synth-ai 0.22.2.dev687__tar.gz → 0.22.2.dev689__tar.gz

{synth_ai-0.22.2.dev687/synth_ai.egg-info → synth_ai-0.22.2.dev689}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: synth-ai
-Version: 0.22.2.dev687
+Version: 0.22.2.dev689
 Summary: Python SDK, CLI and MCP servers for Synth Index search and Swarms
 Author-email: Synth AI <josh@usesynth.ai>
 License-Expression: MIT

{synth_ai-0.22.2.dev687 → synth_ai-0.22.2.dev689}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "synth-ai"
-version = "0.22.2.dev687"
+version = "0.22.2.dev689"
 description = "Python SDK, CLI and MCP servers for Synth Index search and Swarms"
 keywords = ["synth", "index", "search", "citations", "research", "swarms", "mcp", "sdk"]
 authors = [{name = "Synth AI", email = "josh@usesynth.ai"}]

{synth_ai-0.22.2.dev687 → synth_ai-0.22.2.dev689}/synth_ai/cli/index.py

@@ -633,8 +633,8 @@ def contribution_status(contribution_id, revision_id, search_id, api_key, backen
 @_lifecycle_target_options
 def contribution_upload(draft_file, upload_spec_file, root, files, api_key, backend_url):
     """Prepare, transfer exactly the selected files, then finalize. Does not submit."""
-    from synth_ai.mcp.research.tools.index import read_selected_files
     from synth_ai.sdk.index.contributions import ContributionDraft, ContributionUploadSpec
+    from synth_ai.sdk.index.local_files import read_selected_files
 
     selected: dict[str, str] = {}
     for item in files:

synth_ai-0.22.2.dev689/synth_ai/core/http/retry.py

@@ -0,0 +1,302 @@
+"""Classified retry policy shared by sync and async transports.
+
+# See: testing/specifications/sdk/core_research_migration.md
+"""
+
+from __future__ import annotations
+
+import math
+import random
+from collections.abc import Mapping
+from dataclasses import dataclass
+
+from synth_ai.core.errors import (
+    ContractMismatchError,
+    RetryDirective,
+    RuntimeUnavailableError,
+    SynthError,
+    SynthErrorCategory,
+    SynthErrorCode,
+    SynthFailure,
+)
+from synth_ai.core.http.request import HttpMethod, HttpRequest, OperationMetadata
+
+
+@dataclass(frozen=True, slots=True)
+class RetryPolicy:
+    attempts_max: int = 3
+    delay_seconds_initial: float = 0.5
+    delay_seconds_max: float = 5.0
+    retry_statuses: frozenset[int] = frozenset({408, 409, 429, 500, 502, 503, 504})
+
+    def __post_init__(self) -> None:
+        if (
+            isinstance(self.attempts_max, bool)
+            or not isinstance(self.attempts_max, int)
+            or not 1 <= self.attempts_max <= 100
+        ):
+            raise ValueError("attempts_max must be an integer from 1 through 100")
+        for delay in (self.delay_seconds_initial, self.delay_seconds_max):
+            if (
+                isinstance(delay, bool)
+                or not isinstance(delay, (int, float))
+                or not math.isfinite(delay)
+            ):
+                raise ValueError("retry delays must be finite numbers")
+        if self.delay_seconds_initial < 0 or self.delay_seconds_max < 0:
+            raise ValueError("retry delays must be non-negative")
+        if self.delay_seconds_initial > self.delay_seconds_max:
+            raise ValueError("delay_seconds_initial cannot exceed delay_seconds_max")
+
+    def permits(
+        self,
+        operation: OperationMetadata,
+        *,
+        idempotency_key: str | None,
+    ) -> bool:
+        """Retry only metadata-declared idempotent operations.
+
+        Unsafe methods additionally require an idempotency key.
+        """
+        if not operation.idempotent:
+            return False
+        if operation.method is HttpMethod.GET:
+            return True
+        return bool(idempotency_key)
+
+    def delay_seconds(
+        self,
+        attempt_index: int,
+        *,
+        retry_after_seconds: float | None,
+    ) -> float:
+        """Deterministic exponential backoff capped by policy and Retry-After."""
+        if attempt_index < 0:
+            raise ValueError("attempt_index must be non-negative")
+        exponential = min(
+            self.delay_seconds_max,
+            self.delay_seconds_initial * (2**attempt_index),
+        )
+        if retry_after_seconds is None:
+            return exponential
+        if not math.isfinite(retry_after_seconds) or retry_after_seconds < 0:
+            raise ValueError("retry_after_seconds must be non-negative")
+        return min(self.delay_seconds_max, max(exponential, retry_after_seconds))
+
+
+def idempotency_key_from_request(request: HttpRequest) -> str | None:
+    """Extract an idempotency key from headers or JSON body fields."""
+    values = [value for name, value in request.headers.items() if name.lower() == "idempotency-key"]
+    if isinstance(request.body, dict):
+        values.extend(
+            request.body[name]
+            for name in ("idempotency_key", "idempotency_key_run_create")
+            if name in request.body
+        )
+    identities = set()
+    for value in values:
+        if not isinstance(value, str) or not value.strip():
+            raise ValueError("idempotency identity must be a non-empty string")
+        identities.add(value)
+    if len(identities) > 1:
+        raise ValueError("request contains conflicting idempotency identities")
+    return next(iter(identities), None)
+
+
+def should_retry_failure(
+    policy: RetryPolicy,
+    request: HttpRequest,
+    error: BaseException,
+) -> bool:
+    """Decide whether one failed execute attempt may be retried."""
+    if isinstance(error, (ContractMismatchError, RuntimeUnavailableError)):
+        return False
+    if not policy.permits(
+        request.operation,
+        idempotency_key=idempotency_key_from_request(request),
+    ):
+        return False
+    if isinstance(error, SynthError):
+        if error.failure is not None:
+            # The first-class directive is authoritative, including an explicit false.
+            return error.failure.retry.retryable
+        if error.retryable:
+            return True
+        status = None
+        if error.failure is not None:
+            status = error.failure.status
+        if status is None and hasattr(error, "status"):
+            status = error.status
+        return isinstance(status, int) and status in policy.retry_statuses
+    return False
+
+
+def retry_after_from_error(error: BaseException) -> float | None:
+    if isinstance(error, SynthError):
+        return error.retry_after_seconds
+    return None
+
+
+# Backend ``core/data/db/backpressure_classification.py::DB_BACKPRESSURE_REASON_CODE``,
+# emitted as ``error_code`` by ``core/data/db/admission.py::db_backpressure_payload``.
+DB_BACKPRESSURE_ERROR_CODE = "db_backpressure"
+DB_BACKPRESSURE_RETRY_EXHAUSTED_CODE = "db_backpressure_retry_exhausted"
+_REPLAY_SAFE_METHODS = frozenset({"GET", "HEAD", "OPTIONS"})
+
+
+@dataclass(frozen=True, slots=True)
+class DbBackpressureRefusal:
+    """One typed DB backpressure refusal decoded from a backend error body."""
+
+    status: int
+    error_code: str
+    component: str | None
+    work_class: str | None
+    retry_after_seconds: float | None
+    operator_action: str | None
+    message: str
+
+
+@dataclass(frozen=True, slots=True)
+class DbBackpressureRetryPolicy:
+    """Bounds for replaying a request the backend shed before starting DB work.
+
+    Attempts and total sleep are both bounded; the server's ``retry_after`` is
+    honored up to ``retry_after_cap_seconds`` and only ever lengthened by jitter.
+    """
+
+    attempts_max: int = 5
+    total_wait_seconds_max: float = 120.0
+    retry_after_cap_seconds: float = 30.0
+    delay_seconds_initial: float = 1.0
+    jitter_ratio: float = 0.25
+
+    def __post_init__(self) -> None:
+        if (
+            isinstance(self.attempts_max, bool)
+            or not isinstance(self.attempts_max, int)
+            or not 1 <= self.attempts_max <= 20
+        ):
+            raise ValueError("attempts_max must be an integer from 1 through 20")
+        for name in (
+            "total_wait_seconds_max",
+            "retry_after_cap_seconds",
+            "delay_seconds_initial",
+            "jitter_ratio",
+        ):
+            value = getattr(self, name)
+            if (
+                isinstance(value, bool)
+                or not isinstance(value, (int, float))
+                or not math.isfinite(value)
+                or value < 0
+            ):
+                raise ValueError(f"{name} must be a finite non-negative number")
+        if self.jitter_ratio > 1:
+            raise ValueError("jitter_ratio cannot exceed 1")
+
+    def next_delay_seconds(
+        self,
+        *,
+        attempts_made: int,
+        waited_seconds: float,
+        refusal: DbBackpressureRefusal,
+        rng: random.Random,
+    ) -> float | None:
+        """Return the sleep before the next attempt, or None when bounds are spent."""
+        if attempts_made >= self.attempts_max:
+            return None
+        if refusal.retry_after_seconds is not None:
+            base = min(self.retry_after_cap_seconds, refusal.retry_after_seconds)
+        else:
+            base = min(
+                self.retry_after_cap_seconds,
+                self.delay_seconds_initial * (2 ** (attempts_made - 1)),
+            )
+        delay = base * (1.0 + rng.uniform(0.0, self.jitter_ratio))
+        if waited_seconds + delay > self.total_wait_seconds_max:
+            return None
+        return delay
+
+
+def request_permits_replay(method: str, headers: Mapping[str, str]) -> bool:
+    """A request may be replayed only when safe by method or carrying an idempotency key."""
+    if method.upper() in _REPLAY_SAFE_METHODS:
+        return True
+    return any(
+        name.lower() == "idempotency-key" and bool(str(value).strip())
+        for name, value in headers.items()
+    )
+
+
+class DbBackpressureRetryExhaustedError(SynthError):
+    """The backend kept shedding DB work past the retry bounds.
+
+    Carries the last refusal's ``component``, ``work_class`` and ``retry_after``.
+    Not retryable again: callers already spent the bounded budget.
+    """
+
+    def __init__(
+        self,
+        *,
+        method: str,
+        path: str,
+        operation_id: str | None,
+        refusal: DbBackpressureRefusal,
+        attempts: int,
+        waited_seconds: float,
+    ) -> None:
+        self.method = method
+        self.path = path
+        self.refusal = refusal
+        self.attempts = attempts
+        self.waited_seconds = waited_seconds
+        detail = (
+            f"{method} {path}: backend refused DB work ({refusal.error_code}) on "
+            f"{attempts} attempts over {waited_seconds:.1f}s; last component="
+            f"{refusal.component} work_class={refusal.work_class} "
+            f"retry_after={refusal.retry_after_seconds} status={refusal.status} "
+            f"operator_action={refusal.operator_action}"
+        )
+        super().__init__(
+            detail,
+            failure=SynthFailure(
+                code=SynthErrorCode(DB_BACKPRESSURE_RETRY_EXHAUSTED_CODE),
+                category=SynthErrorCategory.TRANSIENT_SERVICE,
+                operation=operation_id,
+                request_id=None,
+                correlation_id=None,
+                retry=RetryDirective(
+                    retryable=False,
+                    retry_after_seconds=refusal.retry_after_seconds,
+                ),
+                status=refusal.status,
+                detail=detail,
+                reason=refusal.component,
+            ),
+        )
+
+    @property
+    def component(self) -> str | None:
+        return self.refusal.component
+
+    @property
+    def work_class(self) -> str | None:
+        return self.refusal.work_class
+
+    @property
+    def retry_after_seconds(self) -> float | None:
+        return self.refusal.retry_after_seconds
+
+
+__all__ = [
+    "DB_BACKPRESSURE_ERROR_CODE",
+    "DbBackpressureRefusal",
+    "DbBackpressureRetryExhaustedError",
+    "DbBackpressureRetryPolicy",
+    "request_permits_replay",
+    "RetryPolicy",
+    "idempotency_key_from_request",
+    "retry_after_from_error",
+    "should_retry_failure",
+]

{synth_ai-0.22.2.dev687 → synth_ai-0.22.2.dev689}/synth_ai/core/http/transport.py

@@ -7,6 +7,7 @@ from __future__ import annotations
 
 import json
 import math
+import random
 import time
 from collections.abc import Callable, Iterator, Mapping
 from dataclasses import dataclass, field
@@ -37,7 +38,12 @@ from synth_ai.core.errors import (
 )
 from synth_ai.core.http.request import HttpRequest
 from synth_ai.core.http.retry import (
+    DB_BACKPRESSURE_ERROR_CODE,
+    DbBackpressureRefusal,
+    DbBackpressureRetryExhaustedError,
+    DbBackpressureRetryPolicy,
     RetryPolicy,
+    request_permits_replay,
     retry_after_from_error,
     should_retry_failure,
 )
@@ -206,6 +212,37 @@ SEARCH_ID_HEADER = "x-synth-search-id"
 SEARCH_RESOURCE_KIND = "index_search"
 
 
+def db_backpressure_refusal(response: httpx.Response) -> DbBackpressureRefusal | None:
+    """Decode the backend's typed DB backpressure refusal, or None for any other error."""
+    if response.status_code not in {429, 503}:
+        return None
+    try:
+        decoded = response.json()
+    except (json.JSONDecodeError, ValueError):
+        return None
+    if not isinstance(decoded, dict):
+        return None
+    detail = decoded.get("detail")
+    body = detail if isinstance(detail, dict) else decoded
+    if DB_BACKPRESSURE_ERROR_CODE not in (body.get("error_code"), body.get("failure_class")):
+        return None
+
+    def text(key: str) -> str | None:
+        value = body.get(key)
+        return value if isinstance(value, str) and value.strip() else None
+
+    retry_after = _retry_after_seconds(response, sources=(cast(JsonObject, body),))
+    return DbBackpressureRefusal(
+        status=response.status_code,
+        error_code=DB_BACKPRESSURE_ERROR_CODE,
+        component=text("component"),
+        work_class=text("work_class"),
+        retry_after_seconds=retry_after,
+        operator_action=text("operator_action"),
+        message=text("message") or "database work rejected before starting",
+    )
+
+
 def _created_search(
     response: httpx.Response, sources: tuple[JsonObject, ...]
 ) -> ResourceRef | None:
@@ -394,6 +431,12 @@ class HttpTransport:
     error_handler: ErrorHandler = raise_http_error
     exception_handler: ExceptionHandler = raise_transport_exception
     decode_error_handler: DecodeErrorHandler = raise_json_decode_error
+    db_backpressure_policy: DbBackpressureRetryPolicy = field(
+        default_factory=DbBackpressureRetryPolicy
+    )
+    sleep: Callable[[float], None] = time.sleep
+    monotonic: Callable[[], float] = time.monotonic
+    rng: random.Random = field(default_factory=random.Random, repr=False)
     client: httpx.Client = field(init=False, repr=False)
 
     def __post_init__(self) -> None:
@@ -420,19 +463,44 @@ class HttpTransport:
         timeout_seconds: float | None = None,
         operation_id: str | None = None,
     ) -> JsonValue:
-        try:
-            response = self.client.request(
-                method,
-                path,
-                params=cast(Any, params),
-                json=json_body,
-                headers=headers,
-                timeout=self.timeout_seconds if timeout_seconds is None else timeout_seconds,
+        replay_safe = request_permits_replay(method, {**self.headers, **(headers or {})})
+        attempts = 0
+        waited_seconds = 0.0
+        while True:
+            try:
+                response = self.client.request(
+                    method,
+                    path,
+                    params=cast(Any, params),
+                    json=json_body,
+                    headers=headers,
+                    timeout=self.timeout_seconds if timeout_seconds is None else timeout_seconds,
+                )
+            except httpx.TimeoutException as exc:
+                self.exception_handler(method, path, exc, operation_id)
+            except httpx.TransportError as exc:
+                self.exception_handler(method, path, exc, operation_id)
+            attempts += 1
+            refusal = db_backpressure_refusal(response) if replay_safe else None
+            if refusal is None:
+                break
+            delay = self.db_backpressure_policy.next_delay_seconds(
+                attempts_made=attempts,
+                waited_seconds=waited_seconds,
+                refusal=refusal,
+                rng=self.rng,
             )
-        except httpx.TimeoutException as exc:
-            self.exception_handler(method, path, exc, operation_id)
-        except httpx.TransportError as exc:
-            self.exception_handler(method, path, exc, operation_id)
+            if delay is None:
+                raise DbBackpressureRetryExhaustedError(
+                    method=method,
+                    path=path,
+                    operation_id=operation_id,
+                    refusal=refusal,
+                    attempts=attempts,
+                    waited_seconds=waited_seconds,
+                )
+            self.sleep(delay)
+            waited_seconds += delay
         if allow_not_found and response.status_code == 404:
             return None
         if response.is_error:
@@ -598,6 +666,7 @@ class HttpTransport:
 
 
 __all__ = [
+    "db_backpressure_refusal",
     "ErrorHandler",
     "ExceptionHandler",
     "DecodeErrorHandler",

{synth_ai-0.22.2.dev687 → synth_ai-0.22.2.dev689}/synth_ai/mcp/research/registry.py

@@ -109,6 +109,7 @@ _DEFAULT_REQUIRED_SCOPES_BY_TOOL_NAME: dict[str, tuple[str, ...]] = {
     "research_get_run": READ_SCOPES,
     "research_get_swarm_activity": READ_SCOPES,
     "research_get_swarm_configuration": READ_SCOPES,
+    "research_get_run_history": READ_SCOPES,
     "research_get_swarm_evidence": READ_SCOPES,
     "research_get_swarm_usage": READ_SCOPES,
     "research_get_run_execution": READ_SCOPES,

{synth_ai-0.22.2.dev687 → synth_ai-0.22.2.dev689}/synth_ai/mcp/research/server.py

@@ -173,6 +173,7 @@ _STABLE_TOOL_NAMES = RESOURCE_READ_TOOL_NAMES | frozenset(
         "research_get_record",
         "research_get_record_citations",
         "research_get_native_attachments",
+        "research_verify_citations",
         "research_list_records",
         "research_get_operation_receipt",
         "research_record_events",
@@ -192,6 +193,7 @@ _STABLE_TOOL_NAMES = RESOURCE_READ_TOOL_NAMES | frozenset(
         "research_get_run_transcript",
         "research_get_swarm_activity",
         "research_get_swarm_configuration",
+        "research_get_run_history",
         "research_get_swarm_evidence",
         "research_get_swarm_status",
         "research_get_swarm_usage",
@@ -2015,6 +2017,13 @@ class ResearchMcpServer:
             result = client.runs.get(run_id, project_id=project_id)
             return asdict(result) if is_dataclass(result) else result
 
+    def _tool_get_run_history(self, args: JSONDict) -> JSONDict:
+        run_id = SwarmId(require_string(args, "run_id"))
+        after = _optional_int_default(args, "after", 0)
+        limit = _optional_int_default(args, "limit", 100)
+        with self._core_client_from_args(args) as client:
+            return client.swarms.history(run_id, after=after, limit=limit).to_wire()
+
     def _tool_get_swarm_configuration(self, args: JSONDict) -> JSONDict:
         swarm_id = SwarmId(require_string(args, "run_id"))
         with self._core_client_from_args(args) as client:

{synth_ai-0.22.2.dev687 → synth_ai-0.22.2.dev689}/synth_ai/mcp/research/tools/index.py

@@ -7,8 +7,7 @@ Upload reads only explicitly listed files under an explicit root: this stdio ser
 runs on the caller's machine; the hosted server cannot read a client's disk.
 """
 
-import re
-from collections.abc import Callable, Mapping
+from collections.abc import Callable
 from contextlib import AbstractContextManager
 from typing import Annotated
 
@@ -24,11 +23,11 @@ from synth_ai.mcp.research.tools.index_qa import (
     QA_READ_TOOL_NAMES,
     build_qa_tools,
 )
-from synth_ai.mcp.research.tools.local_files import SelectedFileReader
 from synth_ai.sdk.index.catalog import PublicSearchCapability
 from synth_ai.sdk.index.client import STATUS_POLL_TIMEOUT_SECONDS, IndexAPI, PublicIndexAPI
 from synth_ai.sdk.index.contracts import ContributionReference, Identifier, IndexContract
 from synth_ai.sdk.index.contributions import ContributionDraft, ContributionUploadSpec
+from synth_ai.sdk.index.local_files import read_selected_files
 from synth_ai.sdk.index.public_search import (
     DEFAULT_PUBLIC_SEARCH_WAIT_SECONDS,
     PublicSearchDisabledError,
@@ -75,11 +74,6 @@ INDEX_WRITE_TOOL_NAMES: tuple[str, ...] = (
 )
 INDEX_TOOL_NAMES = frozenset(INDEX_READ_TOOL_NAMES + INDEX_WRITE_TOOL_NAMES)
 
-_UPLOAD_MAX_BYTES = 64 * 1024 * 1024
-_CREDENTIAL = re.compile(
-    rb"(sk-[A-Za-z0-9_-]{20,}|AKIA[0-9A-Z]{16}|-----BEGIN [A-Z ]*PRIVATE KEY"
-    rb"|ghp_[A-Za-z0-9]{30,}|xox[bpa]-[A-Za-z0-9-]{10,})"
-)
 _KEY = Field(min_length=1, max_length=128, pattern=r"^[a-zA-Z0-9_.-]+$")
 
 
@@ -158,20 +152,6 @@ class SubmitRequest(IndexContract):
     spec: ContributionSubmitSpec
 
 
-def read_selected_files(root: str, files: Mapping[str, str]) -> dict[str, bytes]:
-    """Read exactly the listed regular files; reject escapes, symlinks and secrets."""
-    content: dict[str, bytes] = {}
-    total = 0
-    with SelectedFileReader(root) as reader:
-        for logical_path, relative in files.items():
-            data = reader.read(relative, _UPLOAD_MAX_BYTES - total)
-            total += len(data)
-            if _CREDENTIAL.search(data):
-                raise ValueError(f"{logical_path}: possible credential; remove it before upload")
-            content[logical_path] = data
-    return content
-
-
 _PUBLIC_SEARCH_DESCRIPTION = (
     "Search reviewed Synth Index Contributions (Index Search v0.2). Without an API key "
     "this is the free public search; mode is fast (synchronous) or deep (admitted, then "

synth_ai-0.22.2.dev689/synth_ai/mcp/research/tools/local_files.py

@@ -0,0 +1,5 @@
+"""Compatibility import for the shared descriptor-confined file reader."""
+
+from synth_ai.core.local_files import SelectedFileReader
+
+__all__ = ["SelectedFileReader"]

{synth_ai-0.22.2.dev687 → synth_ai-0.22.2.dev689}/synth_ai/mcp/research/tools/runs.py

@@ -821,6 +821,19 @@ def build_run_tools(server: Any) -> list[ToolDefinition]:
             ),
             handler=server._tool_get_run,
         ),
+        ToolDefinition(
+            name="research_get_run_history",
+            description="Read a bounded backend-authorized journal page with decision reasons and redacted inputs.",
+            input_schema=tool_schema(
+                {
+                    "run_id": {"type": "string", "description": "Research run id."},
+                    "after": {"type": "integer", "minimum": 0, "maximum": 2**64 - 1},
+                    "limit": {"type": "integer", "minimum": 1, "maximum": 256},
+                },
+                required=["run_id"],
+            ),
+            handler=server._tool_get_run_history,
+        ),
         ToolDefinition(
             name="research_get_swarm_configuration",
             description=(

{synth_ai-0.22.2.dev687 → synth_ai-0.22.2.dev689}/synth_ai/mcp/research/tools/scientific_records.py

@@ -58,6 +58,14 @@ class EventArguments(Contract):
     limit: int = Field(default=100, ge=1, le=1000)
 
 
+READ_DESCRIPTIONS = {
+    "research_verify_citations": (
+        "Check a retained record revision's external citations: retained, dangling, "
+        "denied, conflict, unavailable or refused. Read-only."
+    ),
+}
+
+
 def build_scientific_record_tools(client_factory):
     def execution_writer(arguments):
         selected = ExecutionWriteArguments.model_validate(arguments)
@@ -159,6 +167,7 @@ def build_scientific_record_tools(client_factory):
     )
     for name, model, method in (
         ("research_get_record", ReadArguments, "get"),
+        ("research_verify_citations", ReadArguments, "verify_citations"),
         ("research_list_records", ListArguments, "list"),
         ("research_get_operation_receipt", ReceiptArguments, "receipt"),
         ("research_record_events", EventArguments, "events"),
@@ -180,7 +189,9 @@ def build_scientific_record_tools(client_factory):
         tools.append(
             ToolDefinition(
                 name=name,
-                description="Read scoped retained scientific evidence.",
+                description=READ_DESCRIPTIONS.get(
+                    name, "Read scoped retained scientific evidence."
+                ),
                 input_schema=model.model_json_schema(),
                 handler=reader(model, method),
                 required_scopes=READ_SCOPES,

synth_ai-0.22.2.dev689/synth_ai/sdk/index/local_files.py

@@ -0,0 +1,32 @@
+"""Explicit, bounded local bytes shared by Index SDK, CLI and MCP uploads.
+
+# See: synth_ai/core/local_files.py (descriptor confinement)
+"""
+
+import re
+from collections.abc import Mapping
+
+from synth_ai.core.local_files import SelectedFileReader
+
+_UPLOAD_MAX_BYTES = 64 * 1024 * 1024
+_CREDENTIAL = re.compile(
+    rb"(sk-[A-Za-z0-9_-]{20,}|AKIA[0-9A-Z]{16}|-----BEGIN [A-Z ]*PRIVATE KEY"
+    rb"|ghp_[A-Za-z0-9]{30,}|xox[bpa]-[A-Za-z0-9-]{10,})"
+)
+
+
+def read_selected_files(root: str, files: Mapping[str, str]) -> dict[str, bytes]:
+    """Read exactly the listed regular files; reject escapes, symlinks and secrets."""
+    content: dict[str, bytes] = {}
+    total = 0
+    with SelectedFileReader(root) as reader:
+        for logical_path, relative in files.items():
+            data = reader.read(relative, _UPLOAD_MAX_BYTES - total)
+            total += len(data)
+            if _CREDENTIAL.search(data):
+                raise ValueError(f"{logical_path}: possible credential; remove it before upload")
+            content[logical_path] = data
+    return content
+
+
+__all__ = ["read_selected_files"]

{synth_ai-0.22.2.dev687 → synth_ai-0.22.2.dev689}/synth_ai/sdk/index/upload_session.py

@@ -30,8 +30,8 @@ from urllib.parse import urlsplit
 import httpx
 from pydantic import ValidationError
 
-from synth_ai.mcp.research.tools.index import read_selected_files
 from synth_ai.sdk.index.contributions import ContributionUploadPrepared
+from synth_ai.sdk.index.local_files import read_selected_files
 from synth_ai.sdk.index.transfer import _transfer_content
 
 _ACCEPTED = (200, 201, 204)