ms-tau-sdk 1.2.6.dev1__tar.gz → 1.2.6.dev3__tar.gz

{ms_tau_sdk-1.2.6.dev1 → ms_tau_sdk-1.2.6.dev3}/CHANGELOG.md

@@ -2,6 +2,16 @@
 
 ## Unreleased
 
+- Moved durable Tau runtime state out of the installed package. Built-in extension state, provider
+  credentials, project trust, and agent-call diagnostics now live under
+  `MAINSEQUENCE_TAU_STATE_ROOT/<workspace-hash>`, defaulting to an XDG-style user state directory,
+  instead of `ms_tau_sdk/resources/`. An installed wheel no longer writes to its own site-packages
+  directory, so a read-only install works, and a test run no longer leaves runtime files in `src`
+  for the next build to package. Managed-mode and local-mode behavior is otherwise unchanged.
+- Made the release gate reject runtime residue. `scripts/verify_distribution.py` now holds an
+  explicit allowlist of the entries and file types the package ships, and refuses any `state/`
+  directory, so this class of leak fails the gate instead of shipping.
+
 - Adopted one branch and release standard. A final release is a `vX.Y.Z` tag on `main`, and the
   publish workflow refuses a tag whose commit `main` does not contain. Every push to `development`
   publishes one `X.Y.Z.devN` release automatically, after the same quality gate as `quality.yml`

{ms_tau_sdk-1.2.6.dev1 → ms_tau_sdk-1.2.6.dev3}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-tau-sdk
-Version: 1.2.6.dev1
+Version: 1.2.6.dev3
 Summary: Workspace-bound Tau application primitives for Main Sequence projects
 Project-URL: Changelog, https://github.com/mainsequence-sdk/ms-tau-sdk/blob/development/CHANGELOG.md
 Project-URL: Documentation, https://github.com/mainsequence-sdk/ms-tau-sdk/tree/development/docs
@@ -43,6 +43,7 @@ Description-Content-Type: text/markdown
   <a href="https://pypi.org/project/ms-tau-sdk/"><img src="https://img.shields.io/pypi/pyversions/ms-tau-sdk.svg" alt="Supported Python versions"></a>
   <a href="https://github.com/mainsequence-sdk/ms-tau-sdk/actions/workflows/quality.yml"><img src="https://github.com/mainsequence-sdk/ms-tau-sdk/actions/workflows/quality.yml/badge.svg?branch=development" alt="Quality checks"></a>
   <a href="https://github.com/mainsequence-sdk/ms-tau-sdk/actions/workflows/publish-to-pipy.yml"><img src="https://github.com/mainsequence-sdk/ms-tau-sdk/actions/workflows/publish-to-pipy.yml/badge.svg" alt="PyPI publication"></a>
+  <a href="https://github.com/mainsequence-sdk/ms-tau-sdk/actions/workflows/publish-development-release.yml"><img src="https://github.com/mainsequence-sdk/ms-tau-sdk/actions/workflows/publish-development-release.yml/badge.svg?branch=development" alt="Development release publication"></a>
   <a href="https://github.com/mainsequence-sdk/ms-tau-sdk/issues"><img src="https://img.shields.io/github/issues/mainsequence-sdk/ms-tau-sdk.svg" alt="Open issues"></a>
 </p>
 
@@ -68,6 +69,16 @@ Add the SDK to the project that will host the agent:
 uv add ms-tau-sdk
 ```
 
+Every push to `development` also publishes one `X.Y.Z.devN` release to the same PyPI project.
+`pip` and `uv` skip development releases, so take one only on purpose:
+
+```bash
+uv add --prerelease=allow ms-tau-sdk   # or pin one exactly: uv add "ms-tau-sdk==X.Y.Z.devN"
+```
+
+See the [release process](docs/reference/releasing.md#registry-publication) for what each workflow
+publishes.
+
 Provide the runtime credential that Main Sequence assigned to the deployment:
 
 ```bash

{ms_tau_sdk-1.2.6.dev1 → ms_tau_sdk-1.2.6.dev3}/README.md

@@ -15,6 +15,7 @@
   <a href="https://pypi.org/project/ms-tau-sdk/"><img src="https://img.shields.io/pypi/pyversions/ms-tau-sdk.svg" alt="Supported Python versions"></a>
   <a href="https://github.com/mainsequence-sdk/ms-tau-sdk/actions/workflows/quality.yml"><img src="https://github.com/mainsequence-sdk/ms-tau-sdk/actions/workflows/quality.yml/badge.svg?branch=development" alt="Quality checks"></a>
   <a href="https://github.com/mainsequence-sdk/ms-tau-sdk/actions/workflows/publish-to-pipy.yml"><img src="https://github.com/mainsequence-sdk/ms-tau-sdk/actions/workflows/publish-to-pipy.yml/badge.svg" alt="PyPI publication"></a>
+  <a href="https://github.com/mainsequence-sdk/ms-tau-sdk/actions/workflows/publish-development-release.yml"><img src="https://github.com/mainsequence-sdk/ms-tau-sdk/actions/workflows/publish-development-release.yml/badge.svg?branch=development" alt="Development release publication"></a>
   <a href="https://github.com/mainsequence-sdk/ms-tau-sdk/issues"><img src="https://img.shields.io/github/issues/mainsequence-sdk/ms-tau-sdk.svg" alt="Open issues"></a>
 </p>
 
@@ -40,6 +41,16 @@ Add the SDK to the project that will host the agent:
 uv add ms-tau-sdk
 ```
 
+Every push to `development` also publishes one `X.Y.Z.devN` release to the same PyPI project.
+`pip` and `uv` skip development releases, so take one only on purpose:
+
+```bash
+uv add --prerelease=allow ms-tau-sdk   # or pin one exactly: uv add "ms-tau-sdk==X.Y.Z.devN"
+```
+
+See the [release process](docs/reference/releasing.md#registry-publication) for what each workflow
+publishes.
+
 Provide the runtime credential that Main Sequence assigned to the deployment:
 
 ```bash

{ms_tau_sdk-1.2.6.dev1 → ms_tau_sdk-1.2.6.dev3}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-tau-sdk"
-version = "1.2.6.dev1"
+version = "1.2.6.dev3"
 description = "Workspace-bound Tau application primitives for Main Sequence projects"
 readme = "README.md"
 requires-python = ">=3.13"

ms_tau_sdk-1.2.6.dev3/src/ms_tau_sdk/resources/loader.py

@@ -0,0 +1,30 @@
+"""Packaged Tau resource paths with project-native override semantics."""
+
+from __future__ import annotations
+
+from importlib.resources import files
+from pathlib import Path
+
+from tau_coding.paths import TauPaths
+from tau_coding.resources import TauResourcePaths
+
+
+def resource_root() -> Path:
+    return Path(str(files("ms_tau_sdk.resources")))
+
+
+def tau_resource_paths(cwd: Path, *, state_home: Path) -> TauResourcePaths:
+    """Return SDK defaults plus Tau-native project resource discovery.
+
+    `root` stays on the packaged resources, which are read-only inputs: an
+    installed wheel lives in site-packages, so the SDK must never write there.
+    `paths` therefore sends every durable Tau write — built-in extension state,
+    provider credentials, project trust, diagnostics, sessions — to the
+    writable `state_home` instead.
+    """
+    return TauResourcePaths(
+        root=resource_root(),
+        cwd=cwd,
+        agents_root=None,
+        paths=TauPaths(home=state_home),
+    )

{ms_tau_sdk-1.2.6.dev1 → ms_tau_sdk-1.2.6.dev3}/src/ms_tau_sdk/runtime/manager.py

@@ -426,7 +426,10 @@ class SessionRuntimeManager:
                     tools=tools,
                     session_id=session_uid,
                     append_system_prompt=mainsequence_mcp_resource_prompt(mcp_client),
-                    resource_paths=tau_resource_paths(cwd),
+                    resource_paths=tau_resource_paths(
+                        cwd,
+                        state_home=self.settings.tau_state_home,
+                    ),
                     project_extensions_enabled=True,
                     trust_override="approve",
                 )

{ms_tau_sdk-1.2.6.dev1 → ms_tau_sdk-1.2.6.dev3}/src/ms_tau_sdk/settings.py

@@ -14,6 +14,13 @@ from pydantic_settings import BaseSettings, SettingsConfigDict
 from .errors import ConfigurationError
 
 
+def _default_state_root() -> Path:
+    """Return the XDG-style user state directory for SDK-owned runtime state."""
+    override = os.environ.get("XDG_STATE_HOME", "").strip()
+    base = Path(override) if override else Path.home() / ".local" / "state"
+    return base / "ms-tau-sdk"
+
+
 class TauSDKSettings(BaseSettings):
     model_config = SettingsConfigDict(
         env_file=".env",
@@ -66,6 +73,10 @@ class TauSDKSettings(BaseSettings):
         default_factory=lambda: Path.home() / ".tau" / "mainsequence",
         validation_alias="TAU_LOCAL_STATE_ROOT",
     )
+    state_root: Path = Field(
+        default_factory=_default_state_root,
+        validation_alias="MAINSEQUENCE_TAU_STATE_ROOT",
+    )
     host: str = Field(default="0.0.0.0", validation_alias="MAINSEQUENCE_TAU_HOST")
     port: int = Field(default=8787, validation_alias="MAINSEQUENCE_TAU_PORT")
     trusted_origins: tuple[str, ...] = Field(
@@ -240,9 +251,9 @@ class TauSDKSettings(BaseSettings):
         normalized = str(value or "").strip()
         return normalized or None
 
-    @field_validator("local_state_root")
+    @field_validator("local_state_root", "state_root")
     @classmethod
-    def normalize_local_state_root(cls, value: Path) -> Path:
+    def normalize_state_roots(cls, value: Path) -> Path:
         return value.expanduser().resolve()
 
     @model_validator(mode="after")
@@ -291,6 +302,18 @@ class TauSDKSettings(BaseSettings):
     def workspace_digest(self) -> str:
         return sha256(str(self.workspace).encode("utf-8")).hexdigest()[:12]
 
+    @property
+    def tau_state_home(self) -> Path:
+        """Return the writable Tau home holding this workspace's runtime state.
+
+        Tau keeps durable runtime data (built-in extension state, provider
+        credentials, project trust, diagnostics) under one home directory. That
+        home must never be the packaged resource directory: an installed wheel
+        lives in site-packages, which is read-only on hardened installs and must
+        not mutate itself at runtime.
+        """
+        return self.state_root / self.workspace_digest
+
     @property
     def local_state_path(self) -> Path:
         return self.local_state_root / self.workspace_digest / "runtime.sqlite3"

ms_tau_sdk-1.2.6.dev1/src/ms_tau_sdk/resources/loader.py

@@ -1,17 +0,0 @@
-"""Packaged Tau resource paths with project-native override semantics."""
-
-from __future__ import annotations
-
-from importlib.resources import files
-from pathlib import Path
-
-from tau_coding.resources import TauResourcePaths
-
-
-def resource_root() -> Path:
-    return Path(str(files("ms_tau_sdk.resources")))
-
-
-def tau_resource_paths(cwd: Path) -> TauResourcePaths:
-    """Return SDK defaults plus Tau-native project resource discovery."""
-    return TauResourcePaths(root=resource_root(), cwd=cwd, agents_root=None)