@leaflow/sdk 0.0.0-dev.460.gd867712 → 0.0.0-dev.462.g9520bb3

package/dist/fleet/v1/generated/validators/updateAccountRequest.zod.d.ts

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/updateAccountRequest.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/updateGroupRequest.zod.d.ts

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/updateGroupRequest.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/updateMachineRequest.zod.d.ts

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/updateMachineRequest.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/updateMcpServerRequest.zod.d.ts

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/updateMcpServerRequest.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/updateMcpServerResponse.zod.d.ts

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/updateMcpServerResponse.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/updatePrivilegeAutoApprovalRequest.zod.d.ts

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop
@@ -225,6 +237,10 @@
  */
 import * as zod from "zod";
 export declare const UpdatePrivilegeAutoApprovalRequest: zod.ZodObject<{
+    mode: zod.ZodEnum<{
+        automatic_review: "automatic_review";
+        always_approve: "always_approve";
+    }>;
     expires_at: zod.ZodNullable<zod.z.ZodISODateTime>;
 }, zod.z.core.$strict>;
 export type UpdatePrivilegeAutoApprovalRequest = zod.input<typeof UpdatePrivilegeAutoApprovalRequest>;

package/dist/fleet/v1/generated/validators/updatePrivilegeAutoApprovalRequest.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop
@@ -224,7 +236,9 @@
  * OpenAPI spec version: 1.0.0
  */
 import * as zod from "zod";
+import { PrivilegeAutoApprovalMode } from "./privilegeAutoApprovalMode.zod.js";
 export const UpdatePrivilegeAutoApprovalRequest = zod.strictObject({
+    mode: PrivilegeAutoApprovalMode,
     expires_at: zod.iso
         .datetime({ offset: true })
         .nullable()

package/dist/proto/leaflow/fleet/privilege/v1/privilege_pb.d.ts

@@ -35,6 +35,14 @@ export type DecidePrivilegeRequestResponse = Message<"leaflow.fleet.privilege.v1
      * @generated from field: leaflow.fleet.privilege.v1.PrivilegeOutcome outcome = 1;
      */
     outcome: PrivilegeOutcome;
+    /**
+     * DENIED only: why, as the platform gives it, to show whoever asked. Plain
+     * text of at most 200 characters; empty when the platform gives none. The
+     * daemon shows it without control characters.
+     *
+     * @generated from field: string reason = 2;
+     */
+    reason: string;
 };
 /**
  * Describes the message leaflow.fleet.privilege.v1.DecidePrivilegeRequestResponse.
@@ -393,6 +401,14 @@ export type PrivilegeDecision = Message<"leaflow.fleet.privilege.v1.PrivilegeDec
      * @generated from field: google.protobuf.Timestamp decided_at = 3;
      */
     decidedAt?: Timestamp | undefined;
+    /**
+     * Denied only: why, as the person gave it, to show whoever asked. Plain
+     * text of at most 200 characters; empty when they gave none. The daemon
+     * shows it without control characters.
+     *
+     * @generated from field: string reason = 4;
+     */
+    reason: string;
 };
 /**
  * Describes the message leaflow.fleet.privilege.v1.PrivilegeDecision.
@@ -542,11 +558,10 @@ export declare const PrivilegeOutcomeSchema: GenEnum<PrivilegeOutcome>;
  */
 export declare const PrivilegeService: GenService<{
     /**
-     * Decides a request. While the account's owner has set the machine to
-     * approve their requests without asking, the request is approved at once.
-     * Otherwise the owner is asked on the platform, and the answer is their
-     * decision, or EXPIRED once expires_at passes without one. A call without
-     * a timeout runs until expires_at.
+     * Decides a request as the platform does, such as at once, after reviewing
+     * it, or by asking the account's owner. The answer is the decision, or
+     * EXPIRED once expires_at passes without one. A call without a timeout runs
+     * until expires_at.
      *
      * Asking again with the request_id of a request the machine asked about
      * before continues that request: after its connection dropped, the daemon

package/dist/proto/leaflow/fleet/privilege/v1/privilege_pb.js

@@ -6,7 +6,7 @@ import { file_google_protobuf_timestamp } from "@bufbuild/protobuf/wkt";
 /**
  * Describes the file leaflow/fleet/privilege/v1/privilege.proto.
  */
-export const file_leaflow_fleet_privilege_v1_privilege = /*@__PURE__*/ fileDesc("CipsZWFmbG93L2ZsZWV0L3ByaXZpbGVnZS92MS9wcml2aWxlZ2UucHJvdG8SGmxlYWZsb3cuZmxlZXQucHJpdmlsZWdlLnYxIl4KHURlY2lkZVByaXZpbGVnZVJlcXVlc3RSZXF1ZXN0Ej0KB3JlcXVlc3QYASABKAsyLC5sZWFmbG93LmZsZWV0LnByaXZpbGVnZS52MS5Qcml2aWxlZ2VSZXF1ZXN0Il8KHkRlY2lkZVByaXZpbGVnZVJlcXVlc3RSZXNwb25zZRI9CgdvdXRjb21lGAEgASgOMiwubGVhZmxvdy5mbGVldC5wcml2aWxlZ2UudjEuUHJpdmlsZWdlT3V0Y29tZSJjCg1DbGllbnRNZXNzYWdlEkcKCGRlY2lzaW9uGAEgASgLMjMubGVhZmxvdy5mbGVldC5wcml2aWxlZ2UudjEuU2lnbmVkUHJpdmlsZWdlRGVjaXNpb25IAEIJCgdtZXNzYWdlIqkCCg1TZXJ2ZXJNZXNzYWdlEj8KDHNlcnZlcl9oZWxsbxgBIAEoCzInLmxlYWZsb3cuZmxlZXQucHJpdmlsZWdlLnYxLlNlcnZlckhlbGxvSAASPQoGcHJvbXB0GAIgASgLMisubGVhZmxvdy5mbGVldC5wcml2aWxlZ2UudjEuUHJpdmlsZWdlUHJvbXB0SAASTAoOcmVxdWVzdF9jbG9zZWQYAyABKAsyMi5sZWFmbG93LmZsZWV0LnByaXZpbGVnZS52MS5Qcml2aWxlZ2VSZXF1ZXN0Q2xvc2VkSAASPwoMc25hcHNob3RfZW5kGAQgASgLMicubGVhZmxvdy5mbGVldC5wcml2aWxlZ2UudjEuU25hcHNob3RFbmRIAEIJCgdtZXNzYWdlIiYKC1NlcnZlckhlbGxvEhcKD2FwcHJvdmVfYWxsb3dlZBgBIAEoCCIiCg9Qcml2aWxlZ2VQcm9tcHQSDwoHcmVxdWVzdBgBIAEoDCL/AgoQUHJpdmlsZWdlUmVxdWVzdBISCgpyZXF1ZXN0X2lkGAEgASgJEg0KBW5vbmNlGAIgASgMEhIKCm1hY2hpbmVfaWQYAyABKAkSEgoKc2Vzc2lvbl9pZBgEIAEoCRIuCgpjcmVhdGVkX2F0GAUgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIuCgpleHBpcmVzX2F0GAYgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBILCgNwaWQYByABKA0SFAoMY29tbWFuZF9saW5lGAggASgJEksKEnBhbV9hdXRoZW50aWNhdGlvbhgJIAEoCzItLmxlYWZsb3cuZmxlZXQucHJpdmlsZWdlLnYxLlBhbUF1dGhlbnRpY2F0aW9uSAASQwoOa2V5cmluZ19hY2Nlc3MYCiABKAsyKS5sZWFmbG93LmZsZWV0LnByaXZpbGVnZS52MS5LZXlyaW5nQWNjZXNzSABCCwoJb3BlcmF0aW9uIpkCChFQYW1BdXRoZW50aWNhdGlvbhIPCgdzZXJ2aWNlGAEgASgJEhAKCHVzZXJuYW1lGAIgASgJEhcKD3JlcXVlc3RpbmdfdXNlchgDIAEoCRITCgtyZW1vdGVfaG9zdBgEIAEoCRILCgN0dHkYBSABKAkSGAoQcG9sa2l0X2FjdGlvbl9pZBgGIAEoCRIPCgdtZXNzYWdlGAcgASgJEksKB2RldGFpbHMYCCADKAsyOi5sZWFmbG93LmZsZWV0LnByaXZpbGVnZS52MS5QYW1BdXRoZW50aWNhdGlvbi5EZXRhaWxzRW50cnkaLgoMRGV0YWlsc0VudHJ5EgsKA2tleRgBIAEoCRINCgV2YWx1ZRgCIAEoCToCOAEiagoNS2V5cmluZ0FjY2VzcxI/CglvcGVyYXRpb24YASABKA4yLC5sZWFmbG93LmZsZWV0LnByaXZpbGVnZS52MS5LZXlyaW5nT3BlcmF0aW9uEhgKEGNvbGxlY3Rpb25fbGFiZWwYAiABKAkiPgoXU2lnbmVkUHJpdmlsZWdlRGVjaXNpb24SEAoIZGVjaXNpb24YASABKAwSEQoJc2lnbmF0dXJlGAIgASgMIm0KEVByaXZpbGVnZURlY2lzaW9uEhYKDnJlcXVlc3Rfc2hhMjU2GAEgASgMEhAKCGFwcHJvdmVkGAIgASgIEi4KCmRlY2lkZWRfYXQYAyABKAsyGi5nb29nbGUucHJvdG9idWYuVGltZXN0YW1wImsKFlByaXZpbGVnZVJlcXVlc3RDbG9zZWQSEgoKcmVxdWVzdF9pZBgBIAEoCRI9CgdvdXRjb21lGAIgASgOMiwubGVhZmxvdy5mbGVldC5wcml2aWxlZ2UudjEuUHJpdmlsZWdlT3V0Y29tZSINCgtTbmFwc2hvdEVuZCIqCg9Qcml2aWxlZ2VQb2xpY3kSFwoPYXBwcm92ZV9hbGxvd2VkGAEgASgIKocBChBLZXlyaW5nT3BlcmF0aW9uEiEKHUtFWVJJTkdfT1BFUkFUSU9OX1VOU1BFQ0lGSUVEEAASJwojS0VZUklOR19PUEVSQVRJT05fVU5MT0NLX0NPTExFQ1RJT04QARInCiNLRVlSSU5HX09QRVJBVElPTl9DUkVBVEVfQ09MTEVDVElPThACKrMBChBQcml2aWxlZ2VPdXRjb21lEiEKHVBSSVZJTEVHRV9PVVRDT01FX1VOU1BFQ0lGSUVEEAASHgoaUFJJVklMRUdFX09VVENPTUVfQVBQUk9WRUQQARIcChhQUklWSUxFR0VfT1VUQ09NRV9ERU5JRUQQAhIdChlQUklWSUxFR0VfT1VUQ09NRV9FWFBJUkVEEAMSHwobUFJJVklMRUdFX09VVENPTUVfQ0FOQ0VMTEVEEAQyqQEKEFByaXZpbGVnZVNlcnZpY2USlAEKFkRlY2lkZVByaXZpbGVnZVJlcXVlc3QSOS5sZWFmbG93LmZsZWV0LnByaXZpbGVnZS52MS5EZWNpZGVQcml2aWxlZ2VSZXF1ZXN0UmVxdWVzdBo6LmxlYWZsb3cuZmxlZXQucHJpdmlsZWdlLnYxLkRlY2lkZVByaXZpbGVnZVJlcXVlc3RSZXNwb25zZSIDkAICQkJaQGdpdGh1Yi5jb20vbGVhZmxvd2FwaXMvbGVhZmxvdy1nby9mbGVldC9wcml2aWxlZ2UvdjE7cHJpdmlsZWdldjFiBnByb3RvMw", [file_google_protobuf_timestamp]);
+export const file_leaflow_fleet_privilege_v1_privilege = /*@__PURE__*/ fileDesc("CipsZWFmbG93L2ZsZWV0L3ByaXZpbGVnZS92MS9wcml2aWxlZ2UucHJvdG8SGmxlYWZsb3cuZmxlZXQucHJpdmlsZWdlLnYxIl4KHURlY2lkZVByaXZpbGVnZVJlcXVlc3RSZXF1ZXN0Ej0KB3JlcXVlc3QYASABKAsyLC5sZWFmbG93LmZsZWV0LnByaXZpbGVnZS52MS5Qcml2aWxlZ2VSZXF1ZXN0Im8KHkRlY2lkZVByaXZpbGVnZVJlcXVlc3RSZXNwb25zZRI9CgdvdXRjb21lGAEgASgOMiwubGVhZmxvdy5mbGVldC5wcml2aWxlZ2UudjEuUHJpdmlsZWdlT3V0Y29tZRIOCgZyZWFzb24YAiABKAkiYwoNQ2xpZW50TWVzc2FnZRJHCghkZWNpc2lvbhgBIAEoCzIzLmxlYWZsb3cuZmxlZXQucHJpdmlsZWdlLnYxLlNpZ25lZFByaXZpbGVnZURlY2lzaW9uSABCCQoHbWVzc2FnZSKpAgoNU2VydmVyTWVzc2FnZRI/CgxzZXJ2ZXJfaGVsbG8YASABKAsyJy5sZWFmbG93LmZsZWV0LnByaXZpbGVnZS52MS5TZXJ2ZXJIZWxsb0gAEj0KBnByb21wdBgCIAEoCzIrLmxlYWZsb3cuZmxlZXQucHJpdmlsZWdlLnYxLlByaXZpbGVnZVByb21wdEgAEkwKDnJlcXVlc3RfY2xvc2VkGAMgASgLMjIubGVhZmxvdy5mbGVldC5wcml2aWxlZ2UudjEuUHJpdmlsZWdlUmVxdWVzdENsb3NlZEgAEj8KDHNuYXBzaG90X2VuZBgEIAEoCzInLmxlYWZsb3cuZmxlZXQucHJpdmlsZWdlLnYxLlNuYXBzaG90RW5kSABCCQoHbWVzc2FnZSImCgtTZXJ2ZXJIZWxsbxIXCg9hcHByb3ZlX2FsbG93ZWQYASABKAgiIgoPUHJpdmlsZWdlUHJvbXB0Eg8KB3JlcXVlc3QYASABKAwi/wIKEFByaXZpbGVnZVJlcXVlc3QSEgoKcmVxdWVzdF9pZBgBIAEoCRINCgVub25jZRgCIAEoDBISCgptYWNoaW5lX2lkGAMgASgJEhIKCnNlc3Npb25faWQYBCABKAkSLgoKY3JlYXRlZF9hdBgFIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASLgoKZXhwaXJlc19hdBgGIAEoCzIaLmdvb2dsZS5wcm90b2J1Zi5UaW1lc3RhbXASCwoDcGlkGAcgASgNEhQKDGNvbW1hbmRfbGluZRgIIAEoCRJLChJwYW1fYXV0aGVudGljYXRpb24YCSABKAsyLS5sZWFmbG93LmZsZWV0LnByaXZpbGVnZS52MS5QYW1BdXRoZW50aWNhdGlvbkgAEkMKDmtleXJpbmdfYWNjZXNzGAogASgLMikubGVhZmxvdy5mbGVldC5wcml2aWxlZ2UudjEuS2V5cmluZ0FjY2Vzc0gAQgsKCW9wZXJhdGlvbiKZAgoRUGFtQXV0aGVudGljYXRpb24SDwoHc2VydmljZRgBIAEoCRIQCgh1c2VybmFtZRgCIAEoCRIXCg9yZXF1ZXN0aW5nX3VzZXIYAyABKAkSEwoLcmVtb3RlX2hvc3QYBCABKAkSCwoDdHR5GAUgASgJEhgKEHBvbGtpdF9hY3Rpb25faWQYBiABKAkSDwoHbWVzc2FnZRgHIAEoCRJLCgdkZXRhaWxzGAggAygLMjoubGVhZmxvdy5mbGVldC5wcml2aWxlZ2UudjEuUGFtQXV0aGVudGljYXRpb24uRGV0YWlsc0VudHJ5Gi4KDERldGFpbHNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBImoKDUtleXJpbmdBY2Nlc3MSPwoJb3BlcmF0aW9uGAEgASgOMiwubGVhZmxvdy5mbGVldC5wcml2aWxlZ2UudjEuS2V5cmluZ09wZXJhdGlvbhIYChBjb2xsZWN0aW9uX2xhYmVsGAIgASgJIj4KF1NpZ25lZFByaXZpbGVnZURlY2lzaW9uEhAKCGRlY2lzaW9uGAEgASgMEhEKCXNpZ25hdHVyZRgCIAEoDCJ9ChFQcml2aWxlZ2VEZWNpc2lvbhIWCg5yZXF1ZXN0X3NoYTI1NhgBIAEoDBIQCghhcHByb3ZlZBgCIAEoCBIuCgpkZWNpZGVkX2F0GAMgASgLMhouZ29vZ2xlLnByb3RvYnVmLlRpbWVzdGFtcBIOCgZyZWFzb24YBCABKAkiawoWUHJpdmlsZWdlUmVxdWVzdENsb3NlZBISCgpyZXF1ZXN0X2lkGAEgASgJEj0KB291dGNvbWUYAiABKA4yLC5sZWFmbG93LmZsZWV0LnByaXZpbGVnZS52MS5Qcml2aWxlZ2VPdXRjb21lIg0KC1NuYXBzaG90RW5kIioKD1ByaXZpbGVnZVBvbGljeRIXCg9hcHByb3ZlX2FsbG93ZWQYASABKAgqhwEKEEtleXJpbmdPcGVyYXRpb24SIQodS0VZUklOR19PUEVSQVRJT05fVU5TUEVDSUZJRUQQABInCiNLRVlSSU5HX09QRVJBVElPTl9VTkxPQ0tfQ09MTEVDVElPThABEicKI0tFWVJJTkdfT1BFUkFUSU9OX0NSRUFURV9DT0xMRUNUSU9OEAIqswEKEFByaXZpbGVnZU91dGNvbWUSIQodUFJJVklMRUdFX09VVENPTUVfVU5TUEVDSUZJRUQQABIeChpQUklWSUxFR0VfT1VUQ09NRV9BUFBST1ZFRBABEhwKGFBSSVZJTEVHRV9PVVRDT01FX0RFTklFRBACEh0KGVBSSVZJTEVHRV9PVVRDT01FX0VYUElSRUQQAxIfChtQUklWSUxFR0VfT1VUQ09NRV9DQU5DRUxMRUQQBDKpAQoQUHJpdmlsZWdlU2VydmljZRKUAQoWRGVjaWRlUHJpdmlsZWdlUmVxdWVzdBI5LmxlYWZsb3cuZmxlZXQucHJpdmlsZWdlLnYxLkRlY2lkZVByaXZpbGVnZVJlcXVlc3RSZXF1ZXN0GjoubGVhZmxvdy5mbGVldC5wcml2aWxlZ2UudjEuRGVjaWRlUHJpdmlsZWdlUmVxdWVzdFJlc3BvbnNlIgOQAgJCQlpAZ2l0aHViLmNvbS9sZWFmbG93YXBpcy9sZWFmbG93LWdvL2ZsZWV0L3ByaXZpbGVnZS92MTtwcml2aWxlZ2V2MWIGcHJvdG8z", [file_google_protobuf_timestamp]);
 /**
  * Describes the message leaflow.fleet.privilege.v1.DecidePrivilegeRequestRequest.
  * Use `create(DecidePrivilegeRequestRequestSchema)` to create a new message.

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@leaflow/sdk",
-  "version": "0.0.0-dev.460.gd867712",
+  "version": "0.0.0-dev.462.g9520bb3",
   "description": "Leaflow 平台 API 的 TypeScript SDK",
   "license": "MIT",
   "repository": {