      *
      * A read-only view, so an agent authoring another agent's
      * config can learn which repositories, channels, teams, and
-     * organizations it may name before POST /automations.
+     * organizations it may name before POST /agents.
      *
-     * Available to all credential types including sandbox tokens: the
+     * Available to all credential types including session tokens: the
      * responses never include OAuth tokens or any other secret.
+     *
+     * Required permissions: read:integrations.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['GetIntegrationsResponse']>;
 }
@@ -1957,6 +2593,13 @@ declare class EllipsisMemories {
      *
      * Creating never overwrites: a path that already exists is a 409, so
      * correcting an existing memory is an explicit edit.
+     *
+     * Required permissions: write:memories.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     create(options: {
         content: string;
@@ -1971,6 +2614,13 @@ declare class EllipsisMemories {
      * Available to every credential type, agents included — a wrong
      * memory is worse than a missing one. The deleted content is kept in
      * the memory's history for forensics, not for an undo API.
+     *
+     * Required permissions: delete:memories.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     delete(memory_id: string, options?: {
         if_sha256?: string | null;
@@ -1986,6 +2636,13 @@ declare class EllipsisMemories {
      *
      * Pass `if_sha256` (from a previous read) to make a concurrent write
      * a 409 instead of silently overwriting it.
+     *
+     * Required permissions: write:memories.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     edit(memory_id: string, options?: {
         content?: string | null;
@@ -1998,6 +2655,13 @@ declare class EllipsisMemories {
      * Read one memory's full content.
      *
      * The id comes from the index returned by listing memories.
+     *
+     * Required permissions: read:memories.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     get(memory_id: string): Promise<S['MemoryResponse']>;
     /**
@@ -2009,6 +2673,13 @@ declare class EllipsisMemories {
      * memory, carrying its id, path, and description) plus the same
      * entries structured, each with every field except `content`. Read
      * the index, then fetch the ids whose content you want.
+     *
+     * Required permissions: read:memories.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     list(options?: {
         prefix?: string | null;
@@ -2019,6 +2690,12 @@ declare class EllipsisReviews {
     constructor(transport: Transport);
     /**
      * List Review Configs
+     *
+     * Required permissions: read:reviews.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     configs(): Promise<S['GetCodeReviewConfigsResponse']>;
     /**
@@ -2032,10 +2709,16 @@ declare class EllipsisReviews {
      * the automatic one.
      *
      * A review is one pipeline run over one commit range, with one
-     * agent session per stage: `review.id` is the run id, and
+     * agent session per stage: `review.id` is the review id, and
      * `stages[].session_id` is where a client streams
      * (/sessions/{id}/stream on a stage session), since the review
      * itself is a pipeline rather than one process.
+     *
+     * Required permissions: write:reviews.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     create(options: {
         owner: string;
@@ -2055,6 +2738,12 @@ declare class EllipsisReviews {
      * Findings only exist after a stage session finalizes — a running
      * review honestly reports [] / null, which is why a client
      * streams a stage session and then re-fetches the review.
+     *
+     * Required permissions: read:reviews.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(review_id: string): Promise<S['Review']>;
     /**
@@ -2069,6 +2758,12 @@ declare class EllipsisReviews {
      *
      * Webhook-created reviews appear here too, so this answers "show
      * me every review on this PR".
+     *
+     * Required permissions: read:reviews.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(options?: {
         repository?: (string)[];
@@ -2080,22 +2775,6 @@ declare class EllipsisReviews {
         cursor?: string | null;
     }): Promise<Page<S['Review'], S['ReviewsListResponse']>>;
 }
-declare class EllipsisSandboxes {
-    private readonly transport;
-    constructor(transport: Transport);
-    /**
-     * Get Single Sandbox
-     */
-    get(sandbox_id: string): Promise<S['SandboxResponse']>;
-    /**
-     * Get Sandboxes
-     */
-    list(): Promise<void>;
-    /**
-     * Get Sandbox Stream Ticket
-     */
-    streamTicket(sandbox_id: string): Promise<S['StreamTicketResponse']>;
-}
 declare class EllipsisSecrets {
     private readonly transport;
     constructor(transport: Transport);
@@ -2104,8 +2783,15 @@ declare class EllipsisSecrets {
      *
      * Delete a secret by name.
      *
-     * Refused for sandbox tokens; mutations require an API key or
+     * Refused for session tokens; mutations require an API key or
      * user token.
+     *
+     * Required permissions: delete:secrets.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     delete(name: string): Promise<void>;
     /**
@@ -2115,6 +2801,13 @@ declare class EllipsisSecrets {
      *
      * Values are write-only: the response carries only names and
      * timestamps, never the stored value.
+     *
+     * Required permissions: read:secrets.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     list(): Promise<S['SecretsListResponse']>;
     /**
@@ -2123,117 +2816,203 @@ declare class EllipsisSecrets {
      * Upsert secrets.
      *
      * Returns only the secrets this call wrote, names and timestamps
-     * only — values are write-only. Refused for sandbox tokens (held by
-     * potentially-untrusted in-sandbox code); mutations require an
-     * API key or user token.
+     * only — values are write-only. Refused for session tokens (held by
+     * potentially-untrusted code running inside a session); mutations
+     * require an API key or user token.
+     *
+     * Required permissions: write:secrets.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     set(options: {
         secrets: (S['SecretInput'])[];
     }): Promise<S['SecretsListResponse']>;
 }
+declare class EllipsisSessionsTurns {
+    private readonly transport;
+    constructor(transport: Transport);
+    /**
+     * Get Session Turn
+     *
+     * Return one turn.
+     *
+     * Poll this after sending a message: the message is answered when
+     * the turn's status is completed, failed, stopped, or cancelled.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    get(session_id: string, turn_id: string): Promise<S['SessionTurnResponse']>;
+    /**
+     * Get Session Turns
+     *
+     * Return the session's turns and messages, oldest first.
+     *
+     * One turn per message: pending until the agent starts on it,
+     * running while it works, then completed, failed, stopped, or
+     * cancelled.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    list(session_id: string): Promise<S['SessionTurnsListResponse']>;
+}
 declare class EllipsisSessions {
     private readonly transport;
+    readonly turns: EllipsisSessionsTurns;
     constructor(transport: Transport);
     /**
-     * Get Agent Session Analytics
+     * Get Session Analytics
      *
      * Measured tokens and spend over time, plus estimated content cost.
      *
      * Token lanes use the request's saved rates. Content attribution
      * apportions input/cache spend by text size, counting carried context
-     * on every request. It is an estimate, not a tool execution fee.
+     * on every request. It is an estimate, not a tool call fee.
      * Only the latest 200 retained request bodies are inspected; missing
      * or unsupported context remains explicitly unattributed. No raw
-     * prompts or tool results are returned. Sandbox tokens may read only
+     * prompts or tool results are returned. Session tokens may read only
      * their own session's analytics.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own session.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     analytics(session_id: string): Promise<S['SessionAnalytics']>;
     /**
-     * Get Agent Session Diff
+     * Get Session Diff
      *
      * Return the session's uncommitted changes as a patch.
      *
      * One unified-diff section per changed file, captured from the
-     * sandbox's working tree when the session ended. The per-file
+     * environment's working tree when the session ended. The per-file
      * counts ride on the session itself (`git.repos[].files`); this
      * is the text behind them. Empty when the tree was clean. A
-     * sandbox token may read only its own session's diff.
-     */
-    diff(session_id: string): Promise<S['SessionDiffResponse']>;
-    /**
-     * List Session Executions
-     *
-     * Return the session's execution attempts, oldest first.
+     * session token may read only its own session's diff.
      *
-     * Includes the selected harness, model, resolved instructions, initial
-     * query, and common result summary. Complete native outputs remain in
-     * the session's records. Internal launch options and checkpoint storage
-     * references are excluded.
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own session.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
-    executions(session_id: string): Promise<S['SessionExecutionsListResponse']>;
+    diff(session_id: string): Promise<S['SessionDiffResponse']>;
     /**
-     * Export Agent Session
+     * Download Session
      *
-     * Export the complete session history.
+     * Download the complete session history.
      *
      * The complete, ordered history of the session (agent output, tool calls, thinking,
-     * lifecycle events, sandbox output, message events) as an ordered
+     * lifecycle events, environment output, message events) as an ordered
      * manifest of presigned segment URLs.
      *
      * Segments are gzip members: download in order and concatenate
      * for one file. The JSON API never carries the bytes (same
      * two-step as files). /records is the paged live view of the
      * same data.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
-    export(session_id: string): Promise<S['GetSessionLogResponse']>;
+    download(session_id: string): Promise<S['GetSessionLogResponse']>;
     /**
-     * Get Agent Session
+     * Get Session
      *
      * Return one session.
      *
-     * The public wire shape — the same shape the stream's session
-     * frames carry, with attributed_user and stopped_by_user resolved
-     * at read time.
+     * The public wire shape, the same shape the stream's session frames
+     * carry, with attribution, stop, and archive actors resolved at read
+     * time. `turn` is the turn in progress or the latest one.
      *
      * The heavy near-static blobs (config snapshot, input/output)
      * live on the detail endpoints, not here.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     get(session_id: string): Promise<S['SessionResponse']>;
     /**
-     * Get Agent Session Git
+     * Get Session Git
      *
      * The session's GitHub-side git view: its commits, and each PR it
      * opened joined to the live gh_prs row and reviews. The identity list
      * (output_git) rides the session itself over the WebSocket; this is
      * the join a "run" notify tells an open pane to refetch.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     git(session_id: string): Promise<S['SessionGitResponse']>;
     /**
-     * Ingest Agent Session Transcript
+     * Ingest Session Transcript
      *
      * Append transcript lines to a session's record.
      *
-     * The in-sandbox tailer for interactive sessions.
+     *             The transcript tailer running inside the session's environment, for
+     * interactive sessions.
      *
-     * A sandbox token may only push its own session's transcript.
-     * Idempotent by transcript line uuid; tolerant of malformed lines.
+     *             A session token may only push its own session's transcript.
+     *             Idempotent by transcript line uuid; tolerant of malformed lines.
+     *
+     * Required permissions: write:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own session.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     ingestTranscript(session_id: string, options: {
         lines: (string)[];
         offset?: number;
     }): Promise<S['TranscriptIngestResult']>;
     /**
-     * List Agent Sessions
+     * List Sessions
      *
      * List cloud agent sessions, newest first.
      *
-     * Optionally filtered by automation (id or name), source, time
+     * Optionally filtered by agent (id or name), source, service, handler, time
      * window, attributed author, repository, and whether the session is
      * still going.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     list(options?: {
-        automation?: string | null;
+        agent?: string | null;
         source?: (S['SessionSource'])[] | null;
+        service?: S['HandlerService'] | null;
+        handler?: string | null;
         days?: number | null;
         start?: string | null;
         end?: string | null;
@@ -2245,57 +3024,86 @@ declare class EllipsisSessions {
         exclude_code_review?: boolean;
     }): Promise<Page<S['Session'], S['SessionsListResponse']>>;
     /**
-     * Get Agent Session Output
+     * Get Session Output
      *
      * Return the session's typed output.
      *
      * The payload the agent submitted through its config-declared
      * output.json_schema, as the raw JSON body with no envelope. 404
      * while the session is still running (poll GET /v1/sessions/{id}),
-     * when the agent declares no output block, or when no execution
+     * when the agent declares no output block, or when no turn
      * produced output.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     output(session_id: string): Promise<Record<string, unknown>>;
     /**
-     * Get Agent Session Records
+     * Get Session Records
      *
      * Return the session's stored transcript records, oldest first.
      *
      * Pagination is opt-in (cursor/limit); a bare call returns the
-     * full retained transcript. Available to sandbox tokens too: an
+     * full retained transcript. Available to session tokens too: an
      * agent answering "did X look into Y?" needs to read the sessions
      * it finds, and any org member sees the same transcript in the
      * dashboard.
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     records(session_id: string, options?: {
         cursor?: string | null;
         limit?: number | null;
     }): Promise<Page<S['SessionRecord'], S['SessionRecordsListResponse']>>;
     /**
-     * Search Agent Sessions
+     * Search Sessions
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     search(options?: {
         q?: string;
         scope?: S['SessionSearchScope'];
         source?: (S['SessionSource'])[] | null;
+        service?: S['HandlerService'] | null;
+        handler?: string | null;
         author_id?: (number)[] | null;
-        automation_id?: (string)[] | null;
+        agent_id?: (string)[] | null;
         session_ids?: (string)[] | null;
         repo?: (string)[] | null;
-        status?: (S['SessionStatus'])[] | null;
+        status?: (S['TurnStatus'])[] | null;
         start?: string | null;
         end?: string | null;
         limit?: number;
     }): Promise<S['SessionSearchResponse']>;
     /**
-     * Send Agent Session Message
+     * Send Session Message
      *
      * Send a message to a session.
      *
-     * 409 for react/cron, non-interactive, and closed sessions.
-     * Returns the created message so the caller can track it by id; a
-     * retried send with the same idempotency_key returns the original
-     * message.
+     * 409 for react/cron, non-interactive, closed, and out-of-budget
+     * sessions. Returns the created message and its turn; a retried send
+     * with the same idempotency_key returns the original ones.
+     *
+     * Required permissions: write:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     sendMessage(session_id: string, options: {
         idempotency_key?: string | null;
@@ -2304,52 +3112,105 @@ declare class EllipsisSessions {
     }): Promise<S['SessionMessageResponse']>;
     /**
      * Get Session Stream Ticket
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     sessionStreamTicket(session_id: string): Promise<S['StreamTicketResponse']>;
     /**
-     * Start Agent Session
+     * Start Session
      *
      * Start a cloud agent session.
      *
      * The daily driver: a prompt, optionally where to run it
-     * (`environment`) and the run's own settings, in the AutomationConfig
+     * (`environment`) and the session's own settings, in the AgentConfig
      * vocabulary. What you send is what runs: omit `environment` and the
-     * session runs in the built-in basic sandbox. A missing model or
+     * session runs in the built-in basic environment. A missing model or
      * budget comes from the organization's settings, so
-     * `{"prompt": "..."}` alone is a complete request. `prompt` is the
-     * first message; omit it and the session starts idle, waiting for
-     * one. 400 when `interactive` is false and there is no prompt, or
-     * when `budget` exceeds the organization's per-session ceiling. To
-     * run a saved automation, use POST /v1/automations/{automation_id}/sessions.
-     */
-    start(options: {
+     * `{"claude_code": {"prompt": "..."}}` is a complete request.
+     * Set exactly one of `claude_code` or `codex`. Its `prompt` is the
+     * first message; omit the prompt and the session starts with no
+     * turn, waiting for one. 400 when `conversation.interactive` is false
+     * and there is no prompt, or when `budget` exceeds the organization's
+     * per-session ceiling. To run a saved agent, use
+     * POST /v1/agents/{agent_id}/sessions.
+     *
+     * Required permissions: write:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    start(options?: {
         budget?: number | null;
-        environment?: string | S['EnvironmentConfig'] | null;
+        claude_code?: S['ClaudeConfig-Input'] | null;
+        codex?: S['CodexConfig-Input'] | null;
+        conversation?: S['SessionConversationConfig'];
+        environment?: string | S['EnvironmentConfig-Input'] | null;
         force_rebuild?: boolean;
-        harness: S['HarnessOptions'];
         images?: (S['ImageAttachment'])[];
-        instructions?: S['Instructions'];
-        interactive?: boolean;
         metadata?: Record<string, string>;
         output?: S['OutputConfig'] | null;
-        permissions?: S['PermissionsConfig'] | null;
-        prompt?: string | null;
+        permissions?: S['PermissionsConfig-Input'] | null;
         repositories?: (string)[] | null;
-        skills?: (S['SkillRef'])[] | null;
+        skills?: (S['SkillRef-Input'])[] | null;
     }): Promise<S['SessionResponse']>;
     /**
-     * Stop Agent Session
+     * Stop Session
      *
-     * Stop an in-flight session and return it.
+     * Stop the turn in progress and return the session.
      *
-     * stopped_by is recorded only when the caller's credential maps
-     * to a GitHub account.
+     * The turn ends `stopped`; the conversation stays open. 409 when no
+     * turn is pending or running. The stopping user is recorded only
+     * when the caller's credential maps to a GitHub account.
+     *
+     * Required permissions: write:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     stop(session_id: string): Promise<S['SessionResponse']>;
     /**
      * Get Sessions Stream Ticket
+     *
+     * Required permissions: read:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
      */
     streamTicket(): Promise<S['StreamTicketResponse']>;
+    /**
+     * Update Session
+     *
+     * Archive or unarchive a session and return it.
+     *
+     * Set archived to true to record the current server time and the
+     * authenticated GitHub user. API-key requests record no user.
+     * Repeated archive requests preserve the original time and user.
+     * Set archived to false to clear both fields. Archiving is available
+     * in any session state and does not stop a running session.
+     *
+     * Changes are delivered to session and session-list streams.
+     *
+     * Required permissions: write:sessions.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     * Grant match patterns can further restrict access to individual resources.
+     */
+    update(session_id: string, options: {
+        archived: boolean;
+    }): Promise<S['SessionResponse']>;
     /** Start a session and return a handle over it. */
     run(options: Parameters<EllipsisSessions['start']>[0]): Promise<SessionHandle>;
     /** A handle over an existing session. */
@@ -2360,6 +3221,12 @@ declare class EllipsisSupportSlack {
     constructor(transport: Transport);
     /**
      * Request Slack Help
+     *
+     * Required permissions: write:account.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     create(options: {
         emails: (string)[];
@@ -2367,10 +3234,22 @@ declare class EllipsisSupportSlack {
     }): Promise<S['SlackHelpResponse']>;
     /**
      * Get Slack Help
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(): Promise<void>;
     /**
      * Invite To Slack Help
+     *
+     * Required permissions: write:account.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     invite(options: {
         emails: (string)[];
@@ -2389,6 +3268,12 @@ declare class EllipsisTemplates {
      * Get Agent Template
      *
      * Return one built-in agent template by slug.
+     *
+     * Required permissions: read:templates.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(template_id: string): Promise<S['AgentTemplate']>;
     /**
@@ -2398,6 +3283,12 @@ declare class EllipsisTemplates {
      *
      * Behind auth but not account-scoped — the data is static
      * product content shared by the dashboard, landing site, and CLI.
+     *
+     * Required permissions: read:templates.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['AgentTemplatesListResponse']>;
 }
@@ -2411,6 +3302,12 @@ declare class EllipsisUserSubscriptionTokens {
      *
      * Your sessions stop billing your subscription immediately, and the
      * usage reading goes with it — it described that token's plan.
+     *
+     * Required permissions: delete:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(provider: S['SubscriptionProvider']): Promise<void>;
     /**
@@ -2420,6 +3317,12 @@ declare class EllipsisUserSubscriptionTokens {
      *
      * `configured` is false when nothing is saved. The token itself is
      * never returned, only `token_last4`.
+     *
+     * Required permissions: read:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(provider: S['SubscriptionProvider']): Promise<S['SubscriptionToken']>;
     /**
@@ -2430,6 +3333,12 @@ declare class EllipsisUserSubscriptionTokens {
      * One entry per supported provider, whether or not you have saved a
      * token for it. Tokens are write-only: the response carries only
      * `token_last4`, never the token.
+     *
+     * Required permissions: read:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['SubscriptionTokensListResponse']>;
     /**
@@ -2442,6 +3351,12 @@ declare class EllipsisUserSubscriptionTokens {
      * succeeds. For Claude, use `claude setup-token`. For Codex, paste
      * the auth.json credentials from a ChatGPT login. Each subscription
      * pays only for models from its corresponding provider.
+     *
+     * Required permissions: write:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     set(provider: S['SubscriptionProvider'], options: {
         token: string;
@@ -2456,6 +3371,12 @@ declare class EllipsisUserSubscriptionTokens {
      * real windows without us seeing them. Null unless a token is
      * enabled for the provider: a disabled token routes nothing, so any
      * reading behind it is stale by construction.
+     *
+     * Required permissions: read:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     usage(provider: S['SubscriptionProvider']): Promise<S['SubscriptionUsageResponse']>;
     /**
@@ -2469,6 +3390,12 @@ declare class EllipsisUserSubscriptionTokens {
      * token is how you stop it routing. A 200 with `ok: false` is the
      * normal way a bad token is reported — it is an answer, not a
      * transport failure.
+     *
+     * Required permissions: write:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     verify(provider: S['SubscriptionProvider']): Promise<S['VerifySubscriptionTokenResponse']>;
 }
@@ -2477,10 +3404,22 @@ declare class EllipsisUserTokens {
     constructor(transport: Transport);
     /**
      * List User Tokens
+     *
+     * Required permissions: read:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['ListUserTokensResponse']>;
     /**
      * Revoke User Token
+     *
+     * Required permissions: delete:user.
+     * API key: Requires a CLI user token.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     revoke(token_id: string): Promise<S['TokenRevokedResponse']>;
 }
@@ -2490,6 +3429,106 @@ declare class EllipsisUser {
     readonly tokens: EllipsisUserTokens;
     constructor(transport: Transport);
 }
+declare class EllipsisVmExecutions {
+    private readonly transport;
+    constructor(transport: Transport);
+    /**
+     * Get Single Vm Execution
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own sandbox.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    get(vm_execution_id: string): Promise<S['VMExecutionResponse']>;
+    /**
+     * Get Vm Executions
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own sandbox.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    list(): Promise<void>;
+    /**
+     * Get Vm Execution Stream Ticket
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own sandbox.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    streamTicket(vm_execution_id: string): Promise<S['StreamTicketResponse']>;
+}
+declare class EllipsisVmImages {
+    private readonly transport;
+    constructor(transport: Transport);
+    /**
+     * Get Vm Image
+     *
+     * Get metadata for a reusable VM image.
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    get(image_id: string): Promise<S['VMImageResponse']>;
+    /**
+     * List Vm Images
+     *
+     * List reusable VM images.
+     *
+     * Includes expiration, repository revisions, and build identity.
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    list(options?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<S['VMImageListResponse']>;
+}
+declare class EllipsisVms {
+    private readonly transport;
+    constructor(transport: Transport);
+    /**
+     * Get Vm
+     *
+     * Get a VM and its most recent execution.
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own VM.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    get(vm_id: string): Promise<S['VM']>;
+    /**
+     * List Vms
+     *
+     * List VMs and their last recorded state.
+     *
+     * Each machine appears once, including paused and deleted VMs, newest execution first.
+     *
+     * Required permissions: read:environments.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration. Only the token's own VM.
+     * Higher permission levels include lower levels: read < write < delete.
+     */
+    list(options?: {
+        limit?: number;
+        offset?: number;
+    }): Promise<S['VMListResponse']>;
+}
 declare class EllipsisWebhooksDeliveries {
     private readonly transport;
     constructor(transport: Transport);
@@ -2500,6 +3539,12 @@ declare class EllipsisWebhooksDeliveries {
      *
      * Payloads are immutable across retries. Attempt details include HTTP
      * status, timing, and errors. Response bodies are not retained.
+     *
+     * Required permissions: read:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(delivery_id: string): Promise<S['WebhookDeliveryResponse']>;
     /**
@@ -2509,6 +3554,12 @@ declare class EllipsisWebhooksDeliveries {
      *
      * Includes verification pings and deliveries for deleted webhooks.
      * History is retained for 30 days. Retries belong to the same delivery.
+     *
+     * Required permissions: read:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(options?: {
         webhook_id?: string | null;
@@ -2530,9 +3581,15 @@ declare class EllipsisWebhooks {
      * Create a webhook and send a verification ping.
      *
      * Save the signing secret from this response; it is returned once.
-     * Accounts can have three webhooks, including unverified and pending
-     * ones. A ping returning HTTP 200 moves unverified to pending. Contact
+     * Accounts default to three webhook slots, including unverified and
+     * pending ones; your account may have a custom allowance. A ping returning HTTP 200 moves unverified to pending. Contact
      * Ellipsis to activate it and receive session.create events.
+     *
+     * Required permissions: write:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     create(options: {
         description?: string | null;
@@ -2545,19 +3602,37 @@ declare class EllipsisWebhooks {
      * Delete a webhook and cancel outstanding deliveries.
      *
      * An HTTP request already in flight may finish. Delivery history remains
-     * available for 30 days. Deletion frees one of the account's three slots.
+     * available for 30 days. Deletion frees a webhook slot.
+     *
+     * Required permissions: delete:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     delete(webhook_id: string): Promise<void>;
     /**
      * Get Webhook
      *
      * Get a webhook's configuration and approval state.
+     *
+     * Required permissions: read:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     get(webhook_id: string): Promise<S['WebhookResponse']>;
     /**
      * List Webhooks
      *
      * List your webhooks and their delivery summaries.
+     *
+     * Required permissions: read:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     list(): Promise<S['WebhooksListResponse']>;
     /**
@@ -2566,8 +3641,15 @@ declare class EllipsisWebhooks {
      * Send a signed verification or test ping.
      *
      * Available in every state. Only HTTP 200 verifies a destination;
-     * successful pings never activate it. At most five pings per account
-     * per minute, including pings from creation and URL changes.
+     * successful pings never activate it. The default limit is five pings per
+     * account per minute, including creation and URL changes. Custom
+     * account allowances apply.
+     *
+     * Required permissions: write:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     ping(webhook_id: string): Promise<void>;
     /**
@@ -2578,6 +3660,12 @@ declare class EllipsisWebhooks {
      * Changing the URL cancels outstanding deliveries, clears verification
      * and approval, and sends another ping. State and signing secret cannot
      * be set here. Updating description or subscriptions preserves approval.
+     *
+     * Required permissions: write:webhooks.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Not supported by session tokens, even with permissions.ellipsis enabled.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     update(webhook_id: string, options: {
         description?: string | null;
@@ -2588,27 +3676,35 @@ declare class EllipsisWebhooks {
 declare class Ellipsis {
     private readonly transport;
     readonly account: EllipsisAccount;
+    readonly agents: EllipsisAgents;
     readonly alerts: EllipsisAlerts;
     readonly analytics: EllipsisAnalytics;
     readonly auth: EllipsisAuth;
-    readonly automations: EllipsisAutomations;
     readonly environments: EllipsisEnvironments;
-    readonly files: EllipsisFiles;
+    readonly handlers: EllipsisHandlers;
     readonly integrations: EllipsisIntegrations;
     readonly memories: EllipsisMemories;
     readonly reviews: EllipsisReviews;
-    readonly sandboxes: EllipsisSandboxes;
     readonly secrets: EllipsisSecrets;
     readonly sessions: EllipsisSessions;
     readonly support: EllipsisSupport;
     readonly templates: EllipsisTemplates;
     readonly user: EllipsisUser;
+    readonly vmExecutions: EllipsisVmExecutions;
+    readonly vmImages: EllipsisVmImages;
+    readonly vms: EllipsisVms;
     readonly webhooks: EllipsisWebhooks;
     constructor(options: TransportOptions);
     /**
      * Current Identity
      *
      * Return the identity behind the caller's credential.
+     *
+     * Required permissions: read:account.
+     * API key: Supported.
+     * CLI user token: Supported.
+     * Session token: Requires the ellipsis:api scope and the required grants in the token's permissions.ellipsis configuration.
+     * Higher permission levels include lower levels: read < write < delete.
      */
     identity(): Promise<S['Identity']>;
 }
@@ -2645,4 +3741,4 @@ declare class RateLimitError extends APIError {
 declare class ServerError extends APIError {
 }
 
-export { APIError, AuthenticationError, type AutomationListStreamMessage, type CollectionStreamFrame, type CollectionStreamHeartbeat, ConflictError, DEFAULT_BASE_URL, Ellipsis, EllipsisError, ForbiddenError, NotFoundError, Page, RateLimitError, type SandboxSnapshotFrame, type SandboxUpdateFrame, ServerError, SessionHandle, type SessionListStreamMessage, TERMINAL_STATUSES, Transport, TransportError, type TransportOptions, UnprocessableError, components, isSettled };
+export { APIError, type AgentListStreamMessage, AuthenticationError, type CollectionStreamFrame, type CollectionStreamHeartbeat, ConflictError, DEFAULT_BASE_URL, Ellipsis, EllipsisError, ForbiddenError, NotFoundError, Page, RateLimitError, type SandboxSnapshotFrame, type SandboxUpdateFrame, ServerError, SessionHandle, type SessionListStreamMessage, Transport, TransportError, type TransportOptions, UnprocessableError, components, isTurnFinal };