mainsequence 6.0.37__tar.gz → 6.0.38__tar.gz

{mainsequence-6.0.37 → mainsequence-6.0.38}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 6.0.37
+Version: 6.0.38
 Summary: Main Sequence SDK 
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: LicenseRef-MainSequence-Proprietary

{mainsequence-6.0.37 → mainsequence-6.0.38}/agent_scaffold/skills/maintenance/project-maintenance/SKILL.md

@@ -192,6 +192,12 @@ a detached checkout and rejects a Git branch that is not registered under the
 logical Project. Do not bypass that validation or supply a ProjectBranch UID
 manually. Register or select the correct Git branch first.
 
+After that branch preflight, `--dry-run` resolves the existing `uv` executable,
+previews its patch version without mutation, requests the backend-owned tag for
+that future version, rejects an invalid or existing local tag, prints the
+complete plan, and returns without generating an SSH key, querying private
+remote refs, changing dependencies or project files, or mutating Git state.
+
 After review:
 
 ```bash
@@ -200,13 +206,20 @@ mainsequence project sync --path . -m "<specific commit message>"
 
 The canonical command always:
 
-1. applies a patch version bump;
-2. runs `uv lock`;
-3. runs `uv sync`;
-4. exports locked production requirements;
-5. stages and commits the changes;
-6. creates an annotated `v<version>` tag; and
-7. pushes the branch and tag with `--follow-tags`.
+1. selects `mainsequence-<repository-slug>-<first-16-sha256>` from the normalized
+   `host[:non-default-port]/repository/path`, never from the repository basename alone and never
+   from a legacy basename-only key;
+2. previews the `uv` patch version, requests the backend-owned ProjectBranch tag, and rejects an
+   invalid or existing local tag;
+3. registers a new or inaccessible key through the owning Project and verifies a dry-run push with
+   that forced identity;
+4. queries the exact tag ref on `origin` and stops if it exists or cannot be checked;
+5. applies the patch version bump and verifies it matches the preview;
+6. runs `uv lock` and `uv sync`;
+7. exports locked production requirements;
+8. stages and commits the changes;
+9. creates the returned annotated tag unchanged; and
+10. atomically pushes the explicit branch and tag refs with `--follow-tags`.
 
 Do not offer alternate bump modes, a no-push mode, or a hand-written sequence
 of equivalent commands. Do not call `sync-after-commit` or any backend repair

{mainsequence-6.0.37 → mainsequence-6.0.38}/mainsequence/cli/cli.py

@@ -214,6 +214,7 @@ from .local_ops import (
     run_cmd,
     run_uv,
     uv_export_requirements,
+    uv_preview_patch_version,
     uv_project_version,
 )
 from .migrations import migrations as migrations_group
@@ -228,9 +229,16 @@ from .pydantic_cli import (
 from .sdk_utils import fetch_latest_sdk_version, normalize_version, read_local_sdk_version
 from .ssh_utils import (
     ensure_key_for_repo,
+    git_ssh_environment,
     open_folder,
     open_signed_terminal,
+    repository_ssh_key_paths,
+    require_ssh_git_origin,
     start_agent_and_add_key,
+    verify_git_push_access,
+    verify_git_remote_access,
+    verify_git_remote_tag_absent,
+    verify_git_tag_absent,
 )
 from .ui import error, info, print_kv, print_table, status, success, warn
 
@@ -674,6 +682,48 @@ def _resolve_project_repository_ssh_url(project: dict) -> str:
     return repository_ssh_url
 
 
+def _ensure_project_repository_ssh_access(
+    *,
+    origin: str,
+    project_ref: str | None,
+    verify_access,
+) -> tuple[pathlib.Path, str, dict[str, str]]:
+    expected_key_path, expected_public_key_path = repository_ssh_key_paths(origin)
+    keypair_existed = expected_key_path.is_file() and expected_public_key_path.is_file()
+    key_path, _public_key_path, public_key = ensure_key_for_repo(origin)
+    env = git_ssh_environment(key_path)
+
+    def register_key() -> None:
+        normalized_project_ref = str(project_ref or "").strip()
+        if not normalized_project_ref:
+            raise ApiError(
+                "The repository SSH key is not authorized and no MAIN_SEQUENCE_PROJECT_UID "
+                "is available for deploy-key registration."
+            )
+        key_title = str(platform.node() or "").strip()
+        if not key_title or "\n" in key_title or "\r" in key_title:
+            raise ApiError("Local hostname must contain one non-empty line.")
+        try:
+            add_deploy_key(normalized_project_ref, key_title, public_key)
+        except Exception as exc:
+            raise ApiError(f"Project deploy-key registration failed: {exc}") from exc
+
+    if not keypair_existed:
+        register_key()
+    else:
+        try:
+            verify_access(env)
+            return key_path, public_key, env
+        except RuntimeError:
+            register_key()
+
+    try:
+        verify_access(env)
+    except RuntimeError as exc:
+        raise ApiError(str(exc)) from exc
+    return key_path, public_key, env
+
+
 def _project_identity_value(project: dict) -> str:
     """Return the logical Project public UID."""
     return str(project.get("uid") or "").strip()
@@ -7461,7 +7511,7 @@ def project_create_cmd(
     project_name:
         Project name. If omitted, prompt is shown.
     project_type:
-        Project type used for the initial ProjectBranch.
+        Immutable type of the logical Project, shared by every ProjectBranch.
     default_metatables_data_source_uid:
         Required logical Project default MetaTables data source UID. It is
         assigned automatically to the initial main ProjectBranch.
@@ -9786,7 +9836,7 @@ def project_set_up_locally(
     Clone a project locally and provision runtime `.env`.
 
     Workflow:
-    - ensure an SSH key and optionally register it through the owning Project,
+    - ensure, register when needed, and verify a repository-specific SSH key,
     - clone repository into local projects root,
     - build local runtime auth/backend entries for the active auth mode,
     - write/update `.env` with local runtime values.
@@ -9853,24 +9903,24 @@ def project_set_up_locally(
     target_dir = projects_root / f"{name}-{project_uid}"
     projects_root.mkdir(parents=True, exist_ok=True)
 
-    key_path, _pub_path, pub = ensure_key_for_repo(repo)
-    copied = _copy_clipboard(pub)
+    if target_dir.exists():
+        warn(f"Target already exists: {target_dir}")
+        raise typer.Exit(2)
 
-    # Best-effort Project-owned deploy key (do not fail set-up-locally on this)
     try:
-        host = platform.node()
-        add_deploy_key(project_uid, host, pub)
-    except Exception as e:
-        warn(f"Could not add deploy key automatically (continuing): {e}")
+        key_path, pub, _git_env = _ensure_project_repository_ssh_access(
+            origin=repo,
+            project_ref=project_uid,
+            verify_access=lambda env: verify_git_remote_access(repo, env),
+        )
+    except (ApiError, RuntimeError, ValueError) as exc:
+        error(f"Repository SSH key setup failed: {exc}")
+        raise typer.Exit(1) from exc
 
+    copied = _copy_clipboard(pub)
     agent_env = start_agent_and_add_key(key_path)
 
-    if target_dir.exists():
-        warn(f"Target already exists: {target_dir}")
-        raise typer.Exit(2)
-
-    env = os.environ.copy() | agent_env
-    env["GIT_SSH_COMMAND"] = f'ssh -i "{str(key_path)}" -o IdentitiesOnly=yes'
+    env = git_ssh_environment(key_path, base_env=os.environ.copy() | agent_env)
 
     with status(f"Cloning repo into {target_dir}..."):
         rc = subprocess.call(
@@ -10033,7 +10083,16 @@ def project_open_signed_terminal(
 
     origin = git_origin(project_dir)
     name = repo_name_from_git_url(origin) or project_dir.name
-    key_path, _, _ = ensure_key_for_repo(origin)  # creates if missing
+    project_ref = str(project_id or _read_project_ref_from_env_file(project_dir) or "").strip()
+    try:
+        key_path, _public_key, _git_env = _ensure_project_repository_ssh_access(
+            origin=origin,
+            project_ref=project_ref or None,
+            verify_access=lambda env: verify_git_remote_access(origin, env),
+        )
+    except (ApiError, RuntimeError, ValueError) as exc:
+        error(f"Repository SSH key setup failed: {exc}")
+        raise typer.Exit(1) from exc
     open_signed_terminal(str(project_dir), key_path, name)
 
 
@@ -10300,18 +10359,23 @@ def project_sync(
     project_id: str | None = typer.Argument(None, help="Project UID"),
     path: str | None = typer.Option(None, "--path", help="Project directory"),
     message_opt: str | None = typer.Option(None, "--message", "-m", help="Git commit message"),
-    dry_run: bool = typer.Option(False, "--dry-run", help="Print steps but do not execute"),
+    dry_run: bool = typer.Option(
+        False,
+        "--dry-run",
+        help="Run read-only preflight and print steps without generating keys or changing the project",
+    ),
 ):
     """
     Run end-to-end sync workflow for project dependencies and git state.
 
     Workflow:
-    1. patch the package version via `uv version`,
-    2. request the backend-owned default tag for this ProjectBranch,
-    3. run `uv lock` + `uv sync`,
-    4. export locked `requirements.txt`,
-    5. commit the changes and create that annotated tag,
-    6. push the branch and tag with `--follow-tags`.
+    1. preview the patch version and backend-owned ProjectBranch tag,
+    2. reject local and remote collisions before mutating the project,
+    3. apply and verify the patch version via `uv version`,
+    4. run `uv lock` + `uv sync`,
+    5. export locked `requirements.txt`,
+    6. commit the changes and create that annotated tag,
+    7. atomically push the branch and tag.
 
     Parameters
     ----------
@@ -10322,7 +10386,8 @@ def project_sync(
     path:
         Explicit local path.
     dry_run:
-        Print plan without executing commands.
+        Run read-only preflight and print the plan without generating keys or
+        changing project files, dependencies, Git state, or backend state.
 
     Examples
     --------
@@ -10368,46 +10433,90 @@ def project_sync(
         f"Git branch {git_branch!r} to ProjectBranch {project_branch_uid}."
     )
 
-    ensure_venv(project_dir)
-
     origin = git_origin(project_dir)
     repo_name = repo_name_from_git_url(origin) or project_dir.name
-    key_path, _, _ = ensure_key_for_repo(origin)
+    try:
+        require_ssh_git_origin(origin)
+    except ValueError as exc:
+        error(f"Project sync preflight failed: {exc}")
+        raise typer.Exit(1) from exc
+
+    try:
+        ensure_venv(project_dir)
+        uv = ensure_uv_installed(project_dir)
+        current_version = uv_project_version(uv, cwd=project_dir)
+        next_version = uv_preview_patch_version(uv, cwd=project_dir)
+        tag = render_project_branch_default_redeployment_tag(
+            project_branch_uid,
+            version=next_version,
+        )
+        verify_git_tag_absent(project_dir, tag)
+    except (ApiError, RuntimeError) as exc:
+        error(f"Project sync tag preflight failed: {exc}")
+        raise typer.Exit(1) from exc
 
     steps = [
-        "resolve uv executable",
-        "uv version --bump patch",
+        "preview uv patch version",
         "request backend default redeployment tag",
+        "verify backend tag does not exist locally",
+        "ensure repository SSH key",
+        "register a new or inaccessible SSH key through the owning Project",
+        "git push --dry-run --follow-tags origin HEAD:refs/heads/<branch>",
+        "verify exact backend tag does not exist remotely",
+        "uv version --bump patch",
+        "verify bumped version matches the preflight version",
         "uv lock",
         "uv sync",
         "uv export (locked) -> requirements.txt",
         "git add -A",
         f'git commit -m "{safe_message}"',
         "git tag -a <backend tag> -m <backend tag>",
-        "git push --follow-tags",
+        "git push --atomic --follow-tags origin HEAD:refs/heads/<branch> refs/tags/<backend tag>:refs/tags/<backend tag>",
     ]
 
+    print_kv(
+        "Sync release",
+        [
+            ("Current version", current_version),
+            ("Next version", next_version),
+            ("Branch tag", tag),
+        ],
+    )
     print_table("Sync plan", ["Step"], [[s] for s in steps])
 
     if dry_run:
-        warn("Dry run: no commands executed.")
+        warn("Dry run: read-only preflight complete; no changes made.")
         return
 
-    env = os.environ.copy()
-    env["GIT_SSH_COMMAND"] = f'ssh -i "{str(key_path)}" -o IdentitiesOnly=yes'
+    try:
+        _key_path, _public_key, env = _ensure_project_repository_ssh_access(
+            origin=origin,
+            project_ref=project_ref,
+            verify_access=lambda ssh_env: verify_git_push_access(
+                project_dir,
+                git_branch,
+                ssh_env,
+            ),
+        )
+    except (ApiError, RuntimeError, ValueError) as exc:
+        error(f"Project sync SSH preflight failed: {exc}")
+        raise typer.Exit(1) from exc
+
+    try:
+        verify_git_remote_tag_absent(project_dir, tag, env)
+    except RuntimeError as exc:
+        error(f"Project sync remote tag preflight failed: {exc}")
+        raise typer.Exit(1) from exc
 
-    uv = ensure_uv_installed(project_dir)
     with status("Running uv + git sync steps..."):
         run_uv(uv, ["version", "--bump", "patch"], cwd=project_dir, env=env)
         version = uv_project_version(uv, cwd=project_dir, env=env)
-        try:
-            tag = render_project_branch_default_redeployment_tag(
-                project_branch_uid,
-                version=version,
+        if version != next_version:
+            error(
+                f"Project sync version verification failed: uv produced {version}; "
+                f"preflight expected {next_version}."
             )
-        except ApiError as exc:
-            error(f"Project sync tag resolution failed: {exc}")
-            raise typer.Exit(1) from exc
+            raise typer.Exit(1)
         run_uv(uv, ["lock"], cwd=project_dir, env=env)
         run_uv(uv, ["sync"], cwd=project_dir, env=env)
         # `uv sync` can prune ad hoc packages from `.venv`, including a `uv`
@@ -10425,7 +10534,19 @@ def project_sync(
         run_cmd(["git", "add", "-A"], cwd=project_dir, env=env)
         run_cmd(["git", "commit", "-m", safe_message], cwd=project_dir, env=env)
         run_cmd(["git", "tag", "-a", tag, "-m", tag], cwd=project_dir, env=env)
-        run_cmd(["git", "push", "--follow-tags"], cwd=project_dir, env=env)
+        run_cmd(
+            [
+                "git",
+                "push",
+                "--atomic",
+                "--follow-tags",
+                "origin",
+                f"HEAD:refs/heads/{git_branch}",
+                f"refs/tags/{tag}:refs/tags/{tag}",
+            ],
+            cwd=project_dir,
+            env=env,
+        )
 
     success(f"Synced: {repo_name}")
 

{mainsequence-6.0.37 → mainsequence-6.0.38}/mainsequence/cli/local_ops.py

@@ -11,6 +11,7 @@ Local operations shared by several commands:
 
 from __future__ import annotations
 
+import json
 import os
 import pathlib
 import shutil
@@ -122,6 +123,44 @@ def uv_project_version(
     return version.splitlines()[-1].strip()
 
 
+def uv_preview_patch_version(
+    uv_path: pathlib.Path,
+    cwd: pathlib.Path,
+    env: dict[str, str] | None = None,
+) -> str:
+    """Return the version ``uv version --bump patch`` would produce without mutation."""
+    result = subprocess.run(
+        [
+            str(uv_path),
+            "version",
+            "--bump",
+            "patch",
+            "--dry-run",
+            "--output-format",
+            "json",
+        ],
+        cwd=str(cwd),
+        env=env,
+        capture_output=True,
+        text=True,
+    )
+    if result.returncode != 0:
+        detail = (result.stderr or result.stdout or "").strip()
+        suffix = f": {detail}" if detail else ""
+        raise RuntimeError(
+            f"Command failed ({result.returncode}): {uv_path} version --bump patch "
+            f"--dry-run --output-format json{suffix}"
+        )
+    try:
+        payload = json.loads(result.stdout or "")
+    except json.JSONDecodeError as exc:
+        raise RuntimeError("uv version patch preview returned invalid JSON.") from exc
+    version = payload.get("version") if isinstance(payload, dict) else None
+    if not isinstance(version, str) or not version.strip():
+        raise RuntimeError("uv version patch preview returned no project version.")
+    return version.strip()
+
+
 def git_origin(project_dir: pathlib.Path) -> str:
     """
     Return git remote origin URL.