mainsequence 9.0.12.dev51__py3-none-any.whl → 9.0.12.dev52__py3-none-any.whl

mainsequence/cli/config.py

@@ -75,6 +75,8 @@ KEYCHAIN_ACCOUNT = "default"
 AUTH_RECORD_VERSION = 1
 # Credential entries a project `.env` must not hold. The CLI removes them and
 # never writes them; the session lives in the operating system credential store.
+# The runtime credential secret and `MAINSEQUENCE_TOKEN` are no longer read: they
+# stay listed so that an entry an earlier version left in a checkout is removed.
 PROJECT_ENV_CREDENTIAL_KEYS = (
     "MAINSEQUENCE_ACCESS_TOKEN",
     "MAINSEQUENCE_REFRESH_TOKEN",
@@ -805,7 +807,7 @@ def session_report() -> dict:
     refresh_expires_at = token_expiry(refresh)
 
     if auth_mode == "runtime_credential":
-        # The credential is an ID with a bootstrap secret or an identity token file.
+        # The credential is an ID with the identity token file that proves it.
         authenticated = bool(access or runtime_credential_configured())
         session_expires_at = None
     elif refresh:

mainsequence/client/utils.py

@@ -23,8 +23,6 @@ from mainsequence.defaults import resolve_backend_endpoint
 from mainsequence.logconf import logger
 from mainsequence.runtime_credential_exchange import (
     RUNTIME_CREDENTIAL_ID_ENV,
-    RUNTIME_CREDENTIAL_SECRET_ENV,
-    RUNTIME_IDENTITY_TOKEN_FILE_ENV,
     RuntimeIdentityTokenError,
     exchange_runtime_credential,
     identity_token_file_from_environment,
@@ -321,17 +319,16 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
     """
     Exchange the runtime credential the platform injected for short-lived access tokens.
 
-    The proof is the projected workload identity token when
-    `MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE` is set: the file is read for every
-    exchange, and `MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET` is never read or sent.
-    Otherwise the proof is that bootstrap secret. The token is never kept on the
-    provider, and the secret is left out of `repr()` and `str()`. Throttled
-    (`429`) and temporarily unavailable (`503`) exchanges are retried within the
-    timeout budget; a rejected one (`401`) fails at once.
+    The proof is the projected workload identity token in the file named by
+    `MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE`, read for every exchange. It is the
+    only proof: an unset variable, or a missing, unreadable or empty file, raises
+    `AuthError` instead of sending the exchange. The token is never kept on the
+    provider.
+    Throttled (`429`) and temporarily unavailable (`503`) exchanges are retried
+    within the timeout budget; a rejected one (`401`) fails at once.
     """
 
     credential_id: str | None = None
-    credential_secret: str | None = field(default=None, repr=False)
     token_url: str | None = None
     token_type: str = "Bearer"
     refresh_skew_seconds: int = 30
@@ -347,8 +344,6 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
             self.identity_token_file = identity_token_file_from_environment()
         else:
             self.identity_token_file = str(self.identity_token_file).strip() or None
-        if self.credential_secret is None and not self.identity_token_file:
-            self.credential_secret = os.getenv(RUNTIME_CREDENTIAL_SECRET_ENV)
         if not self.token_url:
             self.token_url = f"{API_ENDPOINT}/runtime-credentials/token/"
 
@@ -376,19 +371,11 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
 
     def _exchange(self) -> requests.Response:
         credential_id = (self.credential_id or "").strip()
-        identity_token_file = self.identity_token_file
-        credential_secret = None if identity_token_file else (self.credential_secret or "").strip()
         if not credential_id:
             raise AuthError(
                 "MAINSEQUENCE_RUNTIME_CREDENTIAL_ID is required when "
                 "MAINSEQUENCE_AUTH_MODE=runtime_credential."
             )
-        if not identity_token_file and not credential_secret:
-            raise AuthError(
-                "MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET is required when "
-                "MAINSEQUENCE_AUTH_MODE=runtime_credential and "
-                f"{RUNTIME_IDENTITY_TOKEN_FILE_ENV} is not set."
-            )
         try:
             # One budget for every attempt and wait, inside the caller's budget if any.
             with request_budget(self.timeout) as budget:
@@ -405,8 +392,7 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
                 return exchange_runtime_credential(
                     post,
                     credential_id=credential_id,
-                    credential_secret=credential_secret,
-                    identity_token_file=identity_token_file,
+                    identity_token_file=self.identity_token_file,
                     deadline=budget.deadline,
                     on_retry=self._log_exchange_retry,
                 )

mainsequence/logconf.py

@@ -25,7 +25,6 @@ from .instrumentation import OTelJSONRenderer
 from .repository_identity_security import UNSUPPORTED_SOURCE_IDENTITY_ENV_NAMES
 from .runtime_credential_exchange import (
     RUNTIME_CREDENTIAL_ID_ENV,
-    RUNTIME_CREDENTIAL_SECRET_ENV,
     exchange_runtime_credential,
     identity_token_file_from_environment,
     runtime_credential_configured,
@@ -104,7 +103,6 @@ def _request_job_startup_state(*, timeout_s: float = 10.0) -> dict[str, Any]:
     def _exchange_runtime_credential() -> bool:
         if not runtime_credential_configured():
             return False
-        identity_token_file = identity_token_file_from_environment()
         token_url = f"{_backend_base_url()}/api/v1/runtime-credentials/token/"
 
         def _post(body: dict[str, str]) -> requests.Response:
@@ -120,12 +118,7 @@ def _request_job_startup_state(*, timeout_s: float = 10.0) -> dict[str, Any]:
             token_resp = exchange_runtime_credential(
                 _post,
                 credential_id=(os.getenv(RUNTIME_CREDENTIAL_ID_ENV) or "").strip(),
-                credential_secret=(
-                    None
-                    if identity_token_file
-                    else (os.getenv(RUNTIME_CREDENTIAL_SECRET_ENV) or "").strip()
-                ),
-                identity_token_file=identity_token_file,
+                identity_token_file=identity_token_file_from_environment(),
                 deadline=time.monotonic() + timeout_s,
             )
         except Exception:

mainsequence/runtime_credential_exchange.py

@@ -3,13 +3,11 @@ The runtime credential exchange, shared by the auth provider and the logger.
 
 A runtime started with ``MAINSEQUENCE_AUTH_MODE=runtime_credential`` exchanges its
 credential at ``POST /api/v1/runtime-credentials/token/`` for a short-lived access
-token. The request carries ``credential_id`` and exactly one proof:
-
-* ``workload_identity_token`` when ``MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE`` is
-  set: the projected token read from that file for every exchange, because the
-  file is rotated. The bootstrap secret is then never read or sent, and a missing,
-  unreadable or empty file is an error, never a fallback to the secret.
-* ``credential_secret`` otherwise: ``MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET``.
+token. The request carries exactly ``credential_id`` and ``workload_identity_token``:
+the projected token read from the file named by
+``MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE`` for every exchange, because the file is
+rotated. That token is the only proof. An unset variable and a missing, unreadable
+or empty file are errors, raised instead of sending the request.
 
 The token exists only inside one exchange request. It is not kept on any object,
 written to the environment or a file, logged, or included in an error message.
@@ -29,7 +27,6 @@ from urllib3.exceptions import InvalidHeader
 from urllib3.util import Retry
 
 RUNTIME_CREDENTIAL_ID_ENV = "MAINSEQUENCE_RUNTIME_CREDENTIAL_ID"
-RUNTIME_CREDENTIAL_SECRET_ENV = "MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET"
 RUNTIME_IDENTITY_TOKEN_FILE_ENV = "MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE"
 
 # 429: the exchange is throttled. 503: verification is temporarily unavailable.
@@ -42,7 +39,7 @@ _RETRY_AFTER = Retry(total=0)
 
 
 class RuntimeIdentityTokenError(Exception):
-    """The runtime identity token file cannot be used. The message never holds its content."""
+    """The identity token file is unset or cannot be used. The message never holds its content."""
 
 
 def _environment_value(name: str) -> str:
@@ -58,18 +55,22 @@ def runtime_credential_configured() -> bool:
     """
     Say whether the environment holds a runtime credential to exchange.
 
-    That is a credential ID and one proof: the identity token file, or else the
-    bootstrap secret. Only the presence of the setting is checked. The token file
-    is read by the exchange itself, which reports a missing or empty file.
+    That is a credential ID and the identity token file that proves it. Only the
+    presence of both settings is checked. The token file is read by the exchange
+    itself, which reports a missing or empty file.
     """
-    if not _environment_value(RUNTIME_CREDENTIAL_ID_ENV):
-        return False
-    if identity_token_file_from_environment():
-        return True
-    return bool(_environment_value(RUNTIME_CREDENTIAL_SECRET_ENV))
+    return bool(
+        _environment_value(RUNTIME_CREDENTIAL_ID_ENV) and identity_token_file_from_environment()
+    )
 
 
-def _read_identity_token(path: str) -> str:
+def _read_identity_token(path: str | None) -> str:
+    if not path:
+        raise RuntimeIdentityTokenError(
+            f"{RUNTIME_IDENTITY_TOKEN_FILE_ENV} is required when "
+            "MAINSEQUENCE_AUTH_MODE=runtime_credential: a runtime credential is exchanged "
+            "only with the projected workload identity token in that file."
+        )
     source = f"The runtime identity token file {path} ({RUNTIME_IDENTITY_TOKEN_FILE_ENV})"
     try:
         with open(path, "rb") as token_file:
@@ -92,17 +93,11 @@ def _read_identity_token(path: str) -> str:
     return token
 
 
-def _request_body(
-    credential_id: str,
-    credential_secret: str | None,
-    identity_token_file: str | None,
-) -> dict[str, str]:
-    if identity_token_file:
-        return {
-            "credential_id": credential_id,
-            "workload_identity_token": _read_identity_token(identity_token_file),
-        }
-    return {"credential_id": credential_id, "credential_secret": credential_secret or ""}
+def _request_body(credential_id: str, identity_token_file: str | None) -> dict[str, str]:
+    return {
+        "credential_id": credential_id,
+        "workload_identity_token": _read_identity_token(identity_token_file),
+    }
 
 
 def _retry_delay(response: Any, attempt: int) -> float:
@@ -120,7 +115,6 @@ def exchange_runtime_credential(
     send: Callable[[dict[str, str]], Any],
     *,
     credential_id: str,
-    credential_secret: str | None,
     identity_token_file: str | None,
     deadline: float,
     on_retry: Callable[[int, float], None] | None = None,
@@ -135,8 +129,6 @@ def exchange_runtime_credential(
         response. It is called once per attempt.
     credential_id:
         The runtime credential ID.
-    credential_secret:
-        The bootstrap secret. Ignored when ``identity_token_file`` is set.
     identity_token_file:
         The projected token file. It is read again for every attempt.
     deadline:
@@ -147,12 +139,12 @@ def exchange_runtime_credential(
     A ``429`` or ``503`` answer is retried up to ``EXCHANGE_RETRIES`` times. The
     wait is the exponential backoff or the answer's ``Retry-After``, whichever is
     longer; a wait that would not end before ``deadline`` ends the retries. Any
-    other answer, ``401`` included, is returned at once and the proof is never
-    switched. ``RuntimeIdentityTokenError`` is raised when the token file cannot
-    be used.
+    other answer, ``401`` included, is returned at once. ``RuntimeIdentityTokenError``
+    is raised instead of sending an attempt when ``identity_token_file`` is not set
+    or the file cannot be used.
     """
     for attempt in range(EXCHANGE_RETRIES + 1):
-        response = send(_request_body(credential_id, credential_secret, identity_token_file))
+        response = send(_request_body(credential_id, identity_token_file))
         status = response.status_code
         if status not in RETRYABLE_EXCHANGE_STATUSES or attempt == EXCHANGE_RETRIES:
             return response

{mainsequence-9.0.12.dev51.dist-info → mainsequence-9.0.12.dev52.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.12.dev51
+Version: 9.0.12.dev52
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.12.dev51.dist-info → mainsequence-9.0.12.dev52.dist-info}/RECORD

@@ -15,9 +15,9 @@ mainsequence/bootstrap.py,sha256=AvG55Y46RcshVqJZsyqvUDN62CJg4CDbHu0Bvsbwfzs,291
 mainsequence/code_repository_context.py,sha256=JRrWjwpnUy8I-OjSd9hHlrcq8-Ow3Zeh_N6cYvmtA3o,28545
 mainsequence/code_repository_skills.py,sha256=AyC1HFAxQXHXNBGbarVUJS2cHd4X5HwDx6u8XBophbE,23611
 mainsequence/defaults.py,sha256=5r6s7AI-X40rpm1D3IgcNsWam7iJg4_lIxB3F_1u2z0,408
-mainsequence/logconf.py,sha256=RonnNIbUAP5IPdbYUHiuqBeWvRtHb5pj2YtWzHluEE4,19295
+mainsequence/logconf.py,sha256=IxBuadkLTIBijNiEyid7rCkrZZP01WAQNaVhrj0OCuk,19005
 mainsequence/repository_identity_security.py,sha256=Cdywndhiy1zJFUPh-FfM90RjZ3Hg3tjhxBr64FRhmXs,1035
-mainsequence/runtime_credential_exchange.py,sha256=US368h7_KKorqW9yeRtIhk_Du9xjs2XNgml21dEGcLk,6428
+mainsequence/runtime_credential_exchange.py,sha256=D-gDGHljKnGbMfOiUi_uJ9b5yVFkYB1CB2hikYxTdO4,6152
 mainsequence/runtime_flags.py,sha256=1eTM7VRRhnuZ_GXcmFhqAmdEKwyQYMyZcPsio88vJRQ,378
 mainsequence/scaffold_skills.py,sha256=k0V6eKC5AwbHr9wB9UGMJNF-8eJ0_1izF4-BU01KHrg,10606
 mainsequence/cli/__init__.py,sha256=sMWTnomCaISjnureLuXFRqOzkH2Y77uYEivsd-M6_8Y,28
@@ -25,7 +25,7 @@ mainsequence/cli/api.py,sha256=emn5UsIpQ0qvGLnW7MpNPYenQZjR4NJ6SGDKmLo6gHk,12740
 mainsequence/cli/browser_auth.py,sha256=Vb5MBOnPC05HLZzVNUDODobJ_p5wEIzH_h8rIlpShlE,9984
 mainsequence/cli/cli.py,sha256=zo3ptVxluTYAIeIAluGQPwgFY-_vr0SO3BthCGuVK-0,268962
 mainsequence/cli/code_repository_status.py,sha256=SHEnU8YSWFowPG6dEdE4Yd8CS1tIcJSE1MXFLfvD3Os,5975
-mainsequence/cli/config.py,sha256=Q4aGhSLxSeSjX2HqGgPDGg9kNAvrLhIBzWUJ-pY4lPg,45567
+mainsequence/cli/config.py,sha256=TJYnM11kg5pH2O7AGWFLpNEkC9UEu0g7k2RLjhAHCzo,45724
 mainsequence/cli/docker_utils.py,sha256=eAnp9MI042cHWwKasA5IF2I7INL3A6tV2JX-cSIe7rc,10687
 mainsequence/cli/doctor.py,sha256=_1XHd72jheRDt7dEJHd6hbBSSpCPpMwwFDUOLcdkii8,4550
 mainsequence/cli/local_ops.py,sha256=15XzdIxooWqUYgWDnKB81KCmXrCdYd3AGCVazVHD1MQ,4363
@@ -47,16 +47,16 @@ mainsequence/client/models_foundry.py,sha256=JwQdPLDSO4dZI-KC0SUdmN6izmNIKMb9IzZ
 mainsequence/client/models_helpers.py,sha256=nlbHuQAylTOHAZOq4ltJQp6QvC3NW_kw7tZFosGc5rM,47311
 mainsequence/client/models_user.py,sha256=YFEClKcKZpWLCy8Gmg8tZXIHmJbkdQHkeOBJXmp0HG0,42169
 mainsequence/client/observability.py,sha256=_WrDKCaNk_TXmKElKCXC1inork6Exxxe8FRY4m1GI9s,16008
-mainsequence/client/utils.py,sha256=d6lXJPAOe683gb-ph9x0GJcvK5c5Pg9gr90ihDgQGug,32484
+mainsequence/client/utils.py,sha256=C0h0U-fOBZw3UxIwHcBTLf8CDClAOatf_oRgjvqFth4,31637
 mainsequence/client/value_sets.py,sha256=7TA-mpuAd3hOduNgO1WTQQTuNOGaFgue-VqCsDWKaC8,6181
 mainsequence/instrumentation/__init__.py,sha256=J_9XmfjprElvz0u2t9rTyJT0kFdyKpxdbkdQiaw28_U,316
 mainsequence/instrumentation/utils.py,sha256=b-ihjSioAepeLfMpudM2SqCtvnxMqIXileHx3klBCQU,3377
 mainsequence/server/__init__.py,sha256=BHUAhtdWPDRdxX07NYO_6wrBv5mf0GsXflecO52PmUc,73
 mainsequence/server/caller_assertions.py,sha256=Me8of2Ku8in-97LWU2oY-0oD1OW6zF-xOVVpEQ0eoe4,11010
 mainsequence/server/fastapi.py,sha256=zclo7ARHKUKSTmOc0KdxUSwfsxlx6SJuaiAe-19nzWg,11465
-mainsequence-9.0.12.dev51.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
-mainsequence-9.0.12.dev51.dist-info/METADATA,sha256=F7sYdFmk6Ni6QFEbA2jMXCaoD6wxb_w4WSSUsZ9dPk4,7403
-mainsequence-9.0.12.dev51.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-mainsequence-9.0.12.dev51.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
-mainsequence-9.0.12.dev51.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
-mainsequence-9.0.12.dev51.dist-info/RECORD,,
+mainsequence-9.0.12.dev52.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
+mainsequence-9.0.12.dev52.dist-info/METADATA,sha256=Kiug7ju2MO3i41EzM2Dt3iCuqNKI3WSgISbnIv4YSkk,7403
+mainsequence-9.0.12.dev52.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+mainsequence-9.0.12.dev52.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
+mainsequence-9.0.12.dev52.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
+mainsequence-9.0.12.dev52.dist-info/RECORD,,