fix(studio): make managed Sidecar prerequisites zero-config

.github/workflows/publish-tag-to-pypi.yaml

@@ -27,6 +27,38 @@ jobs:
         run: python3 -m pip install build --user --upgrade
       - name: Build wheel and source distribution
         run: python3 -m build
+      - name: Verify native AgentKit CLI archives stay outside Python distributions
+        run: |
+          python3 - <<'PY'
+          import tarfile
+          import zipfile
+          from pathlib import Path
+
+          root = Path.cwd()
+          wheels = list((root / "dist").glob("*.whl"))
+          if len(wheels) != 1:
+              raise SystemExit("Expected exactly one VeADK wheel")
+          with zipfile.ZipFile(wheels[0]) as archive:
+              names = archive.namelist()
+              if any("agentkit-linux-" in name or "agentkit-windows-" in name for name in names):
+                  raise SystemExit("VeADK wheel must not embed an AgentKit CLI archive")
+              metadata_name = next(
+                  name for name in names if name.endswith(".dist-info/METADATA")
+              )
+              metadata = archive.read(metadata_name).decode()
+          if "volcengine-agentkit-cli-bin" in metadata:
+              raise SystemExit("VeADK wheel must not depend on an unpublished CLI companion")
+
+          sdists = list((root / "dist").glob("*.tar.gz"))
+          if len(sdists) != 1:
+              raise SystemExit("Expected exactly one VeADK source distribution")
+          with tarfile.open(sdists[0], "r:gz") as archive:
+              if any(
+                  "agentkit-linux-" in member.name or "agentkit-windows-" in member.name
+                  for member in archive.getmembers()
+              ):
+                  raise SystemExit("VeADK sdist must not embed an AgentKit CLI archive")
+          PY
       - name: Reject distributions over the PyPI file-size limit
         run: |
           oversized_file="$(find dist -type f -size +100M -print -quit)"

frontend/README.md

@@ -200,9 +200,13 @@ server that `veadk frontend` launches — no separate backend.
   variables: generated source retains only the `${ENV_NAME}` reference, while
   YAML and browser drafts preserve the corresponding environment value.
   Runtime updates restore only explicitly public environment values. Existing
-  MCP authentication is represented as “configured” without returning its old
-  value to the browser; leaving it unchanged preserves the server-side Runtime
-  value, while entering a replacement Token overrides it. Long descriptions and prompts
+  MCP authentication references are resolved against the server-managed Runtime
+  configuration and transiently restored to the masked editor: leaving the MCP
+  identity unchanged reuses the stored value without another environment-variable
+  input. Changing an authenticated MCP
+  URL requires the user to enter a replacement Token, explicitly confirm reuse
+  of the previous credential, or mark the new endpoint as unauthenticated;
+  Studio never silently replays a credential to a different endpoint. Long descriptions and prompts
   scroll within bounded editors, while the sidebar stays pinned to the
   viewport. On narrow desktop windows, the structure, configuration, and debug
   panels stack vertically instead of squeezing the form. The deployment page

frontend/service/studio_release_server/builder.py

@@ -57,6 +57,7 @@
 _GIT_CLONE_ATTEMPT_SECONDS = 30
 _SPARSE_CHECKOUT_PATHS = (
     "/pyproject.toml",
+    "/uv.lock",
     "/README.md",
     "/LICENSE",
     "/frontend/",