@opengeni/sdk 0.5.0 → 0.6.0

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@opengeni/sdk",
-  "version": "0.5.0",
+  "version": "0.6.0",
   "description": "Framework-agnostic TypeScript SDK for the OpenGeni API: typed client, session lifecycle, SSE event streaming with reconnect + replay-by-sequence, and proxy re-streaming helpers.",
   "license": "Apache-2.0",
   "repository": {

package/src/client.ts

@@ -5,6 +5,14 @@ import type {
   AddWorkspaceMemberRequest,
   ApiKey,
   BillingEntitlementsResponse,
+  CodexAccount,
+  CodexAccountsResponse,
+  CodexRotationSettings,
+  CodexConnectionStatus,
+  CodexConnectPoll,
+  CodexConnectStart,
+  CodexUsage,
+  CodexUsageMap,
   BillingSummary,
   BillingUsageResponse,
   CapabilityCatalogItem,
@@ -28,6 +36,12 @@ import type {
   CreateSessionRequest,
   CreateWorkspaceEnvironmentRequest,
   CreateWorkspaceRequest,
+  // Enrollment UX (design 11): the click-Grant approve-page lookup/deny + headless
+  // enroll-token mint.
+  DeviceEnrollmentApproveResponse,
+  DeviceEnrollmentDenyResponse,
+  DeviceEnrollmentLookupResponse,
+  MintEnrollTokenResponse,
   DiscoverMcpCapabilitiesResponse,
   Document,
   DocumentBase,
@@ -41,6 +55,14 @@ import type {
   GitHubRepositoriesResponse,
   ListApiKeysResponse,
   ListPacksResponse,
+  // Bring-your-own-compute: the Machines dashboard + per-machine metrics (M10).
+  MachinesResponse,
+  MachineView,
+  MetricSample,
+  MachineMetricsSeriesResponse,
+  // Bring-your-own-compute: the user-authenticated active-sandbox swap (M7).
+  SwapActiveSandboxRequest,
+  SwapActiveSandboxResponse,
   ListWorkspaceMembersResponse,
   PackInstallation,
   ReasoningEffort,
@@ -182,6 +204,118 @@ export class OpenGeniClient {
     });
   }
 
+  // --- Bring-your-own-compute: Machines dashboard + metrics (M10) ------------
+
+  /**
+   * List the workspace's machines (the Machines dashboard). Each enrolled
+   * selfhosted machine carries its derived state + latest metrics +
+   * sharedSessionCount. Pass `sessionId` for an in-session view, which adds the
+   * session's synthetic Modal group box + the active-sandbox pointer.
+   */
+  async listMachines(workspaceId: string, options: { sessionId?: string } = {}): Promise<MachinesResponse> {
+    return await this.requestJson<MachinesResponse>("GET", `/v1/workspaces/${workspaceId}/machines`, undefined, {
+      ...(options.sessionId !== undefined ? { sessionId: options.sessionId } : {}),
+    });
+  }
+
+  /**
+   * Read the downsampled (~1/min) metrics series for ONE machine over a time
+   * window (default 1h). The samples are oldest-first (a left-to-right chart).
+   */
+  async machineMetricsSeries(
+    workspaceId: string,
+    enrollmentId: string,
+    options: { window?: "15m" | "1h" | "6h" | "24h" } = {},
+  ): Promise<MetricSample[]> {
+    const response = await this.requestJson<MachineMetricsSeriesResponse>(
+      "GET",
+      `/v1/workspaces/${workspaceId}/machines/${enrollmentId}/metrics/series`,
+      undefined,
+      { ...(options.window !== undefined ? { window: options.window } : {}) },
+    );
+    return response.samples;
+  }
+
+  // --- Self-hosted enrollment UX (design 11) --------------------------------
+
+  /**
+   * Resolve a pending device-enrollment flow by its user_code for the click-Grant
+   * approve page (EnrollmentConsent). NO workspace in the path — the server
+   * resolves the workspace from the (globally-unique-among-pending) code, then
+   * authorizes the caller against it (enrollments:read). Rejects (404) when the
+   * code is unknown/expired OR the caller lacks the grant — the two are
+   * indistinguishable by design (no cross-workspace disclosure). Does not consume
+   * the request.
+   */
+  async lookupDeviceEnrollment(userCode: string): Promise<DeviceEnrollmentLookupResponse> {
+    return await this.requestJson<DeviceEnrollmentLookupResponse>("POST", "/v1/enrollments/device/lookup", { userCode });
+  }
+
+  /**
+   * Approve a pending device-enrollment flow (the LOUD consent step). `allowScreenControl`
+   * is the authoritative screen-control consent (whole-machine is mandatory/implicit).
+   * Lands an enrollment + a selfhosted sandbox and unblocks the agent's poll.
+   */
+  async approveDeviceEnrollment(
+    workspaceId: string,
+    request: { userCode: string; allowScreenControl?: boolean },
+  ): Promise<DeviceEnrollmentApproveResponse> {
+    return await this.requestJson<DeviceEnrollmentApproveResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/enrollments/device/approve`,
+      { userCode: request.userCode, allowScreenControl: request.allowScreenControl ?? false },
+    );
+  }
+
+  /** Deny a pending device-enrollment flow (the explicit "no" at the approve page). */
+  async denyDeviceEnrollment(
+    workspaceId: string,
+    request: { userCode: string },
+  ): Promise<DeviceEnrollmentDenyResponse> {
+    return await this.requestJson<DeviceEnrollmentDenyResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/enrollments/device/deny`,
+      { userCode: request.userCode },
+    );
+  }
+
+  /**
+   * Mint a short-TTL headless enroll token (the `oget_` token) for the fleet /
+   * non-interactive enroll path. The returned `token` is SECRET — surface it once
+   * with a copy-now warning; it cannot be re-read. `allowScreenControl` bakes the
+   * screen-control consent into the token.
+   */
+  async mintEnrollToken(
+    workspaceId: string,
+    request: { allowScreenControl?: boolean } = {},
+  ): Promise<MintEnrollTokenResponse> {
+    return await this.requestJson<MintEnrollTokenResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/enrollments/token`,
+      { allowScreenControl: request.allowScreenControl ?? false },
+    );
+  }
+
+  /**
+   * Swap a session's active sandbox (the user-authenticated equivalent of the
+   * M7 `sandbox_swap` MCP tool). `target` is a `MachineView.sandboxId` from
+   * `listMachines`, or "session"/"default" to swap back to the session's own
+   * group box. Validation (ownership/liveness/epoch fence) is server-side; the
+   * result echoes the resulting pointer (`swapped: false` + `reason` on a
+   * rejected target or a lost epoch fence).
+   */
+  async swapActiveSandbox(
+    workspaceId: string,
+    sessionId: string,
+    request: SwapActiveSandboxRequest,
+  ): Promise<SwapActiveSandboxResponse> {
+    return await this.requestJson<SwapActiveSandboxResponse>(
+      "POST",
+      `/v1/workspaces/${workspaceId}/sessions/${sessionId}/active-sandbox`,
+      request,
+    );
+  }
+
   // --- Scheduled tasks -------------------------------------------------------
 
   async listScheduledTasks(workspaceId: string, options: { limit?: number } = {}): Promise<ScheduledTask[]> {
@@ -1046,6 +1180,76 @@ export class OpenGeniClient {
     return `${this.baseUrl}${path}${params ? `?${params}` : ""}`;
   }
 
+  // --- Codex (ChatGPT) subscription (workspace-scoped) --------------------------------------------
+
+  /** Connection state + the codex models the workspace may select (empty until connected). */
+  async codexStatus(workspaceId: string): Promise<CodexConnectionStatus> {
+    return await this.requestJson<CodexConnectionStatus>("GET", `/v1/workspaces/${workspaceId}/codex/status`);
+  }
+
+  /** Begin device-code login: show `userCode` at `verificationUri`, then poll with `state`. */
+  async codexConnectStart(workspaceId: string): Promise<CodexConnectStart> {
+    return await this.requestJson<CodexConnectStart>("POST", `/v1/workspaces/${workspaceId}/codex/connect/start`);
+  }
+
+  /** Poll device-code authorization with the `state` from {@link codexConnectStart}. */
+  async codexConnectPoll(workspaceId: string, state: string): Promise<CodexConnectPoll> {
+    return await this.requestJson<CodexConnectPoll>("POST", `/v1/workspaces/${workspaceId}/codex/connect/poll`, { state });
+  }
+
+  /** Remaining usage / limits for the connected (ACTIVE) subscription. Back-compat. */
+  async codexUsage(workspaceId: string): Promise<CodexUsage> {
+    return await this.requestJson<CodexUsage>("GET", `/v1/workspaces/${workspaceId}/codex/usage`);
+  }
+
+  /** Live per-account usage read (refreshes THIS account's bearer; writes the cache). */
+  async codexAccountUsage(workspaceId: string, accountId: string): Promise<CodexUsage> {
+    return await this.requestJson<CodexUsage>("GET", `/v1/workspaces/${workspaceId}/codex/accounts/${accountId}/usage`);
+  }
+
+  /** Batched live refresh across every connected account, keyed by credential id. */
+  async refreshCodexUsage(workspaceId: string): Promise<{ usage: CodexUsageMap }> {
+    return await this.requestJson<{ usage: CodexUsageMap }>("POST", `/v1/workspaces/${workspaceId}/codex/usage/refresh`);
+  }
+
+  /** Disconnect ALL accounts (legacy workspace-wide). Prefer `disconnectCodexAccount`. */
+  async codexDisconnect(workspaceId: string): Promise<{ disconnected: boolean }> {
+    return await this.requestJson<{ disconnected: boolean }>("DELETE", `/v1/workspaces/${workspaceId}/codex`);
+  }
+
+  /** List every connected Codex account + the workspace active pointer + settings. */
+  async listCodexAccounts(workspaceId: string): Promise<CodexAccountsResponse> {
+    return await this.requestJson<CodexAccountsResponse>("GET", `/v1/workspaces/${workspaceId}/codex/accounts`);
+  }
+
+  /** Switch the workspace ACTIVE Codex account (the one unpinned sessions use). */
+  async activateCodexAccount(workspaceId: string, accountId: string): Promise<{ activated: boolean; accountId: string }> {
+    return await this.requestJson<{ activated: boolean; accountId: string }>("POST", `/v1/workspaces/${workspaceId}/codex/accounts/${accountId}/activate`);
+  }
+
+  /** P3: enable/disable Codex auto-rotation and/or pick the strategy. Returns the effective settings. */
+  async setCodexRotationSettings(
+    workspaceId: string,
+    patch: { rotationEnabled?: boolean; rotationStrategy?: CodexRotationSettings["rotationStrategy"] },
+  ): Promise<CodexRotationSettings> {
+    return await this.requestJson<CodexRotationSettings>("PATCH", `/v1/workspaces/${workspaceId}/codex/settings`, patch);
+  }
+
+  /** Disconnect ONE Codex account by id (re-picks active when the removed one was active). */
+  async disconnectCodexAccount(workspaceId: string, accountId: string): Promise<{ disconnected: boolean; newActiveId: string | null }> {
+    return await this.requestJson<{ disconnected: boolean; newActiveId: string | null }>("DELETE", `/v1/workspaces/${workspaceId}/codex/accounts/${accountId}`);
+  }
+
+  /** Rename a Codex account (label only in P1). */
+  async renameCodexAccount(workspaceId: string, accountId: string, label: string | null): Promise<CodexAccount> {
+    return await this.requestJson<CodexAccount>("PATCH", `/v1/workspaces/${workspaceId}/codex/accounts/${accountId}`, { label });
+  }
+
+  /** Pin (or unpin via "auto") a session's Codex account. Applies on the next turn. */
+  async pinSessionCodexAccount(workspaceId: string, sessionId: string, target: string): Promise<{ pinned: string }> {
+    return await this.requestJson<{ pinned: string }>("POST", `/v1/workspaces/${workspaceId}/sessions/${sessionId}/codex-account`, { target });
+  }
+
   private async requestJson<T>(method: string, path: string, body?: unknown, query: Record<string, string> = {}): Promise<T> {
     const response = await this.fetchImpl(this.url(path, query), {
       method,

package/src/index.ts

@@ -73,6 +73,17 @@ export type {
   CapabilityUnavailableReason,
   ClientConfig,
   ClientModel,
+  CodexAccount,
+  CodexAccountsResponse,
+  CodexAccountSwitchedPayload,
+  CodexConnectionStatus,
+  CodexConnectStart,
+  CodexConnectPoll,
+  CodexRotationSettings,
+  CodexUsage,
+  CodexUsageMap,
+  CodexUsagePayload,
+  CodexUsageWindow,
   CompactSessionContextResult,
   ClientSessionEventInput,
   CompleteFileUploadResponse,
@@ -244,4 +255,29 @@ export type {
   WorkspaceEnvironmentVariableMetadata,
   WorkspaceMember,
   WorkspaceRegisteredPack,
+  // Bring-your-own-compute: Machines dashboard + per-machine metrics (M10).
+  MetricSample,
+  MachineState,
+  MachineKind,
+  MachineView,
+  MachinesResponse,
+  MachineMetricsSeriesResponse,
+  // Bring-your-own-compute: the user-authenticated active-sandbox swap (M7).
+  SwapActiveSandboxRequest,
+  SwapActiveSandboxResponse,
+  // Self-hosted enrollment UX (design 11): click-Grant approve-page lookup/deny +
+  // headless enroll-token mint/exchange.
+  EnrollmentOs,
+  DeviceEnrollmentLookupRequest,
+  DeviceEnrollmentLookupResponse,
+  DeviceEnrollmentLookupMachine,
+  DeviceEnrollmentApproveRequest,
+  DeviceEnrollmentApproveResponse,
+  DeviceEnrollmentDenyRequest,
+  DeviceEnrollmentDenyResponse,
+  MintEnrollTokenRequest,
+  MintEnrollTokenResponse,
+  EnrollmentCredentials,
+  EnrollTokenExchangeRequest,
+  EnrollTokenExchangeResponse,
 } from "./types";