ms-tau-sdk 2.0.0.dev29__tar.gz → 2.0.0.dev32__tar.gz

{ms_tau_sdk-2.0.0.dev29 → ms_tau_sdk-2.0.0.dev32}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-tau-sdk
-Version: 2.0.0.dev29
+Version: 2.0.0.dev32
 Summary: Workspace-bound Tau application primitives for Main Sequence projects
 Project-URL: Changelog, https://github.com/mainsequence-sdk/ms-tau-sdk/blob/development/CHANGELOG.md
 Project-URL: Documentation, https://github.com/mainsequence-sdk/ms-tau-sdk/tree/development/docs

{ms_tau_sdk-2.0.0.dev29 → ms_tau_sdk-2.0.0.dev32}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-tau-sdk"
-version = "2.0.0.dev29"
+version = "2.0.0.dev32"
 description = "Workspace-bound Tau application primitives for Main Sequence projects"
 readme = "README.md"
 requires-python = ">=3.13"

{ms_tau_sdk-2.0.0.dev29 → ms_tau_sdk-2.0.0.dev32}/src/ms_tau_sdk/api/models.py

@@ -57,6 +57,9 @@ class CancelRequest(ApiModel):
 
 
 class SessionModelSelection(ApiModel):
+    custom_id: str | None = Field(
+        default=None, validation_alias=AliasChoices("customId", "custom_id")
+    )
     session_uid: str = Field(validation_alias=AliasChoices("sessionUid", "session_uid"))
     provider: str
     model: str

{ms_tau_sdk-2.0.0.dev29 → ms_tau_sdk-2.0.0.dev32}/src/ms_tau_sdk/api/sessions.py

@@ -37,6 +37,7 @@ async def session_model(
             "provider": session.active_provider,
             "model": session.active_model,
             "thinkingLevel": session.active_thinking,
+            **({"customId": session.custom_id} if session.custom_id is not None else {}),
         },
     }
 
@@ -45,7 +46,13 @@ async def session_model(
 async def model_providers(client: BackendDep, config: SettingsDep) -> dict[str, object]:
     if not config.local_mode:
         raise HTTPException(status_code=409, detail="Provider catalog is local-mode only")
-    return await client.list_model_providers()
+    return await client.list_model_providers(
+        **(
+            {"organization_environment_uid": config.local_organization_environment_uid}
+            if config.local_organization_environment_uid
+            else {}
+        )
+    )
 
 
 @router.put("/session-model")
@@ -62,6 +69,7 @@ async def select_session_model(
         provider=body.provider,
         model=body.model,
         thinking_level=body.thinking_level,
+        **({"custom_id": body.custom_id} if body.custom_id is not None else {}),
     )
     session = await manager.backend.get_session(session_uid)
     return {
@@ -70,6 +78,7 @@ async def select_session_model(
             "provider": session.active_provider,
             "model": session.active_model,
             "thinkingLevel": session.active_thinking,
+            **({"customId": session.custom_id} if session.custom_id is not None else {}),
         },
     }
 

{ms_tau_sdk-2.0.0.dev29 → ms_tau_sdk-2.0.0.dev32}/src/ms_tau_sdk/backend/client.py

@@ -356,9 +356,16 @@ class MainSequenceClient:
                 detail=error.errors(include_input=False),
             ) from error
 
-    async def list_model_providers(self) -> dict[str, Any]:
+    async def list_model_providers(
+        self, *, organization_environment_uid: str | None = None
+    ) -> dict[str, Any]:
         """Read the authenticated user's safe provider catalog from Main Sequence."""
-        data = await self._request("GET", MODEL_PROVIDERS, idempotent=True)
+        options: dict[str, Any] = (
+            {"params": {"organization_environment_uid": organization_environment_uid}}
+            if organization_environment_uid
+            else {}
+        )
+        data = await self._request("GET", MODEL_PROVIDERS, idempotent=True, **options)
         if not isinstance(data, dict) or not isinstance(data.get("providers"), list):
             raise BackendError("Backend model-provider catalog response is invalid")
         return data
@@ -370,6 +377,7 @@ class MainSequenceClient:
         provider: str,
         model: str,
         thinking_level: str | None,
+        custom_id: str | None = None,
     ) -> AgentSession:
         payload: dict[str, Any] = {
             "llm_provider": provider,
@@ -377,13 +385,18 @@ class MainSequenceClient:
         }
         if thinking_level is not None:
             payload["llm_thinking"] = thinking_level
+        if custom_id is not None:
+            payload["custom_id"] = custom_id
         data = await self._request(
             "PATCH",
             agent_session(session_uid),
             json=payload,
             idempotent=True,
         )
-        return AgentSession.model_validate(data)
+        session = AgentSession.model_validate(data)
+        if custom_id is not None and session.custom_id != custom_id:
+            raise BackendError("Backend did not select the requested configured provider")
+        return session
 
     async def get_agent_card(self, session_uid: str) -> AgentCardEnvelope:
         data = await self._request(
@@ -601,23 +614,27 @@ class MainSequenceClient:
         model: str,
         session_uid: str,
         holder_id: str,
+        custom_id: str | None = None,
     ) -> ProviderExecutionEvidence:
+        payload: dict[str, Any] = {
+            "agent_session_uid": session_uid,
+            "providers": [provider],
+            "holder_id": holder_id,
+            "supported_provider_control_schema_versions": [1],
+            "execution_selection": {"provider": provider, "model": model},
+        }
+        if custom_id is not None:
+            payload["custom_id"] = custom_id
         data = await self._request(
             "POST",
             model_provider_credentials("hydrate"),
-            json={
-                "agent_session_uid": session_uid,
-                "providers": [provider],
-                "holder_id": holder_id,
-                "supported_provider_control_schema_versions": [1],
-                "execution_selection": {
-                    "provider": provider,
-                    "model": model,
-                },
-            },
+            json=payload,
             idempotent=True,
         )
-        return self._provider_evidence(provider, data)
+        evidence = self._provider_evidence(provider, data)
+        if custom_id is not None and evidence.credential.custom_id != custom_id:
+            raise BackendError("Backend did not hydrate the requested configured provider")
+        return evidence
 
     async def hydrate_local_provider_credential(
         self,
@@ -626,24 +643,33 @@ class MainSequenceClient:
         model: str,
         thinking_level: str | None,
         holder_id: str,
+        custom_id: str | None = None,
+        organization_environment_uid: str | None = None,
     ) -> ProviderExecutionEvidence:
-        """Hydrate one explicit selection for the authenticated local user."""
-
+        """Hydrate an owned or shared selection using the backend's access checks."""
         selection: dict[str, str] = {"provider": provider, "model": model}
         if thinking_level:
             selection["thinking_level"] = thinking_level
+        payload: dict[str, Any] = {
+            "providers": [provider],
+            "holder_id": holder_id,
+            "supported_provider_control_schema_versions": [1],
+            "execution_selection": selection,
+        }
+        if organization_environment_uid is not None:
+            payload["organization_environment_uid"] = organization_environment_uid
+        if custom_id is not None:
+            payload["custom_id"] = custom_id
         data = await self._request(
             "POST",
             model_provider_credentials("hydrate"),
-            json={
-                "providers": [provider],
-                "holder_id": holder_id,
-                "supported_provider_control_schema_versions": [1],
-                "execution_selection": selection,
-            },
+            json=payload,
             idempotent=True,
         )
-        return self._provider_evidence(provider, data)
+        evidence = self._provider_evidence(provider, data)
+        if custom_id is not None and evidence.credential.custom_id != custom_id:
+            raise BackendError("Backend did not hydrate the requested configured provider")
+        return evidence
 
     def _provider_evidence(self, provider: str, data: object) -> ProviderExecutionEvidence:
         if not isinstance(data, dict):
@@ -679,6 +705,10 @@ class MainSequenceClient:
         return ProviderCredential.model_validate(
             {
                 "provider": provider,
+                "custom_id": hydrated.get("custom_id"),
+                "model_provider_credential_uid": hydrated.get("uid"),
+                "organization_environment_uid": hydrated.get("organization_environment_uid"),
+                "owner_user_uid": hydrated.get("user_uid"),
                 "credential_kind": credential_kind,
                 "api_key": raw.get("api_key") or raw.get("key"),
                 "access_token": access_token,

{ms_tau_sdk-2.0.0.dev29 → ms_tau_sdk-2.0.0.dev32}/src/ms_tau_sdk/backend/local.py

@@ -147,8 +147,15 @@ class LocalDevelopmentBackend(MainSequenceClient):
     async def aclose(self) -> None:
         await self._services.aclose()
 
-    async def list_model_providers(self) -> dict[str, Any]:
-        return await self._services.list_model_providers()
+    async def list_model_providers(
+        self, *, organization_environment_uid: str | None = None
+    ) -> dict[str, Any]:
+        environment_uid = (
+            organization_environment_uid or self.settings.local_organization_environment_uid
+        )
+        return await self._services.list_model_providers(
+            **({"organization_environment_uid": environment_uid} if environment_uid else {})
+        )
 
     async def _ensure_initialized(self) -> None:
         if self._initialized:
@@ -391,6 +398,13 @@ class LocalDevelopmentBackend(MainSequenceClient):
                 "TEXT NOT NULL DEFAULT ''",
             )
             self._ensure_schema_column(connection, "sessions", "active_task_attempt_uid", "TEXT")
+            self._ensure_schema_column(connection, "sessions", "custom_id", "TEXT")
+            self._ensure_schema_column(
+                connection, "sessions", "model_provider_credential_uid", "TEXT"
+            )
+            self._ensure_schema_column(
+                connection, "sessions", "organization_environment_uid", "TEXT"
+            )
             self._ensure_schema_column(connection, "entries", "turn_uid", "TEXT")
             self._ensure_schema_column(connection, "a2a_task_attempts", "turn_uid", "TEXT")
             self._ensure_schema_column(
@@ -513,14 +527,31 @@ class LocalDevelopmentBackend(MainSequenceClient):
         return "sha256:" + hashlib.sha256(payload).hexdigest()
 
     async def _hydrate_evidence(
-        self, *, holder_id: str, selection: tuple[str, str, str | None] | None = None
+        self,
+        *,
+        holder_id: str,
+        selection: tuple[str, str, str | None] | None = None,
+        custom_id: str | None = None,
+        credential_uid: str | None = None,
+        organization_environment_uid: str | None = None,
     ) -> ProviderExecutionEvidence:
         provider, model, thinking = selection or self._selection()
+        options: dict[str, Any] = {}
+        if custom_id is None and selection is None:
+            custom_id = self.settings.local_custom_id
+        environment_uid = (
+            organization_environment_uid or self.settings.local_organization_environment_uid
+        )
+        if custom_id is not None:
+            options["custom_id"] = custom_id
+        if environment_uid is not None:
+            options["organization_environment_uid"] = environment_uid
         evidence = await self._services.hydrate_local_provider_credential(
             provider,
             model=model,
             thinking_level=thinking,
             holder_id=holder_id,
+            **options,
         )
         if (
             evidence.provider_control.provider != provider
@@ -529,6 +560,16 @@ class LocalDevelopmentBackend(MainSequenceClient):
             raise BackendConflictError(
                 "Main Sequence provider evidence does not match the local selection"
             )
+        if (
+            credential_uid is not None
+            and evidence.credential.model_provider_credential_uid != credential_uid
+        ):
+            raise BackendConflictError("Main Sequence changed the local session credential")
+        if (
+            environment_uid is not None
+            and evidence.credential.organization_environment_uid != environment_uid
+        ):
+            raise BackendConflictError("Main Sequence changed the local session Environment")
         return evidence
 
     async def prefetch_provider(self) -> None:
@@ -560,6 +601,10 @@ class LocalDevelopmentBackend(MainSequenceClient):
         return {
             "credentials": {
                 credential.provider: {
+                    "uid": credential.model_provider_credential_uid,
+                    "custom_id": credential.custom_id,
+                    "organization_environment_uid": credential.organization_environment_uid,
+                    "user_uid": credential.owner_user_uid,
                     "credential_kind": credential.credential_kind,
                     "credential": {key: value for key, value in raw.items() if value is not None},
                     "version": credential.metadata.get("version"),
@@ -576,14 +621,24 @@ class LocalDevelopmentBackend(MainSequenceClient):
         session_uid: str | None = None,
         agent_uid: str | None = None,
         holder_id: str,
+        custom_id: str | None = None,
     ) -> ProviderExecutionEvidence:
         del agent_uid
         selected_provider, selected_model, selected_thinking = self._selection()
+        credential_uid = None
+        environment_uid = None
         if session_uid is not None:
             session = await self.get_session(session_uid)
             selected_provider = session.active_provider or ""
             selected_model = session.active_model or ""
             selected_thinking = session.active_thinking
+            if custom_id is not None and custom_id != session.custom_id:
+                raise BackendConflictError(
+                    "Local refresh must retain the session's configured provider"
+                )
+            custom_id = session.custom_id
+            credential_uid = session.model_provider_credential_uid
+            environment_uid = session.organization_environment_uid
         if provider != selected_provider or model != selected_model:
             raise BackendConflictError(
                 "Local provider refresh does not match the session selection"
@@ -595,6 +650,9 @@ class LocalDevelopmentBackend(MainSequenceClient):
         return await self._hydrate_evidence(
             holder_id=holder_id,
             selection=(selected_provider, selected_model, selected_thinking),
+            custom_id=custom_id,
+            credential_uid=credential_uid,
+            organization_environment_uid=environment_uid,
         )
 
     async def get_session(self, session_uid: str) -> AgentSession:
@@ -617,13 +675,19 @@ class LocalDevelopmentBackend(MainSequenceClient):
         provider: str,
         model: str,
         thinking_level: str | None,
+        custom_id: str | None = None,
     ) -> AgentSession:
         if not provider or not model:
             raise BackendConflictError("A provider and model are required")
         selection = (provider, model, thinking_level)
-        await self._hydrate_evidence(
+        previous = await self.get_session(session_uid)
+        retained = custom_id is None and previous.active_provider == provider
+        evidence = await self._hydrate_evidence(
             holder_id=f"local-selection-{self.settings.workspace_digest}",
             selection=selection,
+            custom_id=previous.custom_id if retained else custom_id,
+            credential_uid=previous.model_provider_credential_uid if retained else None,
+            organization_environment_uid=previous.organization_environment_uid,
         )
 
         def operation() -> None:
@@ -637,11 +701,16 @@ class LocalDevelopmentBackend(MainSequenceClient):
                     raise BackendConflictError("Cannot change a model while the session is working")
                 connection.execute(
                     "UPDATE sessions SET provider = ?, model = ?, thinking = ?, "
-                    "runtime_config_sha256 = ?, updated_at = ? WHERE uid = ?",
+                    "runtime_config_sha256 = ?, updated_at = ?, custom_id = ?, "
+                    "model_provider_credential_uid = ?, "
+                    "organization_environment_uid = ? WHERE uid = ?",
                     (
                         *selection,
                         self._runtime_config_sha256(selection),
                         _iso(_utcnow()),
+                        evidence.credential.custom_id,
+                        evidence.credential.model_provider_credential_uid,
+                        evidence.credential.organization_environment_uid,
                         session_uid,
                     ),
                 )
@@ -1504,6 +1573,9 @@ class LocalDevelopmentBackend(MainSequenceClient):
                 "active_provider": str(row["provider"]),
                 "active_model": str(row["model"]),
                 "active_thinking": row["thinking"],
+                "custom_id": row["custom_id"],
+                "model_provider_credential_uid": row["model_provider_credential_uid"],
+                "organization_environment_uid": row["organization_environment_uid"],
                 "status": "local",
                 "runtime_capabilities": LOCAL_RUNTIME_CAPABILITIES,
                 "runtime_config_sha256": str(row["runtime_config_sha256"]),
@@ -1586,18 +1658,31 @@ class LocalDevelopmentBackend(MainSequenceClient):
         session_uid: str,
         request: TauRuntimeBootstrapRequest,
     ) -> TauRuntimeBootstrap:
-        def stored_selection() -> tuple[str, str, str | None]:
+        def stored_selection() -> tuple[
+            tuple[str, str, str | None], str | None, str | None, str | None
+        ]:
             with closing(self._connect()) as connection:
                 row = connection.execute(
-                    "SELECT provider, model, thinking FROM sessions WHERE uid = ?", (session_uid,)
+                    "SELECT * FROM sessions WHERE uid = ?", (session_uid,)
                 ).fetchone()
                 if row is None:
-                    return self._selection()
-                return str(row["provider"]), str(row["model"]), row["thinking"]
+                    return self._selection(), self.settings.local_custom_id, None, None
+                return (
+                    (str(row["provider"]), str(row["model"]), row["thinking"]),
+                    row["custom_id"],
+                    row["model_provider_credential_uid"],
+                    row["organization_environment_uid"],
+                )
 
-        selection = await self._run(stored_selection)
+        selection, custom_id, credential_uid, environment_uid = await self._run(stored_selection)
         provider, model, thinking = selection
-        evidence = await self._hydrate_evidence(holder_id=request.holder_id, selection=selection)
+        evidence = await self._hydrate_evidence(
+            holder_id=request.holder_id,
+            selection=selection,
+            custom_id=custom_id,
+            credential_uid=credential_uid,
+            organization_environment_uid=environment_uid,
+        )
 
         def operation() -> TauRuntimeBootstrap:
             now = _utcnow()
@@ -1640,6 +1725,20 @@ class LocalDevelopmentBackend(MainSequenceClient):
                     raise BackendConflictError(
                         "Existing local session uses a different provider/model selection"
                     )
+                if row is not None and row["model_provider_credential_uid"] is None:
+                    connection.execute(
+                        "UPDATE sessions SET custom_id = ?, model_provider_credential_uid = ?, "
+                        "organization_environment_uid = ? WHERE uid = ?",
+                        (
+                            evidence.credential.custom_id,
+                            evidence.credential.model_provider_credential_uid,
+                            evidence.credential.organization_environment_uid,
+                            session_uid,
+                        ),
+                    )
+                    row = connection.execute(
+                        "SELECT * FROM sessions WHERE uid = ?", (session_uid,)
+                    ).fetchone()
                 assert row is not None
                 current_lease = connection.execute(
                     "SELECT * FROM leases WHERE session_uid = ?",

{ms_tau_sdk-2.0.0.dev29 → ms_tau_sdk-2.0.0.dev32}/src/ms_tau_sdk/backend/models.py

@@ -52,7 +52,10 @@ class BackendRequestModel(BackendModel):
 
 
 class AgentSession(BackendModel):
+    organization_environment_uid: str | None = None
     uid: str
+    custom_id: str | None = None
+    model_provider_credential_uid: str | None = None
     agent_uid: str | None = None
     harness: HarnessKind
     harness_protocol: HarnessProtocol
@@ -389,6 +392,10 @@ class TauResumeSnapshotUploadResponse(BackendModel):
 
 class ProviderCredential(BackendModel):
     provider: str
+    custom_id: str | None = None
+    model_provider_credential_uid: str | None = None
+    organization_environment_uid: str | None = None
+    owner_user_uid: str | None = None
     credential_kind: str = "api_key"
     api: str | None = None
     api_key: SecretStr | None = None

{ms_tau_sdk-2.0.0.dev29 → ms_tau_sdk-2.0.0.dev32}/src/ms_tau_sdk/providers/factory.py

@@ -291,6 +291,11 @@ class ProviderFactory:
         credential = evidence.credential
         if credential.provider != provider_name:
             raise ConfigurationError("Backend credential does not match the selected provider")
+        if (
+            session.model_provider_credential_uid is not None
+            and credential.model_provider_credential_uid != session.model_provider_credential_uid
+        ):
+            raise ConfigurationError("Backend credential does not match the session binding")
         thinking_level = self.validate_execution(
             evidence.provider_control,
             provider_name=provider_name,
@@ -324,6 +329,15 @@ class ProviderFactory:
                             "Provider-control execution capability changed during "
                             "credential refresh"
                         )
+                    if cached_credential.model_provider_credential_uid is not None and (
+                        refreshed.credential.model_provider_credential_uid
+                        != cached_credential.model_provider_credential_uid
+                        or refreshed.credential.organization_environment_uid
+                        != cached_credential.organization_environment_uid
+                    ):
+                        raise ConfigurationError(
+                            "Credential refresh changed the configured provider"
+                        )
                     cached_credential = refreshed.credential
                 return cached_credential
 

{ms_tau_sdk-2.0.0.dev29 → ms_tau_sdk-2.0.0.dev32}/src/ms_tau_sdk/runtime/manager.py

@@ -2080,6 +2080,7 @@ class SessionRuntimeManager:
         provider: str,
         model: str,
         thinking_level: str | None,
+        custom_id: str | None = None,
     ) -> None:
         """Switch an idle session and reload it with backend-authorized evidence."""
         if not self.settings.local_mode:
@@ -2105,6 +2106,7 @@ class SessionRuntimeManager:
                         provider=provider,
                         model=model,
                         thinking_level=thinking_level,
+                        **({"custom_id": custom_id} if custom_id is not None else {}),
                     )
                 except BaseException:
                     runtime.evicting = False
@@ -2119,6 +2121,11 @@ class SessionRuntimeManager:
                         provider=previous.active_provider,
                         model=previous.active_model,
                         thinking_level=previous.active_thinking,
+                        **(
+                            {"custom_id": previous.custom_id}
+                            if previous.custom_id is not None
+                            else {}
+                        ),
                     )
                     await self._load(session_uid)
                 except Exception:

{ms_tau_sdk-2.0.0.dev29 → ms_tau_sdk-2.0.0.dev32}/src/ms_tau_sdk/settings.py

@@ -152,6 +152,10 @@ class TauSDKSettings(BaseSettings):
         default=False,
         validation_alias="TAU_EXCLUDE_MAINSEQUENCE_MCP",
     )
+    local_custom_id: str | None = Field(default=None, validation_alias="TAU_LOCAL_CUSTOM_ID")
+    local_organization_environment_uid: str | None = Field(
+        default=None, validation_alias="TAU_LOCAL_ORGANIZATION_ENVIRONMENT_UID"
+    )
     local_provider: str | None = Field(default=None, validation_alias="TAU_LOCAL_PROVIDER")
     local_model: str | None = Field(default=None, validation_alias="TAU_LOCAL_MODEL")
     local_thinking: (