mainsequence 9.0.1.dev30__tar.gz → 9.0.2.dev32__tar.gz

{mainsequence-9.0.1.dev30/mainsequence.egg-info → mainsequence-9.0.2.dev32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.1.dev30
+Version: 9.0.2.dev32
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.1.dev30 → mainsequence-9.0.2.dev32}/agent_scaffold/AGENTS.md

@@ -42,6 +42,7 @@ specific update:
 
 - `mainsequence code-repository update-sdk --path .`
 - `mainsequence code-repository update-agent-skills --path .`
+- `mainsequence code-repository update-platform-skills --path .`
 - `mainsequence code-repository update AGENTS.md --path .`
 - `uv run ms-tau skills sync --path .`
 
@@ -51,6 +52,11 @@ to report, not permission to mutate the repository. The same rule applies to
 requested, use the `code_repository_maintenance` skill. The `mainsequence` CLI
 never owns or updates the `ms_tau_sdk` namespace.
 
+The SDK owns all of `.agents/skills/mainsequence/`. Its skill copy is local,
+requires no sign-in, and deletes everything absent from the installed SDK
+bundle. Platform skills are installed separately under
+`.agents/skills/mainsequence_platform/` by the authenticated platform update.
+
 ## Route By Task
 
 - Product architecture, platform ontology, and CodeRepository Blueprint work:

{mainsequence-9.0.1.dev30 → mainsequence-9.0.2.dev32}/agent_scaffold/skills/maintenance/code_repository_maintenance/SKILL.md

@@ -172,22 +172,37 @@ to publish the CodeRepository changes.
 ## Refresh Managed Skills And Instructions
 
 Run either managed-scaffold command only when the user explicitly requests that
-specific update. When both are requested, refresh the SDK-owned and
-platform-owned skills first, then update the managed Main Sequence block in
+specific update. When both are requested, refresh the SDK-owned skills first,
+then update the managed Main Sequence block in
 `AGENTS.md`:
 
 ```bash
-mainsequence code-repository update-agent-skills --path .
-mainsequence code-repository update AGENTS.md --path .
+uv run --offline mainsequence code-repository update-agent-skills --path .
+uv run --offline mainsequence code-repository update AGENTS.md --path .
 ```
 
 Verify `.agents/skills/mainsequence/PINNED_FROM.txt` after success:
 
-- `sdk_version` must match the installed CodeRepository SDK;
-- platform manifest, ontology, and resource hashes must be present;
+- `pinned_version` must match the installed CodeRepository SDK;
+- the namespace must contain exactly the installed SDK's skill folders;
 - repository-owned skills outside `.agents/skills/mainsequence/` must remain
   untouched.
 
+The SDK owns the whole `mainsequence` namespace. Copying it requires no login
+or platform access and deletes obsolete folders, including retired table
+workflow skills. Do not preserve old or platform-owned content in that folder.
+The installed `metatables` package owns table workflows in its own namespace.
+
+When the user requests platform skills, use the separate authenticated command:
+
+```bash
+mainsequence code-repository update-platform-skills --path .
+```
+
+It owns only `.agents/skills/mainsequence_platform/` and records the platform
+manifest, ontology, and resource hashes there. A backend or authentication
+failure in this command must not block a local SDK skill copy.
+
 The skill update is staged and atomic. If it fails, report the failing lane and
 preserve the previous valid managed tree. Because this operation can update
 this skill, reload the refreshed `code_repository_maintenance/SKILL.md` before starting

{mainsequence-9.0.1.dev30 → mainsequence-9.0.2.dev32}/mainsequence/cli/cli.py

@@ -56,8 +56,9 @@ from ..code_repository_context import (
 )
 from ..code_repository_skills import (
     CodeRepositorySkillAssemblyError,
-    install_dual_source_code_repository_skills,
+    install_platform_code_repository_skills,
 )
+from ..scaffold_skills import ScaffoldSkillCopyBlocked, copy_scaffold_skills
 from . import config as cfg
 from .api import (
     ApiError,
@@ -7845,6 +7846,33 @@ def code_repository_update_sdk(
         run_uv(uv, ["sync"], cwd=code_repository_dir)
 
     success("SDK update complete.")
+    _warn_if_sdk_skills_stale(code_repository_dir)
+
+
+def _warn_if_sdk_skills_stale(code_repository_dir: pathlib.Path) -> None:
+    try:
+        version = _code_repository_installed_package_version(code_repository_dir, "mainsequence")
+        sentinel = code_repository_dir / ".agents" / "skills" / "mainsequence" / "PINNED_FROM.txt"
+        values = (
+            dict(
+                line.split("=", 1)
+                for line in sentinel.read_text(encoding="utf-8").splitlines()
+                if "=" in line
+            )
+            if sentinel.is_file()
+            else {}
+        )
+    except (OSError, ValueError, typer.Exit):
+        warn("Could not check the vendored SDK skill pin. Run update-agent-skills to refresh it.")
+        return
+    pinned = values.get("pinned_version", values.get("sdk_version"))
+    if pinned != version:
+        warn(
+            f"Vendored SDK skills are stale or missing (pinned: {pinned or 'missing'}; installed: {version}). "
+            "No scaffold files were changed. Refresh with "
+            "`uv run --offline mainsequence code-repository update-agent-skills --path .` "
+            "and `uv run --offline mainsequence code-repository update AGENTS.md --path .`."
+        )
 
 
 @code_repository.command("update")
@@ -7935,124 +7963,61 @@ def code_repository_update_agent_skills(
     path: str | None = typer.Option(None, "--path", help="CodeRepository directory"),
 ):
     """
-    Update `.agents/skills/mainsequence` from installed SDK and platform sources.
+    Replace SDK-owned skills with the target checkout's installed SDK bundle.
 
-    The existing command copies SDK-owned execution skills from the target
-    CodeRepository's installed `agent_scaffold/skills` tree and retrieves
-    platform-owned skills from authenticated MCP resources. It validates and
-    stages both sources, then replaces only the managed `mainsequence`
-    namespace and writes one dual-source `PINNED_FROM.txt`. Bundle-root files
-    such as `AGENTS.md` are not copied by this command.
+    No sign-in or backend access is required unless a CodeRepository UID
+    assertion is supplied. The SDK owns all of .agents/skills/mainsequence:
+    files and folders absent from the installed bundle are deleted. Other
+    namespaces are untouched. AGENTS.md is refreshed separately with
+    code-repository update AGENTS.md. Platform skills use update-platform-skills.
 
     Examples
     --------
-    ```bash
-    mainsequence code-repository update-agent-skills
     mainsequence code-repository update-agent-skills --path .
-    mainsequence code-repository update-agent-skills --code-repository-uid code-repository-uid-123
-    ```
     """
-    code_repository_dir = _resolve_code_repository_dir(code_repository_id, path)
-
-    scaffold_bundle_dir = _code_repository_agent_scaffold_bundle_dir(code_repository_dir)
-    skills_dir = scaffold_bundle_dir / "skills"
-    if not skills_dir.exists() or not skills_dir.is_dir():
-        error(f"CodeRepository-installed agent_scaffold bundle is missing skills/: {skills_dir}")
-        raise typer.Exit(1)
-
-    pinned_version = _code_repository_installed_package_version(code_repository_dir, "mainsequence")
-    source_checkout_root = _mainsequence_source_checkout_root()
-    protected_code_repository_roots = (
-        (source_checkout_root,) if source_checkout_root is not None else ()
-    )
+    directory = _resolve_code_repository_dir(code_repository_id, path)
+    skills_dir = _code_repository_agent_scaffold_bundle_dir(directory) / "skills"
+    version = _code_repository_installed_package_version(directory, "mainsequence")
+    source_root = _mainsequence_source_checkout_root()
     try:
-        platform_catalog = fetch_platform_code_repository_skill_catalog()
-        install_result = install_dual_source_code_repository_skills(
-            code_repository_dir=code_repository_dir,
-            sdk_library_name="mainsequence",
+        result = copy_scaffold_skills(
+            code_repository_dir=directory,
+            library_name="mainsequence",
             namespace="mainsequence",
-            sdk_skills_path=skills_dir,
-            sdk_version=pinned_version,
-            platform_catalog=platform_catalog,
+            skills_path=skills_dir,
+            pinned_version=version,
             command="mainsequence code-repository update-agent-skills",
-            protected_code_repository_roots=protected_code_repository_roots,
+            protected_code_repository_roots=(source_root,) if source_root else (),
         )
-    except (
-        ApiError,
-        CodeRepositorySkillAssemblyError,
-        FileNotFoundError,
-        OSError,
-        ValueError,
-    ) as exc:
+    except (ScaffoldSkillCopyBlocked, FileNotFoundError, OSError, ValueError) as exc:
         error(str(exc))
         raise typer.Exit(1) from exc
-
     updated = [
-        {
-            "name": item.name,
-            "owner": item.owner,
-            "source": item.source,
-            "destination": item.destination,
-            "content_sha256": item.content_sha256,
-        }
-        for item in install_result.installed
+        {"name": item.name, "owner": "sdk", "source": item.source, "destination": item.destination}
+        for item in result.copied
     ]
-
     payload = {
-        "code_repository": code_repository_dir,
-        "library_name": install_result.sdk_library_name,
-        "namespace": "mainsequence",
-        "skills_path": install_result.sdk_skills_path,
-        "destination_root": install_result.destination_root,
-        "sentinel_path": install_result.sentinel_path,
-        "pinned_version": install_result.sdk_version,
+        "code_repository": directory,
+        "library_name": result.library_name,
+        "namespace": result.namespace,
+        "skills_path": result.skills_path,
+        "destination_root": result.destination_root,
+        "sentinel_path": result.sentinel_path,
+        "pinned_version": result.pinned_version,
         "sdk": {
-            "library_name": install_result.sdk_library_name,
-            "version": install_result.sdk_version,
-            "skills_path": install_result.sdk_skills_path,
-        },
-        "platform": {
-            "source_url": platform_catalog.source_url,
-            "manifest_version": platform_catalog.manifest_version,
-            "manifest_sha256": platform_catalog.manifest_sha256,
-            "ontology_uri": platform_catalog.ontology_uri,
-            "ontology_sha256": platform_catalog.ontology_sha256,
-            "resources": [
-                {
-                    "name": resource.name,
-                    "uri": resource.uri,
-                    "path": str(resource.resource_path),
-                    "content_sha256": resource.content_sha256,
-                }
-                for resource in platform_catalog.resources
-            ],
-            "skills": [
-                {
-                    "name": skill.name,
-                    "uri": skill.uri,
-                    "path": str(skill.relative_path),
-                    "content_sha256": skill.content_sha256,
-                }
-                for skill in platform_catalog.skills
-            ],
+            "library_name": result.library_name,
+            "version": version,
+            "skills_path": result.skills_path,
         },
         "updated_count": len(updated),
         "updated": updated,
     }
     if _emit_json(payload):
         return
-
-    success("Updated .agents/skills/mainsequence from installed SDK and platform sources.")
+    success("Replaced SDK-owned .agents/skills/mainsequence with the installed bundle.")
     print_kv(
         "CodeRepository Skill Provenance",
-        [
-            ("SDK Library", install_result.sdk_library_name),
-            ("SDK Version", install_result.sdk_version),
-            ("Platform Manifest", platform_catalog.manifest_sha256),
-            ("Platform Resources", len(platform_catalog.resources)),
-            ("Platform Skills", len(platform_catalog.skills)),
-            ("Sentinel", str(install_result.sentinel_path)),
-        ],
+        [("SDK Version", version), ("Sentinel", str(result.sentinel_path))],
     )
     print_table(
         "Updated CodeRepository Skills",
@@ -8061,6 +8026,54 @@ def code_repository_update_agent_skills(
     )
 
 
+@code_repository.command("update-platform-skills")
+def code_repository_update_platform_skills(
+    path: str | None = typer.Option(None, "--path", help="CodeRepository directory"),
+):
+    """Refresh authenticated platform skills in .agents/skills/mainsequence_platform.
+
+    This requires a signed-in session and a reachable backend. The SDK-owned
+    mainsequence namespace and other library namespaces remain untouched.
+    """
+    directory = _resolve_code_repository_dir(None, path)
+    source_root = _mainsequence_source_checkout_root()
+    try:
+        catalog = fetch_platform_code_repository_skill_catalog()
+        destination, installed = install_platform_code_repository_skills(
+            code_repository_dir=directory,
+            platform_catalog=catalog,
+            protected_code_repository_roots=(source_root,) if source_root else (),
+        )
+    except (
+        ApiError,
+        CodeRepositorySkillAssemblyError,
+        ScaffoldSkillCopyBlocked,
+        FileNotFoundError,
+        OSError,
+        ValueError,
+    ) as exc:
+        error(str(exc))
+        raise typer.Exit(1) from exc
+    payload = {
+        "code_repository": directory,
+        "namespace": "mainsequence_platform",
+        "destination_root": destination,
+        "sentinel_path": destination / "PINNED_FROM.txt",
+        "platform": {
+            "source_url": catalog.source_url,
+            "manifest_version": catalog.manifest_version,
+            "manifest_sha256": catalog.manifest_sha256,
+            "ontology_uri": catalog.ontology_uri,
+            "ontology_sha256": catalog.ontology_sha256,
+        },
+        "updated_count": len(installed),
+        "updated": [dataclasses.asdict(item) for item in installed],
+    }
+    if _emit_json(payload):
+        return
+    success("Updated .agents/skills/mainsequence_platform from the authenticated platform catalog.")
+
+
 @skills.command("list")
 def skills_list_cmd():
     """

{mainsequence-9.0.1.dev30 → mainsequence-9.0.2.dev32}/mainsequence/cli/config.py

@@ -756,6 +756,24 @@ def secure_store_available() -> bool:
     return _secure_keyring_backend() is not None
 
 
+def saved_session_summary(backend: str | None = None) -> dict:
+    """
+    Describe the saved session of a backend without any token value.
+
+    `usable` says whether its refresh token has not expired by its own claim,
+    `expires_at` is that claim in epoch seconds (None when absent) and
+    `username` is the recorded user. The process environment is not consulted.
+    """
+    tokens = _read_secure_tokens(backend)
+    refresh = (tokens.get("refresh") or "").strip()
+    expires_at = token_expiry(refresh)
+    return {
+        "username": str(tokens.get("username") or ""),
+        "expires_at": expires_at,
+        "usable": bool(refresh) and (expires_at is None or expires_at > int(time.time())),
+    }
+
+
 def stored_session_available(backend: str | None = None) -> bool:
     """
     Return whether the credential store holds a renewable session for a backend.

{mainsequence-9.0.1.dev30 → mainsequence-9.0.2.dev32}/mainsequence/client/utils.py

@@ -70,42 +70,145 @@ def set_mainsequence_endpoint(endpoint: str) -> None:
     AUTH_ENDPOINT = normalized
 
 
-def _jwt_reauth_hint() -> str:
+_SESSION_TOKEN_VARIABLES = ("MAINSEQUENCE_ACCESS_TOKEN", "MAINSEQUENCE_REFRESH_TOKEN")
+# Renewal answers that refuse the credentials, as opposed to a backend that failed.
+_REFUSED_RENEWAL_STATUSES = frozenset({400, 401, 403})
+
+
+def _format_utc(epoch: int) -> str:
+    return datetime.datetime.fromtimestamp(epoch, tz=datetime.UTC).strftime(
+        "%Y-%m-%d %H:%M UTC"
+    )
+
+
+def _session_backend() -> str:
+    return (AUTH_ENDPOINT or "").rstrip("/")
+
+
+def _login_command(backend: str) -> str:
     """
-    Say how to repair rejected JWT credentials, according to where they came from.
+    Return the CLI command that signs in to `backend`.
 
-    A pair that was already in the process environment wins over the saved CLI
-    session. When that pair is stale the saved session is not tried, because the
-    pair may belong to another user or backend; the message names it instead.
+    `mainsequence login` alone signs in to the configured backend. Another
+    backend needs its address and the folder that holds its repositories.
     """
     try:
-        from mainsequence import bootstrap
         from mainsequence.cli import config as cli_config
 
-        from_environment = bootstrap.credential_source() == bootstrap.CREDENTIALS_FROM_ENVIRONMENT
-        saved_session = from_environment and cli_config.stored_session_available()
+        configured = cli_config.normalize_backend_url(
+            cli_config.get_persistent_config().get("backend_url")
+        )
     except Exception:
-        from_environment, saved_session = False, False
+        configured = ""
+    if not backend or backend == configured:
+        return "`mainsequence login`"
+    return f"`mainsequence login {backend} <base folder>`"
+
+
+def _env_file_holding_process_credentials() -> pathlib.Path | None:
+    """
+    Return the working directory's `.env` when it holds this process's tokens.
+
+    IDE run configurations, launchers and dotenv calls load that file into a
+    process's environment. Values are compared here and never shown.
+    """
+    from mainsequence.cli import config as cli_config
+
+    env_path = pathlib.Path.cwd() / ".env"
+    try:
+        lines = env_path.read_text(encoding="utf-8").splitlines()
+    except (OSError, UnicodeError):
+        return None
+    for line in lines:
+        key = cli_config.env_line_key(line)
+        if key not in _SESSION_TOKEN_VARIABLES:
+            continue
+        value = line.split("=", 1)[1].split(" #", 1)[0].strip().strip("\"'")
+        if value and value == (os.environ.get(key) or "").strip():
+            return env_path
+    return None
+
+
+def _jwt_reauth_hint(refresh_token: str | None = None) -> str:
+    """
+    Say why the backend refused this process's credentials and how to repair them.
+
+    The facts come from this process and this machine: the refresh token's own
+    expiry, whether the credentials were already in the environment when the SDK
+    started (and which `.env` holds them, when one does), and the saved session
+    of the backend. A pair from the environment wins over the saved session, so
+    the saved session is named and not used: the pair may belong to another user
+    or backend. No token value is included.
+    """
+    backend = _session_backend()
+    refresh = refresh_token if refresh_token is not None else os.getenv("MAINSEQUENCE_REFRESH_TOKEN")
+    expiry = _decode_jwt_exp(refresh)
+    try:
+        from mainsequence import bootstrap
+
+        source = bootstrap.credential_source()
+        from_environment = source == bootstrap.CREDENTIALS_FROM_ENVIRONMENT
+        from_store = source == bootstrap.CREDENTIALS_FROM_STORE
+    except Exception:
+        from_environment = from_store = False
+    login = _login_command(backend)
+
+    parts = []
+    if expiry is not None and expiry <= int(time.time()):
+        parts.append(f" The refresh token expired on {_format_utc(expiry)}.")
+    elif expiry is not None:
+        parts.append(
+            " The refresh token has not expired: the backend revoked it, or it was "
+            "issued by another backend."
+        )
 
     if from_environment:
-        return (
-            " The rejected credentials were set in this process's environment "
-            "(MAINSEQUENCE_ACCESS_TOKEN / MAINSEQUENCE_REFRESH_TOKEN) before the SDK "
-            "started: a shell export, an IDE run configuration, or a `.env` file that "
-            "your tooling loads. "
-            + (
-                "A saved CLI session exists for this backend and was not used. Remove "
-                "those variables to use it."
-                if saved_session
-                else "No saved CLI session exists for this backend. Remove those "
-                "variables and run `mainsequence login`."
+        try:
+            env_file = _env_file_holding_process_credentials()
+        except Exception:
+            env_file = None
+        try:
+            from mainsequence.cli import config as cli_config
+
+            saved = cli_config.saved_session_summary(backend)
+        except Exception:
+            saved = {"usable": False, "username": "", "expires_at": None}
+        if env_file is not None:
+            parts.append(
+                f" These credentials come from the token lines of {env_file}, not from "
+                "your saved session."
+            )
+            cleanup = f"run `mainsequence refresh-token` in {env_file.parent} to remove those lines"
+        else:
+            parts.append(
+                " These credentials were in this process's environment "
+                "(MAINSEQUENCE_ACCESS_TOKEN / MAINSEQUENCE_REFRESH_TOKEN) when it started, "
+                "set by the program that started it, not taken from your saved session."
+            )
+            cleanup = "start the process without those two variables"
+        if saved["usable"]:
+            who = f" ({saved['username']})" if saved["username"] else ""
+            until = (
+                f", valid until {_format_utc(saved['expires_at'])}"
+                if saved["expires_at"] is not None
+                else ""
+            )
+            parts.append(
+                f" Your saved session for {backend}{who} is usable{until}: "
+                f"{cleanup}, and the next start uses it."
             )
+        else:
+            parts.append(
+                f" There is no usable saved session for {backend}. Sign in with {login}, "
+                f"then {cleanup}."
+            )
+    elif from_store:
+        parts.append(
+            f" These credentials are your saved session for {backend}. Sign in again with {login}."
         )
-    return (
-        " Refresh your credentials with `mainsequence logout` and "
-        "`mainsequence login`. If this code runs in a separate shell or IDE, "
-        "use `mainsequence login --export` and load the exported env vars there."
-    )
+    else:
+        parts.append(f" Sign in with {login}.")
+    return "".join(parts)
 
 
 def _env_has_value(name: str) -> bool:
@@ -397,10 +500,14 @@ class JWTAuthProvider(BaseAuthProvider):
             if not force and not self._needs_refresh():
                 return
 
+            backend = _session_backend()
             if not self.refresh_token:
                 if self.access_token and not force:
                     return
-                raise AuthError("JWT refresh token is missing." + _jwt_reauth_hint())
+                raise AuthError(
+                    f"Main Sequence cannot renew the session of this process for {backend}: "
+                    "it has no refresh token." + _jwt_reauth_hint(self.refresh_token)
+                )
 
             http_client = session or requests
 
@@ -411,16 +518,24 @@ class JWTAuthProvider(BaseAuthProvider):
                 timeout=self.timeout,
             )
 
+            if r.status_code in _REFUSED_RENEWAL_STATUSES:
+                raise AuthError(
+                    f"Main Sequence refused to renew the session of this process for {backend} "
+                    f"(HTTP {r.status_code})." + _jwt_reauth_hint(self.refresh_token)
+                )
             if r.status_code != 200:
+                # The backend failed; the credentials were not judged.
                 raise AuthError(
-                    f"JWT refresh failed with status {r.status_code}." + _jwt_reauth_hint()
+                    f"Main Sequence could not renew the session of this process for {backend}: "
+                    f"the backend answered HTTP {r.status_code}. Try again when it is available."
                 )
 
             data = r.json()
             access = data.get("access")
             if not access:
                 raise AuthError(
-                    "JWT refresh response did not include access token." + _jwt_reauth_hint()
+                    f"Main Sequence renewed the session for {backend} without an access token."
+                    + _jwt_reauth_hint(self.refresh_token)
                 )
 
             # Important if ROTATE_REFRESH_TOKENS=True
@@ -604,15 +719,12 @@ def make_request(
 
             if r.status_code == 401 and loaders is not None and not auth_retried:
                 logger.warning(f"Error {r.status_code}; forcing auth refresh once")
-                try:
-                    s.headers.update(loaders.refresh_headers(force=True, session=s))
-                    req = get_req(session=s)
-                    auth_retried = True
-                    continue
-                except AuthError:
-                    logger.exception("Auth refresh failed")
-                    keep_request = False
-                    break
+                # A refused renewal raises AuthError: it is reported below with the
+                # reason and the repair, not as a traceback.
+                s.headers.update(loaders.refresh_headers(force=True, session=s))
+                req = get_req(session=s)
+                auth_retried = True
+                continue
 
             keep_request = False
             break