mainsequence 9.0.6.dev39__tar.gz → 9.0.6.dev41__tar.gz

{mainsequence-9.0.6.dev39 → mainsequence-9.0.6.dev41}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.6.dev39
+Version: 9.0.6.dev41
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.6.dev39 → mainsequence-9.0.6.dev41}/agent_scaffold/skills/platform_operations/orchestration_and_releases/SKILL.md

@@ -91,8 +91,16 @@ the SDK or CodeRepository code.
 
 Every file requires the backend-advertised `api_version`, a name, and resource
 declarations. Use the current template for accepted fields and resource kinds.
-There is no prune or strict-delete mode; removing a declaration does not delete
-an existing backend resource.
+A declaration owns its target. On the next push of the branch head, these
+delete the target:
+
+- removing the declaration or its file;
+- a `scope` that excludes the branch's Environment.
+
+Renaming a file or key deletes the old target and creates a new one, with new
+UIDs and URLs. An invalid file deletes nothing. The branch's Harness Agent
+stays while any workflow file declares a `harness_agent`, so moving its
+declaration keeps the same Agent.
 
 Do not hide important recurring schedules in ad hoc shell history or one-off manual commands.
 

mainsequence-9.0.6.dev41/mainsequence/client/_transport.py

@@ -0,0 +1,154 @@
+"""One bounded retry policy for SDK HTTP sessions."""
+
+import math
+import time
+from contextlib import contextmanager
+from contextvars import ContextVar
+
+import requests
+from requests.adapters import HTTPAdapter
+from urllib3.exceptions import InvalidHeader
+from urllib3.util import Retry, Timeout
+
+DEFAULT_ALLOWED_METHODS = frozenset({"HEAD", "GET", "OPTIONS"})
+DEFAULT_STATUS_FORCELIST = (429, 500, 502, 503, 504)
+DEFAULT_TIMEOUT = (5.0, 120.0)
+
+
+class RequestBudget:
+    def __init__(self, timeout):
+        if timeout is None:
+            timeout = DEFAULT_TIMEOUT
+        if isinstance(timeout, Timeout):
+            connect, read = timeout.connect_timeout, timeout.read_timeout
+            total = timeout.total
+        elif isinstance(timeout, tuple):
+            connect, read = timeout
+            total = None
+        else:
+            connect = read = total = timeout
+        self.connect = self._seconds(connect)
+        self.read = self._seconds(read)
+        self.deadline = time.monotonic() + self._seconds(
+            self.connect + self.read if total is None else total
+        )
+
+    @staticmethod
+    def _seconds(value):
+        seconds = float(value)
+        if not math.isfinite(seconds) or seconds <= 0:
+            raise ValueError("Request timeouts must be positive, finite seconds.")
+        return seconds
+
+    @property
+    def remaining(self):
+        return self.deadline - time.monotonic()
+
+    def timeout(self):
+        remaining = self.remaining
+        if remaining <= 0:
+            raise requests.Timeout("The SDK request's total timeout budget is exhausted.")
+        return Timeout(
+            total=remaining,
+            connect=min(self.connect, remaining),
+            read=min(self.read, remaining),
+        )
+
+
+_ACTIVE_BUDGET: ContextVar[RequestBudget | None] = ContextVar("sdk_request_budget", default=None)
+
+
+@contextmanager
+def request_budget(timeout):
+    budget = RequestBudget(timeout)
+    parent = _ACTIVE_BUDGET.get()
+    if parent is not None:
+        budget.deadline = min(budget.deadline, parent.deadline)
+    token = _ACTIVE_BUDGET.set(budget)
+    try:
+        yield budget
+    finally:
+        _ACTIVE_BUDGET.reset(token)
+
+
+def remaining_timeout(timeout):
+    budget = _ACTIVE_BUDGET.get()
+    if budget is None:
+        return timeout
+    connect, read = timeout
+    remaining = budget.timeout().total
+    return Timeout(total=remaining, connect=min(connect, remaining), read=min(read, remaining))
+
+
+class DeadlineHTTPAdapter(HTTPAdapter):
+    def __init__(self, *, retries, backoff_factor):
+        if not isinstance(retries, int) or retries < 0:
+            raise ValueError("retries must be a non-negative integer.")
+        if not math.isfinite(backoff_factor) or backoff_factor < 0:
+            raise ValueError("backoff_factor must be non-negative and finite.")
+        # urllib3 must never add a second retry loop or resend a write on connect failure.
+        super().__init__(
+            max_retries=Retry(
+                total=0,
+                connect=0,
+                read=False,
+                status=0,
+                other=0,
+                allowed_methods=DEFAULT_ALLOWED_METHODS,
+            )
+        )
+        self.retries = retries
+        self.backoff_factor = backoff_factor
+
+    def send(self, request, stream=False, timeout=None, verify=True, cert=None, proxies=None):
+        budget = RequestBudget(timeout)
+        parent = _ACTIVE_BUDGET.get()
+        if parent is not None:
+            budget.deadline = min(budget.deadline, parent.deadline)
+        retryable = request.method in DEFAULT_ALLOWED_METHODS
+        for attempt in range(self.retries + 1):
+            response = None
+            error = None
+            try:
+                response = super().send(
+                    request,
+                    stream=stream,
+                    timeout=budget.timeout(),
+                    verify=verify,
+                    cert=cert,
+                    proxies=proxies,
+                )
+                if not stream:
+                    # Read before deciding to retry, so body failures share the same budget.
+                    _ = response.content
+                if not retryable or response.status_code not in DEFAULT_STATUS_FORCELIST:
+                    return response
+            except requests.exceptions.SSLError:
+                raise
+            except (
+                requests.ConnectionError,
+                requests.Timeout,
+                requests.exceptions.ChunkedEncodingError,
+            ) as exc:
+                error = exc
+
+            delay = min(self.backoff_factor * 2**attempt, Retry.DEFAULT_BACKOFF_MAX)
+            if error is None:
+                try:
+                    retry_after = self.max_retries.get_retry_after(response)
+                except InvalidHeader:
+                    retry_after = None
+                if retry_after is not None:
+                    delay = max(delay, retry_after)
+
+            if not retryable or attempt == self.retries or delay >= budget.remaining:
+                if error is not None:
+                    if response is not None:
+                        response.close()
+                    raise error
+                return response
+            if response is not None:
+                response.close()
+            time.sleep(delay)
+
+        raise AssertionError("Unreachable retry state")

{mainsequence-9.0.6.dev39 → mainsequence-9.0.6.dev41}/mainsequence/client/client.py

@@ -9,7 +9,7 @@ import requests
 from mainsequence.defaults import resolve_backend_endpoint
 
 from .exceptions import raise_for_response
-from .utils import AuthLoaders, build_session
+from .utils import AuthLoaders, build_session, make_request
 from .utils import loaders as _global_loaders
 from .utils import session as _global_session
 
@@ -35,6 +35,7 @@ class MainSequenceClient:
     - Uses ONE shared loaders + session (from utils) by default
     - Can be reconfigured once at startup
     """
+
     _default: MainSequenceClient | None = None
 
     def __init__(
@@ -72,15 +73,18 @@ class MainSequenceClient:
         timeout: tuple[float, float] | float | None = None,
     ) -> Any:
         url = self.config.api_root.rstrip("/") + "/" + path.lstrip("/")
-        to = timeout or self.config.timeout
-
-        r = self.session.request(method.upper(), url, params=params, json=json, files=files, timeout=to)
-
-        # Refresh auth once if needed
-        if r.status_code in (401, 403):
-            self.loaders.refresh_headers()
-            self.session.headers.update(self.loaders.auth_headers)
-            r = self.session.request(method.upper(), url, params=params, json=json, files=files, timeout=to)
+        to = self.config.timeout if timeout is None else timeout
+        payload = {"params": params, "json": json}
+        if files is not None:
+            payload["files"] = files
+        r = make_request(
+            self.session,
+            method,
+            url,
+            self.loaders,
+            payload=payload,
+            time_out=to,
+        )
 
         raise_for_response(r, payload={"params": params, "json": json})
 
@@ -95,7 +99,9 @@ class MainSequenceClient:
         """
         if cls._default is None:
             # Reuse the existing global singletons from utils to avoid two sessions in prod.
-            cls._default = cls(MainSequenceClientConfig(), loaders=_global_loaders, session=_global_session)
+            cls._default = cls(
+                MainSequenceClientConfig(), loaders=_global_loaders, session=_global_session
+            )
         return cls._default
 
     @classmethod

{mainsequence-9.0.6.dev39 → mainsequence-9.0.6.dev41}/mainsequence/client/inference.py

@@ -69,8 +69,8 @@ class InferenceClient:
         if self.organization_environment_uid is not None:
             query["organization_environment_uid"] = self.organization_environment_uid
         url = f"{utils.API_ENDPOINT.rstrip('/')}/{path}"
-        # The shared make_request loop retries network failures. Inference uses
-        # the same auth loader with a dedicated zero-retry transport instead.
+        # Inference opts out of safe-read retries as well: an uncertain outcome
+        # must preserve the caller's explicit idempotency key.
         with utils.build_session(loaders=utils.loaders, retries=0) as session:
             headers = dict(utils.loaders.refresh_headers(force=False, session=session))
             if key is not None:

{mainsequence-9.0.6.dev39 → mainsequence-9.0.6.dev41}/mainsequence/client/utils.py

@@ -17,26 +17,21 @@ from uuid import UUID, getnode
 
 import psutil
 import requests
-from requests.adapters import HTTPAdapter
 from requests.structures import CaseInsensitiveDict
-from urllib3.util.retry import Retry
 
 from mainsequence.defaults import resolve_backend_endpoint
 from mainsequence.logconf import logger
 
+from ._transport import DEFAULT_ALLOWED_METHODS as DEFAULT_ALLOWED_METHODS
+from ._transport import DEFAULT_STATUS_FORCELIST as DEFAULT_STATUS_FORCELIST
+from ._transport import DEFAULT_TIMEOUT as DEFAULT_TIMEOUT
+from ._transport import DeadlineHTTPAdapter, remaining_timeout, request_budget
+
 # ---- Backend defaults (single source of truth) ----
 MAINSEQUENCE_ENDPOINT = resolve_backend_endpoint()
 API_ENDPOINT = f"{MAINSEQUENCE_ENDPOINT}/api/v1"
 AUTH_ENDPOINT = MAINSEQUENCE_ENDPOINT.rstrip("/")
 
-DEFAULT_STATUS_FORCELIST = (429, 500, 502, 503, 504)
-DEFAULT_ALLOWED_METHODS = frozenset(["HEAD", "GET", "OPTIONS", "POST", "PUT", "PATCH", "DELETE"])
-
-# requests supports either a float or (connect, read). Preserve previous ~120s read behavior,
-# but add a sane connect timeout.
-DEFAULT_TIMEOUT: tuple[float, float] = (5.0, 120.0)
-
-
 DATE_FORMAT = "%Y-%m-%dT%H:%M:%S.%fZ"
 
 
@@ -383,7 +378,7 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
                     "credential_secret": credential_secret,
                 },
                 headers={"Content-Type": "application/json"},
-                timeout=self.timeout,
+                timeout=remaining_timeout(self.timeout),
                 allow_redirects=False,
             )
             if response.status_code < 200 or response.status_code >= 300:
@@ -515,7 +510,7 @@ class JWTAuthProvider(BaseAuthProvider):
                 self.refresh_url,
                 json={"refresh": self.refresh_token},
                 headers={"Content-Type": "application/json"},
-                timeout=self.timeout,
+                timeout=remaining_timeout(self.timeout),
             )
 
             if r.status_code in _REFUSED_RENEWAL_STATUSES:
@@ -564,7 +559,7 @@ class JWTAuthProvider(BaseAuthProvider):
             self.obtain_url,
             json={"username": username, "password": password},
             headers={"Content-Type": "application/json"},
-            timeout=self.timeout,
+            timeout=remaining_timeout(self.timeout),
         )
         r.raise_for_status()
         data = r.json()
@@ -671,63 +666,46 @@ def make_request(
 ):
     from requests.models import Response
 
-    TIMEOFF = 0.25
-    TRIES = int(15 // TIMEOFF)
     timeout = DEFAULT_TIMEOUT if time_out is None else time_out
     payload = {} if payload is None else payload
-
-    def get_req(session):
-        if r_type == "GET":
-            return session.get
-        elif r_type == "POST":
-            return session.post
-        elif r_type == "PUT":
-            return session.put
-        elif r_type == "PATCH":
-            return session.patch
-        elif r_type == "DELETE":
-            return session.delete
-        else:
-            raise NotImplementedError(f"Unsupported method: {r_type}")
+    r_type = r_type.upper()
+    if r_type not in DEFAULT_ALLOWED_METHODS | {"POST", "PUT", "PATCH", "DELETE"}:
+        raise NotImplementedError(f"Unsupported method: {r_type}")
 
     request_kwargs = {}
     if r_type in ("POST", "PATCH") and "files" in payload:
-        request_kwargs["data"] = payload.get("json", {})
-        request_kwargs["files"] = payload["files"]
+        request_kwargs = dict(payload)
+        request_kwargs["data"] = request_kwargs.pop("json", {})
         s.headers.pop("Content-Type", None)
     else:
-        request_kwargs = payload
-
-    req = get_req(session=s)
-    keep_request = True
-    counter = 0
-    auth_retried = False
+        request_kwargs = dict(payload)
+    request_kwargs.setdefault("allow_redirects", False)
+    req = getattr(s, r_type.lower())
 
     if accept_gzip:
         s.headers.setdefault("Accept-Encoding", "gzip")
 
-    while keep_request:
+    with request_budget(timeout) as budget:
         try:
-            if loaders is not None:
-                s.headers.update(loaders.refresh_headers(force=False, session=s))
-
-            start_time = time.perf_counter()
-            logger.debug(f"Requesting {r_type} from {url}")
-            r = req(url, timeout=timeout, **request_kwargs)
-            duration = time.perf_counter() - start_time
-            logger.debug(f"{url} took {duration:.4f} seconds.")
-
-            if r.status_code == 401 and loaders is not None and not auth_retried:
-                logger.warning(f"Error {r.status_code}; forcing auth refresh once")
-                # A refused renewal raises AuthError: it is reported below with the
-                # reason and the repair, not as a traceback.
-                s.headers.update(loaders.refresh_headers(force=True, session=s))
-                req = get_req(session=s)
-                auth_retried = True
-                continue
-
-            keep_request = False
-            break
+            for auth_attempt in range(2):
+                if loaders is not None:
+                    budget.timeout()
+                    s.headers.update(loaders.refresh_headers(force=bool(auth_attempt), session=s))
+
+                start_time = time.perf_counter()
+                logger.debug(f"Requesting {r_type} from {url}")
+                r = req(url, timeout=budget.timeout(), **request_kwargs)
+                duration = time.perf_counter() - start_time
+                logger.debug(f"{url} took {duration:.4f} seconds.")
+                if (
+                    r.status_code != 401
+                    or loaders is None
+                    or auth_attempt
+                    or r_type not in DEFAULT_ALLOWED_METHODS
+                ):
+                    return r
+                r.close()
+                logger.warning("Error 401; forcing auth refresh once within the request budget")
 
         except AuthError as e:
             logger.warning(f"Auth error for {url}: {e}")
@@ -736,32 +714,15 @@ def make_request(
             r.error_type = "auth_error"
             r.status_code = 401
             r._content = str(e).encode("utf-8")
-            keep_request = False
-            break
-
-        except requests.exceptions.ConnectionError:
-            logger.exception(f"Error connecting {url}")
-        except TypeError as e:
-            logger.exception(f"Type error for {url} exception {e}")
-            raise e
-        except Exception as e:
-            logger.exception(f"Error connecting {url} exception {e}")
-
-        counter += 1
-        if counter >= TRIES:
-            keep_request = False
+            return r
+        except requests.RequestException as e:
+            logger.warning(f"Request {r_type} to {url} failed: {e}")
             r = Response()
             r.code = "expired"
             r.error_type = "expired"
             r.status_code = 500
-            break
-
-        logger.debug(
-            f"Trying request again after {TIMEOFF}s - Counter: {counter}/{TRIES} - URL: {url}"
-        )
-        time.sleep(TIMEOFF)
-
-    return r
+            r._content = str(e).encode("utf-8")
+            return r
 
 
 def build_session(
@@ -779,23 +740,7 @@ def build_session(
     if accept_gzip:
         s.headers.setdefault("Accept-Encoding", "gzip")
 
-    retry_kwargs = dict(
-        total=retries,
-        connect=retries,
-        read=retries,
-        status=retries,
-        backoff_factor=backoff_factor,
-        status_forcelist=DEFAULT_STATUS_FORCELIST,
-        respect_retry_after_header=True,
-        raise_on_status=False,
-    )
-
-    try:
-        retry_cfg = Retry(allowed_methods=DEFAULT_ALLOWED_METHODS, **retry_kwargs)
-    except TypeError:
-        retry_cfg = Retry(method_whitelist=DEFAULT_ALLOWED_METHODS, **retry_kwargs)
-
-    adapter = HTTPAdapter(max_retries=retry_cfg)
+    adapter = DeadlineHTTPAdapter(retries=retries, backoff_factor=backoff_factor)
     s.mount("https://", adapter)
     s.mount("http://", adapter)
     return s
@@ -929,24 +874,7 @@ def _install_retry_adapters_in_place(
     Configure retry adapters on an EXISTING session object (do not rebind 'session').
     This is critical so 'from utils import session' users still get the updated behavior.
     """
-    retry_kwargs = dict(
-        total=retries,
-        connect=retries,
-        read=retries,
-        status=retries,
-        backoff_factor=backoff_factor,
-        status_forcelist=DEFAULT_STATUS_FORCELIST,
-        respect_retry_after_header=True,
-        raise_on_status=False,
-    )
-
-    # urllib3 compatibility across versions
-    try:
-        retry_cfg = Retry(allowed_methods=DEFAULT_ALLOWED_METHODS, **retry_kwargs)
-    except TypeError:
-        retry_cfg = Retry(method_whitelist=DEFAULT_ALLOWED_METHODS, **retry_kwargs)
-
-    adapter = HTTPAdapter(max_retries=retry_cfg)
+    adapter = DeadlineHTTPAdapter(retries=retries, backoff_factor=backoff_factor)
 
     # Close old adapters' pools (best-effort), then mount new ones
     for prefix in ("https://", "http://"):

{mainsequence-9.0.6.dev39 → mainsequence-9.0.6.dev41}/mainsequence.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.6.dev39
+Version: 9.0.6.dev41
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.6.dev39 → mainsequence-9.0.6.dev41}/mainsequence.egg-info/SOURCES.txt

@@ -43,6 +43,7 @@ mainsequence/cli/sdk_utils.py
 mainsequence/cli/ssh_utils.py
 mainsequence/cli/ui.py
 mainsequence/client/__init__.py
+mainsequence/client/_transport.py
 mainsequence/client/agent_runtime_models.py
 mainsequence/client/base.py
 mainsequence/client/client.py
@@ -81,6 +82,7 @@ tests/test_environment_response_contracts.py
 tests/test_fastapi_request_identity.py
 tests/test_filter_normalization.py
 tests/test_github_issues_client.py
+tests/test_http_retry_budget.py
 tests/test_independent_context.py
 tests/test_inference_client.py
 tests/test_instrumentation.py

{mainsequence-9.0.6.dev39 → mainsequence-9.0.6.dev41}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "mainsequence"
-version = "9.0.6.dev39"
+version = "9.0.6.dev41"
 description = "Main Sequence SDK"
 readme = "README.md"
 requires-python = ">=3.13"

{mainsequence-9.0.6.dev39 → mainsequence-9.0.6.dev41}/tests/test_auth_bootstrap.py

@@ -286,6 +286,9 @@ def test_request_reports_a_refused_renewal_with_its_reason(refused):
         status_code = 401
         text = '{"detail": "Given token not valid for any token type"}'
 
+        def close(self):
+            pass
+
     class Session:
         headers: dict = {}
 

{mainsequence-9.0.6.dev39 → mainsequence-9.0.6.dev41}/tests/test_auth_precedence.py

@@ -76,6 +76,9 @@ class _FakeResponse:
     def json(self):
         return self._payload
 
+    def close(self):
+        pass
+
 
 def _jwt_with_exp(exp: int) -> str:
     header = base64.urlsafe_b64encode(json.dumps({"alg": "none"}).encode()).rstrip(b"=").decode()