openvibe-sdk 0.157.0: openvibe-sdk/agents: See it work — desks, takeOver, handBack and replay (#236)

ddiff --git a/CHANGELOG.md b/CHANGELOG.md
iindex c50f91e..b2bf629 100644
---- a/CHANGELOG.md
++++ b/CHANGELOG.md
@@@ -1,5 +1,13 @@
  # Changelog
  
++## 0.157.0 — 2026-11-12
++
++See it work: a run's desks, control and replay
++
++- Add to `openvibe-sdk/agents`: `desks(run)` → the run's desks with their view and still, `takeOver(run, desk)`,
++  `handBack(run, desk, note)` and `replay(run)` → the steps with the still each saw. They call the same-named routes
++  under the client's service (`/api/v1/runs/:id/desks/...`), so a page and a script make the same calls. No tag: the
++  main session releases this after the sites' stage lands.
  ## 0.156.0 — 2026-11-12
  
  - **`openvibe-sdk/exchange`: reviewed compute prices, keyless.**
ddiff --git a/README.md b/README.md
iindex 4285dc4..dc0e2c8 100644
---- a/README.md
++++ b/README.md
@@@ -8,12 +8,12 @@
  **Install and test:** `npm ci && npm test` (Node 20 or newer)
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.156.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.157.0
  ```
  
  > Supported browser and server clients for the OpenVibe platform.
  
--**Status:** alpha, v0.156.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
++**Status:** alpha, v0.157.0 (the five 1.0 core entries — `core`, `auth`, `events`, `db` and `media` — are frozen: their exported names change only with a major release; roadmap Wave 2; developer apps from Wave 20; Media objects v2 from Wave 4; the Tools platform API; Search, Chat, AI, Vision and consent clients; sign-in with recovery and a client health check). Every release is tagged (see [CHANGELOG.md](CHANGELOG.md)). Tested against local stub servers and the built-in mock platform only, never against the live platform. Services pin release tags; each repository's `STATUS.json` names the one it uses.
  **Plan:** OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), §3.2; roadmap §30.  
  **License:** MIT ([LICENSE](LICENSE)). This package is a library that apps outside the network embed, so it uses MIT. The OpenVibe services themselves stay AGPL-3.0.
  
@@@ -22,7 +22,7 @@ npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags
  After v0.97.1 is tagged:
  
  ```bash
--npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.156.0
++npm install https://codeload.github.com/OpenVibers/OpenVibe.SDK/tar.gz/refs/tags/v0.157.0
  ```
  
  It has no runtime dependencies. It needs Node ≥ 20, or any browser with `fetch`, Web Crypto and `TextDecoder`. There is no build step. The package is CommonJS with ESM entry points (`import` works). Each subpath has its own `.d.ts`. For a page with no bundler, `browser/openvibe-sdk.mjs` is one self-contained ES module of the browser-safe subpaths (see [Browser without a bundler](#browser-without-a-bundler)). It does not depend on `openvibe-contracts` at runtime: it copies the contract types it uses (from the temporary Contracts sharing branch, a devDependency the tests check them against).
ddiff --git a/STATUS.json b/STATUS.json
iindex ec4749d..5fab03f 100644
---- a/STATUS.json
++++ b/STATUS.json
@@@ -3,7 +3,7 @@
    "stage": "alpha",
    "code": true,
    "wave": "W2",
--  "version": "0.156.0",
++  "version": "0.157.0",
    "plan": "OpenVibe End-to-End Realignment & Implementation Plan, revision 3 (20 Sep 2026), \u00a73.2; roadmap \u00a730",
    "deployed": false,
    "deployment": "none: a package released as git tags; services and apps pin a tag",
ddiff --git a/browser/openvibe-sdk.mjs b/browser/openvibe-sdk.mjs
iindex 8bff064..014e2c2 100644
---- a/browser/openvibe-sdk.mjs
++++ b/browser/openvibe-sdk.mjs
@@@ -1,4 +1,4 @@
--// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.156.0, MIT). Do not edit.
++// Generated by scripts/browser-bundle.js from browser.js (openvibe-sdk 0.157.0, MIT). Do not edit.
  // One self-contained ES module: core at the top level plus the browser-safe subpaths as namespaces
  // (auth, locker, registry, trust, levels, modules, realtime, media, composer, cam, mediaUpload, ui, uiLayout, community, homeFeed, feed, bot, search, bench, meme, vision, themes, elements, design, redact, chat, ai, credentials, jobs, agents, frame, tools, projects, geo, history, userCard, player, agentSheet). No server-only code: no service tokens, JWT verification, events, identity.
  /* eslint-disable */
@@@ -67,7 +67,7 @@ const { paginate, offsetPager } = __load(7);
  const semver = __load(6);
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.156.0';
++const SDK_VERSION = '0.157.0';
  
  module.exports = {
      createClient,
@@@ -6680,6 +6680,15 @@ const pause = (ms, signal) => new Promise((resolve) => {
  });
  function createAgentsClient(client, { baseUrl, service = 'network', audience = 'openvibe.network' } = {}) {
      const call = (opts) => client.request({ service, baseUrl, audience, ...opts });
++    const runId = (run) => {
++        const id = typeof run === 'string' ? run : run && run.id;
++        if (!id) throw new TypeError('agents: a run (or its id) is required');
++        return enc(id);
++    };
++    const deskId = (desk) => {
++        if (typeof desk !== 'string' || !desk) throw new TypeError('agents: a desk id is required');
++        return enc(desk);
++    };
      async function run(id, { signal } = {}) {
          if (!id) throw new TypeError('agents.run: id is required');
          try { return (await call({ path: `/api/v1/runs/${enc(id)}`, signal })).data; }
@@@ -6718,7 +6727,26 @@ function createAgentsClient(client, { baseUrl, service = 'network', audience = '
              await pause(waitMs, signal);
          }
      }
--    return { run, events, post };
++    /**
++     * See it work (W1): the desks a run may show, the person's control of one, and the finished run's replay. The
++     * shapes match Actor's own until these routes are released here: desks → [{ desk, view, still }], replay → the
++     * steps with their stills. A run is an id or an object with an id.
++     */
++    async function desks(run, { signal } = {}) {
++        return (await call({ path: `/api/v1/runs/${runId(run)}/desks`, signal })).data;
++    }
++    async function takeOver(run, desk, { signal } = {}) {
++        return (await call({ method: 'POST', path: `/api/v1/runs/${runId(run)}/desks/${deskId(desk)}/take-over`, signal })).data;
++    }
++    async function handBack(run, desk, note = '', { signal } = {}) {
++        if (note != null && typeof note !== 'string') throw new TypeError('agents.handBack: note is a string');
++        return (await call({ method: 'POST', path: `/api/v1/runs/${runId(run)}/desks/${deskId(desk)}/hand-back`, json: { note: String(note || '').slice(0, 1000) }, signal })).data;
++    }
++    async function replay(run, { signal } = {}) {
++        return (await call({ path: `/api/v1/runs/${runId(run)}/replay`, signal })).data;
++    }
++
++    return { run, events, post, desks, takeOver, handBack, replay };
  }
  module.exports = { createAgentsClient };
  },
ddiff --git a/package-lock.json b/package-lock.json
iindex 6604f56..2d1a5c1 100644
---- a/package-lock.json
++++ b/package-lock.json
@@@ -1,12 +1,12 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.156.0",
++  "version": "0.157.0",
    "lockfileVersion": 3,
    "requires": true,
    "packages": {
      "": {
        "name": "openvibe-sdk",
--      "version": "0.156.0",
++      "version": "0.157.0",
        "license": "MIT",
        "bin": {
          "openvibe-download": "bin/openvibe-download.js"
ddiff --git a/package.json b/package.json
iindex d3e6612..d0458b6 100644
---- a/package.json
++++ b/package.json
@@@ -1,6 +1,6 @@
  {
    "name": "openvibe-sdk",
--  "version": "0.156.0",
++  "version": "0.157.0",
    "description": "Supported browser and server clients for the OpenVibe platform: auth (incl. developer apps), registry discovery, identity, user modules, events, realtime, media, community, Bot robots, search, chat, AI runs, Tools (registry, run API and jobs), VIP memberships and developer projects, the async PostgreSQL data layer (db) and the Valkey cache, limits store, queue and pub/sub, with deadlines, safe retries, problem errors and trace propagation.",
    "main": "index.js",
    "types": "types/index.d.ts",
ddiff --git a/src/agents.js b/src/agents.js
iindex 98821f1..c3905db 100644
---- a/src/agents.js
++++ b/src/agents.js
@@@ -9,6 +9,15 @@ const pause = (ms, signal) => new Promise((resolve) => {
  });
  function createAgentsClient(client, { baseUrl, service = 'network', audience = 'openvibe.network' } = {}) {
      const call = (opts) => client.request({ service, baseUrl, audience, ...opts });
++    const runId = (run) => {
++        const id = typeof run === 'string' ? run : run && run.id;
++        if (!id) throw new TypeError('agents: a run (or its id) is required');
++        return enc(id);
++    };
++    const deskId = (desk) => {
++        if (typeof desk !== 'string' || !desk) throw new TypeError('agents: a desk id is required');
++        return enc(desk);
++    };
      async function run(id, { signal } = {}) {
          if (!id) throw new TypeError('agents.run: id is required');
          try { return (await call({ path: `/api/v1/runs/${enc(id)}`, signal })).data; }
@@@ -47,6 +56,25 @@ function createAgentsClient(client, { baseUrl, service = 'network', audience = '
              await pause(waitMs, signal);
          }
      }
--    return { run, events, post };
++    /**
++     * See it work (W1): the desks a run may show, the person's control of one, and the finished run's replay. The
++     * shapes match Actor's own until these routes are released here: desks → [{ desk, view, still }], replay → the
++     * steps with their stills. A run is an id or an object with an id.
++     */
++    async function desks(run, { signal } = {}) {
++        return (await call({ path: `/api/v1/runs/${runId(run)}/desks`, signal })).data;
++    }
++    async function takeOver(run, desk, { signal } = {}) {
++        return (await call({ method: 'POST', path: `/api/v1/runs/${runId(run)}/desks/${deskId(desk)}/take-over`, signal })).data;
++    }
++    async function handBack(run, desk, note = '', { signal } = {}) {
++        if (note != null && typeof note !== 'string') throw new TypeError('agents.handBack: note is a string');
++        return (await call({ method: 'POST', path: `/api/v1/runs/${runId(run)}/desks/${deskId(desk)}/hand-back`, json: { note: String(note || '').slice(0, 1000) }, signal })).data;
++    }
++    async function replay(run, { signal } = {}) {
++        return (await call({ path: `/api/v1/runs/${runId(run)}/replay`, signal })).data;
++    }
++
++    return { run, events, post, desks, takeOver, handBack, replay };
  }
  module.exports = { createAgentsClient };
ddiff --git a/src/core/index.js b/src/core/index.js
iindex 44d05aa..f37b8d2 100644
---- a/src/core/index.js
++++ b/src/core/index.js
@@@ -8,7 +8,7 @@ const { paginate, offsetPager } = require('./paginate');
  const semver = require('./semver');
  
  /** The package version (test/version.test.js keeps it equal to package.json). */
--const SDK_VERSION = '0.156.0';
++const SDK_VERSION = '0.157.0';
  
  module.exports = {
      createClient,
ddiff --git a/test/agents.test.js b/test/agents.test.js
iindex 432258f..46ef361 100644
---- a/test/agents.test.js
++++ b/test/agents.test.js
@@@ -16,6 +16,33 @@ run([
       assert.deepEqual(got,[['5','STEP_STARTED'],['6','RUN_FINISHED']]); assert.equal(srv.requests[3].headers['last-event-id'],'5');
     } finally { await srv.close(); }
   }],
++ ['See it work: desks, take over, hand back and replay are the SDK\'s own calls', async () => {
++   const seen = [];
++   const srv = await stubServer((req, res, raw) => {
++     const body = raw && raw.length ? JSON.parse(raw.toString()) : null;
++     seen.push({ method: req.method, url: req.url, body });
++     if (req.url.endsWith('/desks')) return send(res, 200, { desks: [{ desk: { id: 'desk-a' }, view: null, still: '/still' }] });
++     if (req.url.endsWith('/take-over')) return send(res, 200, { control: true });
++     if (req.url.endsWith('/hand-back')) return send(res, 200, { control: false });
++     if (req.url.endsWith('/replay')) return send(res, 200, { steps: [{ seq: 3, action: 'click' }] });
++     return send(res, 200, {});
++   });
++   try {
++     const agents = createAgentsClient(createClient({ baseUrls: { network: srv.url }, token: 't' }));
++     assert.deepEqual(await agents.desks('run_a'), { desks: [{ desk: { id: 'desk-a' }, view: null, still: '/still' }] });
++     assert.deepEqual(await agents.takeOver({ id: 'run_a' }, 'desk-a'), { control: true });
++     assert.deepEqual(await agents.handBack('run_a', 'desk-a', 'signed in, carry on'), { control: false });
++     assert.deepEqual(await agents.replay('run_a'), { steps: [{ seq: 3, action: 'click' }] });
++     assert.deepEqual(seen.map((x) => `${x.method} ${x.url}`), [
++       'GET /api/v1/runs/run_a/desks',
++       'POST /api/v1/runs/run_a/desks/desk-a/take-over',
++       'POST /api/v1/runs/run_a/desks/desk-a/hand-back',
++       'GET /api/v1/runs/run_a/replay',
++     ]);
++     assert.deepEqual(seen[2].body, { note: 'signed in, carry on' });
++     await assert.rejects(agents.takeOver('run_a', ''), /desk id/);
++   } finally { await srv.close(); }
++ }],
   ['reconnect retries use exponential backoff', async () => {
     let calls=0; const srv=await stubServer((req,res)=>{ calls++; if(calls<4) return send(res,503,{code:'temporarily.unavailable'}); res.writeHead(200,{'Content-Type':'text/event-stream'}); res.end(`id: 1\nevent: RUN_FINISHED\ndata: ${JSON.stringify({type:'RUN_FINISHED',timestamp:1794355200000})}\n\n`); });
     try { const agents=createAgentsClient(createClient({baseUrls:{network:srv.url},token:'t'})); const start=Date.now(); const got=[]; for await(const e of agents.events('run_a',{reconnectDelayMs:10,maxReconnects:5})) got.push(e.id); assert.deepEqual(got,['1']); assert.ok(Date.now()-start>=65,`backoff elapsed ${Date.now()-start}ms`); assert.equal(calls,4); }