ms-tau-sdk 2.0.2.dev34__tar.gz → 2.0.3.dev35__tar.gz

{ms_tau_sdk-2.0.2.dev34 → ms_tau_sdk-2.0.3.dev35}/CHANGELOG.md

@@ -1,5 +1,17 @@
 # Changelog
 
+## Unreleased
+
+- Main Sequence MCP no longer offers `agent_session.resolve_runtime_access` to the model. Its
+  result carries a short-lived runtime token for direct-runtime clients, and Tau's generic MCP
+  projection copied that token into model-visible tool content and into tool details, which reach
+  stream events and session history. Tau never needs the token: agent-to-agent turns use
+  `a2a.send_message`. The operation is left out of the session's tool list, so
+  `mainsequence__agent_session_resolve_runtime_access` is no longer a tool; every other MCP tool
+  and its result are unchanged. Direct-runtime clients that call the operation themselves are
+  unaffected. See the 2026-10-06 amendment of ADR 0002
+  ([issue #65](https://github.com/mainsequence-sdk/ms-tau-sdk/issues/65)).
+
 ## 2.0.2 — 2026-10-06
 
 - Runtime credentials require the projected workload identity token file. The runtime credential

{ms_tau_sdk-2.0.2.dev34 → ms_tau_sdk-2.0.3.dev35}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ms-tau-sdk
-Version: 2.0.2.dev34
+Version: 2.0.3.dev35
 Summary: Workspace-bound Tau application primitives for Main Sequence projects
 Project-URL: Changelog, https://github.com/mainsequence-sdk/ms-tau-sdk/blob/development/CHANGELOG.md
 Project-URL: Documentation, https://github.com/mainsequence-sdk/ms-tau-sdk/tree/development/docs

{ms_tau_sdk-2.0.2.dev34 → ms_tau_sdk-2.0.3.dev35}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ms-tau-sdk"
-version = "2.0.2.dev34"
+version = "2.0.3.dev35"
 description = "Workspace-bound Tau application primitives for Main Sequence projects"
 readme = "README.md"
 requires-python = ">=3.13"

{ms_tau_sdk-2.0.2.dev34 → ms_tau_sdk-2.0.3.dev35}/src/ms_tau_sdk/runtime/manager.py

@@ -1116,13 +1116,17 @@ class SessionRuntimeManager:
             )
             cwd = self._resolve_cwd()
             project_extension_state = ProjectExtensionState(enabled=True)
-            caller_session_proof = None
+            caller_session_proof: dict[str, JSONValue] | None = None
             if not self.settings.local_mode:
                 caller_session_proof = {
                     "caller_agent_session_uid": session_uid,
                     "lease_holder_id": lease.holder_id,
                     "lease_token": lease.lease_token,
                 }
+
+            async def record_secret_entry(payload: dict[str, JSONValue]) -> None:
+                await coding_session.append_custom_entry("mainsequence.secret_entry", payload)
+
             tools = []
             if self.settings.exclude_base_tools:
                 # Tau lists skills only when a tool named `read` exists. The tool runs only in
@@ -1134,6 +1138,8 @@ class SessionRuntimeManager:
                 tools.extend(
                     create_mainsequence_mcp_tools(
                         mcp_client,
+                        session_uid=session_uid,
+                        on_secret_entry=record_secret_entry,
                         caller_session_proof=caller_session_proof,
                         allow_missing_session_proof=self.settings.local_mode,
                     )
@@ -1202,6 +1208,7 @@ class SessionRuntimeManager:
                 provider_name=provider_runtime.name,
                 model=provider_runtime.model,
                 mcp_client=mcp_client,
+                secret_entry_proof=caller_session_proof,
                 runtime_config_sha256=str(session_extra.get("runtime_config_sha256", "")),
                 provider_control_schema=bootstrap.provider_control.schema_version,
                 catalog_digest=bootstrap.provider_control.catalog_digest,

ms_tau_sdk-2.0.3.dev35/src/ms_tau_sdk/runtime/secret_entry.py

@@ -0,0 +1,74 @@
+"""Refresh persisted, reference-only Secret requests before a resumed conversation turn."""
+
+from __future__ import annotations
+
+import json
+from collections.abc import Awaitable, Callable, Sequence
+
+from tau_agent.session import CustomEntry, SessionEntry
+from tau_agent.types import JSONValue
+
+from ms_tau_sdk.backend.mcp import MainSequenceMCPClient
+from ms_tau_sdk.tools.secret_entry import SecretEntryStatus, secret_entry_result
+
+
+async def refresh_secret_entries(
+    *,
+    entries: Sequence[SessionEntry],
+    client: MainSequenceMCPClient,
+    private_proof: dict[str, JSONValue] | None,
+    record: Callable[[dict[str, JSONValue]], Awaitable[None]],
+) -> str:
+    latest: dict[str, SecretEntryStatus] = {}
+    for entry in entries:
+        if isinstance(entry, CustomEntry) and entry.namespace == "mainsequence.secret_entry":
+            # Stored state is not proof of completion. Revalidate pending references below.
+            try:
+                status = SecretEntryStatus.model_validate_json(json.dumps(entry.data))
+            except ValueError:
+                raise RuntimeError(
+                    "Stored Secret entry status is invalid. Check the request before continuing."
+                ) from None
+            latest[str(status.uid)] = status
+    checks = []
+    for status in latest.values():
+        if status.status not in {"pending", "submitting"}:
+            continue
+        try:
+            arguments: dict[str, object] = {
+                "request_uid": str(status.uid),
+                "organization_environment_uid": str(status.organization_environment_uid),
+            }
+            result = await client.call_tool(
+                "secret_entry.status",
+                arguments,
+                meta={"mainsequence.ai/caller-session-proof/v1": private_proof}
+                if private_proof is not None
+                else None,
+            )
+            projected = secret_entry_result("secret_entry.status", result)
+            if not isinstance(projected.details, dict):
+                raise ValueError("Unverified status")
+            payload = projected.details.get("structured_content")
+            if projected.details.get("is_error") or not isinstance(payload, dict):
+                raise ValueError("Unverified status")
+            if payload.get("uid") != str(status.uid) or payload.get(
+                "organization_environment_uid"
+            ) != str(status.organization_environment_uid):
+                raise ValueError("Unbound status")
+        except Exception:
+            # Do not run the model with an assumed success or copy transport errors to history.
+            raise RuntimeError(
+                "Secret entry status could not be verified. Retry the conversation after "
+                "checking the private page; never send a value in chat."
+            ) from None
+        await record(payload)
+        checks.append(projected.text)
+    if not checks:
+        return ""
+    return (
+        "\n\nPlatform Secret-entry status checked by the host before this turn:\n"
+        + "\n".join(checks)
+        + "\nContinue dependent work only for confirmed completion. Do not repeat an already "
+        "completed business operation or request the secret value."
+    )

{ms_tau_sdk-2.0.2.dev34 → ms_tau_sdk-2.0.3.dev35}/src/ms_tau_sdk/runtime/session.py

@@ -16,6 +16,7 @@ from ms_tau_sdk.backend.models import TauTurnCommit
 from ms_tau_sdk.runtime.events import TauRuntimeEvent, translate_tau_event
 from ms_tau_sdk.runtime.extensions import ProjectExtensionState
 from ms_tau_sdk.runtime.provenance import PROVENANCE_NAMESPACE, TurnProvenance
+from ms_tau_sdk.runtime.secret_entry import refresh_secret_entries
 from ms_tau_sdk.sessions.storage import BackendSessionStorage
 
 type PlatformEvent = tuple[str, dict[str, JSONValue]]
@@ -31,6 +32,7 @@ class ActiveSessionRuntime:
     provider_name: str = ""
     model: str = ""
     mcp_client: MainSequenceMCPClient | None = None
+    secret_entry_proof: dict[str, JSONValue] | None = field(default=None, repr=False)
     lease_renew_task: asyncio.Task[None] | None = None
     persistence_task: asyncio.Task[object] | None = None
     pending_snapshot_commit: TauTurnCommit | None = None
@@ -91,6 +93,19 @@ class ActiveSessionRuntime:
             if platform_event is not None:
                 namespace, payload = platform_event
                 await self.coding_session.append_custom_entry(namespace, dict(payload))
+            if self.mcp_client is not None:
+
+                async def record_secret_entry(payload: dict[str, JSONValue]) -> None:
+                    await self.coding_session.append_custom_entry(
+                        "mainsequence.secret_entry", payload
+                    )
+
+                content += await refresh_secret_entries(
+                    entries=await self.storage.read_all(),
+                    client=self.mcp_client,
+                    private_proof=self.secret_entry_proof,
+                    record=record_secret_entry,
+                )
             async for event in self.coding_session.prompt(content):
                 translated = translate_tau_event(event)
                 if settled_event is not None and translated.type != "agent_settled":

{ms_tau_sdk-2.0.2.dev34 → ms_tau_sdk-2.0.3.dev35}/src/ms_tau_sdk/tools/mainsequence_mcp.py

@@ -4,9 +4,10 @@ from __future__ import annotations
 
 import json
 import re
-from collections.abc import Mapping
+from collections.abc import Awaitable, Callable, Mapping
 from copy import deepcopy
 from typing import Literal, cast
+from uuid import NAMESPACE_URL, uuid5
 
 from mcp import types
 from tau_agent.messages import ImageContent, TextContent
@@ -23,12 +24,17 @@ from ms_tau_sdk.backend.mcp import (
     ENVIRONMENT_UID_ARGUMENT,
     MainSequenceMCPClient,
 )
+from ms_tau_sdk.tools.secret_entry import secret_entry_result
 
 _INVALID_TOOL_NAME = re.compile(r"[^A-Za-z0-9_-]")
 _RESOURCE_TOOL_NAME = "mainsequence__read_resource"
 CALLER_SESSION_PROOF_META_KEY = "mainsequence.ai/caller-session-proof/v1"
 CALLER_SESSION_PROOF_REQUIRED_META_KEY = "mainsequence.ai/requires-caller-session-proof/v1"
 A2A_SEND_TOOL = "a2a.send_message"
+# These operations return credentials for direct-runtime clients. Tau never calls them for
+# the model: agent-to-agent turns use a2a.send_message, so the credential stays out of model
+# content, tool details, events, and persisted history.
+CREDENTIAL_RESULT_MCP_TOOLS = frozenset({"agent_session.resolve_runtime_access"})
 
 
 def _tau_tool_name(mcp_name: str) -> str:
@@ -51,6 +57,8 @@ def _tool_result(
     canonical_name: str,
     result: types.CallToolResult,
 ) -> AgentToolResult:
+    if canonical_name in {"secret_entry.start", "secret_entry.status", "secret_entry.cancel"}:
+        return secret_entry_result(canonical_name, result)
     content: list[TextContent | ImageContent] = []
     for block in result.content:
         if isinstance(block, types.TextContent):
@@ -87,6 +95,11 @@ def _tau_tool_input_schema(
     local_user_semantics: bool = False,
 ) -> Mapping[str, JSONValue]:
     schema = deepcopy(tool.inputSchema)
+    if tool.name == "secret_entry.start":
+        schema.get("properties", {}).pop("idempotency_key", None)
+        schema["required"] = [
+            name for name in schema.get("required", []) if name != "idempotency_key"
+        ]
     if tool.name == A2A_SEND_TOOL:
         properties = schema.setdefault("properties", {})
         if isinstance(properties, dict):
@@ -160,6 +173,8 @@ def _create_mcp_tool(
     tau_name: str,
     private_meta: Mapping[str, JSONValue] | None = None,
     local_user_semantics: bool = False,
+    session_uid: str | None = None,
+    on_secret_entry: Callable[[dict[str, JSONValue]], Awaitable[None]] | None = None,
 ) -> AgentTool:
     canonical_name = tool.name
     annotations = tool.annotations
@@ -177,7 +192,36 @@ def _create_mcp_tool(
         signal: ToolCancellationToken | None = None,
         on_update: ToolUpdateCallback | None = None,
     ) -> AgentToolResult:
-        del tool_call_id, on_update
+        del on_update
+        if canonical_name in {"secret_entry.start", "secret_entry.status", "secret_entry.cancel"}:
+            allowed = {"organization_environment_uid", "request_uid"}
+            if canonical_name == "secret_entry.start":
+                allowed = {
+                    "organization_environment_uid",
+                    "name",
+                    "secret_uid",
+                    "purpose",
+                    "consumer_user_uid",
+                }
+            if set(arguments) - allowed:
+                return AgentToolResult(
+                    content=[
+                        TextContent(
+                            text=(
+                                "Secret-entry tools accept only metadata and references. "
+                                "Enter values on the private page."
+                            )
+                        )
+                    ],
+                    details={"mcp_tool": canonical_name, "is_error": True},
+                )
+            if canonical_name == "secret_entry.start":
+                arguments = {
+                    **arguments,
+                    "idempotency_key": str(
+                        uuid5(NAMESPACE_URL, f"ms-tau-secret-entry:{session_uid}:{tool_call_id}")
+                    ),
+                }
         if signal is not None and signal.is_cancelled():
             return AgentToolResult(
                 content=[TextContent(text="Main Sequence MCP tool call was cancelled.")],
@@ -199,15 +243,35 @@ def _create_mcp_tool(
                 raise ValueError("Local A2A Task communication requires completion_policy 'poll'")
             if response_kind == "message" and completion_policy is not None:
                 raise ValueError("completion_policy is not valid for Message response_kind")
-        if private_meta is None:
-            result = await client.call_tool(canonical_name, dict(arguments))
-        else:
-            result = await client.call_tool(
-                canonical_name,
-                dict(arguments),
-                meta=dict(private_meta),
+        try:
+            if private_meta is None:
+                result = await client.call_tool(canonical_name, dict(arguments))
+            else:
+                result = await client.call_tool(
+                    canonical_name,
+                    dict(arguments),
+                    meta=dict(private_meta),
+                )
+        except Exception:
+            if canonical_name not in {
+                "secret_entry.start",
+                "secret_entry.status",
+                "secret_entry.cancel",
+            }:
+                raise
+            return secret_entry_result(
+                canonical_name, types.CallToolResult(content=[], isError=True)
             )
-        return _tool_result(canonical_name=canonical_name, result=result)
+        projected = _tool_result(canonical_name=canonical_name, result=result)
+        if (
+            canonical_name.startswith("secret_entry.")
+            and on_secret_entry is not None
+            and isinstance(projected.details, dict)
+        ):
+            payload = projected.details.get("structured_content")
+            if not projected.details.get("is_error") and isinstance(payload, dict):
+                await on_secret_entry(payload)
+        return projected
 
     return AgentTool(
         name=tau_name,
@@ -285,10 +349,14 @@ def create_mainsequence_mcp_tools(
     *,
     caller_session_proof: Mapping[str, JSONValue] | None = None,
     allow_missing_session_proof: bool = False,
+    session_uid: str | None = None,
+    on_secret_entry: Callable[[dict[str, JSONValue]], Awaitable[None]] | None = None,
 ) -> list[AgentTool]:
     tools: list[AgentTool] = []
     names: set[str] = set()
     for tool in client.tools:
+        if tool.name in CREDENTIAL_RESULT_MCP_TOOLS:
+            continue
         tau_name = _tau_tool_name(tool.name)
         if tau_name in names or tau_name == _RESOURCE_TOOL_NAME:
             raise ValueError(f"Main Sequence MCP tool name collision: {tool.name}")
@@ -304,6 +372,8 @@ def create_mainsequence_mcp_tools(
                     allow_missing_proof=allow_missing_session_proof,
                 ),
                 local_user_semantics=allow_missing_session_proof,
+                session_uid=session_uid,
+                on_secret_entry=on_secret_entry,
             )
         )
     if client.resources:

ms_tau_sdk-2.0.3.dev35/src/ms_tau_sdk/tools/secret_entry.py

@@ -0,0 +1,116 @@
+"""Reference-only Secret entry. Values travel directly from a private browser to Django."""
+
+from __future__ import annotations
+
+import json
+from datetime import datetime
+from typing import Literal
+from urllib.parse import parse_qs, urlsplit
+from uuid import UUID
+
+from mcp import types
+from pydantic import BaseModel, ConfigDict, ValidationError, model_validator
+from tau_agent.messages import TextContent
+from tau_agent.tools import AgentToolResult
+
+from ms_tau_sdk.runtime.task_context import active_task_execution
+
+
+class SecretEntryStatus(BaseModel):
+    model_config = ConfigDict(extra="forbid", strict=True)
+
+    uid: UUID
+    status: Literal["pending", "submitting", "completed", "cancelled", "expired", "failed"]
+    operation: Literal["create", "rotate"]
+    name: str
+    purpose: str
+    organization_environment_uid: UUID
+    organization_environment_name: str
+    requesting_agent_name: str | None
+    consumer_user_uid: UUID | None
+    secret_uid: UUID | None
+    entry_url: str
+    expires_at: datetime
+    error_code: str
+    requirement_reference: str
+
+    @model_validator(mode="after")
+    def trusted_entry_link(self) -> SecretEntryStatus:
+        url = urlsplit(self.entry_url)
+        local = url.scheme == "http" and url.hostname in {"localhost", "127.0.0.1"}
+        if (
+            (url.scheme != "https" and not local)
+            or not url.hostname
+            or url.username
+            or url.password
+            or url.fragment
+            or url.path != "/app/main-sequence-foundry/secrets"
+            or parse_qs(url.query)
+            != {
+                "secretEntryRequest": [str(self.uid)],
+                "organization_environment_uid": [str(self.organization_environment_uid)],
+            }
+            or self.requirement_reference != f"secret-entry:{self.uid}"
+            or (self.status != "completed" and self.secret_uid is not None)
+        ):
+            raise ValueError("Invalid Secret-entry binding")
+        return self
+
+
+def secret_entry_result(canonical_name: str, result: types.CallToolResult) -> AgentToolResult:
+    """Ignore free-form MCP content; accept only the complete value-free status contract."""
+    try:
+        if result.isError or result.structuredContent is None:
+            raise ValueError("Secret entry is unavailable")
+        # Strict JSON accepts UUID/date strings but rejects coercion and extra fields.
+        status = SecretEntryStatus.model_validate_json(json.dumps(result.structuredContent))
+    except (ValidationError, ValueError, TypeError):
+        return AgentToolResult(
+            content=[
+                TextContent(
+                    text=(
+                        "Secret entry could not be verified. Check access or retry; "
+                        "never send a value in chat."
+                    )
+                )
+            ],
+            details={"mcp_tool": canonical_name, "is_error": True},
+        )
+    payload = status.model_dump(mode="json")
+    if status.status == "pending":
+        guidance = (
+            f"Enter the value on the authenticated private page: {status.entry_url}\n"
+            "Open it yourself outside agent browser control or screen capture. "
+            "Do not paste the value here. "
+            "Wait for the person, then call secret_entry.status; "
+            "opening the page does not complete the request."
+        )
+    elif status.status == "submitting":
+        guidance = (
+            "Storage is in progress. Check secret_entry.status; do not repeat the submission."
+        )
+    elif status.status == "completed":
+        guidance = "Django confirmed storage. Saving does not grant access to a consumer."
+    elif status.error_code == "storage_outcome_unknown":
+        guidance = (
+            "The storage outcome is uncertain. Do not retry the value write; "
+            "ask an operator to reconcile this request."
+        )
+    else:
+        guidance = f"Secret entry is {status.status}. No completion is confirmed."
+    task = active_task_execution()
+    if (
+        canonical_name == "secret_entry.start"
+        and status.status == "pending"
+        and task is not None
+        and task.interruption_status is None
+    ):
+        task.request_interruption(
+            status="auth_required",
+            text=guidance,
+            details={"requirementReference": status.requirement_reference},
+        )
+    return AgentToolResult(
+        content=[TextContent(text=guidance), TextContent(text=json.dumps(payload, sort_keys=True))],
+        details={"mcp_tool": canonical_name, "is_error": False, "structured_content": payload},
+    )