@kosuke-ai/kosuke 1.0.4 → 1.0.5

package/openapi.json

@@ -881,6 +881,8 @@
         "summary": "Whether your Mac is online now, with the Kosuke desktop app open and signed in, and the tools it offers: a missing macOS permission or no Google Chrome leaves its tools out. Offline answers online false and nothing else.",
         "tags": ["mac"],
         "x-kosuke-command": ["mac", "tools"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "responses": {
           "2XX": {
@@ -1074,6 +1076,8 @@
         "summary": "Run agent-browser commands in order, in one headless Google Chrome session on the member's Mac signed in with their cookies, for sites that need their sign-in. On updated desktops each Sensei Thread has its own browser, so threads browse at once, and it closes when the Turn ends, so page state does not carry over to the next Turn; past the Mac's cap on open browsers, with none idle, a call answers BROWSER_LIMIT. Select a Chrome profile by directory ID or exact unambiguous name, and pin its Mac with deviceId. Updated desktops return profile ID/name; the platform returns device ID/name. Unknown or removed profiles fail without fallback, and a profile the member turned off in Settings → Devices fails with PROFILE_DISCONNECTED. Older desktops require an update for explicit selection, and share one browser per profile under the Mac lock. Answers each command's output, the recording's lasting link as recording.url (the recording is posted in the chat too), and the paths of files it downloaded to ~/Downloads. Only Sensei calls it.",
         "tags": ["mac"],
         "x-kosuke-command": ["mac", "browser"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -1153,6 +1157,8 @@
         "summary": "List the member's LinkedIn and X browser connections, oldest first: each is one account Sensei may act as, with its id, revision, account (null until Sensei fills it in), device (id, name, removed), profile (id, name), the last check (unchecked, connected, signed_out, other_account) with checkedAt, and connectThreadId, the only thread whose Turn may fill the account in. Pass its device id and profile id to every browser call for it. Only Sensei calls it, in a Turn the member's own message started.",
         "tags": ["mac"],
         "x-kosuke-command": ["mac", "browser-connections"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -1205,6 +1211,8 @@
         "summary": "Report what one check of the live page saw for a browser connection, with the revision `mac browser-connections` answered: connected with the account's name and handle, signed_out, or other_account with the name found. The first connected fills the account in, only from a Turn of its connectThreadId (else 403 NOT_CONNECT_THREAD); afterwards the handle must match it (else 409 ACCOUNT_MISMATCH). 409 STALE_REVISION after a newer Connect or Reconnect: read again. 404 once the member disconnected it. Only Sensei calls it, in a Turn the member's own message started.",
         "tags": ["mac"],
         "x-kosuke-command": ["mac", "browser-connection-check"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -1294,6 +1302,8 @@
         "summary": "List Chrome profile IDs and display names on the member's Mac, including the default choice and device ID/name, with access allowed or off on every profile (off: turned off in Settings → Devices, never to be used). With --site, a bare host (Google's sites answer BAD_ARGS), it names the site and whether Kosuke watches it, and every allowed profile carries chromeSignIn: candidate when that profile in their Chrome holds a live cookie for the site (the sign-in cookie for LinkedIn and X), none when it holds none, unknown when it could not be read. An off profile carries none. A candidate is not a sign-in: check the account by browsing. Discovery reads cookie presence only, never a value, never the Keychain, and no history, and opens no browser. An older desktop app answers without access and chromeSignIn: read that as unknown. Only Sensei calls it.",
         "tags": ["mac"],
         "x-kosuke-command": ["mac", "browser-profiles"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -1360,6 +1370,8 @@
         "tags": ["mac"],
         "x-kosuke-command": ["mac", "browser-sign-in"],
         "x-kosuke-answer-timeout-ms": 590000,
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -2771,6 +2783,9 @@
         "summary": "Store or switch workspace credentials. The body is one of the operation variants. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "ai-provider", "set"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -2965,6 +2980,9 @@
         "summary": "Remove the credentials of one auth method, or with loginId one login of claude_code, codex or muse_code. Which methods a provider takes is not in the schema. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "ai-provider", "remove"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -3393,6 +3411,9 @@
         "summary": "Validate and save a workspace Gemini API key without selecting it. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "ai-provider", "google", "save"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -3464,6 +3485,9 @@
         "summary": "Remove both workspace Gemini methods and clear selection. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "ai-provider", "google", "remove"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -3515,6 +3539,9 @@
         "summary": "Select a saved workspace Gemini method with its selection revision. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "ai-provider", "google", "select-method"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -3585,6 +3612,9 @@
         "summary": "Remove one workspace Gemini method. Removing the selected method leaves none selected. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "ai-provider", "google", "delete-method"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -3872,6 +3902,9 @@
         "summary": "Start workspace Antigravity sign-in. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "ai-provider", "login", "antigravity", "start"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -3940,6 +3973,9 @@
         "summary": "Cancel workspace Antigravity sign-in. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "ai-provider", "login", "antigravity", "cancel"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -4013,6 +4049,9 @@
         "summary": "Complete workspace Antigravity sign-in. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "ai-provider", "login", "antigravity", "complete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -4090,6 +4129,9 @@
         "summary": "Re-check usage for the workspace's logins of one provider (including SuperGrok on xai) at their limit, without waiting for their reset: every login of the provider, or the one loginId names. Admins only. Returns cleared, stillAtLimit and unreadable counts and retryAt, the earliest remaining reset, or null.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "ai-provider", "logins", "recheck"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -4824,6 +4866,9 @@
         "summary": "Delete a cron with its runs, their transcripts and their Artifacts. The sessions its runs filed stay. The creator or a workspace admin only.",
         "tags": ["crons"],
         "x-kosuke-command": ["crons", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -5595,6 +5640,8 @@
         "summary": "Read why a run of a cron ended as it did: its status, error, error code and stop source (member_stop, host_watch, deadline, replaced, sandbox_abort or runtime_error, with who stopped it), the sandbox it ran in and that sandbox's agent version, when each phase happened (queued, sandbox booted, credentials ready, agent requested, first event, done), the sandbox's own done payload, and the Cron Agent's log lines from the sandbox with secrets redacted. The log is capped at 256 KB and cleared after 30 days. The creator or a workspace admin only.",
         "tags": ["crons"],
         "x-kosuke-command": ["crons", "runs", "diagnostics"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -6078,6 +6125,9 @@
         "summary": "Delete a workspace file, or a folder and every item inside it. Agents cannot delete Files.",
         "tags": ["files"],
         "x-kosuke-command": ["files", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -6262,6 +6312,9 @@
         "summary": "Connect, select, poll, cancel or remove workspace Grok access. Owners and admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "grok", "change"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -6571,6 +6624,9 @@
         "summary": "Disconnect an integration by toolkit slug: agents lose the workspace's access at once, then Kosuke deletes the stored authorization, retrying in the background if needed. Revoking the authorization at the toolkit itself is not part of this. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "integrations", "remove"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -6892,6 +6948,9 @@
         "summary": "Start a Claude login for the workspace: open the returned url in a browser, then pass the code it shows and loginToken to complete within 15 minutes. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "provider-login", "claude", "start"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -6961,6 +7020,9 @@
         "summary": "Finish a Claude login with the loginToken from start and the code from the browser (code, code#state, or the whole callback URL). A refused code answers 200 with authenticated false. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "provider-login", "claude", "complete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -7033,6 +7095,9 @@
         "summary": "Start a Codex login for the workspace: enter userCode at verificationUrl in a browser, then call complete with loginToken until it answers authenticated. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "provider-login", "codex", "start"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -7102,6 +7167,9 @@
         "summary": "Poll a Codex login with the loginToken from start: authenticated false until the code is approved in the browser, so repeat every intervalSeconds; restart true means start again. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "provider-login", "codex", "complete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -7170,6 +7238,9 @@
         "summary": "Start a Muse Code login for the workspace: open verificationUrl in a browser and approve userCode, then call complete with loginToken until it answers authenticated. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "provider-login", "muse", "start"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -7239,6 +7310,9 @@
         "summary": "Poll a Muse Code login with the loginToken from start: authenticated false until the code is approved in the browser, so repeat every intervalSeconds; restart true means start again. The first login makes muse_code the active method. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "provider-login", "muse", "complete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -7654,6 +7728,9 @@
         "summary": "Delete a custom skill and its files. Admins only.",
         "tags": ["workspaces"],
         "x-kosuke-command": ["workspaces", "skills", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -8469,6 +8546,9 @@
         "summary": "Delete a task.",
         "tags": ["tasks"],
         "x-kosuke-command": ["tasks", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "workspaceId",
@@ -8530,6 +8610,8 @@
         "summary": "Move a Todo or In progress Personal task into a workspace. Members and Sensei only.",
         "tags": ["tasks"],
         "x-kosuke-command": ["tasks", "move"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -8856,6 +8938,8 @@
         "summary": "List your personal tasks, newest first. status is a csv of todo, in_progress, done; includeOpenCount counts Todo and In progress with the same filters, independent of status and cursor.",
         "tags": ["personal-tasks"],
         "x-kosuke-command": ["personal-tasks", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -8968,6 +9052,8 @@
         "summary": "File a personal task: yours alone, in no workspace. From a Sensei Turn it joins the Turn’s thread unless threadId names another.",
         "tags": ["personal-tasks"],
         "x-kosuke-command": ["personal-tasks", "create"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -9050,6 +9136,8 @@
         "summary": "Get one of your personal tasks.",
         "tags": ["personal-tasks"],
         "x-kosuke-command": ["personal-tasks", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -9101,6 +9189,8 @@
         "summary": "Edit one of your personal tasks. dueOn or threadId null clears it.",
         "tags": ["personal-tasks"],
         "x-kosuke-command": ["personal-tasks", "update"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -9211,6 +9301,9 @@
         "summary": "Delete one of your personal tasks.",
         "tags": ["personal-tasks"],
         "x-kosuke-command": ["personal-tasks", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "taskId",
@@ -9263,6 +9356,8 @@
         "summary": "Move a Todo or In progress personal task into a workspace you belong to, as its Todo task assigned to you; the personal task is removed. A due date becomes the description’s last line.",
         "tags": ["personal-tasks"],
         "x-kosuke-command": ["personal-tasks", "move"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -9334,6 +9429,8 @@
         "summary": "Start a Todo or In progress Personal task in a deployed Personal Repository.",
         "tags": ["personal-tasks"],
         "x-kosuke-command": ["personal-tasks", "start"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -9679,6 +9776,9 @@
         "summary": "Delete a project and everything it owns. Workspace admins only.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -9950,6 +10050,9 @@
         "summary": "Delete a Backlog item. One already sent to the chat stays in Up next.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "backlog-items", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -10130,6 +10233,8 @@
         "summary": "Turn Batch Merging on or off. While it is on, a batch agent merges up to 10 ready pull requests into the Target Branch together, reviews them once and runs a short QA, then opens one pull request for a member to merge. Batches run as the member who turned it on. Refused with MERGE_COMMITS_OFF while the repository or a rule on the Target Branch allows no merge commit.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "batch-merging", "set"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -11133,6 +11238,8 @@
         "summary": "Delete a chat session. Sensei deletes only a Backlog ticket, refused with 409 NOT_IN_BACKLOG once it started, and only in a Turn its member started.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -11628,6 +11735,8 @@
         "summary": "Hand a chat session's desktop to a member, or back to the agent. While a member controls it, the agent's desktop tools refuse. Answers the Desktop as it is after the change. Refused with 409 DESKTOP_NOT_RUNNING while the session's sandbox is not up.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "desktop-control"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -11708,6 +11817,8 @@
         "summary": "Give the session's pull request the go-ahead to merge, as the session's member, on one head: goAheadSha, goAheadBy, goAheadAt and goAheadMerges. A push to another head takes it away. With `merge`, Kosuke merges it on its own; without, it waits for whoever merges it, and Batch Merging is asked to look. Members and their Sensei only.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "go-ahead", "set"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -11792,6 +11903,8 @@
         "summary": "Take the session's go-ahead away, so neither Kosuke nor a Batch merges its pull request until it is given again. The callers of `sessions go-ahead set`.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "go-ahead", "clear"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -13059,6 +13172,9 @@
         "summary": "Delete your own comment.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "diff", "comments", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -14369,6 +14485,8 @@
         "summary": "Delete a queued message: your own, or any as a workspace owner or admin.",
         "tags": ["sessions"],
         "x-kosuke-command": ["sessions", "queue", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -15517,6 +15635,9 @@
         "summary": "Delete a Session Label from the project's catalog. A label sessions still carry is refused with 409 and the list of them unless removeFromSessions is true, which removes it from each of them. Deleting a name the project does not have, including one already deleted, answers 404.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "labels", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -16401,6 +16522,9 @@
         "summary": "Revoke the public share link of a preview.",
         "tags": ["preview"],
         "x-kosuke-command": ["preview", "share", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -17124,6 +17248,9 @@
         "summary": "Delete a queued Deploy Chat message: your own, or any as a workspace owner or admin.",
         "tags": ["deploy"],
         "x-kosuke-command": ["deploy", "queue", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -17540,6 +17667,9 @@
         "summary": "Remove environment variables. The body is a JSON array of variable ids.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "env-vars", "remove"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -17942,6 +18072,7 @@
         "summary": "Save the project's Project QA Guide. Chat sessions created after the save get it; running sessions keep the one they started with. With baseRevision it is refused with 409 GUIDE_CHANGED when the saved guide changed since; Sensei must pass it.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "qa-guide", "set"],
+        "x-kosuke-sandbox-token": true,
         "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
@@ -18386,6 +18517,9 @@
         "summary": "Remove one service.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "services", "remove"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "projectId",
@@ -18579,6 +18713,8 @@
         "summary": "Switch a project between YOLO mode and Collaboration. YOLO completes every Active and Under Review session and turns Backlog sessions into Backlog items; switching back revives the sessions it closed.",
         "tags": ["projects"],
         "x-kosuke-command": ["projects", "switch-workflow"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -18649,6 +18785,9 @@
         "summary": "Register an iPhone or Apple Watch for push notifications with its hex APNs device token, the app bundle id it was issued to and its APNs environment. A token already registered moves to you. The Watch also sends its installationId and a generation it raises on every registration; one older than the registration already held for that installation answers 409. Both apps send their appVersion, which decides the notification categories they are sent. Called by the Kosuke iOS and Watch apps; answers 204.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "push-devices", "register"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
           "content": {
@@ -18737,6 +18876,9 @@
         "summary": "Stop push notifications to one of your devices, by its APNs device token. A token that is not yours, or not registered, is left alone; answers 204 either way.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "push-devices", "remove"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
           "content": {
@@ -18794,6 +18936,9 @@
         "summary": "Read your own Sensei Chat as the Sensei page does: its latest page and its Turn, or with `before` the older messages before that message.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "chat"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "before",
@@ -18926,6 +19071,8 @@
         "summary": "Open a card in your Turn's own thread, or update its open card with that key by passing the revision you read. Refused when the card moved, closed or is being sent, when your Turn stopped, when the member rejected this key in this stateKey (SKIPPED_STATE), when the session now lives in another thread (SESSION_MOVED), or when an id it names is not in the member's reach.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "cards", "put"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -20199,6 +20346,8 @@
         "summary": "Close your Turn's thread's open card with this key, at the revision you read, with one line on why it no longer asks anything of the member. A thread Kosuke opened that holds nothing of the member's then leaves Needs you and Done. Refused when the card moved, closed or is being sent, or when your Turn stopped.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "cards", "close"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -20271,6 +20420,8 @@
         "summary": "Execute only the stored mark_read action of the card this member approved",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "cards", "mark-read"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -20332,6 +20483,8 @@
         "summary": "Execute only the stored reply action of the card this member approved",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "cards", "send-reply"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -20393,6 +20546,8 @@
         "summary": "Put Connect buttons in a message of your Turn's own thread, under your words, for each connection the request needs: github, toolkit:<slug>, subscription:<claude_code|codex|antigravity>, or notifications (iOS app only, once per member). The member signs in from the message; once it is done, or on Not now, the thread carries on in a Turn of its own. End your Turn after it. Refused when your Turn stopped.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "connect"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -20476,6 +20631,8 @@
         "summary": "Hand a long job the member asked for in this Turn's thread to a Job Delegate, which works on it out of the conversation and posts its result in the thread. Kosuke gives it the member's message and its attachments; the brief adds what you know. The same message and key return the first job. Refused with DELEGATES_OUTDATED on an older Sensei container, and with DELEGATE_NOT_STARTED when its first Turn cannot start now, which Kosuke retries.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "delegates", "start"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -20555,6 +20712,8 @@
         "summary": "Read one of the member's delegates: its state, Model and Delegate Summary, with the newest job result you have not read, in full.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "delegates", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -20608,6 +20767,8 @@
         "summary": "Deliver a change of the member's intent to one of their delegates as a Note, and wake it. Its Turn that began before the Note can write nothing more, and the next one reads it. The same key writes the Note once.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "delegates", "note"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -20694,6 +20855,8 @@
         "summary": "Stop one of the member's delegates. A job stays stopped until the member redirects it or you note it; a Task Delegate reads its waiting events at its next wake.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "delegates", "stop"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -20747,6 +20910,8 @@
         "summary": "Put the Describe card in a message of your Turn's own thread, under your words: the member writes what the app does and creates it as a YOLO project in the workspace it names. Once created, the thread carries on in a Turn of its own. End your Turn after it. Refused when your Turn stopped.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "describe"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -20812,6 +20977,8 @@
         "summary": "List the Device Requests of a Chat Session, oldest first, as you would see them on its cards: id, device, kind, owner, reason, status (pending, approved, declined, expired, withdrawn or closed), who asked and who answered, when, and canApprove, whether you may answer it. A request past its 30 minutes reads expired.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "device-requests", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -20867,6 +21034,8 @@
         "summary": "Approve or decline one Device Request of a Chat Session as you, the Mac’s owner or an admin of the device’s workspace. Answers the stored status. Refused with 403 when you may not answer it, 404 for a request not of this session, and 409 GRANT_ALREADY_DECIDED with its current status when it is no longer pending: already answered, expired, withdrawn, or closed because the session can no longer use the device.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "device-requests", "decide"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -20938,6 +21107,8 @@
         "summary": "Read your three private Memory files and their revisions.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "memory", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "responses": {
           "2XX": {
@@ -20977,6 +21148,8 @@
         "summary": "Save a Memory file at the revision you read. Sensei must name the card approved to start this Turn.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "memory", "put"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -21052,6 +21225,8 @@
         "summary": "Merge the pull request of any Chat Session in a workspace you belong to, as you on GitHub, whenever GitHub allows it: added to GitHub's merge queue where the base has one, updated first where GitHub requires an up-to-date branch, merged otherwise, pinned to the head read. GitHub alone decides: Kosuke adds no hold of its own on approvals, reviews, checks or a working session. Asking is your go-ahead, recorded on the session for its member on the head read with Kosuke merging it, so it merges later when GitHub refuses now. A push to another head takes it away. Answers the outcome, the head it decided on and why. Refused with the reason unless you have GitHub connected and the head is still `headSha` when given, and with GitHub's own reason when GitHub refuses the merge.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "merge"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -21117,6 +21292,8 @@
         "summary": "Turn your Merge rule on or off. While it is on, your Sensei gives the go-ahead to merge each pull request of a Chat Session you are the Assignee of once it is approved and its QA passed. Changed only when you ask. Answers whether it is on now.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "merge-rule"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -21178,6 +21355,8 @@
         "summary": "Send a message that reached you on to another member: the one the required memberId names. It opens in their Sensei, and the sender's later updates of it go to them. Your own card on it stays yours to close. Refused with 404 when the message is not with you now, with 409 MESSAGE_CHANGED when it changed since you read it, and with 400 when nobody else is named for it.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "messages", "reroute"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -21297,6 +21476,9 @@
         "summary": "Read stored activity versions for your Reels cards and Backlog tickets.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "reels", "activity"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -21337,6 +21519,9 @@
         "summary": "Read your Backlog proposals newest first by ticket creation or edit, ten per page, excluding the ones you skipped at the current ticket version.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "reels", "proposals"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "cursor",
@@ -21390,6 +21575,9 @@
         "summary": "Read Jev ranks for your open Sensei Cards, valid only at each card revision.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "reels", "ranks"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -21430,6 +21618,9 @@
         "summary": "Skip your Backlog proposal on every device until its ticket version changes.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "reels", "skips"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
           "content": {
@@ -21492,6 +21683,8 @@
         "summary": "Put the Repository card in a message of your Turn's own thread, under your words: it names the workspace and lists the repositories Kosuke can write to, and the member imports one from it. Once imported, the thread carries on in a Turn of its own. End your Turn after it. Refused when your Turn stopped.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "repository"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -21557,6 +21750,8 @@
         "summary": "Approve the pull request of a Chat Session as you on GitHub, pinned to headSha: the approval is of that commit. Refused with 409 HEAD_MOVED, naming the new head, when the pull request moved past headSha, with NO_PULL_REQUEST when the session has no open pull request, and with GITHUB_REFUSED and GitHub’s own words when GitHub says no, such as for your own pull request or without GitHub connected in Kosuke.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "review", "approve"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -21622,6 +21817,8 @@
         "summary": "Ask members to review the pull request of a Chat Session you are the Assignee of, as you on GitHub, and record who was asked for the merge to count. With again, ask again everyone asked before and whoever requested changes since. A member who never connected GitHub, or whom GitHub refuses, is left out and named; it is refused when nobody could be asked, with 400 when you name yourself, nobody, or there is nobody to ask again, with 403 when you are not the Assignee, and with 409 NO_PULL_REQUEST or GITHUB_REFUSED.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "review", "ask"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -21697,6 +21894,8 @@
         "summary": "Read bounded, untrusted GitHub review evidence for a Chat Session using repository-scoped read-only installation access. Pass sessionId and optionally paths, a JSON array of at most three repository-relative helper paths. Returns section completeness, observed head/base, checks, rules, ownership, authorship, associated merged reviews and matched workspace reviewer candidates. Partial evidence never proves all checks or rules passed; stale evidence must be read again. No GitHub action is performed and no GitHub credential is returned.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "review", "context"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -21759,6 +21958,8 @@
         "summary": "Record Sensei’s done or not-done decision from fresh session facts, with its reason. Only a running Sensei Turn in its authorized following thread may decide. Does not send work, archive or complete the session, or write to GitHub.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "sessions", "assess"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -21874,6 +22075,8 @@
         "summary": "Read fresh session evidence and the opaque revision needed for an assessment. Requires the running Sensei Turn to follow this session in its own thread.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "sessions", "facts"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -21927,6 +22130,8 @@
         "summary": "Put suggestion pills in a message of your Turn's own thread, under your words. A tap on a pill fills the member's reply and sends nothing; a newThread pill is a new topic, and its tap starts a thread of its own with those words. Refused when your Turn stopped.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "suggest"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -22133,6 +22338,8 @@
         "summary": "Pass your member's reply to a teammate's message card back to the teammate who sent it, when the words are meant for them. It updates the answer that teammate already got for the message, so their answer card quotes the words instead of saying your member replied to their Sensei. messageId is the message's identity and replyId the reply's id, as the reply's note names them. The same words again write nothing. Only the Turn of your member's reply sends one, for the card that reply decided. Refused with 404 when this Turn carries no reply with that replyId to the message with that messageId, and with 409 ANSWER_CHANGED when your member decided the message again since the reply. Answers the answer's id, revision, updated and the sender.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "messages", "reply"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -22204,6 +22411,8 @@
         "summary": "Move the member’s message that started this Turn’s thread into another of their threads, which it continues. Only Sensei calls it, and only before the Turn has written anything: Kosuke ends this Turn, sends the message into that thread, where it is answered with that thread’s memory, and removes this thread. Write no answer after it.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "thread", "move"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -22265,6 +22474,8 @@
         "summary": "Split the member’s message that started this Turn’s thread into one thread per ask. Only Sensei calls it, once per message. The member’s message stays the root of this thread, which does the first ask; each other ask becomes a thread of its own with its own Turn. The reply lists the asks handed off: do not do those here.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "thread", "split"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -22337,6 +22548,8 @@
         "summary": "List your Sensei Threads, those that need you first, with the id, title, state, last activity and sessions of each, and the pull request number of every session that has one. `states` and `search` filter; `limit` threads a page, and `cursor` the next page.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "threads"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -22515,6 +22728,8 @@
         "summary": "Mark your Sensei Thread done",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "thread", "done"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -22568,6 +22783,8 @@
         "summary": "Fold Backlog tickets of one project into one, in one step: the kept ticket takes content as its prompt and the folded tickets are deleted, or nothing changes. revisions holds the promptRevision `sessions get` gave for every ticket content was written from, the kept one included. Refused with 409 TICKET_EDITED when any of them changed since, with 409 NOT_IN_BACKLOG when any of them started, and with 400 when a revision is missing or a ticket is of another project. Pass the body whole with --body or --body-file.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "tickets", "merge"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -22658,6 +22875,9 @@
         "summary": "Read your open Sensei Card count and the first four cards in Reels order for widgets.",
         "tags": ["sensei"],
         "x-kosuke-command": ["sensei", "widgets"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -23026,6 +23246,8 @@
         "summary": "List your Personal Crons, newest first, with each one's thread and last run status. A Personal Cron belongs to you and no workspace: with Personal Repositories or Apps it runs in its own sandbox; without, in its Sensei Thread. Repository runs use your own Subscriptions; thread runs use your Subscriptions or Kosuke free when you hold none. Among agents, only your Sensei reaches them.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "crons", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -23101,6 +23323,8 @@
         "summary": "Create a Personal Cron, enabled, with you as its owner. A Personal Cron belongs to you and no workspace: with Personal Repositories or Apps it runs in its own sandbox; without, in its Sensei Thread. Repository runs use your own Subscriptions; thread runs use your Subscriptions or Kosuke free when you hold none. Kosuke free cannot run a Cron with repositories yet. The crontab is read in the cron's own timezone, and may not fire more often than every 15 minutes. The model is an encoded id such as anthropic:opus__xhigh; repositories require an explicit Model from any released Provider on one of your Subscriptions. Changing to Free while you hold a Subscription, or to a personal Model without one, is refused. Without repositories, null or left out runs on the thread’s model. From your Sensei it is refused with 409 CRON_ALREADY_EXISTS when you have a Personal Cron by that name.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "crons", "create"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
@@ -23206,6 +23430,8 @@
         "summary": "Read one of your Personal Crons: its prompt, schedule, timezone, model, when it runs next, its thread, its last run status, and how many runs in a row failed: five disable it. A Personal Cron belongs to you and no workspace: with Personal Repositories or Apps it runs in its own sandbox; without, in its Sensei Thread. Both use your own Subscription.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "crons", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -23257,6 +23483,8 @@
         "summary": "Change one of your Personal Crons; only the fields sent change. Any edit sets the cron's failure count back to zero. enabled=false pauses the cron and enabled=true resumes it. No projects left stays until a save picks at least one repository, and Resume is refused meanwhile. Changing repositories rechecks the Model: a sandbox requires an explicit Model from any released Provider on one of your Subscriptions; Kosuke free cannot run it yet. Changing to Free while you hold a Subscription, or to a personal Model without one, is refused. Re-sending the unchanged stored Model is accepted. Without repositories, model=null goes back to the thread’s model. The crontab is read in the cron's own timezone.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "crons", "update"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -23376,6 +23604,8 @@
         "summary": "List the Artifacts a cron's runs published, across all of its runs, most recently changed first: each one's title, kind and version, with the run and the project it came from, and the total the filters keep. One row per Artifact: the same slug published by two runs is two rows. Rows only: a body or a file url comes from crons runs artifacts get, with the row's runId. The project and kind filters each take several values and keep an Artifact matching any of them.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "crons", "artifacts", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -23484,6 +23714,8 @@
         "summary": "Fire one of your Personal Crons once now, on your own Subscription: with repositories it runs in its own sandbox; without, in its Sensei Thread. Resume a paused Cron first. Refused for No projects left until a save picks a repository. Answers with runs: [{ runId, status, projectIds, projectId }]. Status may be queued while the fire is pending.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "crons", "run"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -23537,6 +23769,8 @@
         "summary": "List the runs of one of your Personal Crons, newest first: each one's status, the first line of its report or its error, and whether it ran in a sandbox or Sensei Thread, with the total and failed counts of the runs the filter keeps. The status filter takes several values and keeps a run matching any of them.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "crons", "runs", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -23629,6 +23863,8 @@
         "summary": "Read one Personal Cron run: its kind, status, Model, report, repositories and filed sessions. A sandbox run has its Cron Agent transcript and Artifacts and threadId null. A thread run names the Sensei Thread holding its Turn.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "crons", "runs", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -23692,6 +23928,8 @@
         "summary": "List the Artifacts a run of a cron published, most recently changed first. Rows only: a body or a file url comes from reading one.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "crons", "runs", "artifacts", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -23755,6 +23993,8 @@
         "summary": "Read one Artifact of a run of a cron, by its id or its slug: a markdown or html one carries its body, an image or a video a presigned url, its media type and its size.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "crons", "runs", "artifacts", "get"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
         "x-kosuke-sensei-token": true,
         "parameters": [
           {
@@ -24128,6 +24368,9 @@
         "summary": "Delete a file of your personal Files, or a folder and every item inside it. Agents cannot delete Files.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "files", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "fileId",
@@ -24240,6 +24483,9 @@
         "summary": "List personal integrations, including unavailable entries marked availability: restricted with no held connections, such as Gmail or Notion, with your own connections to each: label, status and whether a Reconnect is needed. They belong to you and follow you into every workspace you belong to. Never a credential or a connected-account identifier, and only a signed-in member or their own API key can read them: an agent token, a workspace admin and every other member cannot.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "integrations", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -24280,6 +24526,9 @@
         "summary": "Disconnect one of your own integration connections by toolkit slug and connection id, such as gmail and the id `user integrations list` returns: agents lose it at once, then Kosuke deletes the stored authorization, retrying in the background if needed. Revoking the authorization at the toolkit itself is not part of this. A connection that is not yours, or is already gone, answers 404.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "integrations", "remove"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "toolkit",
@@ -24340,6 +24589,9 @@
         "summary": "List your LinkedIn browser connections, oldest first: each is one LinkedIn account Sensei may act as in its browser, in one Chrome profile of one of your Macs, with what Sensei's last check saw. account is null while it waits for Sensei to read it on the page; device.removed is true once that Mac was removed.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "integrations", "linkedin", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -24378,6 +24630,9 @@
         "summary": "Connect LinkedIn in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "integrations", "linkedin", "connect"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
           "content": {
@@ -24443,6 +24698,9 @@
         "summary": "Start the LinkedIn connection flow again for the same account, Mac and Chrome profile, in a new Sensei thread, whose ID it answers. The account stays: to use another one, remove the connection and connect again. 409 MAC_REMOVED when its Mac was removed.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "integrations", "linkedin", "reconnect"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "connectionId",
@@ -24495,6 +24753,9 @@
         "summary": "List your X browser connections, oldest first: each is one X account Sensei may act as in its browser, in one Chrome profile of one of your Macs, with what Sensei's last check saw. account is null while it waits for Sensei to read it on the page; device.removed is true once that Mac was removed.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "integrations", "x", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -24533,6 +24794,9 @@
         "summary": "Connect X in one allowed Chrome profile of one of your online Macs: creates the connection waiting for Sensei and sends Sensei the request as you, in a new Sensei thread, whose ID it answers. 404 MAC_NOT_FOUND or PROFILE_NOT_FOUND, 409 MAC_OFFLINE, PROFILE_OFF, or ALREADY_CONNECTED with details.connectionId.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "integrations", "x", "connect"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
           "content": {
@@ -24598,6 +24862,9 @@
         "summary": "Start the X connection flow again for the same account, Mac and Chrome profile, in a new Sensei thread, whose ID it answers. The account stays: to use another one, remove the connection and connect again. 409 MAC_REMOVED when its Mac was removed.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "integrations", "x", "reconnect"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "connectionId",
@@ -24650,6 +24917,9 @@
         "summary": "Read your private Memory files.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "memory", "list"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "responses": {
           "2XX": {
             "description": "Success envelope",
@@ -24690,6 +24960,9 @@
         "summary": "Save a private Memory file at the revision you read.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "memory", "put"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "file",
@@ -25187,6 +25460,9 @@
         "summary": "Delete one of your personal skills. Running chat sessions drop it at their next turn.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "skills", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "skillId",
@@ -25280,6 +25556,9 @@
         "summary": "Save the model new chat sessions start on, as an encoded id such as anthropic:sonnet__medium, or null to let Kosuke choose, kosuke-free to use Auto - Kosuke free, or defaultAuto: true for personal Auto. Answers 204.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "set-default-model"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
           "content": {
@@ -25339,6 +25618,9 @@
         "summary": "Save a personal GLM Coding Plan (zai), Kimi Code (moonshot), or DeepSeek API (deepseek) key after one validation call. Providers keep up to 20 keys; loginId replaces one.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "set-key"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "provider",
@@ -25411,6 +25693,9 @@
         "summary": "Disconnect all your saved access to one provider. Google disconnects your Antigravity sign-in. Answers 204.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "provider",
@@ -25462,6 +25747,9 @@
         "summary": "Disconnect one login of your subscription for a provider, by its id under logins. Sessions move to your next login of that provider on their next message, or off the subscription when it was the last. Answers 204.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "logins", "delete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "provider",
@@ -25523,6 +25811,9 @@
         "summary": "Re-check usage for your own Subscriptions of one provider (including SuperGrok on xai) at their limit, without waiting for their reset. Returns cleared, stillAtLimit and unreadable counts and retryAt, the earliest remaining reset, or null.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "logins", "recheck"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "parameters": [
           {
             "name": "provider",
@@ -25574,6 +25865,9 @@
         "summary": "Start your personal Antigravity Subscription sign-in. Poll complete with attemptId and revision until authorizationUrl is ready, then open it and paste the whole loopback return URL into complete. Saving does not select the method.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "login", "antigravity", "start"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": false,
           "content": {
@@ -25631,6 +25925,9 @@
         "summary": "Cancel your pending Google sign-in. The isolated login host is removed by the cleanup worker. Saved Google methods and selection stay as they are.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "login", "antigravity", "cancel"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
           "content": {
@@ -25693,6 +25990,9 @@
         "summary": "Poll your Antigravity sign-in, or submit the whole http://127.0.0.1 return URL once it is waiting. Repeating completion returns its confirmed receipt. Never pass a return URL from another attempt.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "login", "antigravity", "complete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
           "content": {
@@ -25759,6 +26059,9 @@
         "summary": "Start connecting your Claude subscription: open the returned url in a browser, then pass the code it shows and loginToken to complete within 15 minutes.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "login", "claude", "start"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": false,
           "content": {
@@ -25817,6 +26120,9 @@
         "summary": "Finish connecting your Claude subscription with the loginToken from start and the code from the browser (code, code#state, or the whole callback URL). A refused code answers 200 with authenticated false.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "login", "claude", "complete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
           "content": {
@@ -25878,6 +26184,9 @@
         "summary": "Start connecting your Codex subscription: enter userCode at verificationUrl in a browser, then call complete with loginToken until it answers authenticated.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "login", "codex", "start"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": false,
           "content": {
@@ -25936,6 +26245,9 @@
         "summary": "Poll your Codex login with the loginToken from start: authenticated false until the code is approved in the browser, so repeat every intervalSeconds; restart true means start again.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "login", "codex", "complete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
           "content": {
@@ -25993,6 +26305,9 @@
         "summary": "Start connecting your Muse Code subscription: open verificationUrl in a browser and approve userCode, then call complete with loginToken until it answers authenticated.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "login", "muse", "start"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": false,
           "content": {
@@ -26051,6 +26366,9 @@
         "summary": "Poll your Muse Code login with the loginToken from start: authenticated false until the code is approved in the browser, so repeat every intervalSeconds; restart true means start again.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "login", "muse", "complete"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
           "content": {
@@ -26279,6 +26597,9 @@
         "summary": "Connect, poll, cancel or remove your SuperGrok login. An xAI API key is a workspace connection.",
         "tags": ["user"],
         "x-kosuke-command": ["user", "subscriptions", "grok", "change"],
+        "x-kosuke-sandbox-token": true,
+        "x-kosuke-cron-token": true,
+        "x-kosuke-sensei-token": true,
         "requestBody": {
           "required": true,
           "content": {