proteworks 0.1.9__tar.gz → 0.1.10__tar.gz

{proteworks-0.1.9 → proteworks-0.1.10}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proteworks
-Version: 0.1.9
+Version: 0.1.10
 Summary: Sync files with Proteworks using file-browser paths.
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{proteworks-0.1.9 → proteworks-0.1.10}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "proteworks"
-version = "0.1.9"
+version = "0.1.10"
 description = "Sync files with Proteworks using file-browser paths."
 readme = "README.md"
 requires-python = ">=3.11"

{proteworks-0.1.9 → proteworks-0.1.10}/src/proteworks/__init__.py

@@ -8,6 +8,6 @@ try:
     try:
         __version__ = version("proteworks")
     except PackageNotFoundError:
-        __version__ = "0.1.9"
+        __version__ = "0.1.10"
 except Exception:  # pragma: no cover
-    __version__ = "0.1.9"
+    __version__ = "0.1.10"

{proteworks-0.1.9 → proteworks-0.1.10}/src/proteworks/api.py

@@ -37,13 +37,21 @@ class ApiError(Exception):
 
 
 def assert_allowed_storage_url(url: str) -> None:
-    """Reject signed URLs whose host is outside the storage allowlist (SSRF defense)."""
+    """Reject signed URLs whose host is outside the storage allowlist (SSRF defense).
+
+    Production GCS signed URLs must be HTTPS. Plain HTTP is allowed only for
+    localhost / 127.0.0.1 (FakeApi and local integration tests).
+    """
     parsed = urlparse(str(url or ""))
-    if parsed.scheme not in {"https", "http"}:
-        raise ApiError("Storage URL must use http(s)", 400)
     host = (parsed.hostname or "").lower()
     if not host:
         raise ApiError("Storage URL missing host", 400)
+    if parsed.scheme == "https":
+        pass
+    elif parsed.scheme == "http" and host in {"localhost", "127.0.0.1"}:
+        pass
+    else:
+        raise ApiError("Storage URL must use https", 400)
     suffixes = allowed_storage_host_suffixes()
     if any(host == suffix or host.endswith("." + suffix) for suffix in suffixes):
         return

{proteworks-0.1.9 → proteworks-0.1.10}/src/proteworks/auth.py

@@ -12,7 +12,13 @@ from urllib.parse import parse_qs, urlencode, urlparse
 
 import httpx
 
-from proteworks.config import LOOPBACK_PORT, LOOPBACK_REDIRECT_PATH, Settings, TokenStore
+from proteworks.config import (
+    LOOPBACK_PORT,
+    LOOPBACK_REDIRECT_PATH,
+    ConfigStore,
+    Settings,
+    TokenStore,
+)
 
 
 def pkce_pair() -> tuple[str, str]:
@@ -118,4 +124,7 @@ def login(settings: Settings, token_store: TokenStore, stderr) -> None:
     if not access_token:
         raise SystemExit("Login failed.")
     token_store.set(access_token)
+    # Bind credentials to this API URL so a later PROTEWORKS_API_URL change cannot
+    # silently send the bearer token to a different host.
+    ConfigStore(settings.config_dir / "config.json").bind_api_url(settings.api_url)
     print("Signed in.", file=stderr)

{proteworks-0.1.9 → proteworks-0.1.10}/src/proteworks/config.py

@@ -101,6 +101,12 @@ class ConfigStore:
         data["api_url"] = api_url
         self.write(data)
 
+    def bind_api_url(self, api_url: str) -> None:
+        """Persist the API URL this credential set is bound to (without changing org)."""
+        data = self.read()
+        data["api_url"] = api_url
+        self.write(data)
+
     def bound_api_url(self) -> Optional[str]:
         value = self.read().get("api_url")
         return str(value) if value else None
@@ -110,8 +116,9 @@ class TokenStore:
     """Access token in the OS keychain, with a config-dir file fallback.
 
     Claude Science sandboxes block D-Bus/SecretService, so keyring alone fails
-    inside the connector. The file lives under ``~/.config/proteworks`` (mode
-    0600), which ``setup-claude-science`` already grants read access.
+    inside the connector. When keyring cannot store the token, the file lives
+    under ``~/.config/proteworks`` (mode 0600), which ``setup-claude-science``
+    already grants read access. A working keyring never copies the token to disk.
     """
 
     SERVICE = "proteworks"
@@ -125,15 +132,14 @@ class TokenStore:
     def get(self) -> Optional[str]:
         token = self._keyring_get()
         if token:
-            # Lazy-migrate so an existing keychain login works inside Science.
-            if not self.path.is_file():
-                self._file_set(token)
             return token
         return self._file_get()
 
     def set(self, token: str) -> None:
+        if self._keyring_set(token):
+            return
+        # Keyring unavailable (e.g. Claude Science sandbox): persist to disk only.
         self._file_set(token)
-        self._keyring_set(token)
 
     def _keyring_get(self) -> Optional[str]:
         try:
@@ -143,14 +149,15 @@ class TokenStore:
         except Exception:
             return None
 
-    def _keyring_set(self, token: str) -> None:
+    def _keyring_set(self, token: str) -> bool:
+        """Store in keyring. Returns True on success."""
         try:
             import keyring
 
             keyring.set_password(self.SERVICE, "access_token", token)
+            return True
         except Exception:
-            # File fallback is enough for sandboxed MCP hosts.
-            return
+            return False
 
     def _file_get(self) -> Optional[str]:
         try:
@@ -163,8 +170,16 @@ class TokenStore:
 
     def _file_set(self, token: str) -> None:
         self.path.parent.mkdir(parents=True, exist_ok=True)
-        self.path.write_text(token + "\n", encoding="utf-8")
-        try:
-            os.chmod(self.path, 0o600)
-        except OSError:
-            pass
+        flags = os.O_WRONLY | os.O_CREAT | os.O_TRUNC
+        fd = os.open(self.path, flags, 0o600)
+        with os.fdopen(fd, "w", encoding="utf-8") as fh:
+            fh.write(token + "\n")
+        mode = self.path.stat().st_mode & 0o777
+        if mode != 0o600:
+            try:
+                os.chmod(self.path, 0o600)
+            except OSError as exc:
+                raise OSError(f"Could not set credentials file mode 0600: {self.path}") from exc
+            mode = self.path.stat().st_mode & 0o777
+            if mode != 0o600:
+                raise OSError(f"Credentials file mode is {oct(mode)}, expected 0o600: {self.path}")

proteworks-0.1.10/src/proteworks/mcp/profile.py

@@ -0,0 +1,78 @@
+"""MCP capability profile (read-only vs full)."""
+
+from __future__ import annotations
+
+import os
+from typing import Optional
+
+_ENV_READ_ONLY = "PROTEWORKS_MCP_READ_ONLY"
+_ENV_ALLOW_ORG_SWITCH = "PROTEWORKS_MCP_ALLOW_ORG_SWITCH"
+_ENV_ALLOW_TRANSFERS = "PROTEWORKS_MCP_ALLOW_TRANSFERS"
+
+_TRUTHY = frozenset({"1", "true", "yes", "on"})
+
+
+def is_read_only() -> bool:
+    """When true, mutating tools (submit, push, mkdir, cancel, save-selected) refuse."""
+    return (os.environ.get(_ENV_READ_ONLY) or "").strip().lower() in _TRUTHY
+
+
+def refuse_if_read_only(action: str) -> dict | None:
+    if not is_read_only():
+        return None
+    return {
+        "ok": False,
+        "error": "read_only",
+        "message": (
+            f"{action} is disabled while {_ENV_READ_ONLY} is set. "
+            "Unset it to enable submit/push/create_folder/cancel/save tools."
+        ),
+    }
+
+
+def refuse_if_transfers_disallowed(action: str) -> dict | None:
+    """Block non-dry-run pull/push unless the connector env explicitly allows transfers.
+
+    ``confirm_transfer=true`` alone is not enough: an MCP agent can always pass it.
+    """
+    raw = (os.environ.get(_ENV_ALLOW_TRANSFERS) or "").strip().lower()
+    if raw in _TRUTHY:
+        return None
+    return {
+        "ok": False,
+        "error": "transfer_not_allowed",
+        "message": (
+            f"{action} requires {_ENV_ALLOW_TRANSFERS}=1 in the connector environment "
+            "(in addition to dry_run=false and confirm_transfer=true)."
+        ),
+    }
+
+
+def org_switch_blocked(
+    *,
+    current_org_id: Optional[str],
+    target_org_id: str,
+) -> Optional[str]:
+    """Return an error message when changing an already-set org without env allow.
+
+    Initial organization selection (no current id) only needs confirm=true.
+    """
+    current = (current_org_id or "").strip()
+    target = (target_org_id or "").strip()
+    if not current or current == target:
+        return None
+    raw = (os.environ.get(_ENV_ALLOW_ORG_SWITCH) or "").strip()
+    if not raw:
+        return (
+            f"Changing the active organization requires {_ENV_ALLOW_ORG_SWITCH}=1 "
+            "(or a comma-separated allowlist of target org ids) in the connector environment."
+        )
+    if raw.lower() in _TRUTHY:
+        return None
+    allowed = {part.strip() for part in raw.split(",") if part.strip()}
+    if target in allowed:
+        return None
+    return (
+        f"Organization {target!r} is not listed in {_ENV_ALLOW_ORG_SWITCH} "
+        "(set to 1 to allow any switch, or list allowed org ids)."
+    )

{proteworks-0.1.9 → proteworks-0.1.10}/src/proteworks/mcp/tools_files.py

@@ -8,7 +8,7 @@ from proteworks.browse import list_remote
 from proteworks.folders import mkdir_remote
 from proteworks.mcp.errors import tool_error_kind, tool_error_message, tool_failure
 from proteworks.mcp.paths import mcp_workspace_root, mcp_workspace_roots, resolve_under_workspace
-from proteworks.mcp.profile import refuse_if_read_only
+from proteworks.mcp.profile import refuse_if_read_only, refuse_if_transfers_disallowed
 from proteworks.mcp.runtime import tool_session
 from proteworks.pull import pull_path
 from proteworks.push import looks_like_glob, push_paths
@@ -40,8 +40,9 @@ def list_files(remote: str, limit: int = 200) -> dict[str, Any]:
 def pull(remote: str, dest: str, dry_run: bool = True, confirm_transfer: bool = False) -> dict[str, Any]:
     """Download a remote file, folder/, or wildcard into a local path.
 
-    Default dry_run=true lists planned paths without downloading. Set dry_run=false
-    and confirm_transfer=true to transfer. Remote examples: '~/My Files/campaigns/run/',
+    Default dry_run=true lists planned paths without downloading. Set dry_run=false,
+    confirm_transfer=true, and PROTEWORKS_MCP_ALLOW_TRANSFERS=1 in the connector
+    environment to transfer. Remote examples: '~/My Files/campaigns/run/',
     '~/My Files/msa/*.cif'. dest must be under an allowlisted local project root
     (see proteworks mcp setup-claude-science --mcp-root).
     """
@@ -50,6 +51,10 @@ def pull(remote: str, dest: str, dry_run: bool = True, confirm_transfer: bool =
             "confirmation_required",
             "Set confirm_transfer=true when dry_run=false to download files.",
         )
+    if not dry_run:
+        blocked = refuse_if_transfers_disallowed("pull")
+        if blocked:
+            return blocked
     session = tool_session()
     if isinstance(session, SessionError):
         return {"ok": False, "error": session.code, "message": session.message}
@@ -72,9 +77,9 @@ def push(
 ) -> dict[str, Any]:
     """Upload a local file, directory, glob, or .zip into a remote folder.
 
-    ``remote`` must end with '/'. Prefer dry_run=true first; set dry_run=false and
-    confirm_transfer=true to upload. A single .zip is unpacked into the destination
-    unless extract_mode='never'.
+    ``remote`` must end with '/'. Prefer dry_run=true first; set dry_run=false,
+    confirm_transfer=true, and PROTEWORKS_MCP_ALLOW_TRANSFERS=1 to upload. A single
+    .zip is unpacked into the destination unless extract_mode='never'.
     """
     blocked = refuse_if_read_only("push")
     if blocked:
@@ -84,6 +89,10 @@ def push(
             "confirmation_required",
             "Set confirm_transfer=true when dry_run=false to upload files.",
         )
+    if not dry_run:
+        xfer_blocked = refuse_if_transfers_disallowed("push")
+        if xfer_blocked:
+            return xfer_blocked
     mode = str(extract_mode or "auto").strip().lower()
     if mode not in {"auto", "always", "never"}:
         return tool_failure(
@@ -181,7 +190,8 @@ def register(server) -> None:
         name="pull",
         description=(
             "Download from Proteworks to a local path under an allowlisted project root. "
-            "Prefer dry_run=true first. When dry_run=false, set confirm_transfer=true. "
+            "Prefer dry_run=true first. When dry_run=false, set confirm_transfer=true and "
+            "PROTEWORKS_MCP_ALLOW_TRANSFERS=1 in the connector environment. "
             "Remote paths use file-browser syntax ('~/My Files/.../'); trailing slash is a "
             "folder. If path escapes the workspace, the user should run: "
             "proteworks mcp setup-claude-science --mcp-root <project>. "
@@ -194,7 +204,8 @@ def register(server) -> None:
         description=(
             "Upload a local file, directory, glob, or .zip to a Proteworks folder "
             "(remote must end with '/'). Prefer dry_run=true first; when dry_run=false "
-            "set confirm_transfer=true. A single .zip is unpacked into the destination "
-            "unless extract_mode='never'. Requires login and an active organization."
+            "set confirm_transfer=true and PROTEWORKS_MCP_ALLOW_TRANSFERS=1. A single "
+            ".zip is unpacked into the destination unless extract_mode='never'. "
+            "Requires login and an active organization."
         ),
     )

{proteworks-0.1.9 → proteworks-0.1.10}/src/proteworks/mcp/tools_orgs.py

@@ -6,6 +6,7 @@ from typing import Any
 
 from proteworks.config import Settings, TokenStore
 from proteworks.mcp.errors import tool_error_kind, tool_error_message
+from proteworks.mcp.profile import org_switch_blocked, refuse_if_read_only
 from proteworks.mcp.runtime import tool_auth, tool_settings
 from proteworks.orgs import (
     OrgSelectionError,
@@ -102,7 +103,14 @@ def organization_list() -> dict[str, Any]:
 
 
 def organization_set(name: str, confirm: bool = False) -> dict[str, Any]:
-    """Set the active organization by name or id from organization_list (requires confirm=true)."""
+    """Set the active organization by name or id from organization_list (requires confirm=true).
+
+    Changing an already-set org also requires PROTEWORKS_MCP_ALLOW_ORG_SWITCH in the
+    connector environment (confirm=true alone is not agent-proof).
+    """
+    blocked = refuse_if_read_only("organization_set")
+    if blocked:
+        return blocked
     if not confirm:
         return {
             "ok": False,
@@ -119,11 +127,21 @@ def organization_set(name: str, confirm: bool = False) -> dict[str, Any]:
             org = find_organization(api.list_organizations(), name)
         except OrgSelectionError as exc:
             return {"ok": False, "error": "org_required", "message": str(exc)}
+        switch_err = org_switch_blocked(
+            current_org_id=config.organization_id(),
+            target_org_id=str(org["id"]),
+        )
+        if switch_err:
+            return {"ok": False, "error": "org_switch_not_allowed", "message": switch_err}
+        previous_id = config.organization_id()
         config.set_organization(org["id"], settings.api_url)
+        switched = bool(previous_id and previous_id != org["id"])
         return {
             "ok": True,
             "organization": {"id": org.get("id"), "name": org.get("name")},
             "message": f"Active organization: {org['name']}",
+            "org_switched": switched,
+            "previous_organization_id": previous_id if switched else None,
         }
     finally:
         api.close()
@@ -152,7 +170,9 @@ def register(server) -> None:
         name="organization_set",
         description=(
             "Save the active Proteworks organization by exact name or id from organization_list. "
-            "Requires confirm=true. Required before list_files, pull, or push when the user "
-            "belongs to more than one org."
+            "Requires confirm=true. Changing an already-set org also requires "
+            "PROTEWORKS_MCP_ALLOW_ORG_SWITCH=1 (or a comma-separated org-id allowlist) in the "
+            "connector environment. Required before list_files, pull, or push when the user "
+            "belongs to more than one org. Disabled while PROTEWORKS_MCP_READ_ONLY is set."
         ),
     )

{proteworks-0.1.9 → proteworks-0.1.10}/src/proteworks/mcp/tools_studio.py

@@ -210,6 +210,9 @@ def prepare_refolding_from_proteinmpnn_studio(
     upload_folder_id: Optional[str] = None,
 ) -> dict[str, Any]:
     """Build a refolding SubmitWorkflowRequest from a ProteinMPNN .studio selection (no submit)."""
+    blocked = refuse_if_read_only("prepare_refolding_from_proteinmpnn_studio")
+    if blocked:
+        return blocked
     err = assert_allowlisted("refolding")
     if err:
         return tool_failure("not_allowlisted", err)

{proteworks-0.1.9 → proteworks-0.1.10}/src/proteworks/mcp_host.py

@@ -661,6 +661,8 @@ def setup_claude_science(
         "\n"
         "Optional env (only if the UI has an env section):\n"
         f"  PROTEWORKS_CONFIG_DIR={config_dir}\n"
+        "  PROTEWORKS_MCP_ALLOW_TRANSFERS=1   # required for non-dry-run pull/push\n"
+        "  PROTEWORKS_MCP_ALLOW_ORG_SWITCH=1  # required to change an already-set org\n"
         "\n"
         "Paste only that Command path. Do not use uv-tool paths, python -m, or a\n"
         "second copy under $HOME — one install under /opt/proteworks.\n"

proteworks-0.1.10/src/proteworks/redact.py

@@ -0,0 +1,97 @@
+"""Keep signed URLs and storage locations out of logs and saved state."""
+
+from __future__ import annotations
+
+import logging
+import re
+from typing import Any
+
+_SECRET_KEYS = {
+    "url",
+    "upload_url",
+    "download_url",
+    "signed_url",
+    "cloud_storage_url",
+    "upload_headers",
+    "access_token",
+    "refresh_token",
+    "id_token",
+    "token",
+    "authorization",
+    "Authorization",
+}
+
+# JWT-shaped strings (header.payload.signature) and common API key prefixes.
+_JWT_RE = re.compile(r"\beyJ[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\.[A-Za-z0-9_-]+\b")
+_BEARER_RE = re.compile(r"(?i)\bbearer\s+[A-Za-z0-9\-._~+/]+=*")
+_SK_RE = re.compile(r"\bsk-(?:ant-)?[A-Za-z0-9_-]{8,}\b")
+_GOOG_SIGNED_RE = re.compile(
+    r"(?i)(?:X-Goog-(?:Signature|Credential|Algorithm|Date|Expires|SignedHeaders)=|"
+    r"GoogleAccessId=)[^\s&]+"
+)
+
+
+def _redact_string(value: str) -> str:
+    lowered = value.lower()
+    if lowered.startswith("gs://"):
+        return "[redacted]"
+    if any(
+        host in lowered
+        for host in (
+            "storage.googleapis.com",
+            "googleapis.com",
+            "googleusercontent.com",
+        )
+    ):
+        return "[redacted]"
+    if "x-goog-signature=" in lowered or "x-goog-credential=" in lowered:
+        return "[redacted]"
+    if lowered.startswith("bearer "):
+        return "[redacted]"
+    # Full-string JWT / opaque token heuristics.
+    if value.startswith("eyJ") and value.count(".") >= 2:
+        return "[redacted]"
+    if value.startswith("sk-") or value.startswith("sk-ant-"):
+        return "[redacted]"
+    cleaned = value
+    cleaned = _JWT_RE.sub("[redacted]", cleaned)
+    cleaned = _BEARER_RE.sub("Bearer [redacted]", cleaned)
+    cleaned = _SK_RE.sub("[redacted]", cleaned)
+    cleaned = _GOOG_SIGNED_RE.sub("[redacted]", cleaned)
+    return cleaned
+
+
+def redact(value: Any) -> Any:
+    """Return a copy with storage URLs and signed-URL fields removed."""
+    if isinstance(value, dict):
+        cleaned = {}
+        for key, item in value.items():
+            if key in _SECRET_KEYS:
+                cleaned[key] = "[redacted]"
+            else:
+                cleaned[key] = redact(item)
+        return cleaned
+    if isinstance(value, list):
+        return [redact(item) for item in value]
+    if isinstance(value, str):
+        return _redact_string(value)
+    return value
+
+
+class RedactFilter(logging.Filter):
+    """Drop storage URLs from log records."""
+
+    def filter(self, record: logging.LogRecord) -> bool:
+        if isinstance(record.msg, str):
+            record.msg = str(redact(record.msg))
+        if record.args:
+            record.args = redact(record.args)
+        return True
+
+
+def install_redacting_logs() -> None:
+    """Attach the redaction filter to the root logger once."""
+    root = logging.getLogger()
+    if any(isinstance(item, RedactFilter) for item in root.filters):
+        return
+    root.addFilter(RedactFilter())

{proteworks-0.1.9 → proteworks-0.1.10}/src/proteworks/session.py

@@ -53,6 +53,11 @@ def open_session(
         api.close()
         return SessionError(code="org_required", message=str(exc))
     api.organization_id = org["id"]
+    # Persist org + API URL on first session (e.g. single-org auto-select) so
+    # bound_api_url always sticks for subsequent authenticated_client checks.
+    org_id = str(org["id"])
+    if config.organization_id() != org_id or not config.bound_api_url():
+        config.set_organization(org_id, settings.api_url)
     return Session(api=api, organization=org, settings=settings, config=config)
 
 

{proteworks-0.1.9 → proteworks-0.1.10}/src/proteworks/studio/kinds/rfd4_proteina.py

@@ -20,13 +20,24 @@ from proteworks.studio.kinds.base import (
 
 _EXCLUDE = frozenset({"assets_json", "row_key", "designID", "design_id", "example_id"})
 
+# Keep aligned with Protein Studio rfd4ProteinaMetricLabels DEFAULT_METRIC_CANDIDATES
+# and common design-native parquet columns written by the RFD4 bundle builder.
 KNOWN_SCORE_COLUMNS = (
+    "radius_of_gyration.radius_of_gyration_coi",
+    "radius_of_gyration.radius_of_gyration",
     "clash_metrics.frac_atoms_clashing_1p5A",
+    "bond_length_metrics.bond_length.frac_unreasonable",
     "bond_length_metrics.frac_unreasonable",
     "sse_distribution.helix_fraction",
     "sse_distribution.sheet_fraction",
+    "sse_distribution.loop_fraction",
+    "sse_distribution.helix_fraction_coi",
+    "sse_distribution.sheet_fraction_coi",
     "sequence_adherence.sequence_adherence",
     "hotspot_obedience.hotspot_obedience",
+    "amino_acid_composition.ala_fraction",
+    "ca_rmsd_to_input",
+    "join_point_rmsd",
 )
 
 RFD4_PROTEINA_SPEC = StudioKindSpec(
@@ -60,10 +71,13 @@ class Rfd4ProteinaStudioAdapter(StudioKindAdapter):
                         "bond",
                         "helix",
                         "sheet",
+                        "loop",
                         "adherence",
                         "hotspot",
                         "rmsd",
                         "fraction",
+                        "gyration",
+                        "radius",
                     ),
                     exclude_keys=_EXCLUDE,
                 )

{proteworks-0.1.9 → proteworks-0.1.10}/src/proteworks/workflows.py

@@ -36,6 +36,71 @@ CLIENT_ONLY_PARAM_KEYS = frozenset(
     }
 )
 
+# Keep in sync with Protein Studio backend CLIENT_RESERVED_WORKFLOW_PARAMETER_KEYS
+# (server-injected GCS paths and pod shapes). Also reject pattern matches below.
+_REFOLDING_METHOD_GPU_KEYS = (
+    "boltz",
+    "protenix",
+    "opendde",
+    "promera",
+    "intellifold",
+    "openfold3",
+    "chai1",
+    "rf3",
+    "esmfold",
+    "esmfold2",
+    "alphafold2",
+    "alphafold-initial-guess",
+)
+
+CLIENT_RESERVED_WORKFLOW_PARAMETER_KEYS = frozenset(
+    {
+        "output-gcs-path",
+        "output-gcs-path-base",
+        "scratch-gcs-path",
+        "gcs-bucket",
+        "json-tarball-gcs-path",
+        "msa-tarball-gcs-path",
+        "msa-output-tarball-gcs-path",
+        "yaml-tarball-gcs-path",
+        "templates-tarball-gcs-path",
+        "execution-plan-gcs-path",
+        "reuse-copy-instructions-gcs-path",
+        "input-manifest-gcs-path",
+        "gpu-pod-cpu",
+        "gpu-pod-memory",
+        "gpu-compute-class",
+        "esmc-gpu-pod-cpu",
+        "esmc-gpu-pod-memory",
+        "esmc-gpu-compute-class",
+        *(
+            key
+            for method in _REFOLDING_METHOD_GPU_KEYS
+            for key in (
+                f"{method}-gpu-pod-cpu",
+                f"{method}-gpu-pod-memory",
+                f"{method}-gpu-compute-class",
+            )
+        ),
+    }
+)
+
+
+def is_client_reserved_param_key(key: str) -> bool:
+    """True for server-only workflow parameters (exact keys or GCS/pod-shape patterns)."""
+    dashed = str(key or "").strip().replace("_", "-")
+    if not dashed:
+        return False
+    if dashed in CLIENT_RESERVED_WORKFLOW_PARAMETER_KEYS:
+        return True
+    if dashed.endswith("-gcs-path") or dashed.endswith("-gcs-path-base"):
+        return True
+    if dashed.endswith("-gpu-pod-cpu") or dashed.endswith("-gpu-pod-memory"):
+        return True
+    if dashed.endswith("-gpu-compute-class"):
+        return True
+    return False
+
 # Hyphen ↔ underscore aliases accepted for file roles when filtering overrides.
 FILE_ROLE_ALIASES: dict[str, str] = {
     "msa-output-folder": "msa_output_folder",
@@ -72,8 +137,6 @@ _EXTRA_PARAM_PREFIXES: dict[str, tuple[str, ...]] = {
         "batch",
         "target",
         "compile",
-        "hf_",
-        "hf-",
         "metrics",
         "design",
     ),
@@ -359,6 +422,8 @@ def normalize_file_role(name: str) -> str:
 
 
 def _param_key_allowed(key: str, allowed: frozenset[str], workflow_name: str) -> bool:
+    if is_client_reserved_param_key(key):
+        return False
     if key in allowed or key in EXTRA_AGENT_PARAM_KEYS:
         return True
     prefixes = _EXTRA_PARAM_PREFIXES.get(workflow_name) or ()
@@ -371,16 +436,23 @@ def filter_parameters_to_schema(
     *,
     workflow_name: str = "",
 ) -> tuple[dict[str, Any], Optional[str]]:
-    """Keep schema / allowlisted advanced keys; reject unknown keys (client-only stripped)."""
+    """Keep schema / allowlisted advanced keys; reject unknown/reserved keys (client-only stripped)."""
     out: dict[str, Any] = {}
     unknown: list[str] = []
+    reserved: list[str] = []
     for key, value in parameters.items():
         if key in CLIENT_ONLY_PARAM_KEYS:
             continue
+        if is_client_reserved_param_key(key):
+            reserved.append(key)
+            continue
         if not _param_key_allowed(key, allowed, workflow_name):
             unknown.append(key)
             continue
         out[key] = value
+    if reserved:
+        preview = ", ".join(sorted(reserved)[:8])
+        return out, f"Reserved parameter key(s) are server-only: {preview}."
     if unknown:
         preview = ", ".join(sorted(unknown)[:8])
         return out, f"Unknown parameter key(s) not in schema: {preview}."
@@ -421,7 +493,11 @@ def defaults_from_schema(schema: dict[str, Any]) -> dict[str, Any]:
 
 
 def strip_client_only(parameters: dict[str, Any]) -> dict[str, Any]:
-    return {k: v for k, v in parameters.items() if k not in CLIENT_ONLY_PARAM_KEYS}
+    return {
+        k: v
+        for k, v in parameters.items()
+        if k not in CLIENT_ONLY_PARAM_KEYS and not is_client_reserved_param_key(k)
+    }
 
 
 def merge_workflow_submission(

{proteworks-0.1.9 → proteworks-0.1.10}/src/proteworks.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: proteworks
-Version: 0.1.9
+Version: 0.1.10
 Summary: Sync files with Proteworks using file-browser paths.
 Requires-Python: >=3.11
 Description-Content-Type: text/markdown

{proteworks-0.1.9 → proteworks-0.1.10}/src/proteworks.egg-info/SOURCES.txt

@@ -54,6 +54,7 @@ tests/test_mcp_host.py
 tests/test_mcp_paths.py
 tests/test_mcp_studio.py
 tests/test_mcp_workflows.py
+tests/test_redact.py
 tests/test_rfd4_proteina_workflow.py
 tests/test_session.py
 tests/test_token_store.py

{proteworks-0.1.9 → proteworks-0.1.10}/tests/test_mcp_adversarial.py

@@ -119,6 +119,8 @@ def test_resolve_under_workspace_rejects_escape(tmp_path, monkeypatch):
 
 def test_storage_url_host_allowlist():
     assert_allowed_storage_url("https://storage.googleapis.com/bucket/obj")
+    with pytest.raises(ApiError, match="https"):
+        assert_allowed_storage_url("http://storage.googleapis.com/bucket/obj")
     with pytest.raises(ApiError):
         assert_allowed_storage_url("https://evil.example/steal")
 

{proteworks-0.1.9 → proteworks-0.1.10}/tests/test_mcp_files.py

@@ -83,6 +83,16 @@ def test_pull_and_push_tools_dry_run_and_transfer(tmp_path, monkeypatch):
         assert denied["ok"] is False
         assert denied["error"] == "confirmation_required"
 
+        no_env = tools_files.pull(
+            "~/My Files/campaigns/",
+            str(dest),
+            dry_run=False,
+            confirm_transfer=True,
+        )
+        assert no_env["ok"] is False
+        assert no_env["error"] == "transfer_not_allowed"
+
+        monkeypatch.setenv("PROTEWORKS_MCP_ALLOW_TRANSFERS", "1")
         got = tools_files.pull(
             "~/My Files/campaigns/",
             str(dest),
@@ -138,7 +148,7 @@ def test_create_folder_tool(tmp_path):
         server.stop()
 
 
-def test_organization_set_tool(tmp_path):
+def test_organization_set_tool(tmp_path, monkeypatch):
     server = FakeApi([_org("a", "Alpha"), _org("b", "Beta")], []).start()
     try:
         set_overrides(settings=_settings(tmp_path, server.url), token_store=MemoryTokens())
@@ -150,11 +160,25 @@ def test_organization_set_tool(tmp_path):
         assert denied["ok"] is False
         assert denied["error"] == "confirmation_required"
 
+        # Initial set (no org configured yet) only needs confirm=true.
         set_result = tools_orgs.organization_set("Beta", confirm=True)
         assert set_result["ok"] is True
         assert set_result["organization"]["id"] == "b"
+        assert set_result["org_switched"] is False
 
         status = tools_orgs.auth_status()
         assert status["organization"]["name"] == "Beta"
+
+        # Switching away from an already-set org requires connector env allow.
+        blocked = tools_orgs.organization_set("Alpha", confirm=True)
+        assert blocked["ok"] is False
+        assert blocked["error"] == "org_switch_not_allowed"
+
+        monkeypatch.setenv("PROTEWORKS_MCP_ALLOW_ORG_SWITCH", "1")
+        switched = tools_orgs.organization_set("Alpha", confirm=True)
+        assert switched["ok"] is True
+        assert switched["organization"]["id"] == "a"
+        assert switched["org_switched"] is True
+        assert switched["previous_organization_id"] == "b"
     finally:
         server.stop()

{proteworks-0.1.9 → proteworks-0.1.10}/tests/test_mcp_host.py

@@ -160,6 +160,8 @@ def test_setup_claude_science_dry_run_and_write(tmp_path: Path):
     assert "proteworks-production.storage.googleapis.com" in printed
     assert "Science rejects wildcards" in printed
     assert "Do not add bare storage.googleapis.com" in printed
+    assert "PROTEWORKS_MCP_ALLOW_TRANSFERS=1" in printed
+    assert "PROTEWORKS_MCP_ALLOW_ORG_SWITCH=1" in printed
 
 
 def test_science_read_paths_includes_config_dir(tmp_path: Path):

{proteworks-0.1.9 → proteworks-0.1.10}/tests/test_mcp_studio.py

@@ -143,6 +143,11 @@ def test_inspect_studio_refolding_and_rfd3(tmp_path, monkeypatch):
     finally:
         server.stop()
 
+    # Fresh FakeApi port → clear URL binding written by the first session.
+    bound = tmp_path / "config" / "config.json"
+    if bound.exists():
+        bound.unlink()
+
     # RFD3
     studio = _rfd3_studio_bytes()
     server = FakeApi([_org("reg", "Research")], [_item()], signed_get_body=studio).start()
@@ -207,6 +212,30 @@ def test_save_selected_studio_refolding(tmp_path, monkeypatch):
         server.stop()
 
 
+def test_prepare_refolding_from_proteinmpnn_studio_read_only(tmp_path, monkeypatch):
+    _mcp_env(tmp_path, monkeypatch)
+    monkeypatch.setenv("PROTEWORKS_MCP_READ_ONLY", "1")
+    studio = _mpnn_studio_bytes()
+    server = FakeApi([_org("reg", "Research")], [_item()], signed_get_body=studio).start()
+    try:
+        set_overrides(settings=_settings(tmp_path, server.url), token_store=MemoryTokens())
+        prepared = tools_studio.prepare_refolding_from_proteinmpnn_studio(
+            studio_file_id="studio-1",
+            sequence_ids=["seq-a"],
+            files={"refolding_msa_output_folder": "msa-folder-1"},
+            parameters={
+                "binder-chains": ["B"],
+                "target-chains": ["A"],
+                "refolding-run-boltz": "true",
+            },
+            upload_folder_id="folder-1",
+        )
+        assert prepared["ok"] is False
+        assert prepared["error"] == "read_only"
+    finally:
+        server.stop()
+
+
 def test_inspect_and_prepare_refolding_from_proteinmpnn_studio(tmp_path, monkeypatch):
     _mcp_env(tmp_path, monkeypatch)
     studio = _mpnn_studio_bytes()

{proteworks-0.1.9 → proteworks-0.1.10}/tests/test_mcp_workflows.py

@@ -90,6 +90,8 @@ def test_merge_strips_client_only_and_applies_overrides():
             "num_designs": 3,
             "generator_residue_id_map": {"x": 1},
             "motif_spec": {},
+            "output-gcs-path": "gs://evil/path",
+            "msa-tarball-gcs-path": "gs://evil/msa",
         },
         output_folder_name="Out",
     )
@@ -99,9 +101,31 @@ def test_merge_strips_client_only_and_applies_overrides():
     assert payload["parameters"]["inference-mode"] == "exact"
     assert "generator_residue_id_map" not in payload["parameters"]
     assert "motif_spec" not in payload["parameters"]
+    assert "output-gcs-path" not in payload["parameters"]
+    assert "msa-tarball-gcs-path" not in payload["parameters"]
     assert payload["output_folder_name"] == "Out"
 
 
+def test_prepare_rejects_reserved_gcs_and_pod_params(tmp_path):
+    server = FakeApi([_org("reg", "Research")], [_item()]).start()
+    try:
+        set_overrides(settings=_settings(tmp_path, server.url), token_store=MemoryTokens())
+        prepared = tools_workflows.prepare_workflow_submission(
+            "rf-diffusion3",
+            parameters={
+                "contig": "40-60",
+                "output-gcs-path": "gs://evil/path",
+                "gpu-pod-cpu": "32",
+            },
+        )
+        assert prepared["ok"] is False
+        assert prepared["error"] == "validation_error"
+        assert "Reserved" in prepared["message"]
+        assert server.last_submit_body is None
+    finally:
+        server.stop()
+
+
 def test_prepare_and_submit_reject_non_allowlisted(tmp_path):
     server = FakeApi([_org("reg", "Research")], [_item()]).start()
     try:

proteworks-0.1.10/tests/test_redact.py

@@ -0,0 +1,31 @@
+"""Redaction of storage URLs and credentials."""
+
+from __future__ import annotations
+
+from proteworks.redact import redact
+
+
+def test_redact_storage_and_tokens():
+    payload = {
+        "url": "https://storage.googleapis.com/bucket/obj?X-Goog-Signature=abc",
+        "access_token": "secret",
+        "note": "ok",
+        "nested": {
+            "cloud_storage_url": "gs://bucket/obj",
+            "msg": "Bearer eyJhbGciOiJIUzI1NiJ9.e30.signature",
+        },
+    }
+    cleaned = redact(payload)
+    assert cleaned["url"] == "[redacted]"
+    assert cleaned["access_token"] == "[redacted]"
+    assert cleaned["note"] == "ok"
+    assert cleaned["nested"]["cloud_storage_url"] == "[redacted]"
+    assert "eyJ" not in cleaned["nested"]["msg"]
+    assert "Bearer [redacted]" in cleaned["nested"]["msg"] or cleaned["nested"]["msg"] == "[redacted]"
+
+
+def test_redact_inline_jwt_and_sk():
+    text = "token=eyJhbGciOiJIUzI1NiJ9.e30.abc key=sk-ant-abcdef12345678"
+    cleaned = redact(text)
+    assert "eyJ" not in cleaned
+    assert "sk-ant-" not in cleaned

{proteworks-0.1.9 → proteworks-0.1.10}/tests/test_rfd4_proteina_workflow.py

@@ -20,6 +20,27 @@ def test_studio_adapter_registered():
     assert adapter.spec.route_slug == "rfd4-proteina"
 
 
+def test_studio_adapter_indexes_design_native_scores():
+    adapter = adapter_for_data_kind("rfd4-proteina")
+    assert adapter is not None
+    rows = adapter.summarize_rows(
+        [
+            {
+                "designID": "design_0",
+                "row_key": "design_0",
+                "clash_metrics.frac_atoms_clashing_1p5A": "0.01",
+                "radius_of_gyration.radius_of_gyration_coi": "12.5",
+                "hotspot_obedience.hotspot_obedience": "0.9",
+                "assets_json": '[{"asset_key":"structure","file_id":"fid-0","filename":"design_0.cif"}]',
+            }
+        ]
+    )
+    assert len(rows) == 1
+    assert rows[0].scores.get("clash_metrics.frac_atoms_clashing_1p5A") == 0.01
+    assert rows[0].scores.get("radius_of_gyration.radius_of_gyration_coi") == 12.5
+    assert rows[0].scores.get("hotspot_obedience.hotspot_obedience") == 0.9
+
+
 def test_binder_requires_structure_and_contig():
     err = assert_rfd4_proteina_has_design_spec(
         {"design_mode": "binder", "contig": "50-120, /0, A1-10"},

{proteworks-0.1.9 → proteworks-0.1.10}/tests/test_session.py

@@ -37,9 +37,13 @@ def test_open_session_requires_org_when_multiple(tmp_path):
 def test_open_session_succeeds_for_single_org(tmp_path):
     server = FakeApi([_org("reg", "Research")], []).start()
     try:
-        result = open_session(settings=_settings(tmp_path, server.url), token_store=MemoryTokens())
+        settings = _settings(tmp_path, server.url)
+        result = open_session(settings=settings, token_store=MemoryTokens())
         assert isinstance(result, Session)
         assert result.organization["id"] == "reg"
+        # Single-org auto-select must persist org + API URL binding.
+        assert result.config.organization_id() == "reg"
+        assert result.config.bound_api_url() == settings.api_url
         result.api.close()
     finally:
         server.stop()

{proteworks-0.1.9 → proteworks-0.1.10}/tests/test_token_store.py

@@ -50,16 +50,15 @@ def test_token_store_file_fallback_when_keyring_fails(tmp_path: Path, monkeypatc
     assert store.get() == "sandbox-token"
 
 
-def test_token_store_lazy_migrates_keyring_to_file(tmp_path: Path, monkeypatch):
+def test_token_store_working_keyring_does_not_write_file(tmp_path: Path, monkeypatch):
     monkeypatch.setenv("PROTEWORKS_CONFIG_DIR", str(tmp_path))
     backend = _MemoryKeyring()
     keyring.set_keyring(backend)
-    backend.set_password(TokenStore.SERVICE, "access_token", "from-keyring")
     store = TokenStore()
+    store.set("from-keyring")
     assert not store.path.is_file()
     assert store.get() == "from-keyring"
-    assert store.path.is_file()
-    assert store.path.read_text(encoding="utf-8").strip() == "from-keyring"
+    assert not store.path.is_file()
 
 
 def test_token_store_reads_file_when_keyring_empty(tmp_path: Path, monkeypatch):

proteworks-0.1.9/src/proteworks/mcp/profile.py

@@ -1,30 +0,0 @@
-"""MCP capability profile (read-only vs full)."""
-
-from __future__ import annotations
-
-import os
-
-_ENV_READ_ONLY = "PROTEWORKS_MCP_READ_ONLY"
-
-
-def is_read_only() -> bool:
-    """When true, mutating tools (submit, push, mkdir, cancel, save-selected) refuse."""
-    return (os.environ.get(_ENV_READ_ONLY) or "").strip().lower() in {
-        "1",
-        "true",
-        "yes",
-        "on",
-    }
-
-
-def refuse_if_read_only(action: str) -> dict | None:
-    if not is_read_only():
-        return None
-    return {
-        "ok": False,
-        "error": "read_only",
-        "message": (
-            f"{action} is disabled while {_ENV_READ_ONLY} is set. "
-            "Unset it to enable submit/push/create_folder/cancel/save tools."
-        ),
-    }

proteworks-0.1.9/src/proteworks/redact.py

@@ -1,47 +0,0 @@
-"""Keep signed URLs and storage locations out of logs and saved state."""
-
-from __future__ import annotations
-
-import logging
-from typing import Any
-
-_SECRET_KEYS = {"url", "upload_url", "cloud_storage_url", "upload_headers"}
-
-
-def redact(value: Any) -> Any:
-    """Return a copy with storage URLs and signed-URL fields removed."""
-    if isinstance(value, dict):
-        cleaned = {}
-        for key, item in value.items():
-            if key in _SECRET_KEYS:
-                cleaned[key] = "[redacted]"
-            else:
-                cleaned[key] = redact(item)
-        return cleaned
-    if isinstance(value, list):
-        return [redact(item) for item in value]
-    if isinstance(value, str):
-        lowered = value.lower()
-        if lowered.startswith("gs://") or "storage.googleapis.com" in lowered:
-            return "[redacted]"
-        return value
-    return value
-
-
-class RedactFilter(logging.Filter):
-    """Drop storage URLs from log records."""
-
-    def filter(self, record: logging.LogRecord) -> bool:
-        if isinstance(record.msg, str):
-            record.msg = str(redact(record.msg))
-        if record.args:
-            record.args = redact(record.args)
-        return True
-
-
-def install_redacting_logs() -> None:
-    """Attach the redaction filter to the root logger once."""
-    root = logging.getLogger()
-    if any(isinstance(item, RedactFilter) for item in root.filters):
-        return
-    root.addFilter(RedactFilter())