codai-sdk 0.63.0 → 0.65.0

package/dist/index.js

@@ -4450,6 +4450,34 @@ var Settings = class {
 	}
 };
 
+//#endregion
+//#region src/resources/os-gate.ts
+var OsGate = class {
+	http;
+	constructor(http) {
+		this.http = http;
+	}
+	/** `GET /v1/policy` — `{ os_gate: { allow_override } }` folded over every org of the caller (strictest wins). */
+	policy(opts = {}) {
+		return this.http.json("/v1/policy", {
+			ext: opts.ext,
+			signal: opts.signal
+		});
+	}
+	/**
+	* `POST /v1/os-gate/events` — record that the user granted or revoked an override of `checks` on `surface`.
+	* The body is strict: unknown keys, unknown check ids or an empty `checks` list throw a 400 `CodaiError`.
+	*/
+	recordEvent(event, opts = {}) {
+		return this.http.json("/v1/os-gate/events", {
+			method: "POST",
+			body: event,
+			ext: opts.ext,
+			signal: opts.signal
+		});
+	}
+};
+
 //#endregion
 //#region src/resources/sfx.ts
 var Sfx = class {
@@ -5289,8 +5317,9 @@ var Memory = class {
 //#endregion
 //#region src/resources/sandboxes.ts
 /**
-* `/v1/sandboxes` — agent sandboxes (beta): isolated gVisor containers with a persistent
-* `/workspace`, no network by default, artifacts from `/workspace/out` as scanned, signed links.
+* `/v1/sandboxes` — agent sandboxes: isolated gVisor containers with a persistent `/workspace`, no network
+* by default, artifacts from `/workspace/out` as scanned, signed links. Backend `v2` (default) = long-lived
+* GKE pod with pause/resume, fork, a persistent kernel and preview URLs; `v1` = Cloud Run, on request.
 */
 const base = (id) => `/v1/sandboxes/${encodeURIComponent(id)}`;
 /** Encode each segment of a workspace path, keeping the slashes. */
@@ -5341,9 +5370,12 @@ var Sandboxes = class {
 		this.files = new SandboxFiles(http);
 	}
 	/**
-	* `POST /v1/sandboxes` — start a sandbox (`ttl_seconds` 60–86400, default 3600; `egress` none by default).
-	* `backend: 'v2'` (closed canary) starts a long-lived pod with memory snapshots and accepts `template`
-	* `codai-base` | `brivio-acte` | `desktop`; its reply may carry `restored`.
+	* `POST /v1/sandboxes` — start a sandbox (`ttl_seconds` default 3600, max 86400 on v1 / 604800 on v2;
+	* `egress` none by default, or a `pypi`/`npm` preset / allowlist on both backends).
+	* `backend` defaults to `'v2'`: a long-lived pod with memory snapshots, Node 24 + npm, `template`
+	* `codai-base` | `brivio-acte` | `desktop`; its reply may carry `restored`. When `backend` is omitted and v2
+	* is unavailable for the key the gateway falls back to `'v1'` (check `backend` on the reply).
+	* Errors: 429 `sandbox_concurrency_limit` (3 per key, 5 running v2 per user), 503 `sandbox_capacity` (retry).
 	*/
 	create(input = {}, opts = {}) {
 		return this.http.json("/v1/sandboxes", {
@@ -5412,7 +5444,7 @@ var Sandboxes = class {
 			signal: opts.signal
 		});
 	}
-	/** `POST /v1/sandboxes/{id}/snapshot` — store a compressed copy of the workspace. */
+	/** `POST /v1/sandboxes/{id}/snapshot` (v1 only; v2 answers 409 `not_supported_on_v2`) — store a compressed copy of the workspace. */
 	snapshot(id, input = {}, opts = {}) {
 		return this.http.json(`${base(id)}/snapshot`, {
 			method: "POST",
@@ -5446,7 +5478,10 @@ var Sandboxes = class {
 			signal: opts.signal
 		});
 	}
-	/** `POST /v1/sandboxes/{id}/pause` (v2) — memory snapshot, then stop the pod (status `paused`). */
+	/**
+	* `POST /v1/sandboxes/{id}/pause` (v2) — memory snapshot, then stop the pod (status `paused`).
+	* At most 10 paused v2 sandboxes per user (429 `sandbox_paused_limit`).
+	*/
 	pause(id, opts = {}) {
 		return this.http.json(`${base(id)}/pause`, {
 			method: "POST",
@@ -6541,6 +6576,8 @@ const OPERATION_METHODS = {
 	getReferrals: "referrals.get",
 	getSettings: "settings.get",
 	patchSettings: "settings.update",
+	getPolicy: "osGate.policy",
+	recordOsGateEvent: "osGate.recordEvent",
 	getReceipt: "receipt.get",
 	submitFeedback: "feedback.submit",
 	listPhoneModels: "phoneModels.list"
@@ -6790,13 +6827,14 @@ var CodaiApps = class {
 *   client.tasks.*                              client.sessions.* (events, controls, lease, shares, stream)
 *   client.devices.* / client.hosts.*           client.orgs.* / client.account / client.receipt
 *   client.settings.get / .update (account-level settings shared by every device)
+*   client.osGate.policy / .recordEvent (OS protection gate: org override policy + override audit events)
 *   client.billing.get / .invoices / .watchBalance (READ-ONLY billing overview; never starts a payment)
 *   client.referrals.get / .redeem / .setConsent (referral stats + invitees; mutations via PATCH /v1/account)
 *   client.usage.get / client.keys.list / .setTags (own usage breakdown + API keys)
 *   client.projects.*                           client.environments.* (members, ports, secrets)
 *   client.sandboxes.create / .list / .retrieve / .exec / .execStream / .files.put / .files.get / .files.list
-*     / .artifacts / .snapshot / .delete / .run (agent sandboxes, beta: isolated gVisor workspaces, no network by default)
-*     / .runCode / .resetKernel / .pause / .resume / .fork / .preview (backend v2, closed canary)
+*     / .artifacts / .snapshot / .delete / .run (agent sandboxes: isolated gVisor workspaces, no network by default)
+*     / .runCode / .resetKernel / .pause / .resume / .fork / .preview (backend v2, the default; .snapshot is v1 only)
 *   client.verify.agentOutputKey / .agentOutput (EXPERIMENTAL HIDE-signed agent outputs)
 *   client.feedback / client.phoneModels
 *   client.resolve.* (verified bug fixes on https://resolve.codai.ro — resolve.yaml; .list / .iterate page your jobs)
@@ -6890,13 +6928,15 @@ var Codai = class {
 	orgs;
 	projects;
 	environments;
-	/** Agent sandboxes (beta) — isolated gVisor workspaces: `sandboxes.create/exec/execStream/files/artifacts/run`. */
+	/** Agent sandboxes (backend v2 by default) — isolated gVisor workspaces: `sandboxes.create/exec/execStream/files/artifacts/run`. */
 	sandboxes;
 	/** EXPERIMENTAL (HIDE, unaudited): verify signed agent outputs. Provenance only. */
 	verify;
 	account;
 	/** Account-level settings shared by every device (`settings.get()`, `settings.update(partial, { version })`). */
 	settings;
+	/** OS protection gate: `osGate.policy()` (org override policy) and `osGate.recordEvent(event)` (audit). */
+	osGate;
 	/** READ-ONLY billing: plan, wallet, invoices, `watchBalance` (pay via the returned links, never via the SDK). */
 	billing;
 	/** Referral stats and invitees; `redeem(code)` / `setConsent(bool)` go through `PATCH /v1/account`. */
@@ -6977,6 +7017,7 @@ var Codai = class {
 		this.verify = new Verify(http);
 		this.account = new Account(http);
 		this.settings = new Settings(http);
+		this.osGate = new OsGate(http);
 		this.billing = new Billing(http);
 		this.referrals = new Referrals(http);
 		this.receipt = new Receipts(http);
@@ -7071,5 +7112,5 @@ function allKeys(obj) {
 }
 
 //#endregion
-export { AbuseReports, Account, AgentRuns, Agents, Assets, Audio, Batches, Billing, BrandKits, Cards, Chat, ChatCompletions, Codai, Codai as default, CodaiApps, CodaiError, Creatives, Devices, Documents, Embeddings, EnvironmentFiles, EnvironmentJobs, EnvironmentMembers, EnvironmentPorts, EnvironmentSecrets, EnvironmentTasks, Environments, Exports, Feedback, Health, Heartbeats, Hosts, HttpClient, Images, Keys, Lists, Memory, Messages, Models, Music, Notifications, OPERATION_METHODS, OrgMembers, Orgs, PROVENANCE_MAX_BYTES, PhoneModels, Productions, Projects, Prompts, Provenance, RESOLVE_ATTESTATION_PAYLOAD_TYPE, RESOLVE_OPERATION_METHODS, RESOLVE_TERMINAL_STATUSES, Realtime, RealtimeSession, Receipts, Referrals, Renders, Research, Resolve, ResolveError, ResolveInsufficientFundsError, Responses, STREAMING_OPERATIONS, SandboxFiles, Sandboxes, ScheduleExecutor, SchedulerHosts, Schedules, SessionControls, SessionEvents, SessionLease, SessionShares, Sessions, Settings, Sfx, Shares, SystemOne, TUS_CHUNK_BYTES, Tasks, Templates, Tokens, Tools, Transcripts, Triggers, Usage, Vault, VaultDevices, Verify, Videos, VoiceRevocations, extensionHeaders, frameJson, isAssetDto, isProductionFinished, isResearchFinished, mergeToolCall, readSse, realtimeUrl, resolveAttestationStatement, settingsConflictCurrent, shareTokenFrom, uploadIdFromLocation, verifyAttestationWithKeys, verifyResolveWebhook };
+export { AbuseReports, Account, AgentRuns, Agents, Assets, Audio, Batches, Billing, BrandKits, Cards, Chat, ChatCompletions, Codai, Codai as default, CodaiApps, CodaiError, Creatives, Devices, Documents, Embeddings, EnvironmentFiles, EnvironmentJobs, EnvironmentMembers, EnvironmentPorts, EnvironmentSecrets, EnvironmentTasks, Environments, Exports, Feedback, Health, Heartbeats, Hosts, HttpClient, Images, Keys, Lists, Memory, Messages, Models, Music, Notifications, OPERATION_METHODS, OrgMembers, Orgs, OsGate, PROVENANCE_MAX_BYTES, PhoneModels, Productions, Projects, Prompts, Provenance, RESOLVE_ATTESTATION_PAYLOAD_TYPE, RESOLVE_OPERATION_METHODS, RESOLVE_TERMINAL_STATUSES, Realtime, RealtimeSession, Receipts, Referrals, Renders, Research, Resolve, ResolveError, ResolveInsufficientFundsError, Responses, STREAMING_OPERATIONS, SandboxFiles, Sandboxes, ScheduleExecutor, SchedulerHosts, Schedules, SessionControls, SessionEvents, SessionLease, SessionShares, Sessions, Settings, Sfx, Shares, SystemOne, TUS_CHUNK_BYTES, Tasks, Templates, Tokens, Tools, Transcripts, Triggers, Usage, Vault, VaultDevices, Verify, Videos, VoiceRevocations, extensionHeaders, frameJson, isAssetDto, isProductionFinished, isResearchFinished, mergeToolCall, readSse, realtimeUrl, resolveAttestationStatement, settingsConflictCurrent, shareTokenFrom, uploadIdFromLocation, verifyAttestationWithKeys, verifyResolveWebhook };
 //# sourceMappingURL=index.js.map