release: 1.4.0-alpha.2

.github/workflows/ci.yml

@@ -21,15 +21,15 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/warp-api-typescript' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: (github.event_name == 'push' || github.event.pull_request.head.repo.fork) && (github.event_name != 'push' || github.event.head_commit.message != 'codegen metadata')
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
         with:
           version: '10.30.1'
 
@@ -48,15 +48,15 @@ jobs:
       contents: read
       id-token: write
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
         with:
           version: '10.30.1'
 
@@ -71,7 +71,7 @@ jobs:
           github.repository == 'stainless-sdks/warp-api-typescript' &&
           !startsWith(github.ref, 'refs/heads/stl/')
         id: github-oidc
-        uses: actions/github-script@v8
+        uses: actions/github-script@ed597411d8f924073f98dfc5c65a23a2325f34cd # v8.0.0
         with:
           script: core.setOutput('github_token', await core.getIDToken());
 
@@ -90,15 +90,15 @@ jobs:
     runs-on: ${{ github.repository == 'stainless-sdks/warp-api-typescript' && 'depot-ubuntu-24.04' || 'ubuntu-latest' }}
     if: github.event_name == 'push' || github.event.pull_request.head.repo.fork
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@v4
+        uses: actions/setup-node@49933ea5288caeca8642d1e84afbd3f7d6820020 # v4.4.0
         with:
           node-version: '20'
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
         with:
           version: '10.30.1'
 

.github/workflows/publish-npm.yml

@@ -17,15 +17,15 @@ jobs:
       id-token: write
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Set up Node
-        uses: actions/setup-node@v3
+        uses: actions/setup-node@3235b876344d2a9aa001b8d1453c930bba69e610 # v3.9.1
         with:
           node-version: '20'
 
       - name: Set up pnpm
-        uses: pnpm/action-setup@v4
+        uses: pnpm/action-setup@b906affcce14559ad1aafd4ab0e942779e9f58b1 # v4.3.0
 
       - name: Install dependencies
         run: |

.github/workflows/release-doctor.yml

@@ -12,7 +12,7 @@ jobs:
     if: github.repository == 'warpdotdev/oz-sdk-typescript' && (github.event_name == 'push' || github.event_name == 'workflow_dispatch' || startsWith(github.head_ref, 'release-please') || github.head_ref == 'next')
 
     steps:
-      - uses: actions/checkout@v6
+      - uses: actions/checkout@de0fac2e4500dabe0009e67214ff5f5447ce83dd # v6.0.2
 
       - name: Check release environment
         run: |

.release-please-manifest.json

@@ -1,3 +1,3 @@
 {
-  ".": "1.4.0-alpha.1"
+  ".": "1.4.0-alpha.2"
 }

.stats.yml

@@ -1,4 +1,4 @@
-configured_endpoints: 22
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/warp-bnavetta/warp-api-1fecc5f5d6ee664d804b81bd1aa6eec4d3f170ffa788d214fead4f7e95ab9d4e.yml
-openapi_spec_hash: 82990b03bd5a93e45bfc79db56ae7fc0
-config_hash: f52e7636f248f25c4ea0b086e7326816
+configured_endpoints: 23
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/warp-bnavetta/warp-api-964f646a32c318735de7673531a12788aede1840f7ab4893f2efa31c83440837.yml
+openapi_spec_hash: 30f07ff0bfb491efb11cd88fce79968a
+config_hash: 236823a4936c76818117c16aa5c188df

CHANGELOG.md

@@ -1,5 +1,45 @@
 # Changelog
 
+## 1.4.0-alpha.2 (2026-05-21)
+
+Full Changelog: [v1.4.0-alpha.1...v1.4.0-alpha.2](https://github.com/warpdotdev/oz-sdk-typescript/compare/v1.4.0-alpha.1...v1.4.0-alpha.2)
+
+### Features
+
+* Add default harness selection for agents ([a5ec72d](https://github.com/warpdotdev/oz-sdk-typescript/commit/a5ec72d95f8c53927571b3493396c1282c7f1844))
+* Add per-agent AWS Bedrock OIDC inference role (backend) ([c82dc15](https://github.com/warpdotdev/oz-sdk-typescript/commit/c82dc153cdac6ab44e4e2aa3bf451a50bba54a52))
+* Add updated_at to agent API responses ([0de41e1](https://github.com/warpdotdev/oz-sdk-typescript/commit/0de41e183fc457652ffda1cd94c624ed9f70e04c))
+* **agents:** add prompt property to agent identity data model ([bc889e1](https://github.com/warpdotdev/oz-sdk-typescript/commit/bc889e1be8e9d52df135230cb37aa6817192e4cd))
+* **api:** api update ([05594f1](https://github.com/warpdotdev/oz-sdk-typescript/commit/05594f1ad14c32f357fcd31ceaea7758c5b41a91))
+* **api:** api update ([4e81853](https://github.com/warpdotdev/oz-sdk-typescript/commit/4e81853387e0cb3031ba517781ab2560f92a98fc))
+* **api:** api update ([64fc1a2](https://github.com/warpdotdev/oz-sdk-typescript/commit/64fc1a2471b3e0ed9873795a04b4f0e2368c92dd))
+* **api:** api update ([f43cf4f](https://github.com/warpdotdev/oz-sdk-typescript/commit/f43cf4fb4f402b3961166a792b7556fbee266ece))
+* **api:** api update ([a530c11](https://github.com/warpdotdev/oz-sdk-typescript/commit/a530c11d0897c8c1cc3706e1fc68d2d9b1768689))
+* **api:** api update ([63390f5](https://github.com/warpdotdev/oz-sdk-typescript/commit/63390f5adc5bfae988ebc6081c3f447672c59d61))
+* **api:** api update ([89e4435](https://github.com/warpdotdev/oz-sdk-typescript/commit/89e44352062b2526d9bd39f28d70562c87d667cf))
+* **api:** api update ([345e736](https://github.com/warpdotdev/oz-sdk-typescript/commit/345e736aba6081962afbae4d997b267ee7755497))
+* **api:** api update ([63ba09a](https://github.com/warpdotdev/oz-sdk-typescript/commit/63ba09ae4224b712830fb30980b96e3658804e01))
+* **api:** api update ([cfd9f36](https://github.com/warpdotdev/oz-sdk-typescript/commit/cfd9f367cd29d9bd81d74e1b1c4c2a908806967b))
+* **api:** api update ([cc72fe8](https://github.com/warpdotdev/oz-sdk-typescript/commit/cc72fe842eb431c60bbe72f16b3aab1694893fb6))
+* Codex auth: API key support. ([3239af5](https://github.com/warpdotdev/oz-sdk-typescript/commit/3239af50b067dc61e9795e0abbd0e11fb155e83d))
+* **memory:** agent identity memory store attachments — API layer ([f987f21](https://github.com/warpdotdev/oz-sdk-typescript/commit/f987f2148a940658d6e751ef1b98e4a5dbc2c3a3))
+* **memory:** wire memory stores into run pipeline and add listing endpoint ([56324ee](https://github.com/warpdotdev/oz-sdk-typescript/commit/56324ee8cf997f928aa67e3c95821b78fea619b2))
+* Partial support for multiple skills per run ([a24ac35](https://github.com/warpdotdev/oz-sdk-typescript/commit/a24ac355581959d8fa6329a8adc2a7f11cc31dfb))
+* Resolve Bedrock region server-side and ship as AWS_REGION ([fce3967](https://github.com/warpdotdev/oz-sdk-typescript/commit/fce39679b0ca2095b812fac8631b71d81fceef63))
+* Retrieve memories in third party harnesses ([3df6e50](https://github.com/warpdotdev/oz-sdk-typescript/commit/3df6e50ad1915320ad8b0e15be00dac5c55c1b06))
+* Support service account impersonation in GCP Workload Identity Federation config ([2a1e2cd](https://github.com/warpdotdev/oz-sdk-typescript/commit/2a1e2cd9bd113ab834c70ff1df781696220b21b5))
+
+
+### Bug Fixes
+
+* **typescript:** upgrade tsc-multi so that it works with Node 26 ([17a7800](https://github.com/warpdotdev/oz-sdk-typescript/commit/17a7800ccf6ea73492d8dc5d20ff3a1b83ab36dc))
+
+
+### Chores
+
+* redact api-key headers in debug logs ([173a753](https://github.com/warpdotdev/oz-sdk-typescript/commit/173a7532c552b3741ecb6e34a177d4f7f4ecce5d))
+* **tests:** remove redundant File import ([c8353e7](https://github.com/warpdotdev/oz-sdk-typescript/commit/c8353e75abd9f48897f6f60339cfdf62920eaf19))
+
 ## 1.4.0-alpha.1 (2026-05-07)
 
 Full Changelog: [v1.4.0-alpha.0...v1.4.0-alpha.1](https://github.com/warpdotdev/oz-sdk-typescript/compare/v1.4.0-alpha.0...v1.4.0-alpha.1)

api.md

@@ -79,6 +79,7 @@ Methods:
 - <code title="put /agent/identities/{uid}">client.agent.agent.<a href="./src/resources/agent/agent_.ts">update</a>(uid, { ...params }) -> AgentResponse</code>
 - <code title="get /agent/identities">client.agent.agent.<a href="./src/resources/agent/agent_.ts">list</a>() -> ListAgentIdentitiesResponse</code>
 - <code title="delete /agent/identities/{uid}">client.agent.agent.<a href="./src/resources/agent/agent_.ts">delete</a>(uid) -> void</code>
+- <code title="get /agent/identities/{uid}">client.agent.agent.<a href="./src/resources/agent/agent_.ts">get</a>(uid) -> AgentResponse</code>
 
 ## Sessions
 

package.json

@@ -1,6 +1,6 @@
 {
   "name": "oz-agent-sdk",
-  "version": "1.4.0-alpha.1",
+  "version": "1.4.0-alpha.2",
   "description": "The official TypeScript library for the Oz API API",
   "author": "Oz API <>",
   "types": "dist/index.d.ts",
@@ -43,7 +43,7 @@
     "publint": "^0.2.12",
     "ts-jest": "^29.1.0",
     "ts-node": "^10.5.0",
-    "tsc-multi": "https://github.com/stainless-api/tsc-multi/releases/download/v1.1.9/tsc-multi.tgz",
+    "tsc-multi": "https://github.com/stainless-api/tsc-multi/releases/download/v1.1.11/tsc-multi.tgz",
     "tsconfig-paths": "^4.0.0",
     "tslib": "^2.8.1",
     "typescript": "5.8.3",

src/internal/utils/log.ts

@@ -107,6 +107,8 @@ export const formatRequestDetails = (details: {
           name,
           (
             name.toLowerCase() === 'authorization' ||
+            name.toLowerCase() === 'api-key' ||
+            name.toLowerCase() === 'x-api-key' ||
             name.toLowerCase() === 'cookie' ||
             name.toLowerCase() === 'set-cookie'
           ) ?

src/resources/agent/agent.ts

@@ -245,11 +245,21 @@ export interface AmbientAgentConfig {
    */
   idle_timeout_minutes?: number;
 
+  /**
+   * Inference provider settings used for LLM calls.
+   */
+  inference_providers?: AmbientAgentConfig.InferenceProviders;
+
   /**
    * Map of MCP server configurations by name
    */
   mcp_servers?: { [key: string]: McpServerConfig };
 
+  /**
+   * Memory stores to attach to this run.
+   */
+  memory_stores?: Array<AmbientAgentConfig.MemoryStore>;
+
   /**
    * LLM model to use (uses team default if not specified)
    */
@@ -274,13 +284,23 @@ export interface AmbientAgentConfig {
   session_sharing?: AmbientAgentConfig.SessionSharing;
 
   /**
-   * Skill specification identifying which agent skill to use. Format:
+   * Skill specification identifying the primary agent skill to use. Format:
    * "{owner}/{repo}:{skill_path}" Example:
-   * "warpdotdev/warp-server:.claude/skills/deploy/SKILL.md" Use the list agents
-   * endpoint to discover available skills.
+   * "warpdotdev/warp-server:.claude/skills/deploy/SKILL.md" Mutually exclusive with
+   * skills in create/update requests. Responses include the first skills entry here
+   * for backward compatibility. Use the list agents endpoint to discover available
+   * skills.
    */
   skill_spec?: string;
 
+  /**
+   * Ordered skill specifications to attach to the run. Format:
+   * "{owner}/{repo}:{skill_path}" Example:
+   * "warpdotdev/warp-server:.claude/skills/deploy/SKILL.md" Mutually exclusive with
+   * skill_spec in create/update requests.
+   */
+  skills?: Array<string>;
+
   /**
    * Self-hosted worker ID that should execute this task. If not specified or set to
    * "warp", the task runs on Warp-hosted workers.
@@ -316,6 +336,65 @@ export namespace AmbientAgentConfig {
      * type is "claude".
      */
     claude_auth_secret_name?: string;
+
+    /**
+     * Name of a managed secret for Codex harness authentication. The secret must exist
+     * within the caller's personal or team scope. Only applicable when harness type is
+     * "codex".
+     */
+    codex_auth_secret_name?: string;
+  }
+
+  /**
+   * Inference provider settings used for LLM calls.
+   */
+  export interface InferenceProviders {
+    /**
+     * Configures AWS Bedrock as the LLM inference provider for this agent or run.
+     */
+    aws?: InferenceProviders.Aws;
+  }
+
+  export namespace InferenceProviders {
+    /**
+     * Configures AWS Bedrock as the LLM inference provider for this agent or run.
+     */
+    export interface Aws {
+      /**
+       * If true, opt out of Bedrock at this layer.
+       */
+      disabled?: boolean;
+
+      /**
+       * AWS region used for STS when assuming the Bedrock inference role.
+       */
+      region?: string;
+
+      /**
+       * IAM role ARN to assume when calling Bedrock.
+       */
+      role_arn?: string;
+    }
+  }
+
+  /**
+   * Reference to a memory store to attach to an agent.
+   */
+  export interface MemoryStore {
+    /**
+     * Access level for the store.
+     */
+    access: 'read_write' | 'read_only';
+
+    /**
+     * Instructions for how the agent should use this memory store. Must not be empty.
+     */
+    instructions: string;
+
+    /**
+     * UID of the memory store.
+     */
+    uid: string;
   }
 
   /**
@@ -625,6 +704,11 @@ export interface GcpProviderConfig {
    * Workload Identity Federation provider ID
    */
   workload_identity_federation_provider_id: string;
+
+  /**
+   * Optional GCP service account email to impersonate
+   */
+  service_account_email?: string;
 }
 
 /**
@@ -1025,7 +1109,7 @@ export interface AgentRunParams {
 
   /**
    * The prompt/instruction for the agent to execute. Required unless a skill is
-   * specified via the skill field or config.skill_spec.
+   * specified via the skill field, config.skill_spec, or config.skills.
    */
   prompt?: string;