ap-client 0.3.0.dev0__tar.gz → 0.3.1__tar.gz

{ap_client-0.3.0.dev0 → ap_client-0.3.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: ap-client
-Version: 0.3.0.dev0
+Version: 0.3.1
 Summary: Agent Platform API Client & CLI
 Requires-Python: >=3.10
 Requires-Dist: pyyaml>=6.0

{ap_client-0.3.0.dev0 → ap_client-0.3.1}/ap_client/api.py

@@ -15,6 +15,7 @@ from urllib.parse import parse_qsl, quote, urlencode, urlsplit, urlunsplit
 import requests
 
 from .config import Config, ConfigurationError, get_config, has_cluster_header
+from .managed_ak import require_managed_ak_ack, validate_ak_id, validate_ak_selection
 
 _DEFAULT_CONNECT_TIMEOUT = 300
 _DEFAULT_READ_TIMEOUT = 86400
@@ -459,7 +460,12 @@ class APIClient:
 
     def _post(self, path: str, data: Any, timeout: TimeoutType = None) -> Any:
         """Send a POST request."""
-        return self._request("POST", path, json_body=data, timeout=timeout)
+        from .managed_ak import parameter_ak_ids, require_parameter_ak_ack
+
+        references = parameter_ak_ids(data) if path == "/jobs" else set()
+        result = self._request("POST", path, json_body=data, timeout=timeout)
+        require_parameter_ak_ack(result, references)
+        return result
 
     def _delete(self, path: str, *, params: Optional[dict] = None) -> Any:
         """Send a DELETE request."""
@@ -911,9 +917,19 @@ class APIClient:
         checkpoint: Optional[dict] = None,
         benchmark: Optional[str] = None,
         experiment: Optional[str] = None,
+        ak_ids: Optional[list[str]] = None,
     ) -> dict:
         """Create a group."""
+        if ak_ids is not None and not isinstance(ak_ids, list):
+            raise ValueError("ak_ids must be a list")
+        references = list(ak_ids or [])
+        for reference in references:
+            if validate_ak_id(reference) is None:
+                raise ValueError("ak_ids entries must be nonempty strings")
+        references = list(dict.fromkeys(references))
         body: dict = {}
+        if references:
+            body["ak_ids"] = references
         if name:
             body["name"] = name
         effective_tags = _merge_meta_tags(
@@ -965,11 +981,14 @@ class APIClient:
             body["benchmark"] = benchmark
         if experiment is not None:
             body["experiment"] = experiment
-        return self._post("/groups", body)
+        result = self._post("/groups", body)
+        for reference in references:
+            require_managed_ak_ack(result, reference)
+        return result
 
     def create_job(
         self,
-        template: str,
+        template: Optional[str] = None,
         params: Optional[dict] = None,
         params_list: Optional[list] = None,
         suite_name: Optional[str] = None,
@@ -1022,6 +1041,7 @@ class APIClient:
         checkpoint: Optional[dict] = None,
         benchmark: Optional[str] = None,
         experiment: Optional[str] = None,
+        ak_id: Optional[str] = None,
     ) -> dict:
         """Create a job."""
         body = self.build_create_job_body(
@@ -1068,13 +1088,16 @@ class APIClient:
             checkpoint=checkpoint,
             benchmark=benchmark,
             experiment=experiment,
+            ak_id=ak_id,
         )
 
-        return self._post("/jobs", body, timeout=timeout)
+        result = self._post("/jobs", body, timeout=timeout)
+        require_managed_ak_ack(result, ak_id)
+        return result
 
     def build_create_job_body(
         self,
-        template: str,
+        template: Optional[str] = None,
         params: Optional[dict] = None,
         params_list: Optional[list] = None,
         suite_name: Optional[str] = None,
@@ -1126,6 +1149,7 @@ class APIClient:
         checkpoint: Optional[dict] = None,
         benchmark: Optional[str] = None,
         experiment: Optional[str] = None,
+        ak_id: Optional[str] = None,
     ) -> dict:
         """Build the /jobs request body for job creation."""
         _validate_credential_source_selection(
@@ -1134,7 +1158,14 @@ class APIClient:
             params=params,
             params_list=params_list,
         )
-        body: dict = {"template": template}
+        if not template and not profile_id:
+            raise ValueError("Either template or profile_id is required")
+        validate_ak_selection(ak_id, params, params_list, overrides)
+        body: dict = {}
+        if template is not None:
+            body["template"] = template
+        if ak_id is not None:
+            body["ak_id"] = ak_id
 
         if params is not None:
             body["params"] = params
@@ -1289,9 +1320,13 @@ class APIClient:
         next_token: Optional[str] = None,
         pagination: Optional[str] = None,
         include_total: bool = True,
+        ak_id: Optional[str] = None,
     ) -> dict:
         """List jobs."""
+        validate_ak_id(ak_id)
         params = {"skip": skip, "limit": limit}
+        if ak_id is not None:
+            params["ak_id"] = ak_id
         if template:
             params["template"] = template
         if group_id:
@@ -1485,9 +1520,13 @@ class APIClient:
         meta_job_type: Optional[str] = None,
         upstream_platform: Optional[str] = None,
         upstream_job_id: Optional[str] = None,
+        ak_id: Optional[str] = None,
     ) -> dict:
         """List groups."""
+        validate_ak_id(ak_id)
         params: dict = {"skip": skip, "limit": limit}
+        if ak_id is not None:
+            params["ak_id"] = ak_id
         if name is not None:
             params["name"] = name
         if group_id is not None:

{ap_client-0.3.0.dev0 → ap_client-0.3.1}/ap_client/cli.py

@@ -17,13 +17,22 @@ from ap_client.api import (
     _OTHERS_MODEL,
     APIError,
     PaginationProtocolError,
+    _is_sensitive_key,
     _merge_meta_tags,
+    _redact_sensitive_data,
     set_cluster_override,
     set_verbose_override,
 )
 from ap_client.config import ENV_VAR_SPECS, ConfigurationError, _parse_bool, normalize_output_format
 from ap_client.exporter import export_group, export_job
 from ap_client.irepo_commands import register as _register_dataset_repo
+from ap_client.managed_ak import (
+    ManagedAKProtocolError,
+    require_managed_ak_ack,
+    response_ak_ids,
+    validate_ak_id,
+    validate_ak_selection,
+)
 from ap_client.profile_commands import profile_app
 from ap_client.waiter import (
     WaitTimeoutError,
@@ -188,9 +197,28 @@ def _shell_command(args: list[str]) -> str:
     return " ".join(shlex.quote(str(arg)) for arg in args)
 
 
+def _retry_argument_contains_secret(raw: str) -> bool:
+    """Inspect display arguments without changing the submission payload."""
+    try:
+        value = json.loads(raw)
+    except (json.JSONDecodeError, TypeError):
+        value = raw
+
+    def contains_secret(item: Any) -> bool:
+        if isinstance(item, dict):
+            return any(
+                _is_sensitive_key(str(key)) or contains_secret(field) for key, field in item.items()
+            )
+        if isinstance(item, list):
+            return any(contains_secret(field) for field in item)
+        return _redact_sensitive_data(item) != item
+
+    return contains_secret(value)
+
+
 def _build_job_create_retry_command(
     *,
-    template: str,
+    template: Optional[str],
     agenthub_ref: Optional[str],
     instance_id: Optional[str],
     dataset: Optional[str],
@@ -223,8 +251,13 @@ def _build_job_create_retry_command(
     profile: Optional[str] = None,
     resource_profile_id: Optional[str] = None,
     timeout: Optional[float] = None,
+    ak_id: Optional[str] = None,
 ) -> str:
-    args = ["ap", "job", "create", template]
+    args = ["ap", "job", "create"]
+    if template is not None:
+        args.append(template)
+    if ak_id is not None:
+        args.extend(["--ak-id", ak_id])
     if profile:
         args.extend(["--profile", profile])
     if resource_profile_id:
@@ -287,6 +320,14 @@ def _build_job_create_retry_command(
         args.extend(["--group-post-process", group_post_process])
     elif enable_post_process:
         args.append("--enable-post-process")
+    if any(_retry_argument_contains_secret(str(arg)) for arg in args):
+        # A redacted command would silently retry with different credentials.
+        # Keep the original invocation private and print only the retry key.
+        return (
+            "Rerun your original command with "
+            f"--idempotency-key {shlex.quote(idempotency_key)}. "
+            "The command is omitted because it contains inline credentials."
+        )
     args.extend(["--idempotency-key", idempotency_key])
     return _shell_command(args)
 
@@ -1085,6 +1126,7 @@ def _idempotency_item_key(
     account_pool: Optional[str],
     resource_profile_id: Optional[str] = None,
     max_failure_retries: int = 0,
+    ak_id: Optional[str] = None,
 ) -> str:
     # Client-supplied item keys are authoritative; server hashing is only a
     # fallback for non-CLI callers, so this payload intentionally need not
@@ -1102,6 +1144,8 @@ def _idempotency_item_key(
         "queue": queue,
         "account_pool": account_pool,
     }
+    if ak_id is not None:
+        payload_data["ak_id"] = ak_id
     if resource_profile_id is not None:
         payload_data["resource_profile_id"] = resource_profile_id
     if max_failure_retries:
@@ -2595,6 +2639,7 @@ def meta_job_type_list(
 @job_app.command("list")
 def job_list(
     template: Optional[str] = typer.Option(None, "--template", help="Template name"),
+    ak_id: Optional[str] = typer.Option(None, "--ak-id", help="AP-managed AK ID"),
     group_id: Optional[str] = typer.Option(None, "--group-id", help="Group ID"),
     status: Optional[str] = typer.Option(None, "--status", help=_JOB_STATUS_HELP),
     job_id: Optional[str] = typer.Option(None, "--job-id", help="Job ID"),
@@ -2670,6 +2715,10 @@ def job_list(
     ),
 ):
     """List jobs."""
+    try:
+        validate_ak_id(ak_id)
+    except ValueError as exc:
+        raise typer.BadParameter(str(exc), param_hint="--ak-id") from None
     output_format = _normalize_output_format(output_format, keep_table=True)
     selected_columns = (
         _parse_columns_option(columns) if output_format in ("plain", "table") else None
@@ -2696,6 +2745,7 @@ def job_list(
     client = get_client()
     result = client.list_jobs(
         template=template,
+        **({"ak_id": ak_id} if ak_id is not None else {}),
         group_id=group_id,
         status=status,
         job_id=job_id,
@@ -2735,7 +2785,10 @@ def job_list(
 
 @job_app.command("create")
 def job_create(
-    template: str = typer.Argument(..., help="Template name"),
+    template: Optional[str] = typer.Argument(None, help="Template name; optional with --profile"),
+    ak_id: Optional[str] = typer.Option(
+        None, "--ak-id", help="AP-managed AK ID; requires server support"
+    ),
     agenthub_ref: Optional[str] = typer.Option(
         None, "--agenthub-ref", help="Agent-Hub branch/commit; overrides AP_AGENTHUB_REF"
     ),
@@ -3016,7 +3069,7 @@ def job_create(
     """Submit a job.
 
     Model configuration:
-        All jobs must provide model, model_base_url, and model_api_key through --params/-p.
+        Supply template parameters through --params/-p; select a managed credential with --ak-id.
 
     Examples:
         # Single job - full parameters
@@ -3057,7 +3110,10 @@ def job_create(
     different requested group_id (409 idempotency_conflict).
     """
     output_format = _normalize_output_format(output_format)
+    if not template and not profile:
+        raise typer.BadParameter("TEMPLATE is required unless --profile is provided")
     try:
+        validate_ak_id(ak_id)
         resource_profile_id = _normalize_resource_profile_id(resource_profile_id)
     except ValueError as exc:
         _emit_error(str(exc))
@@ -3076,6 +3132,7 @@ def job_create(
         or idempotency_key is not None
         or profile is not None
         or implicit_resource_profile_idempotency
+        or ak_id is not None
     )
     submission_idempotency_key = (
         idempotency_key or str(uuid.uuid4()) if idempotency_enabled else None
@@ -3110,6 +3167,11 @@ def job_create(
         _emit_error(str(exc))
         raise typer.Exit(1)
     overrides_dict = json.loads(overrides) if overrides else None
+    try:
+        validate_ak_selection(ak_id, params_dict, None, overrides_dict)
+    except ValueError as exc:
+        _emit_error(str(exc))
+        raise typer.Exit(1) from None
     if isinstance(overrides_dict, dict) and overrides_dict.get("sidecar_resources"):
         typer.secho(
             "warning: 'overrides.sidecar_resources' is deprecated; "
@@ -3215,7 +3277,7 @@ def job_create(
         if not suite_name and not group_id:
             from datetime import datetime as _dt
 
-            suite_name = f"{template}-sp-{profile}-{_dt.now().strftime('%m%d-%H%M')}"
+            suite_name = f"{template or 'profile'}-sp-{profile}-{_dt.now().strftime('%m%d-%H%M')}"
 
         # Parse instances from -i (simple comma split, no range/exclude expansion)
         instances_list: Optional[list[str]] = None
@@ -3255,6 +3317,7 @@ def job_create(
             eval_config=eval_config_dict,
             profile_id=profile,
             resource_profile_id=resource_profile_id,
+            **({"ak_id": ak_id} if ak_id is not None else {}),
             profile_version=profile_version_req,
             instances=instances_list,
             dataset=dataset,
@@ -3276,6 +3339,11 @@ def job_create(
             _emit_dry_run_warnings(dry_run_warnings)
             body["dry_run"] = True
             result = client._post("/jobs", body, timeout=timeout)
+            try:
+                require_managed_ak_ack(result, ak_id)
+            except ManagedAKProtocolError as exc:
+                _emit_error(str(exc))
+                raise typer.Exit(1) from None
             _print_formatted(result, "json" if output_format == "plain" else output_format)
             return
 
@@ -3314,6 +3382,7 @@ def job_create(
                 idempotency_key=submission_idempotency_key,
                 profile=profile,
                 resource_profile_id=resource_profile_id,
+                **({"ak_id": ak_id} if ak_id is not None else {}),
                 timeout=timeout,
             )
             if idempotency_enabled and submission_idempotency_key is not None
@@ -3357,6 +3426,7 @@ def job_create(
                     eval_config=eval_config_dict,
                     profile_id=profile,
                     resource_profile_id=resource_profile_id,
+                    **({"ak_id": ak_id} if ak_id is not None else {}),
                     profile_version=profile_version_req,
                     instances=instances_list,
                     dataset=dataset,
@@ -3370,7 +3440,11 @@ def job_create(
                     timeout=timeout,
                     **post_process_kwargs,
                 )
+                require_managed_ak_ack(result, ak_id)
                 _require_resource_profile_ack(result, resource_profile_id)
+        except ManagedAKProtocolError as exc:
+            _emit_error(str(exc))
+            raise typer.Exit(1) from None
         except Exception:
             emit_profile_retry_hint_once()
             raise
@@ -3385,6 +3459,8 @@ def job_create(
             else:
                 print("[green]Profile submission completed:[/]")
             print(f"  profile: {profile}")
+            if ak_id is not None:
+                print(f"  ak_ids: {response_ak_ids(result)}")
             if resource_profile_id is not None:
                 print(f"  resource_profile_id: {resource_profile_id}")
             print(f"  group_id: {result.get('group_id')}")
@@ -3496,6 +3572,12 @@ def job_create(
             *(item.get("credential_type") for item in parsed_params_list if isinstance(item, dict)),
         )
 
+    try:
+        validate_ak_selection(ak_id, params_dict, parsed_params_list, overrides_dict)
+    except ValueError as exc:
+        _emit_error(str(exc))
+        raise typer.Exit(1) from None
+
     is_batch = False
     if parsed_params_list:
         is_batch = True
@@ -3555,6 +3637,7 @@ def job_create(
             group_post_process=group_post_process,
             idempotency_key=submission_idempotency_key,
             resource_profile_id=resource_profile_id,
+            **({"ak_id": ak_id} if ak_id is not None else {}),
             timeout=timeout,
         )
         if not dry_run
@@ -3627,6 +3710,7 @@ def job_create(
         total_submitted = 0
         total_failed = 0
         batch_results: list[dict] = []
+        observed_ak_ids: set[str] = set()
         observed_group_id = target_group_id
         observed_queue_id: Optional[str] = None
 
@@ -3649,6 +3733,7 @@ def job_create(
                         queue=queue,
                         account_pool=account_pool,
                         resource_profile_id=resource_profile_id,
+                        **({"ak_id": ak_id} if ak_id is not None else {}),
                         max_failure_retries=max_failure_retries,
                     )
                 batch.append(item)
@@ -3681,6 +3766,7 @@ def job_create(
                 credential_type=credential_type,
                 account_pool=account_pool,
                 resource_profile_id=resource_profile_id,
+                **({"ak_id": ak_id} if ak_id is not None else {}),
                 checkpoint_id=checkpoint_id,
                 checkpoint_path=checkpoint_path,
                 checkpoint=checkpoint_dict,
@@ -3723,6 +3809,7 @@ def job_create(
                         credential_type=credential_type,
                         account_pool=account_pool,
                         resource_profile_id=resource_profile_id,
+                        **({"ak_id": ak_id} if ak_id is not None else {}),
                         checkpoint_id=checkpoint_id,
                         checkpoint_path=checkpoint_path,
                         checkpoint=checkpoint_dict,
@@ -3779,6 +3866,7 @@ def job_create(
                         credential_type=credential_type,
                         account_pool=account_pool,
                         resource_profile_id=resource_profile_id,
+                        **({"ak_id": ak_id} if ak_id is not None else {}),
                         checkpoint_id=checkpoint_id,
                         checkpoint_path=checkpoint_path,
                         checkpoint=checkpoint_dict,
@@ -3787,6 +3875,10 @@ def job_create(
                         timeout=timeout,
                         **post_process_kwargs,
                     )
+                    require_managed_ak_ack(batch_result, ak_id)
+                    observed_ak_ids.update(response_ak_ids(batch_result))
+                    for batch_job in batch_result.get("jobs", []):
+                        observed_ak_ids.update(response_ak_ids(batch_job))
                     _require_resource_profile_ack(batch_result, resource_profile_id)
                     batch_group_id = batch_result.get("group_id")
                     if not observed_group_id and batch_group_id:
@@ -3820,6 +3912,9 @@ def job_create(
                         current_job=f"group={observed_group_id}" if observed_group_id else "",
                         current_stage=f"submitted={total_submitted} failed={total_failed}",
                     )
+        except ManagedAKProtocolError as exc:
+            _emit_error(str(exc))
+            raise typer.Exit(1) from None
         except Exception:
             emit_retry_hint_once()
             raise
@@ -3832,6 +3927,7 @@ def job_create(
             "failed": total_failed,
             "batches": batch_results,
         }
+        result["ak_ids"] = sorted(observed_ak_ids)
         if submission_idempotency_key is not None:
             result["idempotency_key"] = submission_idempotency_key
         if resource_profile_id is not None:
@@ -3841,6 +3937,8 @@ def job_create(
             print(f"  group_id: {result.get('group_id')}")
             if result.get("queue_id") is not None:
                 print(f"  queue_id: {result.get('queue_id')}")
+            if ak_id is not None:
+                print(f"  ak_ids: {response_ak_ids(result)}")
             if resource_profile_id is not None:
                 print(f"  resource_profile_id: {resource_profile_id}")
             if submission_idempotency_key is not None:
@@ -3874,6 +3972,7 @@ def job_create(
                 credential_type=credential_type,
                 account_pool=account_pool,
                 resource_profile_id=resource_profile_id,
+                **({"ak_id": ak_id} if ak_id is not None else {}),
                 checkpoint_id=checkpoint_id,
                 checkpoint_path=checkpoint_path,
                 checkpoint=checkpoint_dict,
@@ -3910,6 +4009,7 @@ def job_create(
                 credential_type=credential_type,
                 account_pool=account_pool,
                 resource_profile_id=resource_profile_id,
+                **({"ak_id": ak_id} if ak_id is not None else {}),
                 checkpoint_id=checkpoint_id,
                 checkpoint_path=checkpoint_path,
                 checkpoint=checkpoint_dict,
@@ -3956,6 +4056,7 @@ def job_create(
                     credential_type=credential_type,
                     account_pool=account_pool,
                     resource_profile_id=resource_profile_id,
+                    **({"ak_id": ak_id} if ak_id is not None else {}),
                     checkpoint_id=checkpoint_id,
                     checkpoint_path=checkpoint_path,
                     checkpoint=checkpoint_dict,
@@ -3964,6 +4065,7 @@ def job_create(
                     timeout=timeout,
                     **post_process_kwargs,
                 )
+                require_managed_ak_ack(result, ak_id)
                 _require_resource_profile_ack(result, resource_profile_id)
                 jobs = result.get("jobs", [])
                 if not jobs:
@@ -3978,6 +4080,9 @@ def job_create(
                         current_job=f"job={job.get('job_id')}" if job.get("job_id") else "",
                         current_stage=f"submitted={submitted} failed={failed}",
                     )
+        except ManagedAKProtocolError as exc:
+            _emit_error(str(exc))
+            raise typer.Exit(1) from None
         except Exception:
             emit_retry_hint_once()
             raise
@@ -4009,6 +4114,8 @@ def job_create(
                 )
             if result.get("group_id"):
                 print(f"  group_id: {result.get('group_id')}")
+            if ak_id is not None:
+                print(f"  ak_ids: {response_ak_ids(result)}")
             if resource_profile_id is not None:
                 print(f"  resource_profile_id: {resource_profile_id}")
 
@@ -4970,6 +5077,9 @@ def checkpoint_get(
 
 @group_app.command("create")
 def group_create(
+    ak_id: Optional[list[str]] = typer.Option(
+        None, "--ak-id", help="Managed AK reference (repeatable) to associate with the Group"
+    ),
     name: Optional[str] = typer.Option(None, "--name", "-n", help="Group name"),
     template: Optional[str] = typer.Option(
         None,
@@ -5108,6 +5218,11 @@ def group_create(
 ):
     """Create a Group."""
     output_format = _normalize_output_format(output_format)
+    try:
+        for reference in ak_id or []:
+            validate_ak_id(reference)
+    except ValueError as exc:
+        raise typer.BadParameter(str(exc), param_hint="--ak-id") from None
     client = get_client()
     eval_config_dict = json.loads(eval_config) if eval_config else None
     group_post_process_dict = _parse_json_object(group_post_process, "--group-post-process")
@@ -5163,30 +5278,37 @@ def group_create(
         _emit_error(str(exc))
         raise typer.Exit(1)
 
-    result = client.create_group(
-        name=name,
-        tags=group_tags,
-        template=template,
-        agenthub_revision=agenthub_revision,
-        queue_id=queue,  # CLI --queue / -q 走标准 queue_id 字段
-        max_concurrency=max_concurrency,
-        eval_config=eval_config_dict,
-        model_base_url_collection=model_base_url_collection_list,
-        group_post_process=group_post_process_dict,
-        dataset=dataset,
-        model=model_name,
-        scaffold=scaffold,
-        agent=agent_dict,
-        checkpoint_id=checkpoint_id,
-        checkpoint_path=checkpoint_path,
-        checkpoint=checkpoint_dict,
-        benchmark=benchmark,
-        experiment=experiment,
-    )
+    try:
+        result = client.create_group(
+            ak_ids=ak_id,
+            name=name,
+            tags=group_tags,
+            template=template,
+            agenthub_revision=agenthub_revision,
+            queue_id=queue,  # CLI --queue / -q 走标准 queue_id 字段
+            max_concurrency=max_concurrency,
+            eval_config=eval_config_dict,
+            model_base_url_collection=model_base_url_collection_list,
+            group_post_process=group_post_process_dict,
+            dataset=dataset,
+            model=model_name,
+            scaffold=scaffold,
+            agent=agent_dict,
+            checkpoint_id=checkpoint_id,
+            checkpoint_path=checkpoint_path,
+            checkpoint=checkpoint_dict,
+            benchmark=benchmark,
+            experiment=experiment,
+        )
+    except ManagedAKProtocolError as exc:
+        _emit_error(str(exc))
+        raise typer.Exit(1) from None
     if output_format == "plain":
         print("[green]Group created:[/]")
         print(f"  group_id: {result.get('group_id')}")
         print(f"  name: {result.get('name')}")
+        if response_ak_ids(result):
+            print(f"  ak_ids: {response_ak_ids(result)}")
         if result.get("queue_id") is not None:
             print(f"  queue_id: {result.get('queue_id')}")
         if result.get("template") is not None:
@@ -5226,6 +5348,9 @@ def group_create(
 def group_list(
     name: Optional[str] = typer.Option(None, "--name", help="Group name"),
     group_id: Optional[str] = typer.Option(None, "--group-id", help="Group ID"),
+    ak_id: Optional[str] = typer.Option(
+        None, "--ak-id", help="Filter groups containing this managed AK"
+    ),
     user_id: Optional[str] = typer.Option(None, "--user-id", help="User ID"),
     user_name: Optional[str] = typer.Option(None, "--user-name", help="User name"),
     skip: int = typer.Option(0, "--skip", help="Skip the first N entries"),
@@ -5280,6 +5405,7 @@ def group_list(
         profile=profile,
         name=name,
         group_id=group_id,
+        **({"ak_id": ak_id} if ak_id is not None else {}),
         user_id=user_id,
         user_name=user_name,
         dataset=dataset,
@@ -7299,19 +7425,21 @@ async def _non_interactive_exec(client, job_id: str, container: str, command: li
                 else:
                     try:
                         data = json.loads(message)
-                        if "error" in data:
+                        if isinstance(data, dict) and "error" in data:
                             sys.stderr.write(f"[错误] {data['error']}\n")
                             sys.stderr.flush()
-                            break
+                            raise typer.Exit(1)
+                        sys.stdout.write(message)
+                        sys.stdout.flush()
                     except (json.JSONDecodeError, TypeError):
                         sys.stdout.write(message)
                         sys.stdout.flush()
+    except typer.Exit:
+        raise
     except websockets.exceptions.ConnectionClosed:
         # 命令执行完毕后服务端关闭连接，属于正常结束
         pass
     except Exception as e:
-        import typer
-
         typer.echo(f"连接失败: {e}", err=True)
         raise typer.Exit(1)
 

ap_client-0.3.1/ap_client/managed_ak.py

@@ -0,0 +1,86 @@
+"""Client-side validation and acknowledgement of managed AK references."""
+
+import re
+from typing import Any
+
+
+def validate_ak_id(value: Any) -> str | None:
+    if value is None:
+        return None
+    if not isinstance(value, str) or not 1 <= len(value) <= 128 or value != value.strip():
+        raise ValueError(
+            "ak_id must be a nonempty string of at most 128 characters without surrounding whitespace"
+        )
+    return value
+
+
+def validate_ak_selection(ak_id: Any, params: Any, params_list: Any, overrides: Any) -> None:
+    validate_ak_id(ak_id)
+    candidates = [params, overrides]
+    if isinstance(params_list, list):
+        candidates.extend(params_list)
+    for value in candidates:
+        parameter_ak_ids(value)
+        if (
+            isinstance(value, dict)
+            and {"ak_id", "ak_selection_source", "user_ak_id", "key_id"} & value.keys()
+        ):
+            raise ValueError(
+                "AK selection belongs at the request top level; ak_selection_source is server-generated"
+            )
+
+
+def parameter_ak_ids(value: Any) -> set[str]:
+    """Find explicit parameter references without resolving credential plaintext."""
+    if isinstance(value, dict):
+        return set().union(*(parameter_ak_ids(v) for v in value.values())) if value else set()
+    if isinstance(value, list):
+        return set().union(*(parameter_ak_ids(v) for v in value)) if value else set()
+    if isinstance(value, str) and "$akpool" in value:
+        match = re.fullmatch(r"\$akpool:([A-Za-z0-9][A-Za-z0-9_.-]{0,127})", value)
+        if not match:
+            raise ValueError("Use a complete $akpool:<ak-id> parameter value")
+        return {match[1]}
+    return set()
+
+
+def require_parameter_ak_ack(response: Any, ak_ids: set[str]) -> None:
+    if ak_ids and (not isinstance(response, dict) or response.get("ak_placeholder_version") != 1):
+        raise ManagedAKProtocolError(",".join(sorted(ak_ids)), response)
+
+
+class ManagedAKProtocolError(RuntimeError):
+    """A response cannot confirm that the requested AK reference was honored."""
+
+    def __init__(self, ak_id: str, response: Any):
+        self.response = response
+        self.job_ids = []
+        if isinstance(response, dict):
+            jobs = response.get("jobs") or [response]
+            self.job_ids = [
+                job["job_id"] for job in jobs if isinstance(job, dict) and job.get("job_id")
+            ]
+        self.group_id = response.get("group_id") if isinstance(response, dict) else None
+        super().__init__(
+            f"Managed AK protocol mismatch: server did not acknowledge ak_id={ak_id}. "
+            f"Returned Job IDs: {self.job_ids}. Verify these jobs before resubmitting; "
+            "the target AP server may need an upgrade."
+            + (f" Returned Group ID: {self.group_id}." if self.group_id else "")
+        )
+
+
+def response_ak_ids(response: Any) -> list[str]:
+    if not isinstance(response, dict):
+        return []
+    value = response.get("ak_ids", [])
+    return value if isinstance(value, list) and all(isinstance(v, str) for v in value) else []
+
+
+def require_managed_ak_ack(response: Any, ak_id: str | None) -> None:
+    if ak_id is None:
+        return
+    if ak_id not in response_ak_ids(response):
+        raise ManagedAKProtocolError(ak_id, response)
+    jobs = response.get("jobs", [])
+    if not isinstance(jobs, list) or any(ak_id not in response_ak_ids(job) for job in jobs):
+        raise ManagedAKProtocolError(ak_id, response)

{ap_client-0.3.0.dev0 → ap_client-0.3.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "ap-client"
-version = "0.3.0.dev0"
+version = "0.3.1"
 description = "Agent Platform API Client & CLI"
 readme = { text = "A lightweight Python SDK and command line interface for Agent Platform. It provides helpers for configuring API access and managing templates, datasets, jobs, and groups.", content-type = "text/markdown" }
 requires-python = ">=3.10"