cmpnd 0.47.0__tar.gz → 0.47.1__tar.gz

{cmpnd-0.47.0 → cmpnd-0.47.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cmpnd
-Version: 0.47.0
+Version: 0.47.1
 Summary: DSPy observability and deployment SDK for cmpnd
 Project-URL: Homepage, https://cmpnd.ai
 Author-email: cmpnd <hello@cmpnd.ai>

{cmpnd-0.47.0 → cmpnd-0.47.1}/cmpnd/callback.py

@@ -1372,10 +1372,10 @@ class _LMMixin(_CallbackBase):
         if self._active_optimization_run_id is not None or context.get_current_optimization_run_id() is not None:
             span.attributes["optimization.role"] = "rollout"
 
-        # Capture LM kwargs (exclude secrets)
-        lm_kwargs = {
-            k: v for k, v in getattr(instance, "kwargs", {}).items() if k not in {"api_key", "api_base", "api_secret"}
-        }
+        # The usage fields read one named value each out of the raw kwargs. The
+        # span attributes copy only what helpers.SAFE_LM_KWARGS names, because
+        # the kwargs also hold provider credentials.
+        lm_kwargs = getattr(instance, "kwargs", None) or {}
         span.lm_usage = models.LMUsageObservationV1(
             sdk_call_id=call_id,
             model_requested=span.model_name,
@@ -1387,7 +1387,7 @@ class _LMMixin(_CallbackBase):
             {
                 "lm.model_type": getattr(instance, "model_type", "unknown"),
                 "lm.cache": str(getattr(instance, "cache", False)),
-                **{f"lm.{k}": str(v) for k, v in lm_kwargs.items()},
+                **{f"lm.{k}": str(v) for k, v in helpers.safe_lm_kwargs(lm_kwargs).items()},
             }
         )
 

{cmpnd-0.47.0 → cmpnd-0.47.1}/cmpnd/helpers.py

@@ -193,3 +193,55 @@ def infer_provider(instance: Any) -> str:
         return "together"
     else:
         return "unknown"
+
+
+# The LM kwargs the SDK may copy off an LM: into an ``lm.*`` span attribute,
+# which every member of the org can read, and into the ``dspy.LM(...)`` line of
+# deployed source. An allow-list, because an LM's kwargs carry provider
+# credentials under names no deny-list keeps up with, such as
+# ``aws_secret_access_key``, ``azure_ad_token``, ``vertex_credentials`` and
+# ``extra_headers``, and ``dspy.LM.dump_state()`` drops only ``api_key``. A
+# worker spends the deployment's sealed credential, so neither copy needs one.
+#
+# It holds what a provider is asked for (a superset of
+# ``optimization.SAMPLING_KEYS``) and the ``dspy.LM`` settings that shape a
+# call, and nothing that names a destination: ``api_base`` and ``base_url``
+# stay out.
+SAFE_LM_KWARGS: frozenset[str] = frozenset(
+    {
+        # Sampling and response shape.
+        "temperature",
+        "max_tokens",
+        "max_completion_tokens",
+        "top_p",
+        "top_k",
+        "n",
+        "stop",
+        "presence_penalty",
+        "frequency_penalty",
+        "seed",
+        "logprobs",
+        "top_logprobs",
+        "reasoning_effort",
+        "thinking",
+        "verbosity",
+        "response_format",
+        "tools",
+        "tool_choice",
+        "parallel_tool_calls",
+        "service_tier",
+        "cache_control_injection_points",
+        # dspy.LM call settings.
+        "cache",
+        "num_retries",
+        "use_developer_role",
+        "rollout_id",
+    }
+)
+
+
+def safe_lm_kwargs(kwargs: Any) -> dict[str, Any]:
+    """The entries of an LM's kwargs or ``dump_state()`` that :data:`SAFE_LM_KWARGS` names."""
+    if not isinstance(kwargs, dict):
+        return {}
+    return {key: value for key, value in kwargs.items() if key in SAFE_LM_KWARGS}

{cmpnd-0.47.0 → cmpnd-0.47.1}/cmpnd/packaging.py

@@ -30,6 +30,7 @@ from typing import TYPE_CHECKING, Any
 
 import typing_extensions
 
+from . import helpers
 from ._runtime_tools import is_runtime_tool
 
 if TYPE_CHECKING:
@@ -331,17 +332,6 @@ def _get_module_signature(module: dspy.Module) -> dspy.Signature | None:
     return None
 
 
-# Keys to omit when generating a dspy.LM() call
-_LM_SKIP_KEYS: set[str] = {
-    "model",
-    "model_type",
-    "api_key",
-    "api_base",
-    "base_url",
-    "model_list",
-}
-
-
 def _is_user_type(cls: type) -> bool:
     """True if cls is defined by user code, not stdlib/dspy/third-party."""
     mod = getattr(cls, "__module__", "") or ""
@@ -894,18 +884,12 @@ def generate_program_source(
     lm_state = _extract_lm_state(module)
     if lm_state is not None:
         model = lm_state.get("model", "")
-        kwargs_parts = []
-        for key, value in lm_state.items():
-            # Skip credentials/config we never codegen, and any dspy-internal
-            # state marker. dump_state() can emit markers like `_dspy_lm_class`
-            # (popped by load_state, never a real constructor kwarg); forwarding
-            # one into dspy.LM(...) makes litellm reject it as an unknown
-            # argument (a 502 at execute on the dspy versions that emit it).
-            # LM/litellm kwargs are never underscore-prefixed, so the prefix is
-            # a safe discriminator.
-            if key in _LM_SKIP_KEYS or key.startswith("_"):
-                continue
-            kwargs_parts.append(f"{key}={value!r}")
+        # dump_state() keeps every constructor kwarg but api_key, including
+        # cloud credentials, the destination (api_base), and dspy-internal
+        # markers such as `_dspy_lm_class` that litellm rejects as unknown
+        # arguments. The deployed LM names only what helpers.SAFE_LM_KWARGS
+        # allows. The worker supplies the credential and the destination.
+        kwargs_parts = [f"{key}={value!r}" for key, value in helpers.safe_lm_kwargs(lm_state).items()]
         kwargs_str = ", ".join(kwargs_parts)
         if kwargs_str:
             lines.append(f'lm = dspy.LM("{model}", {kwargs_str})')

{cmpnd-0.47.0 → cmpnd-0.47.1}/docs/sdk-instrumentation.md

@@ -846,6 +846,8 @@ The callback mints `source_observation_id` when the LM call starts and records `
 
 The LM span's `lm.finish_reason` attribute records why the model stopped, in the chat vocabulary serve's truncation warning reads. Each response shape spells it differently. Chat puts it on the first choice and DSPy 3.3's typed `LMResponse` on the first output. The lm15 `Response` a DSPy 3.4 engine returns carries it at the top level and names a tool-call stop `tool_call`, which the SDK records as `tool_calls`. The Responses API reports a `status`, and its `max_output_tokens` cutoff lands as `length`. `_finish_reason` in `python-sdk/cmpnd/callback.py` holds the mapping.
 
+The LM span's other `lm.*` attributes copy only the LM kwargs that `SAFE_LM_KWARGS` in `python-sdk/cmpnd/helpers.py` names. These are the sampling and response-shape settings, such as `temperature` and `reasoning_effort`, and dspy.LM's own call settings, such as `num_retries`. Every member of the org can read a span. An LM's kwargs can also carry provider credentials under names no deny-list keeps up with, such as `aws_secret_access_key`, `azure_ad_token`, `vertex_credentials` and `extra_headers`. So the list names what may be copied, and a kwarg it does not name stays out. It also leaves out `api_base` and `base_url`, which name a destination. The `dspy.LM(...)` line in a programmatic deploy's generated source goes through the same list, because `dspy.LM.dump_state()` drops only `api_key`. The worker supplies the deployment's credential and destination itself.
+
 `provider_cost` stays `None`. DSPy and LiteLLM can attach a calculated cost to history, but that value is not provider evidence. The SDK will populate this field only when an adapter can prove that the provider supplied both the amount and its currency.
 
 ## Field truncation (span inputs/outputs)

{cmpnd-0.47.0 → cmpnd-0.47.1}/pyproject.toml

@@ -5,7 +5,7 @@ name = "cmpnd"
 # it's new) — no git tags. Bump with `uv version --bump {minor,patch}` or by
 # hand. Runtime `cmpnd.__version__` reads installed metadata, so it tracks
 # this automatically. See docs/plans/2026-07-02-sdk-pypi-tag-free-publish.md.
-version = "0.47.0"
+version = "0.47.1"
 description = "DSPy observability and deployment SDK for cmpnd"
 readme = "README.md"
 requires-python = ">=3.11"

{cmpnd-0.47.0 → cmpnd-0.47.1}/tests/stress/_provider.py

@@ -198,8 +198,8 @@ def deployed_lm_kwargs(**overrides: object) -> dict[str, object]:
     that is where the destination is decided: `deploy` reads the model, the key and the
     ``api_base`` off `dspy.settings.lm` and forwards them so the server can resolve a
     provider. Setting the LM on the *module* does not do it — the packaged program's own
-    LM line comes from there, but `api_base` is stripped out of it (it is in
-    `cmpnd.packaging._LM_SKIP_KEYS`), so a worker pointed by nothing else answers from
+    LM line comes from there, but `api_base` is stripped out of it (it is not in
+    `cmpnd.helpers.SAFE_LM_KWARGS`), so a worker pointed by nothing else answers from
     whatever host it can resolve. Hence `with dspy.context(lm=…): cmpnd.deploy(…)` at the
     call sites here.
     """

{cmpnd-0.47.0 → cmpnd-0.47.1}/tests/test_callback.py

@@ -433,6 +433,51 @@ class TestCallbackLMHandlers:
 
         shutdown_exporter()
 
+    def test_on_lm_start_records_only_allow_listed_lm_kwargs(self):
+        """A provider credential set on the LM never reaches the span.
+
+        The span ships to serve, where every org member can read it, so its
+        ``lm.*`` attributes name what is known to be safe rather than filtering
+        out what is known to be secret.
+        """
+        import json
+
+        import dspy
+
+        from cmpnd.callback import CmpndCallback
+
+        with mock.patch("cmpnd.exporter.ensure_exporter_started", autospec=True):
+            callback = CmpndCallback()
+        lm = dspy.LM(
+            "bedrock/anthropic.claude-3-haiku",
+            temperature=0.2,
+            max_tokens=64,
+            api_key="secret-api-key",
+            api_base="https://secret-host.invalid",
+            aws_access_key_id="secret-access-key-id",
+            aws_secret_access_key="secret-access-key",
+            aws_session_token="secret-session-token",
+            azure_ad_token="secret-azure-token",
+            vertex_credentials='{"private_key": "secret-vertex"}',
+            extra_headers={"Authorization": "Bearer secret-header"},
+            unknown_future_kwarg="secret-unknown",
+        )
+
+        with mock.patch("cmpnd.exporter.get_exporter", autospec=True, return_value=None):
+            callback.on_lm_start(call_id="lm_call_1", instance=lm, inputs={"messages": []})
+
+        span = get_current_span()
+        assert span is not None
+        assert span.attributes["lm.temperature"] == "0.2"
+        assert span.attributes["lm.max_tokens"] == "64"
+        assert "secret" not in json.dumps(span.to_api_dict(), default=str)
+
+    def test_safe_lm_kwargs_cover_the_sampling_an_optimization_forwards(self):
+        """A sampling key an optimization may forward to a provider is one a span may show."""
+        from cmpnd import helpers, optimization
+
+        assert set(optimization.SAMPLING_KEYS) <= helpers.SAFE_LM_KWARGS
+
     @pytest.mark.parametrize("optimization_source", [None, "context", "callback"])
     def test_on_lm_start_creates_span(self, optimization_source):
         """Test on_lm_start creates LM_CALL span."""

{cmpnd-0.47.0 → cmpnd-0.47.1}/tests/test_deploy.py

@@ -528,8 +528,8 @@ class TestLMDestinationForwarding:
 
     A worker calls the model itself, so `deploy()` forwards both halves of the
     destination — `litellm_model` and, when the LM carries one, `lm_api_host` from its
-    ``api_base``. The host cannot ride the packaged program instead: `api_base` is in
-    `packaging._LM_SKIP_KEYS`, so the generated source never mentions it.
+    ``api_base``. The host cannot ride the packaged program instead: `api_base` is not in
+    `helpers.SAFE_LM_KWARGS`, so the generated source never mentions it.
 
     Both come off ``dspy.settings.lm`` **as of the deploy call**, which is the property a
     test that deploys under a different LM than it calls in-process depends on

{cmpnd-0.47.0 → cmpnd-0.47.1}/tests/test_packaging_program_source.py

@@ -781,6 +781,41 @@ class TestGenerateProgramSource(unittest.TestCase):
             self.assertIn("groq/llama-3.1-8b-instant", source)
             self.assertIn("dspy.configure(lm=lm)", source)
 
+    def test_lm_config_carries_only_allow_listed_kwargs(self):
+        """A provider credential set on the LM never reaches the deployed source.
+
+        ``dspy.LM.dump_state()`` keeps every constructor kwarg except ``api_key``,
+        so cloud credentials such as ``aws_secret_access_key`` survive into it.
+        The worker spends the deployment's sealed credential, so the source names
+        only kwargs known to be safe and still runs.
+        """
+        lm = dspy.LM(
+            "bedrock/anthropic.claude-3-haiku",
+            temperature=0.5,
+            num_retries=2,
+            api_key="secret-api-key",
+            api_base="https://secret-host.invalid",
+            aws_access_key_id="secret-access-key-id",
+            aws_secret_access_key="secret-access-key",
+            aws_session_token="secret-session-token",
+            azure_ad_token="secret-azure-token",
+            vertex_credentials='{"private_key": "secret-vertex"}',
+            extra_headers={"Authorization": "Bearer secret-header"},
+            unknown_future_kwarg="secret-unknown",
+        )
+        with dspy.context(lm=lm):
+            source = generate_program_source(dspy.Predict("question -> answer"))
+        self.assertNotIn("secret", source)
+        lm_line = next(line for line in source.splitlines() if line.startswith("lm = dspy.LM("))
+        self.assertIn("temperature=0.5", lm_line)
+        self.assertIn("num_retries=2", lm_line)
+        # The rebuilt LM constructs, so the allow-list names only real dspy.LM kwargs.
+        # Only the LM line runs: the source's dspy.configure(lm=lm) would leave this
+        # LM in the shared settings for every later test.
+        namespace: dict[str, typing.Any] = {"dspy": dspy}
+        exec(lm_line, namespace)
+        self.assertEqual(namespace["lm"].kwargs["temperature"], 0.5)
+
 
 class TestProgramStatePackaging(unittest.TestCase):
     """CMP-289: a deployed program must carry its optimized *state* (demos and

{cmpnd-0.47.0 → cmpnd-0.47.1}/uv.lock

@@ -496,7 +496,7 @@ wheels = [
 
 [[package]]
 name = "cmpnd"
-version = "0.47.0"
+version = "0.47.1"
 source = { editable = "." }
 dependencies = [
     { name = "dspy" },