feat(api): add ExecutableDenyList to environment and organization policy

stainless-app[bot] · stainless-app[bot] · commit 110c2efc4f4d · 2026-02-11T13:04:13.000Z
diff --git a/.stats.yml b/.stats.yml
@@ -1,4 +1,4 @@
 configured_endpoints: 172
-openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/gitpod%2Fgitpod-51659fa76fd9f1e88225f9cf97af0e2ebf5a675728618460693d7456c281f9a7.yml
-openapi_spec_hash: 84d0520cf93175c6993b93c8d3be2677
-config_hash: 2b9740817f5ef36649d603ece3a30906
+openapi_spec_url: https://storage.googleapis.com/stainless-sdk-openapi-specs/gitpod%2Fgitpod-912e6f9f02b4b4e145bd8c12e8ea65422246fb626abedb150c9791065d9407c1.yml
+openapi_spec_hash: e1ffa39323c616de827752550560ee7c
+config_hash: 1666c4673215d2af73eb14329610e026
diff --git a/api.md b/api.md
@@ -121,6 +121,8 @@ from gitpod.types import (
     EnvironmentRole,
     EnvironmentSpec,
     EnvironmentStatus,
+    KernelControlsConfig,
+    Veto,
     EnvironmentCreateResponse,
     EnvironmentRetrieveResponse,
     EnvironmentCreateEnvironmentTokenResponse,
@@ -452,6 +454,7 @@ Types:
 from gitpod.types.organizations import (
     AgentPolicy,
     CrowdStrikeConfig,
+    ExecutableDenyList,
     OrganizationPolicies,
     SecurityAgentPolicy,
     PolicyRetrieveResponse,
diff --git a/src/gitpod/resources/organizations/policies.py b/src/gitpod/resources/organizations/policies.py
@@ -19,6 +19,7 @@
 from ..._base_client import make_request_options
 from ...types.organizations import policy_update_params, policy_retrieve_params
 from ...types.organizations.policy_retrieve_response import PolicyRetrieveResponse
+from ...types.organizations.executable_deny_list_param import ExecutableDenyListParam
 
 __all__ = ["PoliciesResource", "AsyncPoliciesResource"]
 
@@ -104,6 +105,7 @@ def update(
         default_environment_image: Optional[str] | Omit = omit,
         delete_archived_environments_after: Optional[str] | Omit = omit,
         editor_version_restrictions: Dict[str, policy_update_params.EditorVersionRestrictions] | Omit = omit,
+        executable_deny_list: Optional[ExecutableDenyListParam] | Omit = omit,
         maximum_environment_lifetime: Optional[str] | Omit = omit,
         maximum_environments_per_user: Optional[str] | Omit = omit,
         maximum_environment_timeout: Optional[str] | Omit = omit,
@@ -180,6 +182,9 @@ def update(
           editor_version_restrictions: editor_version_restrictions restricts which editor versions can be used. Maps
               editor ID to version policy with allowed major versions.
 
+          executable_deny_list: executable_deny_list contains executables that are blocked from execution in
+              environments.
+
           maximum_environment_lifetime: maximum_environment_lifetime controls for how long environments are allowed to
               be reused. 0 means no maximum lifetime. Maximum duration is 180 days (15552000
               seconds).
@@ -231,6 +236,7 @@ def update(
                     "default_environment_image": default_environment_image,
                     "delete_archived_environments_after": delete_archived_environments_after,
                     "editor_version_restrictions": editor_version_restrictions,
+                    "executable_deny_list": executable_deny_list,
                     "maximum_environment_lifetime": maximum_environment_lifetime,
                     "maximum_environments_per_user": maximum_environments_per_user,
                     "maximum_environment_timeout": maximum_environment_timeout,
@@ -334,6 +340,7 @@ async def update(
         default_environment_image: Optional[str] | Omit = omit,
         delete_archived_environments_after: Optional[str] | Omit = omit,
         editor_version_restrictions: Dict[str, policy_update_params.EditorVersionRestrictions] | Omit = omit,
+        executable_deny_list: Optional[ExecutableDenyListParam] | Omit = omit,
         maximum_environment_lifetime: Optional[str] | Omit = omit,
         maximum_environments_per_user: Optional[str] | Omit = omit,
         maximum_environment_timeout: Optional[str] | Omit = omit,
@@ -410,6 +417,9 @@ async def update(
           editor_version_restrictions: editor_version_restrictions restricts which editor versions can be used. Maps
               editor ID to version policy with allowed major versions.
 
+          executable_deny_list: executable_deny_list contains executables that are blocked from execution in
+              environments.
+
           maximum_environment_lifetime: maximum_environment_lifetime controls for how long environments are allowed to
               be reused. 0 means no maximum lifetime. Maximum duration is 180 days (15552000
               seconds).
@@ -461,6 +471,7 @@ async def update(
                     "default_environment_image": default_environment_image,
                     "delete_archived_environments_after": delete_archived_environments_after,
                     "editor_version_restrictions": editor_version_restrictions,
+                    "executable_deny_list": executable_deny_list,
                     "maximum_environment_lifetime": maximum_environment_lifetime,
                     "maximum_environments_per_user": maximum_environments_per_user,
                     "maximum_environment_timeout": maximum_environment_timeout,
diff --git a/src/gitpod/types/__init__.py b/src/gitpod/types/__init__.py
@@ -3,6 +3,7 @@
 from __future__ import annotations
 
 from .user import User as User
+from .veto import Veto as Veto
 from .group import Group as Group
 from .editor import Editor as Editor
 from .prompt import Prompt as Prompt
@@ -41,6 +42,7 @@
 from .prebuild import Prebuild as Prebuild
 from .log_level import LogLevel as LogLevel
 from .agent_mode import AgentMode as AgentMode
+from .veto_param import VetoParam as VetoParam
 from .environment import Environment as Environment
 from .error_level import ErrorLevel as ErrorLevel
 from .prompt_spec import PromptSpec as PromptSpec
@@ -120,6 +122,7 @@
 from .project_update_params import ProjectUpdateParams as ProjectUpdateParams
 from .editor_retrieve_params import EditorRetrieveParams as EditorRetrieveParams
 from .environment_spec_param import EnvironmentSpecParam as EnvironmentSpecParam
+from .kernel_controls_config import KernelControlsConfig as KernelControlsConfig
 from .prebuild_cancel_params import PrebuildCancelParams as PrebuildCancelParams
 from .prebuild_create_params import PrebuildCreateParams as PrebuildCreateParams
 from .prebuild_delete_params import PrebuildDeleteParams as PrebuildDeleteParams
@@ -184,6 +187,7 @@
 from .agent_update_prompt_response import AgentUpdatePromptResponse as AgentUpdatePromptResponse
 from .environment_unarchive_params import EnvironmentUnarchiveParams as EnvironmentUnarchiveParams
 from .identity_get_id_token_params import IdentityGetIDTokenParams as IdentityGetIDTokenParams
+from .kernel_controls_config_param import KernelControlsConfigParam as KernelControlsConfigParam
 from .organization_create_response import OrganizationCreateResponse as OrganizationCreateResponse
 from .organization_retrieve_params import OrganizationRetrieveParams as OrganizationRetrieveParams
 from .organization_set_role_params import OrganizationSetRoleParams as OrganizationSetRoleParams
diff --git a/src/gitpod/types/environment_spec.py b/src/gitpod/types/environment_spec.py
@@ -8,6 +8,7 @@
 from .._models import BaseModel
 from .admission_level import AdmissionLevel
 from .environment_phase import EnvironmentPhase
+from .kernel_controls_config import KernelControlsConfig
 from .environment_initializer import EnvironmentInitializer
 from .shared.automation_trigger import AutomationTrigger
 
@@ -209,6 +210,9 @@ class EnvironmentSpec(BaseModel):
     devcontainer: Optional[Devcontainer] = None
     """devcontainer is the devcontainer spec of the environment"""
 
+    kernel_controls_config: Optional[KernelControlsConfig] = FieldInfo(alias="kernelControlsConfig", default=None)
+    """kernel_controls_config configures kernel-level controls for this environment"""
+
     machine: Optional[Machine] = None
     """machine is the machine spec of the environment"""
 
diff --git a/src/gitpod/types/environment_spec_param.py b/src/gitpod/types/environment_spec_param.py
@@ -8,6 +8,7 @@
 from .._utils import PropertyInfo
 from .admission_level import AdmissionLevel
 from .environment_phase import EnvironmentPhase
+from .kernel_controls_config_param import KernelControlsConfigParam
 from .environment_initializer_param import EnvironmentInitializerParam
 from .shared_params.automation_trigger import AutomationTrigger
 
@@ -216,6 +217,9 @@ class EnvironmentSpecParam(TypedDict, total=False):
     devcontainer: Devcontainer
     """devcontainer is the devcontainer spec of the environment"""
 
+    kernel_controls_config: Annotated[KernelControlsConfigParam, PropertyInfo(alias="kernelControlsConfig")]
+    """kernel_controls_config configures kernel-level controls for this environment"""
+
     machine: Machine
     """machine is the machine spec of the environment"""
 
diff --git a/src/gitpod/types/environment_update_params.py b/src/gitpod/types/environment_update_params.py
@@ -7,6 +7,7 @@
 
 from .._utils import PropertyInfo
 from .admission_level import AdmissionLevel
+from .kernel_controls_config_param import KernelControlsConfigParam
 from .environment_initializer_param import EnvironmentInitializerParam
 
 __all__ = [
@@ -132,6 +133,9 @@ class Spec(TypedDict, total=False):
 
     devcontainer: Optional[SpecDevcontainer]
 
+    kernel_controls_config: Annotated[Optional[KernelControlsConfigParam], PropertyInfo(alias="kernelControlsConfig")]
+    """kernel_controls_config configures kernel-level controls for this environment"""
+
     ports: Iterable[SpecPort]
     """ports controls port sharing"""
 
diff --git a/src/gitpod/types/kernel_controls_config.py b/src/gitpod/types/kernel_controls_config.py
@@ -0,0 +1,15 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing import Optional
+
+from .veto import Veto
+from .._models import BaseModel
+
+__all__ = ["KernelControlsConfig"]
+
+
+class KernelControlsConfig(BaseModel):
+    """KernelControlsConfig configures kernel-level controls for the environment"""
+
+    veto: Optional[Veto] = None
+    """veto controls blocking mechanisms"""
diff --git a/src/gitpod/types/kernel_controls_config_param.py b/src/gitpod/types/kernel_controls_config_param.py
@@ -0,0 +1,16 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import TypedDict
+
+from .veto_param import VetoParam
+
+__all__ = ["KernelControlsConfigParam"]
+
+
+class KernelControlsConfigParam(TypedDict, total=False):
+    """KernelControlsConfig configures kernel-level controls for the environment"""
+
+    veto: VetoParam
+    """veto controls blocking mechanisms"""
diff --git a/src/gitpod/types/organizations/__init__.py b/src/gitpod/types/organizations/__init__.py
@@ -11,6 +11,7 @@
 from .crowd_strike_config import CrowdStrikeConfig as CrowdStrikeConfig
 from .domain_verification import DomainVerification as DomainVerification
 from .organization_invite import OrganizationInvite as OrganizationInvite
+from .executable_deny_list import ExecutableDenyList as ExecutableDenyList
 from .invite_create_params import InviteCreateParams as InviteCreateParams
 from .policy_update_params import PolicyUpdateParams as PolicyUpdateParams
 from .organization_policies import OrganizationPolicies as OrganizationPolicies
@@ -24,6 +25,7 @@
 from .policy_retrieve_response import PolicyRetrieveResponse as PolicyRetrieveResponse
 from .domain_verification_state import DomainVerificationState as DomainVerificationState
 from .invite_get_summary_params import InviteGetSummaryParams as InviteGetSummaryParams
+from .executable_deny_list_param import ExecutableDenyListParam as ExecutableDenyListParam
 from .custom_domain_create_params import CustomDomainCreateParams as CustomDomainCreateParams
 from .custom_domain_delete_params import CustomDomainDeleteParams as CustomDomainDeleteParams
 from .custom_domain_update_params import CustomDomainUpdateParams as CustomDomainUpdateParams
diff --git a/src/gitpod/types/organizations/executable_deny_list.py b/src/gitpod/types/organizations/executable_deny_list.py
@@ -0,0 +1,19 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing import List, Optional
+
+from ..._models import BaseModel
+
+__all__ = ["ExecutableDenyList"]
+
+
+class ExecutableDenyList(BaseModel):
+    """
+    ExecutableDenyList contains executables that are blocked from execution in environments.
+    """
+
+    enabled: Optional[bool] = None
+    """enabled controls whether executable blocking is active"""
+
+    executables: Optional[List[str]] = None
+    """executables is the list of executable paths or names to block"""
diff --git a/src/gitpod/types/organizations/executable_deny_list_param.py b/src/gitpod/types/organizations/executable_deny_list_param.py
@@ -0,0 +1,21 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import TypedDict
+
+from ..._types import SequenceNotStr
+
+__all__ = ["ExecutableDenyListParam"]
+
+
+class ExecutableDenyListParam(TypedDict, total=False):
+    """
+    ExecutableDenyList contains executables that are blocked from execution in environments.
+    """
+
+    enabled: bool
+    """enabled controls whether executable blocking is active"""
+
+    executables: SequenceNotStr[str]
+    """executables is the list of executable paths or names to block"""
diff --git a/src/gitpod/types/organizations/organization_policies.py b/src/gitpod/types/organizations/organization_policies.py
@@ -6,6 +6,7 @@
 
 from ..._models import BaseModel
 from .agent_policy import AgentPolicy
+from .executable_deny_list import ExecutableDenyList
 from .security_agent_policy import SecurityAgentPolicy
 
 __all__ = ["OrganizationPolicies", "EditorVersionRestrictions"]
@@ -111,6 +112,12 @@ class OrganizationPolicies(BaseModel):
     of the editor
     """
 
+    executable_deny_list: Optional[ExecutableDenyList] = FieldInfo(alias="executableDenyList", default=None)
+    """
+    executable_deny_list contains executables that are blocked from execution in
+    environments.
+    """
+
     maximum_environment_lifetime: Optional[str] = FieldInfo(alias="maximumEnvironmentLifetime", default=None)
     """
     maximum_environment_lifetime controls for how long environments are allowed to
diff --git a/src/gitpod/types/organizations/policy_update_params.py b/src/gitpod/types/organizations/policy_update_params.py
@@ -7,6 +7,7 @@
 
 from ..._types import SequenceNotStr
 from ..._utils import PropertyInfo
+from .executable_deny_list_param import ExecutableDenyListParam
 
 __all__ = [
     "PolicyUpdateParams",
@@ -63,6 +64,12 @@ class PolicyUpdateParams(TypedDict, total=False):
     editor ID to version policy with allowed major versions.
     """
 
+    executable_deny_list: Annotated[Optional[ExecutableDenyListParam], PropertyInfo(alias="executableDenyList")]
+    """
+    executable_deny_list contains executables that are blocked from execution in
+    environments.
+    """
+
     maximum_environment_lifetime: Annotated[Optional[str], PropertyInfo(alias="maximumEnvironmentLifetime")]
     """
     maximum_environment_lifetime controls for how long environments are allowed to
diff --git a/src/gitpod/types/veto.py b/src/gitpod/types/veto.py
@@ -0,0 +1,24 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from typing import List, Optional
+
+from .._models import BaseModel
+
+__all__ = ["Veto", "Exec"]
+
+
+class Exec(BaseModel):
+    """exec controls executable blocking"""
+
+    denylist: Optional[List[str]] = None
+    """denylist is the list of executable paths or names to block"""
+
+    enabled: Optional[bool] = None
+    """enabled controls whether executable blocking is active"""
+
+
+class Veto(BaseModel):
+    """Veto controls kernel-level blocking mechanisms"""
+
+    exec: Optional[Exec] = None
+    """exec controls executable blocking"""
diff --git a/src/gitpod/types/veto_param.py b/src/gitpod/types/veto_param.py
@@ -0,0 +1,26 @@
+# File generated from our OpenAPI spec by Stainless. See CONTRIBUTING.md for details.
+
+from __future__ import annotations
+
+from typing_extensions import TypedDict
+
+from .._types import SequenceNotStr
+
+__all__ = ["VetoParam", "Exec"]
+
+
+class Exec(TypedDict, total=False):
+    """exec controls executable blocking"""
+
+    denylist: SequenceNotStr[str]
+    """denylist is the list of executable paths or names to block"""
+
+    enabled: bool
+    """enabled controls whether executable blocking is active"""
+
+
+class VetoParam(TypedDict, total=False):
+    """Veto controls kernel-level blocking mechanisms"""
+
+    exec: Exec
+    """exec controls executable blocking"""
diff --git a/tests/api_resources/organizations/test_policies.py b/tests/api_resources/organizations/test_policies.py
@@ -9,7 +9,9 @@
 
 from gitpod import Gitpod, AsyncGitpod
 from tests.utils import assert_matches_type
-from gitpod.types.organizations import PolicyRetrieveResponse
+from gitpod.types.organizations import (
+    PolicyRetrieveResponse,
+)
 
 base_url = os.environ.get("TEST_API_BASE_URL", "http://127.0.0.1:4010")
 
@@ -76,6 +78,10 @@ def test_method_update_with_all_params(self, client: Gitpod) -> None:
             default_environment_image="defaultEnvironmentImage",
             delete_archived_environments_after="+9125115.360s",
             editor_version_restrictions={"foo": {"allowed_versions": ["string"]}},
+            executable_deny_list={
+                "enabled": True,
+                "executables": ["string"],
+            },
             maximum_environment_lifetime="+9125115.360s",
             maximum_environments_per_user="20",
             maximum_environment_timeout="3600s",
@@ -188,6 +194,10 @@ async def test_method_update_with_all_params(self, async_client: AsyncGitpod) ->
             default_environment_image="defaultEnvironmentImage",
             delete_archived_environments_after="+9125115.360s",
             editor_version_restrictions={"foo": {"allowed_versions": ["string"]}},
+            executable_deny_list={
+                "enabled": True,
+                "executables": ["string"],
+            },
             maximum_environment_lifetime="+9125115.360s",
             maximum_environments_per_user="20",
             maximum_environment_timeout="3600s",
diff --git a/tests/api_resources/test_environments.py b/tests/api_resources/test_environments.py
