@managoat/fountain-sdk 5.0.0 → 5.1.0

package/CHANGELOG.md

@@ -11,6 +11,25 @@ server releases.
 
 ---
 
+## [5.1.0] — 2026-09-14
+
+### Added
+
+- `components["schemas"]["PermissionPolicy"]`. The permission-policy object was
+  declared inline in five server schemas; it is now one named component that
+  all five reference, so the generated type has a name instead of being
+  repeated as an anonymous intersection. The named type includes `null`, which
+  is what a policy-less agent or conversation carries.
+
+### Changed
+
+- `permission_policy` on `Agent`, `AgentRequest`, `AgentUpdate`, `Conversation`
+  and `ConversationCreateRequest` is typed as
+  `components["schemas"]["PermissionPolicy"] | null`. It resolves to exactly
+  the type 5.0.0 had, so this is a rename and not a new shape: TypeScript is
+  structurally typed and existing code keeps compiling. Code that wrote the old
+  anonymous type out by hand can use the named one instead.
+
 ## [5.0.0] — 2026-09-14
 
 ### Breaking changes

package/dist/generated/openapi.d.ts

@@ -2781,12 +2781,7 @@ export interface components {
             model: string | null;
             name: string;
             /** @description Per-tool permission policy: a map of key to verdict, plus an optional "default" key. A key is matched against the tool card's title first and then ACP's kind (execute, edit, read, fetch, …); prefer a kind, because claude titles a tool call with the command it is about to run. Unset keys fall back to the default, and an unset default is auto_allow — today's behaviour. "ask" holds the tool until a human answers it on the conversation stream, and denies if nobody does before the timeout. A runtime that never asks (opencode) refuses anything stricter than auto_allow with 422 permission_policy_unenforceable. */
-            permission_policy?: ({
-                /** @description Seconds a permission request that outlived its turn waits before it is denied (#1635). Names no tool, so it is the one key whose value is a number rather than a verdict, which is why the value schema below is a union. Absent leaves the global ask timeout. A request may shorten it with `_meta.fountain.timeout` on its own session/request_permission, and may not lengthen it. A launch may only shorten what the agent set, or the global ask timeout where the agent set nothing. Capped at a year, which is where the deadline stops fitting in a timestamp rather than a limit on how long a wait is useful. */
-                ask_timeout?: number;
-            } & {
-                [key: string]: ("auto_allow" | "ask" | "auto_deny") | number;
-            }) | null;
+            permission_policy?: components["schemas"]["PermissionPolicy"] | null;
             /** @enum {string} */
             runtime: "claude" | "codex" | "gemini" | "opencode" | "acp" | "fountain-fixture";
             /** @description The command the acp runtime launches inside the sandbox, as a shell line resolved there (for example `chant acp`). Required when runtime is acp, and rejected on every other runtime, which resolves its own executable. A free string by design: it runs under the same isolation as an environment's setup script. */
@@ -2846,12 +2841,7 @@ export interface components {
             model?: string | null;
             name: string;
             /** @description Per-tool permission policy: a map of key to verdict, plus an optional "default" key. A key is matched against the tool card's title first and then ACP's kind (execute, edit, read, fetch, …); prefer a kind, because claude titles a tool call with the command it is about to run. Unset keys fall back to the default, and an unset default is auto_allow. "ask" holds the tool until a human answers it on the conversation stream, and denies if nobody does before the timeout. A conversation may narrow this at launch, never widen it. A runtime that never asks (opencode) refuses anything stricter than auto_allow with 422 permission_policy_unenforceable. */
-            permission_policy?: ({
-                /** @description Seconds a permission request that outlived its turn waits before it is denied (#1635). Names no tool, so it is the one key whose value is a number rather than a verdict, which is why the value schema below is a union. Absent leaves the global ask timeout. A request may shorten it with `_meta.fountain.timeout` on its own session/request_permission, and may not lengthen it. A launch may only shorten what the agent set, or the global ask timeout where the agent set nothing. Capped at a year, which is where the deadline stops fitting in a timestamp rather than a limit on how long a wait is useful. */
-                ask_timeout?: number;
-            } & {
-                [key: string]: ("auto_allow" | "ask" | "auto_deny") | number;
-            }) | null;
+            permission_policy?: components["schemas"]["PermissionPolicy"] | null;
             /** @enum {string} */
             runtime: "claude" | "codex" | "gemini" | "opencode" | "acp" | "fountain-fixture";
             /** @description The command the acp runtime launches inside the sandbox, as a shell line resolved there (for example `chant acp`). Required when runtime is acp, and rejected on every other runtime, which resolves its own executable. A free string by design: it runs under the same isolation as an environment's setup script. */
@@ -2908,12 +2898,7 @@ export interface components {
             model?: string | null;
             name?: string;
             /** @description Per-tool permission policy: a map of key to verdict, plus an optional "default" key. A key is matched against the tool card's title first and then ACP's kind (execute, edit, read, fetch, …); prefer a kind, because claude titles a tool call with the command it is about to run. Unset keys fall back to the default, and an unset default is auto_allow. "ask" holds the tool until a human answers it on the conversation stream, and denies if nobody does before the timeout. A conversation may narrow this at launch, never widen it. A runtime that never asks (opencode) refuses anything stricter than auto_allow with 422 permission_policy_unenforceable. */
-            permission_policy?: ({
-                /** @description Seconds a permission request that outlived its turn waits before it is denied (#1635). Names no tool, so it is the one key whose value is a number rather than a verdict, which is why the value schema below is a union. Absent leaves the global ask timeout. A request may shorten it with `_meta.fountain.timeout` on its own session/request_permission, and may not lengthen it. A launch may only shorten what the agent set, or the global ask timeout where the agent set nothing. Capped at a year, which is where the deadline stops fitting in a timestamp rather than a limit on how long a wait is useful. */
-                ask_timeout?: number;
-            } & {
-                [key: string]: ("auto_allow" | "ask" | "auto_deny") | number;
-            }) | null;
+            permission_policy?: components["schemas"]["PermissionPolicy"] | null;
             /** @enum {string} */
             runtime?: "claude" | "codex" | "gemini" | "opencode" | "acp" | "fountain-fixture";
             /** @description The command the acp runtime launches inside the sandbox, as a shell line resolved there (for example `chant acp`). Required when runtime is acp, and rejected on every other runtime, which resolves its own executable. A free string by design: it runs under the same isolation as an environment's setup script. */
@@ -3723,12 +3708,7 @@ export interface components {
             /** @description Permission requests that outlived a turn and are still waiting for an answer (#1635). Served on GET /api/conversations/{id} only; absent from the list and from the create response. */
             pending_requests?: components["schemas"]["PendingPermissionRequest"][];
             /** @description The per-launch permission override this conversation was started with, or null if it had none. The policy actually in force is this merged with the agent's, taking the stricter of the two per tool. */
-            permission_policy?: ({
-                /** @description Seconds a permission request that outlived its turn waits before it is denied (#1635). Names no tool, so it is the one key whose value is a number rather than a verdict, which is why the value schema below is a union. Absent leaves the global ask timeout. A request may shorten it with `_meta.fountain.timeout` on its own session/request_permission, and may not lengthen it. A launch may only shorten what the agent set, or the global ask timeout where the agent set nothing. Capped at a year, which is where the deadline stops fitting in a timestamp rather than a limit on how long a wait is useful. */
-                ask_timeout?: number;
-            } & {
-                [key: string]: ("auto_allow" | "ask" | "auto_deny") | number;
-            }) | null;
+            permission_policy?: components["schemas"]["PermissionPolicy"] | null;
             /** @enum {string} */
             runtime: "claude" | "codex" | "gemini" | "opencode" | "acp" | "fountain-fixture";
             runtime_session_id?: string | null;
@@ -3780,12 +3760,7 @@ export interface components {
                 [key: string]: string;
             } | null;
             /** @description Per-launch permission override (#939). Keys are matched against the tool card's title first and then ACP's kind (execute, edit, read, fetch, …); "default" covers the rest. Prefer a kind: claude titles a tool call with the command it is about to run, so a title matches one invocation only. Merged with the agent's own policy, taking the stricter of the two. It may only narrow: a policy that would loosen any tool is refused with 422 permission_policy_widens rather than silently clamped, and one the runtime never consults is refused with 422 permission_policy_unenforceable. */
-            permission_policy?: ({
-                /** @description Seconds a permission request that outlived its turn waits before it is denied (#1635). Names no tool, so it is the one key whose value is a number rather than a verdict, which is why the value schema below is a union. Absent leaves the global ask timeout. A request may shorten it with `_meta.fountain.timeout` on its own session/request_permission, and may not lengthen it. A launch may only shorten what the agent set, or the global ask timeout where the agent set nothing. Capped at a year, which is where the deadline stops fitting in a timestamp rather than a limit on how long a wait is useful. */
-                ask_timeout?: number;
-            } & {
-                [key: string]: ("auto_allow" | "ask" | "auto_deny") | number;
-            }) | null;
+            permission_policy?: components["schemas"]["PermissionPolicy"] | null;
             /** @description Optional first turn prompt. A launch may open with no prompt at all, but a prompt that is present must carry words: blank and whitespace-only text is refused with 422 invalid_prompt, before the launch reserves a sandbox. */
             prompt?: string;
             /** @description When a fresh start reaches the tenant or the fleet concurrency ceiling, wait in the bounded sandbox queue and return 202 with a SandboxRequest instead of 429 or 503 (ADR 0042). Starts carrying images or an explicit sandbox_id are never queued, and a full queue keeps the immediate error. */
@@ -4398,6 +4373,16 @@ export interface components {
             /** @example true */
             ok: boolean;
         };
+        /**
+         * PermissionPolicy
+         * @description The wire shape of a permission policy: a map of key to verdict, plus the optional `ask_timeout` key, whose value is a number rather than a verdict. Every place a policy travels shares this shape and says there what a policy means at that door. Null everywhere a policy is absent.
+         */
+        PermissionPolicy: ({
+            /** @description Seconds a permission request that outlived its turn waits before it is denied (#1635). Names no tool, so it is the one key whose value is a number rather than a verdict, which is why the value schema below is a union. Absent leaves the global ask timeout. A request may shorten it with `_meta.fountain.timeout` on its own session/request_permission, and may not lengthen it. A launch may only shorten what the agent set, or the global ask timeout where the agent set nothing. Capped at a year, which is where the deadline stops fitting in a timestamp rather than a limit on how long a wait is useful. */
+            ask_timeout?: number;
+        } & {
+            [key: string]: ("auto_allow" | "ask" | "auto_deny") | number;
+        }) | null;
         /** PromptRequest */
         PromptRequest: {
             /** @description Optional images to attach to this prompt. */

package/dist/http.d.ts

@@ -15,7 +15,7 @@ export interface RequestOptions {
  * this string is already what Fountain's request logs are keyed on. The
  * version half is asserted against `package.json` by a test.
  */
-export declare const USER_AGENT = "fountain-sdk-js/5.0.0";
+export declare const USER_AGENT = "fountain-sdk-js/5.1.0";
 export declare class HttpClient {
     readonly config: ResolvedConfig;
     private readonly fetchImpl;

package/dist/http.js

@@ -5,7 +5,7 @@ import { AuthError, ConnectionError, FountainError, errorForStatus } from "./err
  * this string is already what Fountain's request logs are keyed on. The
  * version half is asserted against `package.json` by a test.
  */
-export const USER_AGENT = "fountain-sdk-js/5.0.0";
+export const USER_AGENT = "fountain-sdk-js/5.1.0";
 /**
  * The thin layer everything else is built on: one bearer token, JSON in and
  * out, and errors that say which call failed. `Fountain#api` exposes it

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@managoat/fountain-sdk",
-  "version": "5.0.0",
+  "version": "5.1.0",
   "description": "Run a coding agent on a real computer, with your repos and your credentials, in one call.",
   "license": "Apache-2.0",
   "publishConfig": {