[anycodes]

Description

Applications can now discover and invoke Python SandboxServer registered functions through the Node HTTP client. Business argument objects stay separate from request options, so fields such as timeout, name and arguments are preserved. The existing bound URL/query and separate gateway/application authentication apply to these methods.

Closes #23. Shared schema dependency: Alibaba-Agent-Sandbox/python-sdk#152 .

Changes

• Export ServerCommandsApi, metadata types and commands.list()/invoke(). Validate the command envelope and preserve server error status without replay.
• Keep cancellation active through response-body consumption; round fractional seconds safely and reject unsupported timer ranges before I/O.
• Synchronize the Python-owned STS configuration export and pin its exact source in CI.
• Update both language guides, README usage, CHANGELOG and engineering evidence.

Validation

• Typecheck and all 36 tests pass, including an actual local Python server with conflicting business parameter names.
• Existing local runtime example and npm package-content check pass.
• Independent review completed; its fractional-timeout finding has a passing regression.
• Latest-head Node20/22 remote matrix passed: run 41995502952.
• Shared contract dependency Python #153 merged before this consumer.

This package remains an application HTTP client. No cloud lifecycle SDK or package publication is introduced. Evidence: .agents/evidence/verify/2026-11-05-application-command-invocation.md.

Independent final review reran typecheck, all 36 tests with the matching actual Python runtime, and the local runtime example successfully. The initial run without the Python runtime failed three prerequisite-dependent cases and was retained separately; no product assertions were changed.