@leaflow/sdk 0.188.0 → 0.189.0

package/dist/fleet/v1/generated/validators/approveEnrollmentRequest.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/callMcpToolRequest.zod.d.ts

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/callMcpToolRequest.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/callMcpToolResponse.zod.d.ts

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/callMcpToolResponse.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/createGroupMemberRequest.zod.d.ts

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/createGroupMemberRequest.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/createGroupRequest.zod.d.ts

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/createGroupRequest.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/createMachineRegistrationRequest.zod.d.ts

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/createMachineRegistrationRequest.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/createMachineRegistrationResponse.zod.d.ts

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/createMachineRegistrationResponse.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/createParticipantRequest.zod.d.ts

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/createParticipantRequest.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/createParticipantResponse.zod.d.ts

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop

package/dist/fleet/v1/generated/validators/createParticipantResponse.zod.js

@@ -139,16 +139,28 @@
  * applies:
  *
  * - inside a command run through this API, by the request itself;
- * - at once, while the user has approved their requests on the machine without asking, for a
- *   while or until removed (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`);
+ * - by the user's automatic approval for the machine, for a while or until removed
+ *   (`PUT /api/v1/machines/{machineId}/privilege-auto-approval`), in one of two modes:
+ *   - `automatic_review`, the recommended one: a large language model reviews each request and
+ *     approves or denies it with a reason. It stops most dangerous requests, but not all of
+ *     them. Each review is a request to Canopy, the model platform, through the project's
+ *     Canopy service, and may incur Canopy charges; the project needs Canopy enabled. A
+ *     request that cannot be reviewed, such as when the project has not enabled Canopy or the
+ *     review does not complete in time, is denied with a reason saying so;
+ *   - `always_approve`: every request is approved at once. This is dangerous: any program that
+ *     runs as the account, such as a script or an AI agent, becomes root without anyone being
+ *     asked;
  * - by the user, on any of their devices, for a request listed by `GET /api/v1/privilege-requests`
  *   (`POST …:approve` or `…:deny`), or on a participant of the session the asking process belongs
  *   to. A request nobody decides expires, and sudo fails.
  *
+ * A denied sudo shows whoever ran it the reason, when the denial gave one.
+ *
  * Requests reach the user's devices as they happen through EventBus: the event
- * `leaflow.fleet.privilege.requested` when one is waiting and `leaflow.fleet.privilege.decided`
- * when it ends, each addressed to the user in the current project and carrying the request's
- * `id`. A client that subscribes to them needs no polling; one that does not can list the
+ * `leaflow.fleet.privilege.requested` when one waits for the user and
+ * `leaflow.fleet.privilege.decided` when it ends, each addressed to the user in the current
+ * project and carrying the request's `id`. Requests decided without asking the user raise
+ * neither. A client that subscribes to them needs no polling; one that does not can list the
  * pending requests.
  *
  * ## Connections that drop