@qoniai/qoni 0.4.3 → 0.5.0

package/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## 0.5.0 - 2026-09-17
+
+### Added
+
+- Let Do Anything callers select a server-managed Browserbase proxy by ID, choose
+  `off`, `all`, or `scoped` routing, and select a supported Browserbase compute
+  region with `browserProxy`.
+
+### Security
+
+- Reject proxy URLs, usernames, passwords, and any unknown proxy option locally.
+  Proxy credentials remain in the backend's private registry and never cross the
+  public SDK API.
+
+## 0.4.4
+
+- Populate Do Anything `result.artifacts` from durable run files, including attached runs.
+- Expose signed download URLs, per-file link refresh, and explicit file listing.
+
 All notable changes to `@qoniai/qoni` are documented in this file.
 
 This project follows semantic versioning. Before `1.0.0`, minor versions may

package/README.md

@@ -391,12 +391,22 @@ const context = await qoni.gumem.recall({
 const run = await qoni.doAnything.run({
   token,
   prompt: "Open https://en.wikipedia.org/wiki/Solid-state_battery and summarize its key advantages over lithium-ion.",
+  browserProxy: {
+    proxyId: "sg-static", // server-side registry id; never pass credentials here
+    mode: "scoped",       // off | all | scoped
+    region: "ap-southeast-1",
+  },
 });
 
 const status = await run.status(); // refresh the run's current state
 await run.cancel("User stopped the task"); // idempotent
 ```
 
+`browserProxy` affects only newly created Browserbase sessions. `region` selects
+Browserbase compute, while the registered proxy controls network egress. The SDK
+accepts only a proxy ID, mode, and region; operators manage proxy credentials in
+OpsConsole.
+
 ### Web Search
 
 ```ts
@@ -785,3 +795,19 @@ Common first-run errors:
 ## License
 
 MIT
+
+## Do Anything file artifacts
+
+After `wait()`, `result.artifacts` contains this run's persisted files, including when using `attach()` after reconnecting. Screenshots and recordings remain on their dedicated APIs. Temporary S3 URLs expire 900 seconds after signing; do not put them in public logs. Refreshing a link requires a valid delegation token with `webagent.do_anything:read`. Stored files remain subject to project retention.
+
+```ts
+const result = await run.wait();
+for (const artifact of result.artifacts) {
+  let url = artifact.downloadUrl;
+  url = await artifact.refreshDownloadUrl?.();
+  const data = await artifact.content(); // Uint8Array, authenticated download
+}
+const artifacts = await client.doAnything.artifacts({ token, runId: run.id });
+```
+
+Wire methods: `client.doAnything.api.listArtifacts(...)` and `artifactDownloadUrl(...)`.

package/README.zh-CN.md

@@ -362,12 +362,21 @@ const context = await qoni.gumem.recall({
 const run = await qoni.doAnything.run({
   token,
   prompt: "打开 https://en.wikipedia.org/wiki/Solid-state_battery ，总结它相对锂离子电池的主要优势。",
+  browserProxy: {
+    proxyId: "sg-static", // 服务端代理注册表 ID；这里绝不传凭据
+    mode: "scoped",       // off | all | scoped
+    region: "ap-southeast-1",
+  },
 });
 
 const status = await run.status(); // 刷新并返回当前状态
 await run.cancel("用户停止任务"); // 幂等
 ```
 
+`browserProxy` 只影响新建的 Browserbase 会话。`region` 选择 Browserbase
+计算区域，注册代理决定网络出口。SDK 只接受代理 ID、模式和区域；代理账号密码由
+运维人员在 OpsConsole 管理。
+
 ### Web Search
 
 ```ts
@@ -715,3 +724,19 @@ try {
 ## License
 
 MIT
+
+## Do Anything file artifacts
+
+After `wait()`, `result.artifacts` contains this run's persisted files, including when using `attach()` after reconnecting. Screenshots and recordings remain on their dedicated APIs. Temporary S3 URLs expire 900 seconds after signing; do not put them in public logs. Refreshing a link requires a valid delegation token with `webagent.do_anything:read`. Stored files remain subject to project retention.
+
+```ts
+const result = await run.wait();
+for (const artifact of result.artifacts) {
+  let url = artifact.downloadUrl;
+  url = await artifact.refreshDownloadUrl?.();
+  const data = await artifact.content(); // Uint8Array, authenticated download
+}
+const artifacts = await client.doAnything.artifacts({ token, runId: run.id });
+```
+
+Wire methods: `client.doAnything.api.listArtifacts(...)` and `artifactDownloadUrl(...)`.

package/dist/index.cjs

@@ -1194,6 +1194,34 @@ var PLATFORM_DECIDED_RUN_OPTIONS = [
   "outputSchema",
   "cacheScript"
 ];
+var BROWSERBASE_REGIONS = /* @__PURE__ */ new Set([
+  "us-west-2",
+  "us-east-1",
+  "eu-central-1",
+  "ap-southeast-1"
+]);
+function validateBrowserProxyOptions(value) {
+  if (value === void 0) return;
+  if (!isJsonObject(value)) {
+    throw new QoniValidationError("browserProxy must be an object");
+  }
+  const allowed = /* @__PURE__ */ new Set(["proxyId", "mode", "region"]);
+  const extras = Object.keys(value).filter((key) => !allowed.has(key));
+  if (extras.length > 0) {
+    throw new QoniValidationError(
+      `browserProxy does not accept ${extras.join(", ")} \u2014 credentials stay server-side`
+    );
+  }
+  if (value.proxyId !== void 0 && (typeof value.proxyId !== "string" || !/^[a-z0-9][a-z0-9._-]{0,63}$/.test(value.proxyId))) {
+    throw new QoniValidationError("browserProxy.proxyId is invalid");
+  }
+  if (value.mode !== void 0 && !["off", "all", "scoped"].includes(String(value.mode))) {
+    throw new QoniValidationError("browserProxy.mode must be off, all, or scoped");
+  }
+  if (value.region !== void 0 && (typeof value.region !== "string" || !BROWSERBASE_REGIONS.has(value.region))) {
+    throw new QoniValidationError("browserProxy.region is not supported");
+  }
+}
 function createDoAnythingNamespace(transport) {
   const api = {
     createSession: (input) => transport.webAgentJson("POST", "/do_anything/sessions", input.token, {
@@ -1262,6 +1290,18 @@ function createDoAnythingNamespace(transport) {
         requiredScopes: ["webagent.do_anything:read"]
       }
     ),
+    listArtifacts: (input) => transport.webAgentJson(
+      "GET",
+      `/do_anything/runs/${encodeURIComponent(input.runId)}/artifacts`,
+      input.token,
+      { signal: input.signal, requiredScopes: ["webagent.do_anything:read"] }
+    ),
+    artifactDownloadUrl: (input) => transport.webAgentJson(
+      "GET",
+      `/do_anything/artifacts/${encodeURIComponent(input.artifactId)}/download-url`,
+      input.token,
+      { requiredScopes: ["webagent.do_anything:read"] }
+    ),
     readRecording: (input) => transport.webAgentJson(
       "GET",
       `/do_anything/sessions/${encodeURIComponent(input.sessionId)}/recording`,
@@ -1271,8 +1311,42 @@ function createDoAnythingNamespace(transport) {
       }
     )
   };
+  async function artifacts(input) {
+    const { data } = await api.listArtifacts(input);
+    if (!isJsonObject(data) || !Array.isArray(data.items)) {
+      throw new QoniValidationError("artifact list response requires items");
+    }
+    return data.items.map((item) => {
+      if (!isJsonObject(item) || typeof item.id !== "string" || !item.id) {
+        throw new QoniValidationError("artifact requires a nonempty id");
+      }
+      const id = item.id;
+      const artifact = {
+        id,
+        name: typeof item.name === "string" ? item.name : void 0,
+        mime: typeof item.mime_type === "string" ? item.mime_type : void 0,
+        sizeBytes: typeof item.size_bytes === "number" ? item.size_bytes : void 0,
+        createdAt: typeof item.created_at === "string" ? item.created_at : void 0,
+        downloadUrl: typeof item.download_url === "string" ? item.download_url : void 0,
+        expiresIn: typeof item.expires_in === "number" ? item.expires_in : void 0,
+        content: async () => (await transport.webAgentBytes(
+          `/do_anything/artifacts/${encodeURIComponent(id)}/blob`,
+          input.token,
+          { requiredScopes: ["webagent.do_anything:read"] }
+        )).bytes,
+        refreshDownloadUrl: async () => {
+          const { data: link } = await api.artifactDownloadUrl({ token: input.token, artifactId: id });
+          artifact.downloadUrl = link.download_url;
+          artifact.expiresIn = link.expires_in;
+          return link.download_url;
+        }
+      };
+      return artifact;
+    });
+  }
   function buildOps(token, runId, capture) {
     return {
+      listArtifacts: (signal) => artifacts({ token, runId, signal }),
       getDetail: async (signal) => asRecord2((await api.getRun({ token, runId, signal })).data),
       streamEvents: (opts) => api.events({
         token,
@@ -1310,6 +1384,7 @@ function createDoAnythingNamespace(transport) {
       if (!prompt || typeof prompt !== "string") {
         throw new QoniValidationError("doAnything.run requires a prompt string");
       }
+      validateBrowserProxyOptions(rest.browserProxy);
       const unsupported = PLATFORM_DECIDED_RUN_OPTIONS.filter(
         (key) => rest[key] !== void 0
       );
@@ -1351,6 +1426,7 @@ function createDoAnythingNamespace(transport) {
       await handle.status();
       return handle;
     },
+    artifacts,
     api
   };
 }
@@ -1360,8 +1436,13 @@ function normalizeDoAnythingRunInput(input) {
     profileId: "profile_id",
     keepAlive: "keep_alive",
     allowedActions: "allowed_actions",
-    maxDurationMinutes: "max_duration_minutes"
+    maxDurationMinutes: "max_duration_minutes",
+    browserProxy: "browser_proxy"
   });
+  const browserProxy = body.browser_proxy;
+  if (isJsonObject(browserProxy)) {
+    body.browser_proxy = renameKeys2(browserProxy, { proxyId: "proxy_id" });
+  }
   return body;
 }
 function normalizeDoAnythingInterveneInput(input) {