mainsequence 9.0.8.dev45__py3-none-any.whl → 9.0.9.dev46__py3-none-any.whl

mainsequence/cli/browser_auth.py

@@ -15,7 +15,7 @@ import threading
 import time
 import webbrowser
 from collections.abc import Callable
-from dataclasses import dataclass
+from dataclasses import dataclass, field
 from http.server import BaseHTTPRequestHandler, ThreadingHTTPServer
 from urllib.parse import parse_qs, urlparse
 
@@ -37,7 +37,8 @@ class BrowserAuthError(RuntimeError):
 class BrowserAuthCallback:
     """Authorization callback payload captured from the local loopback receiver."""
 
-    code: str | None = None
+    # The authorization code is a bearer credential: it stays out of repr() and str().
+    code: str | None = field(default=None, repr=False)
     state: str | None = None
     error: str | None = None
     error_description: str | None = None

mainsequence/client/agent_runtime_models.py

@@ -353,7 +353,8 @@ class AgentRuntimePresence(BasePydanticModel):
 
 
 class AgentSessionRuntimeAccess(BasePydanticModel):
-    model_config = ConfigDict(extra="allow")
+    # A validation error must not echo the input: it holds the bearer token.
+    model_config = ConfigDict(extra="allow", hide_input_in_errors=True)
 
     coding_agent_service_uid: str | None = Field(
         None,
@@ -373,6 +374,7 @@ class AgentSessionRuntimeAccess(BasePydanticModel):
     token: str | None = Field(
         None,
         description="Bearer token that authorizes calls to the coding-agent gateway.",
+        repr=False,
     )
     expires_at: str | None = Field(
         None,

mainsequence/client/models_foundry.py

@@ -7,7 +7,7 @@ from uuid import UUID
 
 import yaml
 from cachetools import TTLCache, cachedmethod
-from pydantic import Field, SecretStr
+from pydantic import ConfigDict, Field, SecretStr
 
 from .base import (
     BaseObjectOrm,
@@ -891,6 +891,10 @@ class Secret(
     BasePydanticModel,
     BaseObjectOrm,
 ):
+    # `value` is a SecretStr once read, but a validation error would echo the
+    # plaintext it was given.
+    model_config = ConfigDict(hide_input_in_errors=True)
+
     HYDRATE_FILTER_GET_FROM_DETAIL: ClassVar[bool] = True
     FILTERSET_FIELDS: ClassVar[dict[str, list[str]]] = {
         "uid": ["in", "exact"],

mainsequence/client/models_helpers.py

@@ -6,7 +6,7 @@ from decimal import Decimal
 from typing import Any, ClassVar, Literal
 from uuid import UUID
 
-from pydantic import BaseModel, Field, PositiveInt
+from pydantic import BaseModel, ConfigDict, Field, PositiveInt
 
 from .base import (
     BaseObjectOrm,
@@ -798,6 +798,10 @@ class ResourceReleaseRuntimePresence(BasePydanticModel):
 
 
 class ResourceReleaseRuntimeAccess(BasePydanticModel):
+    # `access` holds the runtime's bearer token, so neither repr() nor a
+    # validation error shows it.
+    model_config = ConfigDict(hide_input_in_errors=True)
+
     resource_release_uid: str
     # The canonical vocabulary ResourceRelease.release_kind reads (#119): this
     # payload names a release kind, so it names it the same way.
@@ -805,7 +809,7 @@ class ResourceReleaseRuntimeAccess(BasePydanticModel):
     routing: ResourceReleaseRuntimeRouting
     runtime_access: ResourceReleaseRuntimeAdmission
     runtime_presence: ResourceReleaseRuntimePresence
-    access: dict[str, Any] | None = None
+    access: dict[str, Any] | None = Field(default=None, repr=False)
 
 
 class ResourceRelease(

mainsequence/client/utils.py

@@ -278,8 +278,9 @@ class BaseAuthProvider:
 
 @dataclass
 class SessionJWTAuthProvider(BaseAuthProvider):
-    access_token: str | None = None
-    refresh_token: str | None = None
+    # Tokens stay out of repr() and str(), so logging the provider never shows them.
+    access_token: str | None = field(default=None, repr=False)
+    refresh_token: str | None = field(default=None, repr=False)
     header_keyword: str = "Bearer"
 
     def __post_init__(self):
@@ -324,12 +325,13 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
     `MAINSEQUENCE_RUNTIME_IDENTITY_TOKEN_FILE` is set: the file is read for every
     exchange, and `MAINSEQUENCE_RUNTIME_CREDENTIAL_SECRET` is never read or sent.
     Otherwise the proof is that bootstrap secret. The token is never kept on the
-    provider. Throttled (`429`) and temporarily unavailable (`503`) exchanges are
-    retried within the timeout budget; a rejected one (`401`) fails at once.
+    provider, and the secret is left out of `repr()` and `str()`. Throttled
+    (`429`) and temporarily unavailable (`503`) exchanges are retried within the
+    timeout budget; a rejected one (`401`) fails at once.
     """
 
     credential_id: str | None = None
-    credential_secret: str | None = None
+    credential_secret: str | None = field(default=None, repr=False)
     token_url: str | None = None
     token_type: str = "Bearer"
     refresh_skew_seconds: int = 30
@@ -481,8 +483,9 @@ class RuntimeCredentialAuthProvider(BaseAuthProvider):
 
 @dataclass
 class JWTAuthProvider(BaseAuthProvider):
-    access_token: str | None = None
-    refresh_token: str | None = None
+    # Tokens stay out of repr() and str(), so logging the provider never shows them.
+    access_token: str | None = field(default=None, repr=False)
+    refresh_token: str | None = field(default=None, repr=False)
     refresh_url: str | None = None
     obtain_url: str | None = None
     header_keyword: str = "Bearer"

{mainsequence-9.0.8.dev45.dist-info → mainsequence-9.0.9.dev46.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: mainsequence
-Version: 9.0.8.dev45
+Version: 9.0.9.dev46
 Summary: Main Sequence SDK
 Author-email: Main Sequence GmbH <dev@main-sequence.io>
 License-Expression: MIT

{mainsequence-9.0.8.dev45.dist-info → mainsequence-9.0.9.dev46.dist-info}/RECORD

@@ -22,7 +22,7 @@ mainsequence/runtime_flags.py,sha256=1eTM7VRRhnuZ_GXcmFhqAmdEKwyQYMyZcPsio88vJRQ
 mainsequence/scaffold_skills.py,sha256=k0V6eKC5AwbHr9wB9UGMJNF-8eJ0_1izF4-BU01KHrg,10606
 mainsequence/cli/__init__.py,sha256=sMWTnomCaISjnureLuXFRqOzkH2Y77uYEivsd-M6_8Y,28
 mainsequence/cli/api.py,sha256=emn5UsIpQ0qvGLnW7MpNPYenQZjR4NJ6SGDKmLo6gHk,127404
-mainsequence/cli/browser_auth.py,sha256=C-Sbpt0Pr9Pv3Z9dO80TMk7zPcaaZ-4zvW0tbRVMrTU,9863
+mainsequence/cli/browser_auth.py,sha256=Vb5MBOnPC05HLZzVNUDODobJ_p5wEIzH_h8rIlpShlE,9984
 mainsequence/cli/cli.py,sha256=zo3ptVxluTYAIeIAluGQPwgFY-_vr0SO3BthCGuVK-0,268962
 mainsequence/cli/code_repository_status.py,sha256=SHEnU8YSWFowPG6dEdE4Yd8CS1tIcJSE1MXFLfvD3Os,5975
 mainsequence/cli/config.py,sha256=Q4aGhSLxSeSjX2HqGgPDGg9kNAvrLhIBzWUJ-pY4lPg,45567
@@ -36,27 +36,27 @@ mainsequence/cli/ssh_utils.py,sha256=m7HgFHZQ545sxY9igfQLpaNjWHm4SiN9VwCkAuGy2yw
 mainsequence/cli/ui.py,sha256=memd6pmjALfGj8zndGCx_z80ztQeqTcOvcofU0un34U,2277
 mainsequence/client/__init__.py,sha256=lsr9JWxeVqOG0KRoHErW5M40ACPSR7SAEE508dTN5XM,672
 mainsequence/client/_transport.py,sha256=l2xkbJ21SbrJhzgOf58Yikxg-uzOQPyo-H5hENdCBo8,5374
-mainsequence/client/agent_runtime_models.py,sha256=lay0DN3lN5p6-3ajVsaHvPgcmrURFwrNfTb6upoImm4,66642
+mainsequence/client/agent_runtime_models.py,sha256=tsjs71If9B7CJOx7YoEYg9l9_NOxAW3EPLX1wSF3rCU,66766
 mainsequence/client/base.py,sha256=T3k3xptM09TreiVogrxAPWoIy8zM6Dtn3Cbwsnb33ag,42678
 mainsequence/client/client.py,sha256=Jaw9RYObdVDS5J2O0pln99-XpuW9e4vW-SsbJRNldfw,3866
 mainsequence/client/compute_validation.py,sha256=ByeX0CkIE7qq06ggZFfN92U3Qp2e9cvo2RTIGWa5_Vw,6662
 mainsequence/client/exceptions.py,sha256=xx2L4l3OMNsTybbYkiTKK398ahnutEascM0It35tGr0,3815
 mainsequence/client/github_issues.py,sha256=pSTUw3UPrmE6wqnpoJctartTaNSq6iu6PQRrd8hip6I,14568
 mainsequence/client/inference.py,sha256=g24H9LWumMRABIevho8FS7BBOuyYvf80pRwCmJZpLeY,7353
-mainsequence/client/models_foundry.py,sha256=iN1jJzDokfniEQF0Ac5eepAB7L5pVjJnKavaHLP7BHA,36310
-mainsequence/client/models_helpers.py,sha256=y7cgcsH8yO3dfIWPhRdcYam7ItWHw3Ps63-WYDe4YHE,46262
+mainsequence/client/models_foundry.py,sha256=JwQdPLDSO4dZI-KC0SUdmN6izmNIKMb9IzZlYXy0Mig,36488
+mainsequence/client/models_helpers.py,sha256=vwZdQhEQZBCxXojP9-DxhdRc-TlceWz4lTqQQnT05Ms,46465
 mainsequence/client/models_user.py,sha256=co9uhe-LKkt7Kw5u8-wDMWcp0yL_lS2LuUOyauW5KF0,38557
 mainsequence/client/observability.py,sha256=_WrDKCaNk_TXmKElKCXC1inork6Exxxe8FRY4m1GI9s,16008
-mainsequence/client/utils.py,sha256=wg0tSaAe9R4-LD75_A-G9pf5p43kXZWRqXo6sHL8Q0Y,32123
+mainsequence/client/utils.py,sha256=d6lXJPAOe683gb-ph9x0GJcvK5c5Pg9gr90ihDgQGug,32484
 mainsequence/client/value_sets.py,sha256=7TA-mpuAd3hOduNgO1WTQQTuNOGaFgue-VqCsDWKaC8,6181
 mainsequence/instrumentation/__init__.py,sha256=J_9XmfjprElvz0u2t9rTyJT0kFdyKpxdbkdQiaw28_U,316
 mainsequence/instrumentation/utils.py,sha256=b-ihjSioAepeLfMpudM2SqCtvnxMqIXileHx3klBCQU,3377
 mainsequence/server/__init__.py,sha256=BHUAhtdWPDRdxX07NYO_6wrBv5mf0GsXflecO52PmUc,73
 mainsequence/server/caller_assertions.py,sha256=f9jHhVeoFK1ScDCmW8h3lEIU5V7zKw70SUSVV2P7wUI,10975
 mainsequence/server/fastapi.py,sha256=Y5QB51CRVbuUVRUcWh5GKQ5b5vMPjbs9scioTt684oQ,10712
-mainsequence-9.0.8.dev45.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
-mainsequence-9.0.8.dev45.dist-info/METADATA,sha256=z8ETo9B0eKLTBZxqULrm9ZNkbehM-ObnGFdieIR5WjA,7402
-mainsequence-9.0.8.dev45.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
-mainsequence-9.0.8.dev45.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
-mainsequence-9.0.8.dev45.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
-mainsequence-9.0.8.dev45.dist-info/RECORD,,
+mainsequence-9.0.9.dev46.dist-info/licenses/LICENSE,sha256=b6Ecsk8wjsEby3lbSzdljR6hHiFGHBizt9iWV2p1c_I,1074
+mainsequence-9.0.9.dev46.dist-info/METADATA,sha256=ZaHroaaeOwrBElz7C46oQ1o6m6iIgE3b-u1Lap3ozPg,7402
+mainsequence-9.0.9.dev46.dist-info/WHEEL,sha256=YVMoNqKzERt-wjUZwJ33xBGAwnFl-4cqbYkTtWa4itE,91
+mainsequence-9.0.9.dev46.dist-info/entry_points.txt,sha256=XGAOq3-mF2lWWpeRJvoaWyMarRcK167mH1g124aGdUs,88
+mainsequence-9.0.9.dev46.dist-info/top_level.txt,sha256=BFeblM_Q9q0cUWBvTxnfWcWQEHtf5XZi9nOS-Gdfwus,28
+mainsequence-9.0.9.dev46.dist-info/RECORD,,