@labelbox/rl-sdk 0.0.147 → 0.0.149

package/dist/reference/sdk-reference.generated.js

@@ -44128,6 +44128,110 @@ export const SDK_REFERENCE = {
             ],
         },
     },
+    managedAgentsApplyAgentTag: {
+        operationId: 'managedAgentsApplyAgentTag',
+        tag: 'managed-agents',
+        callPath: ['managedAgents', 'applyAgentTag'],
+        namespace: 'managedAgents',
+        method: 'applyAgentTag',
+        signature: 'rl.managedAgents.applyAgentTag({ agent_id, tag_id })',
+        example: "const result = await rl.managedAgents.applyAgentTag({\n  agent_id: '<agent_id>',\n  tag_id: '<tag_id>',\n});",
+        cliInvocation: 'rl managed-agents apply-agent-tag',
+        cliExample: 'rl managed-agents apply-agent-tag \\\n  --agent_id <agent_id> \\\n  --tag_id <tag_id>',
+        curlExample: "curl -X PUT 'https://api.recursion.labelbox.com/managed-agents/v1/agents/<agent_id>/tags/<tag_id>' \\\n  -H 'Authorization: Bearer $LABELBOX_API_KEY'",
+        summary: 'Apply one tag to an agent',
+        description: "Idempotently applies one live organization tag and returns the agent's resulting full tag definitions. The classification write does not update the agent or mint a version.",
+        httpMethod: 'put',
+        path: '/managed-agents/v1/agents/{agent_id}/tags/{tag_id}',
+        requiredPermissions: ['managed-agents:update'],
+        params: [
+            {
+                name: 'agent_id',
+                in: 'path',
+                required: true,
+                type: 'string',
+                description: 'Agent id (UUID) as returned by createAgent or listAgents.',
+                format: 'uuid',
+            },
+            {
+                name: 'tag_id',
+                in: 'path',
+                required: true,
+                type: 'string',
+                description: 'Tag id (UUID) as returned by createTag or listTags.',
+                format: 'uuid',
+            },
+        ],
+        response: {
+            type: 'ManagedAgentsTagListResponse',
+            description: "A complete set of organization-scoped tag definitions. GET /v1/tags returns the organization catalog; agent tag PUT routes return the agent's resulting exact set.",
+            fields: [
+                {
+                    name: 'tags',
+                    required: true,
+                    type: 'ManagedAgentsTag[]',
+                    description: 'The complete live tag set for this response. Always an array; an empty array means no definitions exist or the agent has no classifications.',
+                    items: {
+                        type: 'ManagedAgentsTag',
+                        description: 'An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.',
+                        fields: [
+                            {
+                                name: 'color',
+                                required: false,
+                                type: 'string',
+                                description: 'Display color in #RRGGBB form.',
+                                minLength: 7,
+                                maxLength: 7,
+                                pattern: '^#[0-9A-Fa-f]{6}$',
+                            },
+                            {
+                                name: 'created_at',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned RFC 3339 timestamp of when the tag was created.',
+                                format: 'date-time',
+                            },
+                            {
+                                name: 'description',
+                                required: false,
+                                type: 'string',
+                                description: 'Optional operator-facing explanation of the classification, up to 280 characters.',
+                                maxLength: 280,
+                            },
+                            {
+                                name: 'label',
+                                required: false,
+                                type: 'string',
+                                description: 'Display label, trimmed by the service. Unique case-insensitively among live tags in this organization.',
+                                minLength: 1,
+                                maxLength: 32,
+                            },
+                            {
+                                name: 'organization_id',
+                                required: false,
+                                type: 'string',
+                                description: 'Labelbox organization that owns the tag. Server-assigned from the authenticated principal and never accepted as authority from the request body.',
+                            },
+                            {
+                                name: 'tag_id',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned tag id (UUID).',
+                                format: 'uuid',
+                            },
+                            {
+                                name: 'updated_at',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned RFC 3339 timestamp of the most recent definition update.',
+                                format: 'date-time',
+                            },
+                        ],
+                    },
+                },
+            ],
+        },
+    },
     managedAgentsArchiveMemoryStore: {
         operationId: 'managedAgentsArchiveMemoryStore',
         tag: 'managed-agents',
@@ -44477,7 +44581,7 @@ export const SDK_REFERENCE = {
         ],
         response: {
             type: 'ManagedAgentsAgent',
-            description: 'A configured agent: its model, system prompt, tool and MCP surface, and the vault defaults new sessions inherit. Mutating an agent mints a new immutable AgentVersion; a session records the version it ran.',
+            description: 'A configured agent: its versioned execution definition plus current mutable classification tags. Patching the execution definition mints a new immutable AgentVersion; applying tags does not. A session records the version it ran and never snapshots tags.',
             fields: [
                 {
                     name: 'agent_id',
@@ -44639,6 +44743,69 @@ export const SDK_REFERENCE = {
                     type: 'string',
                     description: 'System prompt prepended to every conversation this agent runs.',
                 },
+                {
+                    name: 'tags',
+                    required: true,
+                    type: 'ManagedAgentsTag[]',
+                    description: 'Current organization-scoped classification tags applied to this agent. Always an array. Tags are mutable catalog metadata and are deliberately absent from AgentVersion and session runtime snapshots.',
+                    items: {
+                        type: 'ManagedAgentsTag',
+                        description: 'An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.',
+                        fields: [
+                            {
+                                name: 'color',
+                                required: false,
+                                type: 'string',
+                                description: 'Display color in #RRGGBB form.',
+                                minLength: 7,
+                                maxLength: 7,
+                                pattern: '^#[0-9A-Fa-f]{6}$',
+                            },
+                            {
+                                name: 'created_at',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned RFC 3339 timestamp of when the tag was created.',
+                                format: 'date-time',
+                            },
+                            {
+                                name: 'description',
+                                required: false,
+                                type: 'string',
+                                description: 'Optional operator-facing explanation of the classification, up to 280 characters.',
+                                maxLength: 280,
+                            },
+                            {
+                                name: 'label',
+                                required: false,
+                                type: 'string',
+                                description: 'Display label, trimmed by the service. Unique case-insensitively among live tags in this organization.',
+                                minLength: 1,
+                                maxLength: 32,
+                            },
+                            {
+                                name: 'organization_id',
+                                required: false,
+                                type: 'string',
+                                description: 'Labelbox organization that owns the tag. Server-assigned from the authenticated principal and never accepted as authority from the request body.',
+                            },
+                            {
+                                name: 'tag_id',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned tag id (UUID).',
+                                format: 'uuid',
+                            },
+                            {
+                                name: 'updated_at',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned RFC 3339 timestamp of the most recent definition update.',
+                                format: 'date-time',
+                            },
+                        ],
+                    },
+                },
                 {
                     name: 'toolsets',
                     required: false,
@@ -46069,6 +46236,110 @@ export const SDK_REFERENCE = {
             ],
         },
     },
+    managedAgentsCreateTag: {
+        operationId: 'managedAgentsCreateTag',
+        tag: 'managed-agents',
+        callPath: ['managedAgents', 'createTag'],
+        namespace: 'managedAgents',
+        method: 'createTag',
+        bodyKey: 'body',
+        signature: 'rl.managedAgents.createTag({ body })',
+        example: 'const result = await rl.managedAgents.createTag({\n  body: {\n    color: "#14b8a6",\n    description: "example",\n    label: "example"\n  },\n});',
+        cliInvocation: 'rl managed-agents create-tag',
+        cliExample: "rl managed-agents create-tag \\\n  --color '#14b8a6' \\\n  --label 'example' \\\n  --from-json body.json",
+        curlExample: 'curl -X POST \'https://api.recursion.labelbox.com/managed-agents/v1/tags\' \\\n  -H \'Authorization: Bearer $LABELBOX_API_KEY\' \\\n  -H \'Content-Type: application/json\' \\\n  -d \'{\n    "color": "#14b8a6",\n    "description": "example",\n    "label": "example"\n  }\'',
+        summary: 'Create an organization tag',
+        description: 'Creates a mutable classification definition in the calling organization. Labels are trimmed and case-insensitively unique among live tags; deleting a tag releases its label.',
+        httpMethod: 'post',
+        path: '/managed-agents/v1/tags',
+        requiredPermissions: ['managed-agents:create'],
+        params: [
+            {
+                name: 'color',
+                in: 'body',
+                required: true,
+                type: 'string',
+                description: 'Display color in #RRGGBB form.',
+                minLength: 7,
+                maxLength: 7,
+                pattern: '^#[0-9A-Fa-f]{6}$',
+            },
+            {
+                name: 'description',
+                in: 'body',
+                required: false,
+                type: 'string',
+                description: 'Optional operator-facing explanation of this classification, up to 280 characters.',
+                maxLength: 280,
+            },
+            {
+                name: 'label',
+                in: 'body',
+                required: true,
+                type: 'string',
+                description: 'Display label. Leading and trailing whitespace is removed; the result must contain 1-32 characters and be unique case-insensitively among live tags in the organization.',
+                minLength: 1,
+                maxLength: 32,
+            },
+        ],
+        response: {
+            type: 'ManagedAgentsTag',
+            description: 'An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.',
+            fields: [
+                {
+                    name: 'color',
+                    required: false,
+                    type: 'string',
+                    description: 'Display color in #RRGGBB form.',
+                    minLength: 7,
+                    maxLength: 7,
+                    pattern: '^#[0-9A-Fa-f]{6}$',
+                },
+                {
+                    name: 'created_at',
+                    required: false,
+                    type: 'string',
+                    description: 'Server-assigned RFC 3339 timestamp of when the tag was created.',
+                    format: 'date-time',
+                },
+                {
+                    name: 'description',
+                    required: false,
+                    type: 'string',
+                    description: 'Optional operator-facing explanation of the classification, up to 280 characters.',
+                    maxLength: 280,
+                },
+                {
+                    name: 'label',
+                    required: false,
+                    type: 'string',
+                    description: 'Display label, trimmed by the service. Unique case-insensitively among live tags in this organization.',
+                    minLength: 1,
+                    maxLength: 32,
+                },
+                {
+                    name: 'organization_id',
+                    required: false,
+                    type: 'string',
+                    description: 'Labelbox organization that owns the tag. Server-assigned from the authenticated principal and never accepted as authority from the request body.',
+                },
+                {
+                    name: 'tag_id',
+                    required: false,
+                    type: 'string',
+                    description: 'Server-assigned tag id (UUID).',
+                    format: 'uuid',
+                },
+                {
+                    name: 'updated_at',
+                    required: false,
+                    type: 'string',
+                    description: 'Server-assigned RFC 3339 timestamp of the most recent definition update.',
+                    format: 'date-time',
+                },
+            ],
+        },
+    },
     managedAgentsCreateVault: {
         operationId: 'managedAgentsCreateVault',
         tag: 'managed-agents',
@@ -46161,10 +46432,10 @@ export const SDK_REFERENCE = {
         method: 'createVaultCredential',
         bodyKey: 'body',
         signature: 'rl.managedAgents.createVaultCredential({ vault_id, body })',
-        example: 'const result = await rl.managedAgents.createVaultCredential({\n  vault_id: \'<vault_id>\',\n  body: {\n    allowed_hosts: [\n      "example"\n    ],\n    credential_type: "bearer_token",\n    display_name: "example-name",\n    injection_locations: [\n      "headers"\n    ],\n    integration_connection_id: "9f8b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d",\n    integration_permission: "example",\n    integration_resources: [\n      "example"\n    ],\n    mcp_server_url: "https://example.com",\n    metadata: {\n      key: "example"\n    },\n    network_mode: "limited",\n    secret_name: "example",\n    secret_ref: "example",\n    secret_value: "example"\n  },\n});',
+        example: 'const result = await rl.managedAgents.createVaultCredential({\n  vault_id: \'<vault_id>\',\n  body: {\n    allowed_hosts: [\n      "example"\n    ],\n    credential_type: "bearer_token",\n    display_name: "example-name",\n    injection_locations: [\n      "headers"\n    ],\n    integration_connection_id: "9f8b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d",\n    integration_permission: "example",\n    integration_resources: [\n      "example"\n    ],\n    labelbox_scope: {\n      organization_id: "9f8b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d",\n      project_ids: [\n        "example"\n      ]\n    },\n    mcp_server_url: "https://example.com",\n    metadata: {\n      key: "example"\n    },\n    network_mode: "limited",\n    secret_name: "example",\n    secret_ref: "example",\n    secret_value: "example"\n  },\n});',
         cliInvocation: 'rl managed-agents create-vault-credential',
         cliExample: "rl managed-agents create-vault-credential \\\n  --vault_id <vault_id> \\\n  --credential_type 'bearer_token' \\\n  --from-json body.json",
-        curlExample: 'curl -X POST \'https://api.recursion.labelbox.com/managed-agents/v1/vaults/<vault_id>/credentials\' \\\n  -H \'Authorization: Bearer $LABELBOX_API_KEY\' \\\n  -H \'Content-Type: application/json\' \\\n  -d \'{\n    "allowed_hosts": [\n      "example"\n    ],\n    "credential_type": "bearer_token",\n    "display_name": "example-name",\n    "injection_locations": [\n      "headers"\n    ],\n    "integration_connection_id": "9f8b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d",\n    "integration_permission": "example",\n    "integration_resources": [\n      "example"\n    ],\n    "mcp_server_url": "https://example.com",\n    "metadata": {\n      "key": "example"\n    },\n    "network_mode": "limited",\n    "secret_name": "example",\n    "secret_ref": "example",\n    "secret_value": "example"\n  }\'',
+        curlExample: 'curl -X POST \'https://api.recursion.labelbox.com/managed-agents/v1/vaults/<vault_id>/credentials\' \\\n  -H \'Authorization: Bearer $LABELBOX_API_KEY\' \\\n  -H \'Content-Type: application/json\' \\\n  -d \'{\n    "allowed_hosts": [\n      "example"\n    ],\n    "credential_type": "bearer_token",\n    "display_name": "example-name",\n    "injection_locations": [\n      "headers"\n    ],\n    "integration_connection_id": "9f8b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d",\n    "integration_permission": "example",\n    "integration_resources": [\n      "example"\n    ],\n    "labelbox_scope": {\n      "organization_id": "9f8b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d",\n      "project_ids": [\n        "example"\n      ]\n    },\n    "mcp_server_url": "https://example.com",\n    "metadata": {\n      "key": "example"\n    },\n    "network_mode": "limited",\n    "secret_name": "example",\n    "secret_ref": "example",\n    "secret_value": "example"\n  }\'',
         summary: 'Register a credential reference in a vault',
         description: "Registers one credential in a vault and returns the stored reference. Supply exactly one of secret_value (encrypted under the organization's key and stored as ciphertext) or secret_ref (material you already stored yourself) for secret-backed kinds. Integration grants carry neither; they reference a connected account that mints short-lived credentials. Secret material is never echoed back on this or any later response.",
         httpMethod: 'post',
@@ -46235,6 +46506,29 @@ export const SDK_REFERENCE = {
                 type: 'string[]',
                 description: 'Resources within the connection this grant may reach, e.g. GitHub repository names. Empty means every resource the connection reaches, which is broader than most grants should be.',
             },
+            {
+                name: 'labelbox_scope',
+                in: 'body',
+                required: false,
+                type: 'ManagedAgentsLabelboxScopeRequest',
+                description: "Organization and exact project set the credential may read through the deployment's Labelbox product-state MCP service. Required when credential_type is bearer_token and mcp_server_url is that service; rejected for any other server.",
+                fields: [
+                    {
+                        name: 'organization_id',
+                        required: false,
+                        type: 'string',
+                        description: 'Labelbox organization the projects belong to. Optional: filled in from the organization that owns the credential, and rejected if it names any other.',
+                    },
+                    {
+                        name: 'project_ids',
+                        required: true,
+                        type: 'unknown',
+                        description: 'Exact Labelbox project ids (1 to 100, each up to 128 characters of letters, digits, hyphen, or underscore) the credential may read. Duplicates are rejected.',
+                        minItems: 1,
+                        maxItems: 100,
+                    },
+                ],
+            },
             {
                 name: 'mcp_server_url',
                 in: 'body',
@@ -46247,7 +46541,7 @@ export const SDK_REFERENCE = {
                 in: 'body',
                 required: false,
                 type: 'object',
-                description: 'Free-form caller-owned JSON stored with the credential row and returned on reads. Not interpreted by the service; never put secret material here, since unlike secret_value it is returned verbatim.',
+                description: 'Free-form caller-owned JSON stored with the credential row and returned on reads. Not interpreted by the service; never put secret material here, since unlike secret_value it is returned verbatim. The key labelbox_scope is reserved for the typed field.',
             },
             {
                 name: 'network_mode',
@@ -46338,6 +46632,28 @@ export const SDK_REFERENCE = {
                     type: 'string[]',
                     description: 'Resources within the connection the grant is narrowed to — repositories, for GitHub. Empty means every resource the connection itself can reach, which is broader than most grants should be.',
                 },
+                {
+                    name: 'labelbox_scope',
+                    required: false,
+                    type: 'ManagedAgentsLabelboxToolsScope',
+                    description: 'Organization and exact project set this credential may read through the Labelbox product-state MCP service. Required for a bearer_token credential whose mcp_server_url is that service; rejected for any other server. Replaced as a whole on update and kept when omitted.',
+                    fields: [
+                        {
+                            name: 'organization_id',
+                            required: true,
+                            type: 'string',
+                            description: 'Labelbox organization the projects belong to. Must equal the organization that owns the credential; filled in from it when omitted on write.',
+                        },
+                        {
+                            name: 'project_ids',
+                            required: true,
+                            type: 'unknown',
+                            description: 'Exact Labelbox project ids (1 to 100, each up to 128 characters of letters, digits, hyphen, or underscore) the credential may read. Validated as unique and sorted on write.',
+                            minItems: 1,
+                            maxItems: 100,
+                        },
+                    ],
+                },
                 {
                     name: 'mcp_server_url',
                     required: false,
@@ -46348,7 +46664,7 @@ export const SDK_REFERENCE = {
                     name: 'metadata',
                     required: false,
                     type: 'object',
-                    description: 'Free-form caller-supplied key/value labels. Stored verbatim and never interpreted by the service.',
+                    description: 'Free-form caller-supplied key/value labels. Stored verbatim and never interpreted by the service. The key labelbox_scope is reserved for the typed field of that name.',
                 },
                 {
                     name: 'network_mode',
@@ -47236,7 +47552,7 @@ export const SDK_REFERENCE = {
         ],
         response: {
             type: 'ManagedAgentsDeletedResponse',
-            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
+            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
             fields: [
                 {
                     name: 'deleted',
@@ -47301,7 +47617,7 @@ export const SDK_REFERENCE = {
         ],
         response: {
             type: 'ManagedAgentsDeletedResponse',
-            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
+            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
             fields: [
                 {
                     name: 'deleted',
@@ -47402,7 +47718,7 @@ export const SDK_REFERENCE = {
         ],
         response: {
             type: 'ManagedAgentsDeletedResponse',
-            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
+            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
             fields: [
                 {
                     name: 'deleted',
@@ -47441,7 +47757,46 @@ export const SDK_REFERENCE = {
         ],
         response: {
             type: 'ManagedAgentsDeletedResponse',
-            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
+            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
+            fields: [
+                {
+                    name: 'deleted',
+                    required: false,
+                    type: 'boolean',
+                    description: 'Always true. The record was soft deleted and is now excluded from reads; a delete that did not happen is an HTTP error instead, so this field never reports false.',
+                },
+            ],
+        },
+    },
+    managedAgentsDeleteTag: {
+        operationId: 'managedAgentsDeleteTag',
+        tag: 'managed-agents',
+        callPath: ['managedAgents', 'deleteTag'],
+        namespace: 'managedAgents',
+        method: 'deleteTag',
+        signature: 'rl.managedAgents.deleteTag({ tag_id })',
+        example: "const result = await rl.managedAgents.deleteTag({\n  tag_id: '<tag_id>',\n});",
+        cliInvocation: 'rl managed-agents delete-tag',
+        cliExample: 'rl managed-agents delete-tag \\\n  --tag_id <tag_id>',
+        curlExample: "curl -X DELETE 'https://api.recursion.labelbox.com/managed-agents/v1/tags/<tag_id>' \\\n  -H 'Authorization: Bearer $LABELBOX_API_KEY'",
+        summary: 'Soft delete a tag',
+        description: 'Soft deletes the bounded definition row. Live-definition joins immediately hide every application without rewriting them; agents and immutable versions are untouched, and the label may be reused.',
+        httpMethod: 'delete',
+        path: '/managed-agents/v1/tags/{tag_id}',
+        requiredPermissions: ['managed-agents:delete'],
+        params: [
+            {
+                name: 'tag_id',
+                in: 'path',
+                required: true,
+                type: 'string',
+                description: 'Tag id (UUID) as returned by createTag or listTags.',
+                format: 'uuid',
+            },
+        ],
+        response: {
+            type: 'ManagedAgentsDeletedResponse',
+            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
             fields: [
                 {
                     name: 'deleted',
@@ -47480,7 +47835,7 @@ export const SDK_REFERENCE = {
         ],
         response: {
             type: 'ManagedAgentsDeletedResponse',
-            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
+            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
             fields: [
                 {
                     name: 'deleted',
@@ -47519,7 +47874,7 @@ export const SDK_REFERENCE = {
         ],
         response: {
             type: 'ManagedAgentsDeletedResponse',
-            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
+            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
             fields: [
                 {
                     name: 'deleted',
@@ -47566,7 +47921,7 @@ export const SDK_REFERENCE = {
         ],
         response: {
             type: 'ManagedAgentsDeletedResponse',
-            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
+            description: 'Shared response body of every soft-delete endpoint, on agents, environments, environment worker keys, tags, vaults, vault credentials, webhook bindings, and sessions. Soft delete is a tombstone, not an erase: the row stops appearing in list and get responses but is retained, and there is no undelete endpoint to bring it back. Irreversible erasure is the separate, confirmation-gated purge path.',
             fields: [
                 {
                     name: 'deleted',
@@ -47631,7 +47986,7 @@ export const SDK_REFERENCE = {
         ],
         response: {
             type: 'ManagedAgentsAgent',
-            description: 'A configured agent: its model, system prompt, tool and MCP surface, and the vault defaults new sessions inherit. Mutating an agent mints a new immutable AgentVersion; a session records the version it ran.',
+            description: 'A configured agent: its versioned execution definition plus current mutable classification tags. Patching the execution definition mints a new immutable AgentVersion; applying tags does not. A session records the version it ran and never snapshots tags.',
             fields: [
                 {
                     name: 'agent_id',
@@ -47794,32 +48149,95 @@ export const SDK_REFERENCE = {
                     description: 'System prompt prepended to every conversation this agent runs.',
                 },
                 {
-                    name: 'toolsets',
-                    required: false,
-                    type: 'unknown',
-                    description: 'Additional tool groups to enable, snapshotted into the session and passed to the execution runtime unchanged. This does NOT gate the sandbox tools: run_command, run_process, read_file and write_file are offered to every session with a sandbox whether or not this list mentions them, so a shell needs no entry here. The names a session actually offers the model are reported as config.available_builtin_tools on the started session -- read that rather than inferring the tool surface from this list.',
-                },
-                {
-                    name: 'updated_at',
-                    required: false,
-                    type: 'string',
-                    description: 'Server-assigned RFC 3339 timestamp of the most recent update to the agent.',
-                    format: 'date-time',
-                },
-                {
-                    name: 'web_search_enabled',
-                    required: false,
-                    type: 'boolean',
-                    description: 'Whether new sessions may use the native web_search tool. Omitted on legacy agents and interpreted as enabled.',
-                    default: true,
-                },
-            ],
-        },
-    },
-    managedAgentsGetAgentLearning: {
-        operationId: 'managedAgentsGetAgentLearning',
-        tag: 'managed-agents',
-        callPath: ['managedAgents', 'getAgentLearning'],
+                    name: 'tags',
+                    required: true,
+                    type: 'ManagedAgentsTag[]',
+                    description: 'Current organization-scoped classification tags applied to this agent. Always an array. Tags are mutable catalog metadata and are deliberately absent from AgentVersion and session runtime snapshots.',
+                    items: {
+                        type: 'ManagedAgentsTag',
+                        description: 'An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.',
+                        fields: [
+                            {
+                                name: 'color',
+                                required: false,
+                                type: 'string',
+                                description: 'Display color in #RRGGBB form.',
+                                minLength: 7,
+                                maxLength: 7,
+                                pattern: '^#[0-9A-Fa-f]{6}$',
+                            },
+                            {
+                                name: 'created_at',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned RFC 3339 timestamp of when the tag was created.',
+                                format: 'date-time',
+                            },
+                            {
+                                name: 'description',
+                                required: false,
+                                type: 'string',
+                                description: 'Optional operator-facing explanation of the classification, up to 280 characters.',
+                                maxLength: 280,
+                            },
+                            {
+                                name: 'label',
+                                required: false,
+                                type: 'string',
+                                description: 'Display label, trimmed by the service. Unique case-insensitively among live tags in this organization.',
+                                minLength: 1,
+                                maxLength: 32,
+                            },
+                            {
+                                name: 'organization_id',
+                                required: false,
+                                type: 'string',
+                                description: 'Labelbox organization that owns the tag. Server-assigned from the authenticated principal and never accepted as authority from the request body.',
+                            },
+                            {
+                                name: 'tag_id',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned tag id (UUID).',
+                                format: 'uuid',
+                            },
+                            {
+                                name: 'updated_at',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned RFC 3339 timestamp of the most recent definition update.',
+                                format: 'date-time',
+                            },
+                        ],
+                    },
+                },
+                {
+                    name: 'toolsets',
+                    required: false,
+                    type: 'unknown',
+                    description: 'Additional tool groups to enable, snapshotted into the session and passed to the execution runtime unchanged. This does NOT gate the sandbox tools: run_command, run_process, read_file and write_file are offered to every session with a sandbox whether or not this list mentions them, so a shell needs no entry here. The names a session actually offers the model are reported as config.available_builtin_tools on the started session -- read that rather than inferring the tool surface from this list.',
+                },
+                {
+                    name: 'updated_at',
+                    required: false,
+                    type: 'string',
+                    description: 'Server-assigned RFC 3339 timestamp of the most recent update to the agent.',
+                    format: 'date-time',
+                },
+                {
+                    name: 'web_search_enabled',
+                    required: false,
+                    type: 'boolean',
+                    description: 'Whether new sessions may use the native web_search tool. Omitted on legacy agents and interpreted as enabled.',
+                    default: true,
+                },
+            ],
+        },
+    },
+    managedAgentsGetAgentLearning: {
+        operationId: 'managedAgentsGetAgentLearning',
+        tag: 'managed-agents',
+        callPath: ['managedAgents', 'getAgentLearning'],
         namespace: 'managedAgents',
         method: 'getAgentLearning',
         signature: 'rl.managedAgents.getAgentLearning({ agent_id })',
@@ -51262,6 +51680,90 @@ export const SDK_REFERENCE = {
             ],
         },
     },
+    managedAgentsGetTag: {
+        operationId: 'managedAgentsGetTag',
+        tag: 'managed-agents',
+        callPath: ['managedAgents', 'getTag'],
+        namespace: 'managedAgents',
+        method: 'getTag',
+        signature: 'rl.managedAgents.getTag({ tag_id })',
+        example: "const result = await rl.managedAgents.getTag({\n  tag_id: '<tag_id>',\n});",
+        cliInvocation: 'rl managed-agents get-tag',
+        cliExample: 'rl managed-agents get-tag \\\n  --tag_id <tag_id>',
+        curlExample: "curl -X GET 'https://api.recursion.labelbox.com/managed-agents/v1/tags/<tag_id>' \\\n  -H 'Authorization: Bearer $LABELBOX_API_KEY'",
+        summary: 'Get one organization tag',
+        description: 'Returns one live tag definition. Unknown, deleted, and cross-organization ids all return the same 404.',
+        httpMethod: 'get',
+        path: '/managed-agents/v1/tags/{tag_id}',
+        requiredPermissions: ['managed-agents:read'],
+        params: [
+            {
+                name: 'tag_id',
+                in: 'path',
+                required: true,
+                type: 'string',
+                description: 'Tag id (UUID) as returned by createTag or listTags.',
+                format: 'uuid',
+            },
+        ],
+        response: {
+            type: 'ManagedAgentsTag',
+            description: 'An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.',
+            fields: [
+                {
+                    name: 'color',
+                    required: false,
+                    type: 'string',
+                    description: 'Display color in #RRGGBB form.',
+                    minLength: 7,
+                    maxLength: 7,
+                    pattern: '^#[0-9A-Fa-f]{6}$',
+                },
+                {
+                    name: 'created_at',
+                    required: false,
+                    type: 'string',
+                    description: 'Server-assigned RFC 3339 timestamp of when the tag was created.',
+                    format: 'date-time',
+                },
+                {
+                    name: 'description',
+                    required: false,
+                    type: 'string',
+                    description: 'Optional operator-facing explanation of the classification, up to 280 characters.',
+                    maxLength: 280,
+                },
+                {
+                    name: 'label',
+                    required: false,
+                    type: 'string',
+                    description: 'Display label, trimmed by the service. Unique case-insensitively among live tags in this organization.',
+                    minLength: 1,
+                    maxLength: 32,
+                },
+                {
+                    name: 'organization_id',
+                    required: false,
+                    type: 'string',
+                    description: 'Labelbox organization that owns the tag. Server-assigned from the authenticated principal and never accepted as authority from the request body.',
+                },
+                {
+                    name: 'tag_id',
+                    required: false,
+                    type: 'string',
+                    description: 'Server-assigned tag id (UUID).',
+                    format: 'uuid',
+                },
+                {
+                    name: 'updated_at',
+                    required: false,
+                    type: 'string',
+                    description: 'Server-assigned RFC 3339 timestamp of the most recent definition update.',
+                    format: 'date-time',
+                },
+            ],
+        },
+    },
     managedAgentsGetVault: {
         operationId: 'managedAgentsGetVault',
         tag: 'managed-agents',
@@ -51432,6 +51934,28 @@ export const SDK_REFERENCE = {
                     type: 'string[]',
                     description: 'Resources within the connection the grant is narrowed to — repositories, for GitHub. Empty means every resource the connection itself can reach, which is broader than most grants should be.',
                 },
+                {
+                    name: 'labelbox_scope',
+                    required: false,
+                    type: 'ManagedAgentsLabelboxToolsScope',
+                    description: 'Organization and exact project set this credential may read through the Labelbox product-state MCP service. Required for a bearer_token credential whose mcp_server_url is that service; rejected for any other server. Replaced as a whole on update and kept when omitted.',
+                    fields: [
+                        {
+                            name: 'organization_id',
+                            required: true,
+                            type: 'string',
+                            description: 'Labelbox organization the projects belong to. Must equal the organization that owns the credential; filled in from it when omitted on write.',
+                        },
+                        {
+                            name: 'project_ids',
+                            required: true,
+                            type: 'unknown',
+                            description: 'Exact Labelbox project ids (1 to 100, each up to 128 characters of letters, digits, hyphen, or underscore) the credential may read. Validated as unique and sorted on write.',
+                            minItems: 1,
+                            maxItems: 100,
+                        },
+                    ],
+                },
                 {
                     name: 'mcp_server_url',
                     required: false,
@@ -51442,7 +51966,7 @@ export const SDK_REFERENCE = {
                     name: 'metadata',
                     required: false,
                     type: 'object',
-                    description: 'Free-form caller-supplied key/value labels. Stored verbatim and never interpreted by the service.',
+                    description: 'Free-form caller-supplied key/value labels. Stored verbatim and never interpreted by the service. The key labelbox_scope is reserved for the typed field of that name.',
                 },
                 {
                     name: 'network_mode',
@@ -51854,16 +52378,24 @@ export const SDK_REFERENCE = {
         namespace: 'managedAgents',
         method: 'listAgents',
         signature: 'rl.managedAgents.listAgents()',
-        example: 'const result = await rl.managedAgents.listAgents();',
+        example: 'const result = await rl.managedAgents.listAgents({\n  // optional: tag_ids\n});',
         cliInvocation: 'rl managed-agents list-agents',
         cliExample: 'rl managed-agents list-agents',
         curlExample: "curl -X GET 'https://api.recursion.labelbox.com/managed-agents/v1/agents' \\\n  -H 'Authorization: Bearer $LABELBOX_API_KEY'",
         summary: 'List agents',
-        description: 'Returns every agent in the calling organization, each resolved to its latest immutable version. Soft-deleted agents are omitted, and the response is not paginated.',
+        description: 'Returns every agent in the calling organization, each resolved to its latest immutable version and hydrated with current tag definitions in one batch. tag_ids is a comma-separated AND filter: every returned agent carries every requested tag. Soft-deleted agents are omitted, and the response is not paginated.',
         httpMethod: 'get',
         path: '/managed-agents/v1/agents',
         requiredPermissions: ['managed-agents:read'],
-        params: [],
+        params: [
+            {
+                name: 'tag_ids',
+                in: 'query',
+                required: false,
+                type: 'string',
+                description: 'Comma-separated tag ids, with at most 32 distinct ids. Blank segments are ignored. An agent must carry every requested tag (AND semantics). Unknown or cross-organization ids return 404.',
+            },
+        ],
         response: {
             type: 'ManagedAgentsAgentListResponse',
             description: "Response body of GET /v1/agents. Unpaginated: the whole organization is returned in one document, so callers need no cursor here. Each row is the agent's current mutable definition; its immutable snapshots are listed by GET /v1/agents/{agent_id}/versions.",
@@ -52621,12 +53153,12 @@ export const SDK_REFERENCE = {
         namespace: 'managedAgents',
         method: 'listSessions',
         signature: 'rl.managedAgents.listSessions()',
-        example: 'const result = await rl.managedAgents.listSessions({\n  // optional: status, kind, agent_id, external_source_type, external_source_id, root_only, limit\n});',
+        example: 'const result = await rl.managedAgents.listSessions({\n  // optional: status, kind, agent_id, tag_ids, external_source_type, external_source_id, root_only, limit\n});',
         cliInvocation: 'rl managed-agents list-sessions',
         cliExample: 'rl managed-agents list-sessions',
         curlExample: "curl -X GET 'https://api.recursion.labelbox.com/managed-agents/v1/sessions' \\\n  -H 'Authorization: Bearer $LABELBOX_API_KEY'",
         summary: 'List sessions',
-        description: 'Returns sessions in the calling organization, most recent first, filtered by any combination of status, kind, agent_id, and external source. kind accepts a comma-separated list, which is how a caller selects agent sessions without RL rollouts. Capped by limit (default 100, max 1000) rather than cursor-paginated.',
+        description: 'Returns sessions in the calling organization, most recent first, filtered by any combination of status, kind, agent_id, current agent tag_ids, and external source. kind accepts a comma-separated list, while tag_ids uses AND semantics. Capped by limit (default 100, max 1000) rather than cursor-paginated.',
         httpMethod: 'get',
         path: '/managed-agents/v1/sessions',
         requiredPermissions: ['managed-agents:read'],
@@ -52652,6 +53184,13 @@ export const SDK_REFERENCE = {
                 type: 'string',
                 description: 'Filter by agent id.',
             },
+            {
+                name: 'tag_ids',
+                in: 'query',
+                required: false,
+                type: 'string',
+                description: "Comma-separated current agent tag ids, with at most 32 distinct ids. A session row's agent must carry every requested tag (AND semantics). Unknown or cross-organization ids return 404. Tags are resolved at read time, not from the session snapshot.",
+            },
             {
                 name: 'external_source_type',
                 in: 'query',
@@ -52762,6 +53301,93 @@ export const SDK_REFERENCE = {
             ],
         },
     },
+    managedAgentsListTags: {
+        operationId: 'managedAgentsListTags',
+        tag: 'managed-agents',
+        callPath: ['managedAgents', 'listTags'],
+        namespace: 'managedAgents',
+        method: 'listTags',
+        signature: 'rl.managedAgents.listTags()',
+        example: 'const result = await rl.managedAgents.listTags();',
+        cliInvocation: 'rl managed-agents list-tags',
+        cliExample: 'rl managed-agents list-tags',
+        curlExample: "curl -X GET 'https://api.recursion.labelbox.com/managed-agents/v1/tags' \\\n  -H 'Authorization: Bearer $LABELBOX_API_KEY'",
+        summary: 'List organization tags',
+        description: 'Returns every live tag definition in the calling organization. The list is bounded by the 200-tag organization quota and is not paginated.',
+        httpMethod: 'get',
+        path: '/managed-agents/v1/tags',
+        requiredPermissions: ['managed-agents:read'],
+        params: [],
+        response: {
+            type: 'ManagedAgentsTagListResponse',
+            description: "A complete set of organization-scoped tag definitions. GET /v1/tags returns the organization catalog; agent tag PUT routes return the agent's resulting exact set.",
+            fields: [
+                {
+                    name: 'tags',
+                    required: true,
+                    type: 'ManagedAgentsTag[]',
+                    description: 'The complete live tag set for this response. Always an array; an empty array means no definitions exist or the agent has no classifications.',
+                    items: {
+                        type: 'ManagedAgentsTag',
+                        description: 'An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.',
+                        fields: [
+                            {
+                                name: 'color',
+                                required: false,
+                                type: 'string',
+                                description: 'Display color in #RRGGBB form.',
+                                minLength: 7,
+                                maxLength: 7,
+                                pattern: '^#[0-9A-Fa-f]{6}$',
+                            },
+                            {
+                                name: 'created_at',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned RFC 3339 timestamp of when the tag was created.',
+                                format: 'date-time',
+                            },
+                            {
+                                name: 'description',
+                                required: false,
+                                type: 'string',
+                                description: 'Optional operator-facing explanation of the classification, up to 280 characters.',
+                                maxLength: 280,
+                            },
+                            {
+                                name: 'label',
+                                required: false,
+                                type: 'string',
+                                description: 'Display label, trimmed by the service. Unique case-insensitively among live tags in this organization.',
+                                minLength: 1,
+                                maxLength: 32,
+                            },
+                            {
+                                name: 'organization_id',
+                                required: false,
+                                type: 'string',
+                                description: 'Labelbox organization that owns the tag. Server-assigned from the authenticated principal and never accepted as authority from the request body.',
+                            },
+                            {
+                                name: 'tag_id',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned tag id (UUID).',
+                                format: 'uuid',
+                            },
+                            {
+                                name: 'updated_at',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned RFC 3339 timestamp of the most recent definition update.',
+                                format: 'date-time',
+                            },
+                        ],
+                    },
+                },
+            ],
+        },
+    },
     managedAgentsListTriggerBindings: {
         operationId: 'managedAgentsListTriggerBindings',
         tag: 'managed-agents',
@@ -53198,6 +53824,145 @@ export const SDK_REFERENCE = {
             },
         ],
     },
+    managedAgentsRemoveAgentTag: {
+        operationId: 'managedAgentsRemoveAgentTag',
+        tag: 'managed-agents',
+        callPath: ['managedAgents', 'removeAgentTag'],
+        namespace: 'managedAgents',
+        method: 'removeAgentTag',
+        signature: 'rl.managedAgents.removeAgentTag({ agent_id, tag_id })',
+        example: "const result = await rl.managedAgents.removeAgentTag({\n  agent_id: '<agent_id>',\n  tag_id: '<tag_id>',\n});",
+        cliInvocation: 'rl managed-agents remove-agent-tag',
+        cliExample: 'rl managed-agents remove-agent-tag \\\n  --agent_id <agent_id> \\\n  --tag_id <tag_id>',
+        curlExample: "curl -X DELETE 'https://api.recursion.labelbox.com/managed-agents/v1/agents/<agent_id>/tags/<tag_id>' \\\n  -H 'Authorization: Bearer $LABELBOX_API_KEY'",
+        summary: 'Remove one tag from an agent',
+        description: 'Removes the application and returns 204. Retrying after the relationship is already absent also returns 204; the agent and tag must still exist in the calling organization.',
+        httpMethod: 'delete',
+        path: '/managed-agents/v1/agents/{agent_id}/tags/{tag_id}',
+        requiredPermissions: ['managed-agents:update'],
+        params: [
+            {
+                name: 'agent_id',
+                in: 'path',
+                required: true,
+                type: 'string',
+                description: 'Agent id (UUID) as returned by createAgent or listAgents.',
+                format: 'uuid',
+            },
+            {
+                name: 'tag_id',
+                in: 'path',
+                required: true,
+                type: 'string',
+                description: 'Tag id (UUID) as returned by createTag or listTags.',
+                format: 'uuid',
+            },
+        ],
+    },
+    managedAgentsReplaceAgentTags: {
+        operationId: 'managedAgentsReplaceAgentTags',
+        tag: 'managed-agents',
+        callPath: ['managedAgents', 'replaceAgentTags'],
+        namespace: 'managedAgents',
+        method: 'replaceAgentTags',
+        bodyKey: 'body',
+        signature: 'rl.managedAgents.replaceAgentTags({ agent_id, body })',
+        example: 'const result = await rl.managedAgents.replaceAgentTags({\n  agent_id: \'<agent_id>\',\n  body: {\n    tag_ids: [\n      "example"\n    ]\n  },\n});',
+        cliInvocation: 'rl managed-agents replace-agent-tags',
+        cliExample: 'rl managed-agents replace-agent-tags \\\n  --agent_id <agent_id> \\\n  --from-json body.json',
+        curlExample: "curl -X PUT 'https://api.recursion.labelbox.com/managed-agents/v1/agents/<agent_id>/tags' \\\n  -H 'Authorization: Bearer $LABELBOX_API_KEY' \\\n  -H 'Content-Type: application/json' \\\n  -d '{\n    \"tag_ids\": [\n      \"example\"\n    ]\n  }'",
+        summary: "Replace an agent's complete tag set",
+        description: "Atomically replaces the agent's classifications with tag_ids and returns the resulting full definitions. Every id must be live in the calling organization; [] clears the set. This never changes agent.updated_at or mints an AgentVersion.",
+        httpMethod: 'put',
+        path: '/managed-agents/v1/agents/{agent_id}/tags',
+        requiredPermissions: ['managed-agents:update'],
+        params: [
+            {
+                name: 'agent_id',
+                in: 'path',
+                required: true,
+                type: 'string',
+                description: 'Agent id (UUID) whose classifications are replaced.',
+                format: 'uuid',
+            },
+            {
+                name: 'tag_ids',
+                in: 'body',
+                required: true,
+                type: 'string[]',
+                description: "Complete replacement set of tag ids, with at most 32 distinct ids. Every id must be a live tag in the caller's organization. Duplicates are collapsed before enforcing the limit; [] removes every tag.",
+            },
+        ],
+        response: {
+            type: 'ManagedAgentsTagListResponse',
+            description: "A complete set of organization-scoped tag definitions. GET /v1/tags returns the organization catalog; agent tag PUT routes return the agent's resulting exact set.",
+            fields: [
+                {
+                    name: 'tags',
+                    required: true,
+                    type: 'ManagedAgentsTag[]',
+                    description: 'The complete live tag set for this response. Always an array; an empty array means no definitions exist or the agent has no classifications.',
+                    items: {
+                        type: 'ManagedAgentsTag',
+                        description: 'An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.',
+                        fields: [
+                            {
+                                name: 'color',
+                                required: false,
+                                type: 'string',
+                                description: 'Display color in #RRGGBB form.',
+                                minLength: 7,
+                                maxLength: 7,
+                                pattern: '^#[0-9A-Fa-f]{6}$',
+                            },
+                            {
+                                name: 'created_at',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned RFC 3339 timestamp of when the tag was created.',
+                                format: 'date-time',
+                            },
+                            {
+                                name: 'description',
+                                required: false,
+                                type: 'string',
+                                description: 'Optional operator-facing explanation of the classification, up to 280 characters.',
+                                maxLength: 280,
+                            },
+                            {
+                                name: 'label',
+                                required: false,
+                                type: 'string',
+                                description: 'Display label, trimmed by the service. Unique case-insensitively among live tags in this organization.',
+                                minLength: 1,
+                                maxLength: 32,
+                            },
+                            {
+                                name: 'organization_id',
+                                required: false,
+                                type: 'string',
+                                description: 'Labelbox organization that owns the tag. Server-assigned from the authenticated principal and never accepted as authority from the request body.',
+                            },
+                            {
+                                name: 'tag_id',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned tag id (UUID).',
+                                format: 'uuid',
+                            },
+                            {
+                                name: 'updated_at',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned RFC 3339 timestamp of the most recent definition update.',
+                                format: 'date-time',
+                            },
+                        ],
+                    },
+                },
+            ],
+        },
+    },
     managedAgentsRestoreMemoryVersion: {
         operationId: 'managedAgentsRestoreMemoryVersion',
         tag: 'managed-agents',
@@ -54066,7 +54831,7 @@ export const SDK_REFERENCE = {
         ],
         response: {
             type: 'ManagedAgentsAgent',
-            description: 'A configured agent: its model, system prompt, tool and MCP surface, and the vault defaults new sessions inherit. Mutating an agent mints a new immutable AgentVersion; a session records the version it ran.',
+            description: 'A configured agent: its versioned execution definition plus current mutable classification tags. Patching the execution definition mints a new immutable AgentVersion; applying tags does not. A session records the version it ran and never snapshots tags.',
             fields: [
                 {
                     name: 'agent_id',
@@ -54228,6 +54993,69 @@ export const SDK_REFERENCE = {
                     type: 'string',
                     description: 'System prompt prepended to every conversation this agent runs.',
                 },
+                {
+                    name: 'tags',
+                    required: true,
+                    type: 'ManagedAgentsTag[]',
+                    description: 'Current organization-scoped classification tags applied to this agent. Always an array. Tags are mutable catalog metadata and are deliberately absent from AgentVersion and session runtime snapshots.',
+                    items: {
+                        type: 'ManagedAgentsTag',
+                        description: 'An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.',
+                        fields: [
+                            {
+                                name: 'color',
+                                required: false,
+                                type: 'string',
+                                description: 'Display color in #RRGGBB form.',
+                                minLength: 7,
+                                maxLength: 7,
+                                pattern: '^#[0-9A-Fa-f]{6}$',
+                            },
+                            {
+                                name: 'created_at',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned RFC 3339 timestamp of when the tag was created.',
+                                format: 'date-time',
+                            },
+                            {
+                                name: 'description',
+                                required: false,
+                                type: 'string',
+                                description: 'Optional operator-facing explanation of the classification, up to 280 characters.',
+                                maxLength: 280,
+                            },
+                            {
+                                name: 'label',
+                                required: false,
+                                type: 'string',
+                                description: 'Display label, trimmed by the service. Unique case-insensitively among live tags in this organization.',
+                                minLength: 1,
+                                maxLength: 32,
+                            },
+                            {
+                                name: 'organization_id',
+                                required: false,
+                                type: 'string',
+                                description: 'Labelbox organization that owns the tag. Server-assigned from the authenticated principal and never accepted as authority from the request body.',
+                            },
+                            {
+                                name: 'tag_id',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned tag id (UUID).',
+                                format: 'uuid',
+                            },
+                            {
+                                name: 'updated_at',
+                                required: false,
+                                type: 'string',
+                                description: 'Server-assigned RFC 3339 timestamp of the most recent definition update.',
+                                format: 'date-time',
+                            },
+                        ],
+                    },
+                },
                 {
                     name: 'toolsets',
                     required: false,
@@ -55735,6 +56563,118 @@ export const SDK_REFERENCE = {
             ],
         },
     },
+    managedAgentsUpdateTag: {
+        operationId: 'managedAgentsUpdateTag',
+        tag: 'managed-agents',
+        callPath: ['managedAgents', 'updateTag'],
+        namespace: 'managedAgents',
+        method: 'updateTag',
+        bodyKey: 'body',
+        signature: 'rl.managedAgents.updateTag({ tag_id, body })',
+        example: 'const result = await rl.managedAgents.updateTag({\n  tag_id: \'<tag_id>\',\n  body: {\n    color: "#14b8a6",\n    description: "example",\n    label: "example"\n  },\n});',
+        cliInvocation: 'rl managed-agents update-tag',
+        cliExample: 'rl managed-agents update-tag \\\n  --tag_id <tag_id> \\\n  --from-json body.json',
+        curlExample: 'curl -X PATCH \'https://api.recursion.labelbox.com/managed-agents/v1/tags/<tag_id>\' \\\n  -H \'Authorization: Bearer $LABELBOX_API_KEY\' \\\n  -H \'Content-Type: application/json\' \\\n  -d \'{\n    "color": "#14b8a6",\n    "description": "example",\n    "label": "example"\n  }\'',
+        summary: 'Update a tag definition',
+        description: "Changes a tag's label, color, or description without changing any application. This does not update an agent, mint an AgentVersion, or affect a running session.",
+        httpMethod: 'patch',
+        path: '/managed-agents/v1/tags/{tag_id}',
+        requiredPermissions: ['managed-agents:update'],
+        params: [
+            {
+                name: 'tag_id',
+                in: 'path',
+                required: true,
+                type: 'string',
+                description: 'Tag id (UUID) as returned by createTag or listTags.',
+                format: 'uuid',
+            },
+            {
+                name: 'color',
+                in: 'body',
+                required: false,
+                type: 'string',
+                description: 'Replacement display color in #RRGGBB form. Omit to keep the current color.',
+                minLength: 7,
+                maxLength: 7,
+                pattern: '^#[0-9A-Fa-f]{6}$',
+            },
+            {
+                name: 'description',
+                in: 'body',
+                required: false,
+                type: 'string',
+                description: 'Replacement description. Send an empty string to clear it; omit to keep the current description.',
+                maxLength: 280,
+            },
+            {
+                name: 'label',
+                in: 'body',
+                required: false,
+                type: 'string',
+                description: 'Replacement display label. Leading and trailing whitespace is removed. Omit to keep the current label.',
+                minLength: 1,
+                maxLength: 32,
+            },
+        ],
+        response: {
+            type: 'ManagedAgentsTag',
+            description: 'An organization-scoped classification definition. Applying or removing it changes only catalog membership: it does not update the agent, mint an AgentVersion, or affect running sessions.',
+            fields: [
+                {
+                    name: 'color',
+                    required: false,
+                    type: 'string',
+                    description: 'Display color in #RRGGBB form.',
+                    minLength: 7,
+                    maxLength: 7,
+                    pattern: '^#[0-9A-Fa-f]{6}$',
+                },
+                {
+                    name: 'created_at',
+                    required: false,
+                    type: 'string',
+                    description: 'Server-assigned RFC 3339 timestamp of when the tag was created.',
+                    format: 'date-time',
+                },
+                {
+                    name: 'description',
+                    required: false,
+                    type: 'string',
+                    description: 'Optional operator-facing explanation of the classification, up to 280 characters.',
+                    maxLength: 280,
+                },
+                {
+                    name: 'label',
+                    required: false,
+                    type: 'string',
+                    description: 'Display label, trimmed by the service. Unique case-insensitively among live tags in this organization.',
+                    minLength: 1,
+                    maxLength: 32,
+                },
+                {
+                    name: 'organization_id',
+                    required: false,
+                    type: 'string',
+                    description: 'Labelbox organization that owns the tag. Server-assigned from the authenticated principal and never accepted as authority from the request body.',
+                },
+                {
+                    name: 'tag_id',
+                    required: false,
+                    type: 'string',
+                    description: 'Server-assigned tag id (UUID).',
+                    format: 'uuid',
+                },
+                {
+                    name: 'updated_at',
+                    required: false,
+                    type: 'string',
+                    description: 'Server-assigned RFC 3339 timestamp of the most recent definition update.',
+                    format: 'date-time',
+                },
+            ],
+        },
+    },
     managedAgentsUpdateTriggerBinding: {
         operationId: 'managedAgentsUpdateTriggerBinding',
         tag: 'managed-agents',
@@ -56015,10 +56955,10 @@ export const SDK_REFERENCE = {
         method: 'updateVaultCredential',
         bodyKey: 'body',
         signature: 'rl.managedAgents.updateVaultCredential({ vault_id, credential_id, body })',
-        example: 'const result = await rl.managedAgents.updateVaultCredential({\n  vault_id: \'<vault_id>\',\n  credential_id: \'<credential_id>\',\n  body: {\n    allowed_hosts: [\n      "example"\n    ],\n    display_name: "example-name",\n    injection_locations: [\n      "headers"\n    ],\n    integration_permission: "example",\n    integration_resources: [\n      "example"\n    ],\n    metadata: {\n      key: "example"\n    },\n    network_mode: "limited",\n    secret_name: "example",\n    secret_ref: "example",\n    secret_value: "example"\n  },\n});',
+        example: 'const result = await rl.managedAgents.updateVaultCredential({\n  vault_id: \'<vault_id>\',\n  credential_id: \'<credential_id>\',\n  body: {\n    allowed_hosts: [\n      "example"\n    ],\n    display_name: "example-name",\n    injection_locations: [\n      "headers"\n    ],\n    integration_permission: "example",\n    integration_resources: [\n      "example"\n    ],\n    labelbox_scope: {\n      organization_id: "9f8b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d",\n      project_ids: [\n        "example"\n      ]\n    },\n    metadata: {\n      key: "example"\n    },\n    network_mode: "limited",\n    secret_name: "example",\n    secret_ref: "example",\n    secret_value: "example"\n  },\n});',
         cliInvocation: 'rl managed-agents update-vault-credential',
         cliExample: 'rl managed-agents update-vault-credential \\\n  --vault_id <vault_id> \\\n  --credential_id <credential_id> \\\n  --from-json body.json',
-        curlExample: 'curl -X PATCH \'https://api.recursion.labelbox.com/managed-agents/v1/vaults/<vault_id>/credentials/<credential_id>\' \\\n  -H \'Authorization: Bearer $LABELBOX_API_KEY\' \\\n  -H \'Content-Type: application/json\' \\\n  -d \'{\n    "allowed_hosts": [\n      "example"\n    ],\n    "display_name": "example-name",\n    "injection_locations": [\n      "headers"\n    ],\n    "integration_permission": "example",\n    "integration_resources": [\n      "example"\n    ],\n    "metadata": {\n      "key": "example"\n    },\n    "network_mode": "limited",\n    "secret_name": "example",\n    "secret_ref": "example",\n    "secret_value": "example"\n  }\'',
+        curlExample: 'curl -X PATCH \'https://api.recursion.labelbox.com/managed-agents/v1/vaults/<vault_id>/credentials/<credential_id>\' \\\n  -H \'Authorization: Bearer $LABELBOX_API_KEY\' \\\n  -H \'Content-Type: application/json\' \\\n  -d \'{\n    "allowed_hosts": [\n      "example"\n    ],\n    "display_name": "example-name",\n    "injection_locations": [\n      "headers"\n    ],\n    "integration_permission": "example",\n    "integration_resources": [\n      "example"\n    ],\n    "labelbox_scope": {\n      "organization_id": "9f8b1c2d-3e4f-5a6b-7c8d-9e0f1a2b3c4d",\n      "project_ids": [\n        "example"\n      ]\n    },\n    "metadata": {\n      "key": "example"\n    },\n    "network_mode": "limited",\n    "secret_name": "example",\n    "secret_ref": "example",\n    "secret_value": "example"\n  }\'',
         summary: 'Rename a credential, rotate its reference, or change its egress bounds',
         description: "Renames a credential, rotates the secret it points at, or narrows its egress bounds, and returns the stored reference; omitted fields keep their current values. An integration credential's connection cannot be repointed, because that would silently change which account the agent acts as.",
         httpMethod: 'patch',
@@ -56082,12 +57022,35 @@ export const SDK_REFERENCE = {
                 type: 'string[]',
                 description: 'Replacement resource allowlist for an integration grant.',
             },
+            {
+                name: 'labelbox_scope',
+                in: 'body',
+                required: false,
+                type: 'ManagedAgentsLabelboxScopeRequest',
+                description: 'Replacement Labelbox scope for a credential to the Labelbox product-state service. Sent as a whole object, not merged; omit to keep the current one. It cannot be cleared: delete and recreate the credential instead.',
+                fields: [
+                    {
+                        name: 'organization_id',
+                        required: false,
+                        type: 'string',
+                        description: 'Labelbox organization the projects belong to. Optional: filled in from the organization that owns the credential, and rejected if it names any other.',
+                    },
+                    {
+                        name: 'project_ids',
+                        required: true,
+                        type: 'unknown',
+                        description: 'Exact Labelbox project ids (1 to 100, each up to 128 characters of letters, digits, hyphen, or underscore) the credential may read. Duplicates are rejected.',
+                        minItems: 1,
+                        maxItems: 100,
+                    },
+                ],
+            },
             {
                 name: 'metadata',
                 in: 'body',
                 required: false,
                 type: 'object',
-                description: 'Replacement free-form caller-owned JSON. Sent as a whole object, not merged; omit to keep the current value.',
+                description: 'Replacement free-form caller-owned JSON. Sent as a whole object, not merged; omit to keep the current value. The key labelbox_scope is reserved for the typed field.',
             },
             {
                 name: 'network_mode',
@@ -56178,6 +57141,28 @@ export const SDK_REFERENCE = {
                     type: 'string[]',
                     description: 'Resources within the connection the grant is narrowed to — repositories, for GitHub. Empty means every resource the connection itself can reach, which is broader than most grants should be.',
                 },
+                {
+                    name: 'labelbox_scope',
+                    required: false,
+                    type: 'ManagedAgentsLabelboxToolsScope',
+                    description: 'Organization and exact project set this credential may read through the Labelbox product-state MCP service. Required for a bearer_token credential whose mcp_server_url is that service; rejected for any other server. Replaced as a whole on update and kept when omitted.',
+                    fields: [
+                        {
+                            name: 'organization_id',
+                            required: true,
+                            type: 'string',
+                            description: 'Labelbox organization the projects belong to. Must equal the organization that owns the credential; filled in from it when omitted on write.',
+                        },
+                        {
+                            name: 'project_ids',
+                            required: true,
+                            type: 'unknown',
+                            description: 'Exact Labelbox project ids (1 to 100, each up to 128 characters of letters, digits, hyphen, or underscore) the credential may read. Validated as unique and sorted on write.',
+                            minItems: 1,
+                            maxItems: 100,
+                        },
+                    ],
+                },
                 {
                     name: 'mcp_server_url',
                     required: false,
@@ -56188,7 +57173,7 @@ export const SDK_REFERENCE = {
                     name: 'metadata',
                     required: false,
                     type: 'object',
-                    description: 'Free-form caller-supplied key/value labels. Stored verbatim and never interpreted by the service.',
+                    description: 'Free-form caller-supplied key/value labels. Stored verbatim and never interpreted by the service. The key labelbox_scope is reserved for the typed field of that name.',
                 },
                 {
                     name: 'network_mode',