@mutagent/sdk 0.4.0 → 0.4.2

package/src/sdk/sandbox.ts

@@ -0,0 +1,496 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { sandboxDeleteApiSandboxById } from "../funcs/sandbox-delete-api-sandbox-by-id.js";
+import { sandboxDeleteApiSandboxEnvironmentsByName } from "../funcs/sandbox-delete-api-sandbox-environments-by-name.js";
+import { sandboxGetApiSandboxByIdCheckpoints } from "../funcs/sandbox-get-api-sandbox-by-id-checkpoints.js";
+import { sandboxGetApiSandboxByIdSessions } from "../funcs/sandbox-get-api-sandbox-by-id-sessions.js";
+import { sandboxGetApiSandboxByIdStream } from "../funcs/sandbox-get-api-sandbox-by-id-stream.js";
+import { sandboxGetApiSandboxByIdTraces } from "../funcs/sandbox-get-api-sandbox-by-id-traces.js";
+import { sandboxGetApiSandboxById } from "../funcs/sandbox-get-api-sandbox-by-id.js";
+import { sandboxGetApiSandboxEnvironmentsByName } from "../funcs/sandbox-get-api-sandbox-environments-by-name.js";
+import { sandboxGetApiSandboxEnvironments } from "../funcs/sandbox-get-api-sandbox-environments.js";
+import { sandboxGetApiSandboxHelixDefaults } from "../funcs/sandbox-get-api-sandbox-helix-defaults.js";
+import { sandboxGetApiSandboxPresets } from "../funcs/sandbox-get-api-sandbox-presets.js";
+import { sandboxGetApiSandboxProviders } from "../funcs/sandbox-get-api-sandbox-providers.js";
+import { sandboxGetApiSandbox } from "../funcs/sandbox-get-api-sandbox.js";
+import { sandboxPatchApiSandboxEnvironmentsByName } from "../funcs/sandbox-patch-api-sandbox-environments-by-name.js";
+import { sandboxPostApiSandboxAgentRun } from "../funcs/sandbox-post-api-sandbox-agent-run.js";
+import { sandboxPostApiSandboxByIdCheckpoint } from "../funcs/sandbox-post-api-sandbox-by-id-checkpoint.js";
+import { sandboxPostApiSandboxByIdExec } from "../funcs/sandbox-post-api-sandbox-by-id-exec.js";
+import { sandboxPostApiSandboxByIdInput } from "../funcs/sandbox-post-api-sandbox-by-id-input.js";
+import { sandboxPostApiSandboxByIdRestore } from "../funcs/sandbox-post-api-sandbox-by-id-restore.js";
+import { sandboxPostApiSandboxByIdSession } from "../funcs/sandbox-post-api-sandbox-by-id-session.js";
+import { sandboxPostApiSandboxByIdSignal } from "../funcs/sandbox-post-api-sandbox-by-id-signal.js";
+import { sandboxPostApiSandboxPreflight } from "../funcs/sandbox-post-api-sandbox-preflight.js";
+import { sandboxPostApiSandboxRun } from "../funcs/sandbox-post-api-sandbox-run.js";
+import { sandboxPostApiSandboxTelemetryV1Traces } from "../funcs/sandbox-post-api-sandbox-telemetry-v1-traces.js";
+import { sandboxPostApiSandboxToken } from "../funcs/sandbox-post-api-sandbox-token.js";
+import { sandboxPostApiSandbox } from "../funcs/sandbox-post-api-sandbox.js";
+import { sandboxPutApiSandboxEnvironmentsByName } from "../funcs/sandbox-put-api-sandbox-environments-by-name.js";
+import { sandboxPutApiSandboxHelixDefaults } from "../funcs/sandbox-put-api-sandbox-helix-defaults.js";
+import { ClientSDK, RequestOptions } from "../lib/sdks.js";
+import * as models from "../models/index.js";
+import * as operations from "../models/operations/index.js";
+import { unwrapAsync } from "../types/fp.js";
+
+export class Sandbox extends ClientSDK {
+  /**
+   * List sandbox providers
+   *
+   * @remarks
+   * Providers this backend can reach and which is the default. A CLI that has no provider configured uses the default.
+   */
+  async getApiSandboxProviders(
+    options?: RequestOptions,
+  ): Promise<operations.GetApiSandboxProvidersResponse> {
+    return unwrapAsync(sandboxGetApiSandboxProviders(
+      this,
+      options,
+    ));
+  }
+
+  /**
+   * Preflight a sandbox definition
+   *
+   * @remarks
+   * Validate a definition against a provider without creating anything. Returns every violation, not just the first.
+   */
+  async postApiSandboxPreflight(
+    request: models.DefinitionProvider,
+    options?: RequestOptions,
+  ): Promise<operations.PostApiSandboxPreflightResponse> {
+    return unwrapAsync(sandboxPostApiSandboxPreflight(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * List sandbox presets
+   *
+   * @remarks
+   * Named definitions a one-shot run can name. A preset is what lets a caller run something without knowing our registry, region or image tag. Image references are deliberately not returned.
+   */
+  async getApiSandboxPresets(
+    options?: RequestOptions,
+  ): Promise<operations.GetApiSandboxPresetsResponse> {
+    return unwrapAsync(sandboxGetApiSandboxPresets(
+      this,
+      options,
+    ));
+  }
+
+  /**
+   * Run one command in a fresh sandbox
+   *
+   * @remarks
+   * Spawns from a preset, runs the command, tears the sandbox down. Requires an operator token — a one-shot run creates a sandbox. 200, not 201: the durable outcome is a result, and the sandbox it names is already gone unless `keep` was set. Blocking, and therefore bounded by the provider invocation timeout — long or interactive runs belong on POST /api/sandbox + /:id/exec.
+   */
+  async postApiSandboxRun(
+    request: models.PresetTimeoutMsKeep,
+    options?: RequestOptions,
+  ): Promise<operations.PostApiSandboxRunResponse> {
+    return unwrapAsync(sandboxPostApiSandboxRun(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Spawn a sandbox
+   *
+   * @remarks
+   * Requires an operator token. A session or task token is rejected with 403.
+   */
+  async postApiSandbox(
+    request: models.DefinitionRunId,
+    options?: RequestOptions,
+  ): Promise<operations.PostApiSandboxResponse> {
+    return unwrapAsync(sandboxPostApiSandbox(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * List sandboxes
+   *
+   * @remarks
+   * Always tenant-scoped. There is no unscoped listing path.
+   */
+  async getApiSandbox(
+    options?: RequestOptions,
+  ): Promise<Array<operations.GetApiSandboxResponse>> {
+    return unwrapAsync(sandboxGetApiSandbox(
+      this,
+      options,
+    ));
+  }
+
+  /**
+   * Get sandbox status
+   */
+  async getApiSandboxById(
+    request: operations.GetApiSandboxByIdRequest,
+    options?: RequestOptions,
+  ): Promise<operations.GetApiSandboxByIdResponse> {
+    return unwrapAsync(sandboxGetApiSandboxById(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Tear down a sandbox
+   *
+   * @remarks
+   * Idempotent. The record is forgotten even if the provider teardown fails.
+   */
+  async deleteApiSandboxById(
+    request: operations.DeleteApiSandboxByIdRequest,
+    options?: RequestOptions,
+  ): Promise<operations.DeleteApiSandboxByIdResponse> {
+    return unwrapAsync(sandboxDeleteApiSandboxById(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Watch a sandbox's output live
+   *
+   * @remarks
+   * Server-sent events: `stdout`, `stderr`, `rpc`, `unrecognised`, `session`, `live`, `status`, `ping` (every 15s), `error`. `rpc` carries one complete NDJSON frame from a Helix session running in RPC mode, verbatim — parse it client-side. `unrecognised` carries a line the backend could not classify; receiving one means this server and the sandbox image disagree about the protocol, and it is forwarded rather than dropped so that drift is visible instead of silent. Those four output events share the `{seq, ts, text}` shape and one sequence counter, so their interleaving is the order the box produced them. `session` shares that counter too but carries flat fields instead of `text` — `{sessionId, status: "started"|"exited", exitCode, lastSeq, generation}` — and is how a client learns a Helix session began or ended; it is persisted and replayed like any output event, and `exitCode` is the session's real code (the terminal `status` event describes the SANDBOX and reports null by contract). `live` is emitted at most once, before the opening `status`, and only when this instance cannot follow the sandbox: it replays the log and ends rather than tailing. `seq` is monotonic per sandbox and starts at 1, and every seq-bearing event also carries it as the SSE `id:` field; pass the last one seen as `?since=` to resume. A resume is served from the persisted event log first and the live buffer only for the tail, so it survives a restart and can be answered by an instance that never spawned the box. If the requested range has been TRIMMED from that log, an `error` event names the lost range rather than skipping it silently — it carries `code: 'gap'` with the inclusive `from`/`to` wire seqs, and the stream continues past the gap; a source failure instead carries `code: 'upstream'` and is the end of the stream. Branch on `code`, never on `message`. Disconnecting tears down the upstream.
+   */
+  async getApiSandboxByIdStream(
+    request: operations.GetApiSandboxByIdStreamRequest,
+    options?: RequestOptions,
+  ): Promise<operations.GetApiSandboxByIdStreamResponse> {
+    return unwrapAsync(sandboxGetApiSandboxByIdStream(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Run a command in a sandbox
+   *
+   * @remarks
+   * Returns the command's real exit code. A task token is rejected — in-sandbox code reports on itself, it does not drive the box. With `?stream=1` the same result comes back as the event stream of `GET /:id/stream`, scoped to this one invocation and terminated by a `status` event carrying the exit code.
+   */
+  async postApiSandboxByIdExec(
+    request: operations.PostApiSandboxByIdExecRequest,
+    options?: RequestOptions,
+  ): Promise<operations.PostApiSandboxByIdExecResponse> {
+    return unwrapAsync(sandboxPostApiSandboxByIdExec(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Ingest OTLP spans from inside a sandbox
+   *
+   * @remarks
+   * OTLP/HTTP JSON. Requires a task token; spans are attributed to the sandbox the token is bound to, never to the sandbox named in the payload.
+   */
+  async postApiSandboxTelemetryV1Traces(
+    options?: RequestOptions,
+  ): Promise<operations.PostApiSandboxTelemetryV1TracesResponse> {
+    return unwrapAsync(sandboxPostApiSandboxTelemetryV1Traces(
+      this,
+      options,
+    ));
+  }
+
+  /**
+   * Read a sandbox's captured spans
+   */
+  async getApiSandboxByIdTraces(
+    request: operations.GetApiSandboxByIdTracesRequest,
+    options?: RequestOptions,
+  ): Promise<operations.GetApiSandboxByIdTracesResponse> {
+    return unwrapAsync(sandboxGetApiSandboxByIdTraces(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * List workspace Environments
+   *
+   * @remarks
+   * Every Environment in the token's workspace: its name, the names of its variables and secrets with a `sha256(value)[:8]` fingerprint each, and timestamps. No value is ever returned — compare fingerprints to tell whether what you hold is what is stored. Environments carry the variables and secrets an agent's TOOLS need; LLM provider credentials are `/api/providers`, a different thing. 503 when the deployment has not migrated the table.
+   */
+  async getApiSandboxEnvironments(
+    options?: RequestOptions,
+  ): Promise<operations.GetApiSandboxEnvironmentsResponse> {
+    return unwrapAsync(sandboxGetApiSandboxEnvironments(
+      this,
+      options,
+    ));
+  }
+
+  /**
+   * Describe one workspace Environment
+   *
+   * @remarks
+   * Names and fingerprints only — the same shape as one entry of the list. 404 for a name this workspace does not have, including one another workspace does.
+   */
+  async getApiSandboxEnvironmentsByName(
+    request: operations.GetApiSandboxEnvironmentsByNameRequest,
+    options?: RequestOptions,
+  ): Promise<models.NameVarsSecrets> {
+    return unwrapAsync(sandboxGetApiSandboxEnvironmentsByName(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Create or replace a workspace Environment
+   *
+   * @remarks
+   * The whole Environment. Entries the body omits are REMOVED, secrets included. Values are accepted here and never returned by any route; secrets are encrypted at rest with the same key as provider credentials. Names: Environment `^[A-Za-z0-9._-]{1,64}$`, variables `^[A-Z_][A-Z0-9_]*$`, 64 KiB per Environment. 409 for a variable named like a harness provider key unless `?allowProviderKey=1`.
+   */
+  async putApiSandboxEnvironmentsByName(
+    request: operations.PutApiSandboxEnvironmentsByNameRequest,
+    options?: RequestOptions,
+  ): Promise<models.NameVarsSecrets> {
+    return unwrapAsync(sandboxPutApiSandboxEnvironmentsByName(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Set or unset entries of a workspace Environment
+   *
+   * @remarks
+   * Merges into the existing Environment: a string value sets the entry, `null` unsets it, entries not mentioned stay. Creates the Environment when it does not exist yet, so `mutagent env set` is one step. Same rules and the same 409 as PUT.
+   */
+  async patchApiSandboxEnvironmentsByName(
+    request: operations.PatchApiSandboxEnvironmentsByNameRequest,
+    options?: RequestOptions,
+  ): Promise<models.NameVarsSecrets> {
+    return unwrapAsync(sandboxPatchApiSandboxEnvironmentsByName(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Delete a workspace Environment
+   *
+   * @remarks
+   * Removes the Environment and its encrypted secrets. Boxes already running keep what they were handed; the next spawn naming this Environment answers 404. 404 when there is nothing to delete — a retried delete is not a success.
+   */
+  async deleteApiSandboxEnvironmentsByName(
+    request: operations.DeleteApiSandboxEnvironmentsByNameRequest,
+    options?: RequestOptions,
+  ): Promise<operations.DeleteApiSandboxEnvironmentsByNameResponse> {
+    return unwrapAsync(sandboxDeleteApiSandboxEnvironmentsByName(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Start a Helix session in a sandbox
+   *
+   * @remarks
+   * Returns as soon as the session is running — the run continues in the background and its output arrives on `GET /:id/stream`, not in this response. With `mode: "rpc"` the session is duplex: it emits `rpc` events on the stream and accepts `POST /:id/input`. `mode` defaults to `oneshot`, which is the pre-existing behaviour and has no stdin. A task token is rejected: starting an agent is driving the box.
+   */
+  async postApiSandboxByIdSession(
+    request: operations.PostApiSandboxByIdSessionRequest,
+    options?: RequestOptions,
+  ): Promise<operations.PostApiSandboxByIdSessionResponse> {
+    return unwrapAsync(sandboxPostApiSandboxByIdSession(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * List the workspace's Helix Cloud models and its default
+   *
+   * @remarks
+   * The platform model catalog restricted to the workspace’s active LLM providers, each as `provider/model` in the harness spelling, plus the stored ordered defaults and the one a run naming no model would use now. Providers the box cannot credential are named in `unmapped`. `sandbox:read`.
+   */
+  async getApiSandboxHelixDefaults(
+    options?: RequestOptions,
+  ): Promise<operations.GetApiSandboxHelixDefaultsResponse> {
+    return unwrapAsync(sandboxGetApiSandboxHelixDefaults(
+      this,
+      options,
+    ));
+  }
+
+  /**
+   * Set the workspace's default Helix Cloud models
+   *
+   * @remarks
+   * Replaces the ordered list; the first entry becomes the default for session starts and agent runs that name no model. Every entry must be in the workspace’s list (422 names the list). `[]` clears the defaults, after which such runs answer 428 NO_PROVIDER_CONFIGURED. Operator tokens only. 409 `HELIX_DEFAULTS_UNAVAILABLE` when this server has no Helix Cloud model source configured.
+   */
+  async putApiSandboxHelixDefaults(
+    request: operations.PutApiSandboxHelixDefaultsRequest,
+    options?: RequestOptions,
+  ): Promise<operations.PutApiSandboxHelixDefaultsResponse> {
+    return unwrapAsync(sandboxPutApiSandboxHelixDefaults(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * List the Helix sessions a sandbox is hosting
+   *
+   * @remarks
+   * Ids only — attach to one for detail. `sandbox:read`, unlike the other two session routes: asking which sessions exist is not driving the box.
+   */
+  async getApiSandboxByIdSessions(
+    request: operations.GetApiSandboxByIdSessionsRequest,
+    options?: RequestOptions,
+  ): Promise<operations.GetApiSandboxByIdSessionsResponse> {
+    return unwrapAsync(sandboxGetApiSandboxByIdSessions(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Write one line to a Helix session's stdin
+   *
+   * @remarks
+   * The write half of the duplex session channel — the read half is the `rpc` events on `GET /:id/stream`. Use it to answer a HITL request or send a follow-up turn to a session started in RPC mode. `line` must be exactly one JSON object with no newline in it: the channel is newline-delimited, so one call carries one command. A 200 means the line reached the session, nothing more — whether the agent accepted it comes back on the stream, asynchronously. 400 if the line is not a single JSON object, 409 if the session is not running.
+   */
+  async postApiSandboxByIdInput(
+    request: operations.PostApiSandboxByIdInputRequest,
+    options?: RequestOptions,
+  ): Promise<operations.PostApiSandboxByIdInputResponse> {
+    return unwrapAsync(sandboxPostApiSandboxByIdInput(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Stop a running Helix session without destroying its sandbox
+   *
+   * @remarks
+   * The remote equivalent of Ctrl-C on a local agent: the SESSION stops and the box — its filesystem, its other sessions, its event log — stays up. `DELETE /:id` remains the only thing that destroys a sandbox. Distinct from sending an `abort` command via `POST /:id/input`, which politely asks a cooperating agent to end its turn and only works while it is still reading stdin; a signal reaches a process that has stopped listening. 200 means the signal was delivered to a LIVE process, never merely that the request was well-formed. 409 if the session has already ended, 404 if the box has never heard of it.
+   */
+  async postApiSandboxByIdSignal(
+    request: operations.PostApiSandboxByIdSignalRequest,
+    options?: RequestOptions,
+  ): Promise<operations.PostApiSandboxByIdSignalResponse> {
+    return unwrapAsync(sandboxPostApiSandboxByIdSignal(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Capture a Helix session's own transcript
+   *
+   * @remarks
+   * Copies the HARNESS's session file off the box, verbatim, and stores it. This is what a NEW box needs to CONTINUE the conversation — distinct from `GET /:id/stream?since=`, which replays what the client observed and restores no agent state at all. 409 when the session has not completed a turn: the harness writes its file lazily, so there is genuinely nothing to capture yet, and storing an empty snapshot would produce a restore that succeeds and restores nothing. 503 when the deployment has no snapshot store.
+   */
+  async postApiSandboxByIdCheckpoint(
+    request: operations.PostApiSandboxByIdCheckpointRequest,
+    options?: RequestOptions,
+  ): Promise<operations.PostApiSandboxByIdCheckpointResponse> {
+    return unwrapAsync(sandboxPostApiSandboxByIdCheckpoint(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * List checkpoints captured from this sandbox
+   *
+   * @remarks
+   * Newest first, tenant-scoped, WITHOUT the stored bytes. `messageCount` is how much conversation each one holds.
+   */
+  async getApiSandboxByIdCheckpoints(
+    request: operations.GetApiSandboxByIdCheckpointsRequest,
+    options?: RequestOptions,
+  ): Promise<operations.GetApiSandboxByIdCheckpointsResponse> {
+    return unwrapAsync(sandboxGetApiSandboxByIdCheckpoints(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Rebuild this sandbox from a checkpoint, with full state
+   *
+   * @remarks
+   * A cloud equivalent of a local `/resume`, and it does NOT require the old box to still exist — a reaped or torn-down sandbox is the ordinary input. In order: a fresh box is spawned for the SAME sandbox id at generation+1 with the same secret NAMES (values are re-minted, never stored); the relay's seq counter is seeded from the persisted high-water mark so a client's `?since=` cursor stays valid; the workspace and `$HOME/.mutagent` are extracted BEFORE Helix starts; a session is started in the checkpoint's cwd; the conversation is written in, its sha256 compared against the box's own, and only then switched onto; the runtime settings and pending queue are replayed; and a `session {status:"restored"}` frame is appended to the stream with a real seq. A digest mismatch is a 422 and the session is NOT switched. 404 if the snapshot is not in this workspace. Read `notRestored` — a restore that carried only the conversation is legitimate and says so there. A DEFAULTED restore uses the newest checkpoint that has a manifest and lists newer rows it passed over in `skippedSnapshots`. `partial: true` restores the incremental transcript prefix beyond the checkpoint when one exists (the frame then carries `partial: true`); its tail may end on a tool call with no result, which the harness answers with a synthetic error on the next turn — the accepted risk of asking for it. ENVIRONMENT: `environment` and `env` layer onto the restored session exactly as on session start (provider keys, then the Environment, then per-call `env`, then platform-owned variables). The Environment a session was started with is recorded by NAME in the checkpoint manifest and re-resolved when `environment` is omitted; a name in the body wins, and an unknown one is a 404 before the old box is touched. Per-call `env` values are NEVER stored, so a restore that omits `env` does not bring them back — send a model key given as `env` again.
+   */
+  async postApiSandboxByIdRestore(
+    request: operations.PostApiSandboxByIdRestoreRequest,
+    options?: RequestOptions,
+  ): Promise<operations.PostApiSandboxByIdRestoreResponse> {
+    return unwrapAsync(sandboxPostApiSandboxByIdRestore(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Run one agent turn in a fresh sandbox
+   *
+   * @remarks
+   * `prompt` is WHO the agent is (the agent definition) and `task` is WHAT to do this turn. They are two different prompts and are never concatenated. `prompt` may be omitted when `args` carries `--name <agent>` instead — the box's own helix then resolves the name against the image's bundled roster and its agent dirs; exactly one of the two is required (422 otherwise). The turn's output comes back on stdout with the agent's real exit code. With `?stream=1` the same turn is delivered as it happens, in the event framing of `GET /:id/stream`: a `sandbox` event naming the box, then `stdout`/`stderr` as the agent produces them, then a `result` event carrying the exit code and whether the sandbox was torn down, then the terminal `status`. Disconnecting mid-stream releases the sandbox.
+   */
+  async postApiSandboxAgentRun(
+    request: operations.PostApiSandboxAgentRunRequest,
+    options?: RequestOptions,
+  ): Promise<operations.PostApiSandboxAgentRunResponse> {
+    return unwrapAsync(sandboxPostApiSandboxAgentRun(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Exchange a platform API key for a sandbox operator token
+   *
+   * @remarks
+   * Trades a platform API key (`x-api-key: mg_live_…`) for a short-lived operator token scoped to one workspace. The caller must be able to create resources in that workspace.
+   */
+  async postApiSandboxToken(
+    request: operations.PostApiSandboxTokenRequest,
+    options?: RequestOptions,
+  ): Promise<operations.PostApiSandboxTokenResponse> {
+    return unwrapAsync(sandboxPostApiSandboxToken(
+      this,
+      request,
+      options,
+    ));
+  }
+}

package/src/sdk/sdk.ts

@@ -8,6 +8,8 @@ import { Invitations } from "./invitations.js";
 import { OrganizationMembers } from "./organization-members.js";
 import { Organizations } from "./organizations.js";
 import { ProviderConfigs } from "./provider-configs.js";
+import { Sandbox } from "./sandbox.js";
+import { Traces } from "./traces.js";
 import { UserProfile } from "./user-profile.js";
 import { WorkspaceMembers } from "./workspace-members.js";
 import { Workspaces } from "./workspaces.js";
@@ -18,6 +20,11 @@ export class Mutagent extends ClientSDK {
     return (this._userProfile ??= new UserProfile(this._options));
   }
 
+  private _sandbox?: Sandbox;
+  get sandbox(): Sandbox {
+    return (this._sandbox ??= new Sandbox(this._options));
+  }
+
   private _agents?: Agents;
   get agents(): Agents {
     return (this._agents ??= new Agents(this._options));
@@ -54,4 +61,9 @@ export class Mutagent extends ClientSDK {
   get invitations(): Invitations {
     return (this._invitations ??= new Invitations(this._options));
   }
+
+  private _traces?: Traces;
+  get traces(): Traces {
+    return (this._traces ??= new Traces(this._options));
+  }
 }

package/src/sdk/traces.ts

@@ -0,0 +1,93 @@
+/*
+ * Code generated by Speakeasy (https://speakeasy.com). DO NOT EDIT.
+ */
+
+import { tracesGetTrace } from "../funcs/traces-get-trace.js";
+import { tracesIngestTraceBatch } from "../funcs/traces-ingest-trace-batch.js";
+import { tracesListLogs } from "../funcs/traces-list-logs.js";
+import { tracesListTraceSpans } from "../funcs/traces-list-trace-spans.js";
+import { tracesListTraces } from "../funcs/traces-list-traces.js";
+import { ClientSDK, RequestOptions } from "../lib/sdks.js";
+import * as operations from "../models/operations/index.js";
+import { unwrapAsync } from "../types/fp.js";
+
+export class Traces extends ClientSDK {
+  /**
+   * Ingest a batch of traces (mutagent-cli hook format)
+   *
+   * @remarks
+   * The shape mutagent-cli hooks send. Translated to OTLP internally and stored through the same path as an SDK export.
+   */
+  async ingestTraceBatch(
+    request: operations.IngestTraceBatchRequest,
+    options?: RequestOptions,
+  ): Promise<operations.IngestTraceBatchResponse> {
+    return unwrapAsync(tracesIngestTraceBatch(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * List recent traces
+   *
+   * @remarks
+   * Most recent first, keyset-paginated. Pass the previous page's nextCursor as ?cursor to continue; a null nextCursor means the last page.
+   */
+  async listTraces(
+    request?: operations.ListTracesRequest | undefined,
+    options?: RequestOptions,
+  ): Promise<operations.ListTracesResponse> {
+    return unwrapAsync(tracesListTraces(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * List recent log records
+   */
+  async listLogs(
+    request?: operations.ListLogsRequest | undefined,
+    options?: RequestOptions,
+  ): Promise<operations.ListLogsResponse> {
+    return unwrapAsync(tracesListLogs(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Get one trace envelope
+   */
+  async getTrace(
+    request: operations.GetTraceRequest,
+    options?: RequestOptions,
+  ): Promise<operations.GetTraceResponse> {
+    return unwrapAsync(tracesGetTrace(
+      this,
+      request,
+      options,
+    ));
+  }
+
+  /**
+   * Get every span of one trace
+   *
+   * @remarks
+   * Not paginated: a trace is bounded by construction, and a partial span tree is not a useful thing to hand back.
+   */
+  async listTraceSpans(
+    request: operations.ListTraceSpansRequest,
+    options?: RequestOptions,
+  ): Promise<operations.ListTraceSpansResponse> {
+    return unwrapAsync(tracesListTraceSpans(
+      this,
+      request,
+      options,
+    ));
+  }
+}

package/dist/commonjs/models/name-api-key-base-url.d.ts

@@ -1,62 +0,0 @@
-import * as z from "zod/v4-mini";
-import { IdDisplayNameFamily, IdDisplayNameFamily$Outbound } from "./id-display-name-family.js";
-import { Schemanullab2, Schemanullab2$Outbound } from "./schemanullab2.js";
-export type NameApiKeyBaseUrl = {
-    /**
-     * Updated display name
-     */
-    name?: string | undefined;
-    /**
-     * New API key (will be re-encrypted)
-     */
-    apiKey?: string | undefined;
-    /**
-     * Updated base URL (null to clear)
-     */
-    baseUrl?: string | null | undefined;
-    /**
-     * Updated model mappings (null to clear)
-     */
-    modelOverrides?: Schemanullab2 | null | undefined;
-    /**
-     * Activate or deactivate this config
-     */
-    isActive?: boolean | undefined;
-    /**
-     * Set or unset as default provider
-     */
-    isDefault?: boolean | undefined;
-    /**
-     * Azure/custom wire-format family: 'openai' | 'anthropic' | 'inference'
-     */
-    family?: string | null | undefined;
-    /**
-     * Updated declared models (null to clear)
-     */
-    supportedModels?: Array<IdDisplayNameFamily> | null | undefined;
-    /**
-     * Updated API version (null to clear)
-     */
-    apiVersion?: string | null | undefined;
-    /**
-     * Updated metadata (null to clear)
-     */
-    metadata?: Schemanullab2 | null | undefined;
-};
-/** @internal */
-export type NameApiKeyBaseUrl$Outbound = {
-    name?: string | undefined;
-    apiKey?: string | undefined;
-    baseUrl?: string | null | undefined;
-    modelOverrides?: Schemanullab2$Outbound | null | undefined;
-    isActive?: boolean | undefined;
-    isDefault?: boolean | undefined;
-    family?: string | null | undefined;
-    supportedModels?: Array<IdDisplayNameFamily$Outbound> | null | undefined;
-    apiVersion?: string | null | undefined;
-    metadata?: Schemanullab2$Outbound | null | undefined;
-};
-/** @internal */
-export declare const NameApiKeyBaseUrl$outboundSchema: z.ZodMiniType<NameApiKeyBaseUrl$Outbound, NameApiKeyBaseUrl>;
-export declare function nameApiKeyBaseUrlToJSON(nameApiKeyBaseUrl: NameApiKeyBaseUrl): string;
-//# sourceMappingURL=name-api-key-base-url.d.ts.map

package/dist/commonjs/models/name-api-key-base-url.d.ts.map

@@ -1 +0,0 @@
-{"version":3,"file":"name-api-key-base-url.d.ts","sourceRoot":"","sources":["../../../src/models/name-api-key-base-url.ts"],"names":[],"mappings":"AAIA,OAAO,KAAK,CAAC,MAAM,aAAa,CAAC;AACjC,OAAO,EACL,mBAAmB,EACnB,4BAA4B,EAE7B,MAAM,6BAA6B,CAAC;AACrC,OAAO,EACL,aAAa,EACb,sBAAsB,EAEvB,MAAM,oBAAoB,CAAC;AAE5B,MAAM,MAAM,iBAAiB,GAAG;IAC9B;;OAEG;IACH,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B;;OAEG;IACH,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC;;OAEG;IACH,cAAc,CAAC,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,CAAC;IAClD;;OAEG;IACH,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B;;OAEG;IACH,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC;;OAEG;IACH,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACnC;;OAEG;IACH,eAAe,CAAC,EAAE,KAAK,CAAC,mBAAmB,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IAChE;;OAEG;IACH,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC;;OAEG;IACH,QAAQ,CAAC,EAAE,aAAa,GAAG,IAAI,GAAG,SAAS,CAAC;CAC7C,CAAC;AAEF,gBAAgB;AAChB,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC1B,MAAM,CAAC,EAAE,MAAM,GAAG,SAAS,CAAC;IAC5B,OAAO,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACpC,cAAc,CAAC,EAAE,sBAAsB,GAAG,IAAI,GAAG,SAAS,CAAC;IAC3D,QAAQ,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAC/B,SAAS,CAAC,EAAE,OAAO,GAAG,SAAS,CAAC;IAChC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACnC,eAAe,CAAC,EAAE,KAAK,CAAC,4BAA4B,CAAC,GAAG,IAAI,GAAG,SAAS,CAAC;IACzE,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,GAAG,SAAS,CAAC;IACvC,QAAQ,CAAC,EAAE,sBAAsB,GAAG,IAAI,GAAG,SAAS,CAAC;CACtD,CAAC;AAEF,gBAAgB;AAChB,eAAO,MAAM,gCAAgC,EAAE,CAAC,CAAC,WAAW,CAC1D,0BAA0B,EAC1B,iBAAiB,CAcjB,CAAC;AAEH,wBAAgB,uBAAuB,CACrC,iBAAiB,EAAE,iBAAiB,GACnC,MAAM,CAIR"}