cmpnd 0.55.0__tar.gz → 0.57.0__tar.gz

{cmpnd-0.55.0 → cmpnd-0.57.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cmpnd
-Version: 0.55.0
+Version: 0.57.0
 Summary: DSPy observability and deployment SDK for cmpnd
 Project-URL: Homepage, https://cmpnd.ai
 Author-email: cmpnd <hello@cmpnd.ai>
@@ -205,6 +205,145 @@ The platform makes the program the first time your organization uses the
 program name. Later deploys under the same program name go to the same
 program, and so do the traces of a client that runs it.
 
+### Credentials
+
+A hosted program spends a credential your organization sealed, and the deploy
+names it. The program's code stays the code you run on your laptop:
+
+```python
+lm = dspy.LM("openai/deepseek-4.1-flash", api_base="https://gw.lunaroute.com/v1")  # unchanged
+
+luna = cmpnd.credentials.get("luna-exec")
+deployed = sdk.deploy_program(program, credential=luna)
+# deploy: default-lm: chat_completions openai/deepseek-4.1-flash → luna-exec (https://gw.lunaroute.com)
+```
+
+- `cmpnd.credentials.get(name)` returns a `cmpnd.Credential` holding the name,
+  the protocols its endpoint serves and its `api_base`. It holds no key. A name
+  the organization does not hold raises `cmpnd.CredentialNotFound`, which lists
+  the names it does hold and the nearest one. `cmpnd.credentials.list()`
+  returns them all.
+- `credential=` takes a `cmpnd.Credential`, never a string. A string raises
+  and shows the `cmpnd.credentials.get(...)` line to write.
+- Without `credential=`, the deployment spends the organization's default,
+  which an owner sets with `cmpnd credentials default NAME`.
+- The deployment records the credential's name. Each call spends the newest
+  credential sealed under that name, so an owner who rotates a key needs no
+  redeploy.
+- The deploy prints the protocol, model and credential of each binding, as
+  above. A server that prints none chose the credential from the model's
+  provider prefix, and the SDK warns.
+- A hosted call goes to the credential's `api_base`. The LM's own `api_base`
+  serves your laptop run and is not sent.
+
+Keys never leave your laptop. The SDK sends no key on the LM, and a key reaches
+the platform only through `cmpnd credentials create`. `cmpnd deploy FILE`
+refuses source whose import builds an LM carrying a key, and names the module,
+the model and the field.
+
+### The same source on your laptop and hosted
+
+A program's logic runs unchanged on your laptop and hosted. On your laptop it
+spends the key in your environment. Hosted, it spends a credential your
+organization sealed. Keep the logic in one file and let a small entry point
+choose where it runs.
+
+The program file holds the logic and names its model. It holds no key:
+
+```python
+# qa.py
+import dspy
+
+lm = dspy.LM("openai/gpt-5-mini")  # no api_key: litellm reads OPENAI_API_KEY on your laptop
+program = dspy.Predict("question -> answer")
+
+
+def metric(gold, pred, trace=None, pred_name=None, pred_trace=None, lms=None):
+    verdict = dspy.Predict("answer, gold -> correct: bool")(answer=pred.answer, gold=gold.answer, lm=lms["critic"])
+    return dspy.Prediction(score=float(verdict.correct), feedback="correct" if verdict.correct else "wrong")
+```
+
+Seal the key once for the organization and make it the default:
+
+```bash
+printf '%s' "$OPENAI_API_KEY" | cmpnd credentials create --name openai --preset openai
+cmpnd credentials default openai
+```
+
+The entry point is the only code that knows where the run happens:
+
+```python
+# main.py
+import functools
+import sys
+
+import cmpnd
+import dspy
+
+from qa import lm, metric, program
+
+HOSTED = "--hosted" in sys.argv
+
+sdk = cmpnd.Client()
+qa = cmpnd.Program("qa", module=program, lm=lm)
+reflection = dspy.LM("openai/gpt-5", max_tokens=32000)
+lms = {"critic": dspy.LM("openai/gpt-5-mini")}
+train, val = load_examples()  # your dspy.Example lists
+
+if HOSTED:
+    deployed = sdk.deploy_program(qa)  # spends the default credential, openai
+    print(sdk.run_deployment(deployed, question="What is DSPy?"))
+    best = sdk.optimize_deployment(
+        deployed,
+        trainset=train,
+        valset=val,
+        metric=metric,  # the platform hands it lms
+        reflection_lm=cmpnd.HostedLM(reflection),
+        lms={name: cmpnd.HostedLM(model) for name, model in lms.items()},
+        auto="light",
+    )
+else:
+    print(sdk.run_program(qa, question="What is DSPy?"))  # spends $OPENAI_API_KEY
+    gepa = dspy.GEPA(metric=functools.partial(metric, lms=lms), reflection_lm=reflection, auto="light")
+    best = sdk.optimize_program(qa, gepa, trainset=train, valset=val)
+```
+
+`python main.py` runs everything on your laptop, and `python main.py --hosted`
+runs it on the platform. `cmpnd deploy qa.py qa` deploys the same file from the
+terminal.
+
+| | On your laptop | Hosted |
+|---|---|---|
+| Key | the provider's variable in your environment, such as `OPENAI_API_KEY` | the credential the call names, else the organization's default |
+| Address | the LM's `api_base`, else the provider's endpoint | the credential's `api_base` |
+| Model | `gpt-5-mini`, the model after its first `/` | `gpt-5-mini` |
+| The metric's `lms` | the dict the entry point binds | the run's `lms=`, which the platform hands it |
+
+These rules keep the program file portable:
+
+- **Leave the key off the program's LM** and let litellm read the provider's
+  own variable. For a key in a variable litellm does not read, write
+  `api_key=os.environ.get("NAME")`. cmpnd imports a deploy file with an empty
+  environment, so the key is `None` there and present on your laptop.
+- **Never write a key into the file, and never read it as
+  `os.environ["NAME"]` at module scope.** The deploy refuses the first. The
+  second raises `KeyError` hosted, where the environment holds no key.
+- **Seal the credential at the address your laptop LM reaches.** A program
+  that sets `api_base="https://gw.lunaroute.com/v1"` needs a credential sealed
+  there, with `--preset lunaroute` or `--api-base`. Hosted calls go to the
+  credential's address and ignore the LM's `api_base`. The deploy prints the
+  address it chose, so you can compare the two.
+- **Wrap a model you hand the hosted optimization in `cmpnd.HostedLM`.** The
+  entry point builds `reflection_lm=` and each `lms=` entry, so those LMs may
+  hold a key for the laptop run. The wrapper leaves that key on your machine.
+  `optimize_deployment` refuses a key on an unwrapped LM, because there it would
+  look spent. `cmpnd.HostedLM(model, credential=c)` makes a model spend a
+  credential other than the run's.
+
+A judge built on `dspy.experimental.TypeSafe` also runs unchanged in both
+places. [`docs/sdk-instrumentation.md`](docs/sdk-instrumentation.md), under
+"System One judges", describes the hosted side.
+
 ### Options
 
 ```python
@@ -213,6 +352,7 @@ sdk.deploy_program(
     metric=None,       # optional: a metric callable, packaged for optimization
     timeout=300,       # optional: seconds to wait for the deployment to be ready
     metadata=None,     # optional: a JSON-serializable dict, at most 64 KiB, stored with the deployment
+    credential=None,   # optional: a cmpnd.Credential the program's model spends
 )
 ```
 
@@ -270,11 +410,32 @@ from the deployment.
 `reflection_lm` is the model that proposes each new instruction. The search is
 only as good as this model, so it is usually a strong model and not the one
 being optimized. A `dspy.LM` passes its sampling settings to the provider. A
-bare model name gives the same model with no sampling settings. The platform
-supplies the credential and the endpoint, so the SDK refuses an `api_key`,
-`api_base` or `base_url` on the LM before any network call. On a hosted org,
-both live on the provider credential (Account → Model Providers), keyed by the
-model's protocol. One `openai` credential serves every `openai/*` model.
+bare model name gives the same model with no sampling settings. A run spends
+sealed credentials only, so the SDK refuses a key on the LM before any network
+call. `cmpnd.HostedLM(lm)` keeps a key your laptop runs spend on this machine
+and passes the LM's model and sampling.
+
+`credential=` names the run's credential, which every binding that names none
+spends: the program's model, the reflection model and each entry of `lms`. A
+binding names its own credential through a wrapper for its protocol:
+
+```python
+luna = cmpnd.credentials.get("luna-exec")      # serves chat_completions and system_one
+openai = cmpnd.credentials.get("openai")
+best = sdk.optimize_deployment(
+    deployed, trainset=train, valset=val, metric=metric,
+    credential=luna,
+    reflection_lm=cmpnd.HostedLM(dspy.LM("openai/gpt-5"), credential=openai),
+    lms={"judge": cmpnd.SystemOne("lunaroute/djev", credential=luna)},
+    auto="light",
+)
+```
+
+`cmpnd.HostedLM(lm, credential=c)` wraps a chat LM, and
+`cmpnd.SystemOne(model, credential=c)` declares a System One model. A binding
+without a credential spends the run's, or the organization's default. The
+platform refuses a credential whose endpoint does not serve a binding's
+protocol, and names the `credential=` to add.
 
 The SDK checks the metric before any network call. GEPA writes each new
 instruction from the textual feedback the metric returns, so it needs a
@@ -322,9 +483,9 @@ rules:
   names.
 - `"default-lm"` is reserved for the program's own model, which comes from the
   deployment. Declaring it raises an error that names it.
-- The platform refuses a model your org holds no credential for when it dispatches
-  the run, before the run starts. These LMs, like `reflection_lm`, must not set
-  `api_key`, `api_base` or `base_url`.
+- The platform refuses a binding it finds no credential for when it dispatches
+  the run, before the run starts. These LMs, like `reflection_lm`, must not
+  carry a key.
 
 The `lms` parameter does not change the arity check. Five or more positional
 arguments make a feedback metric, and a metric without `lms` never receives
@@ -340,8 +501,9 @@ sdk.optimize_deployment(
     valset=val,              # required: validation examples
     metric=metric,           # required: the metric, arity-checked
     config=None,             # optional: optimizer config, allow-listed by the platform
-    reflection_lm=None,      # required: a dspy.LM or a bare model name
-    lms=None,                # optional: name -> dspy.LM, the run's named models
+    reflection_lm=None,      # required: a dspy.LM, a bare model name or a cmpnd.HostedLM
+    lms=None,                # optional: name -> dspy.LM, cmpnd.HostedLM or cmpnd.SystemOne
+    credential=None,         # optional: the cmpnd.Credential every other binding spends
     max_metric_calls=None,   # budget: the metric-call ceiling for one step
     auto=None,               # budget: "light", "medium" or "heavy"
     may_author_code=None,    # optional: False keeps each dspy.Flex at its deployed source

{cmpnd-0.55.0 → cmpnd-0.57.0}/README.md

@@ -154,6 +154,145 @@ The platform makes the program the first time your organization uses the
 program name. Later deploys under the same program name go to the same
 program, and so do the traces of a client that runs it.
 
+### Credentials
+
+A hosted program spends a credential your organization sealed, and the deploy
+names it. The program's code stays the code you run on your laptop:
+
+```python
+lm = dspy.LM("openai/deepseek-4.1-flash", api_base="https://gw.lunaroute.com/v1")  # unchanged
+
+luna = cmpnd.credentials.get("luna-exec")
+deployed = sdk.deploy_program(program, credential=luna)
+# deploy: default-lm: chat_completions openai/deepseek-4.1-flash → luna-exec (https://gw.lunaroute.com)
+```
+
+- `cmpnd.credentials.get(name)` returns a `cmpnd.Credential` holding the name,
+  the protocols its endpoint serves and its `api_base`. It holds no key. A name
+  the organization does not hold raises `cmpnd.CredentialNotFound`, which lists
+  the names it does hold and the nearest one. `cmpnd.credentials.list()`
+  returns them all.
+- `credential=` takes a `cmpnd.Credential`, never a string. A string raises
+  and shows the `cmpnd.credentials.get(...)` line to write.
+- Without `credential=`, the deployment spends the organization's default,
+  which an owner sets with `cmpnd credentials default NAME`.
+- The deployment records the credential's name. Each call spends the newest
+  credential sealed under that name, so an owner who rotates a key needs no
+  redeploy.
+- The deploy prints the protocol, model and credential of each binding, as
+  above. A server that prints none chose the credential from the model's
+  provider prefix, and the SDK warns.
+- A hosted call goes to the credential's `api_base`. The LM's own `api_base`
+  serves your laptop run and is not sent.
+
+Keys never leave your laptop. The SDK sends no key on the LM, and a key reaches
+the platform only through `cmpnd credentials create`. `cmpnd deploy FILE`
+refuses source whose import builds an LM carrying a key, and names the module,
+the model and the field.
+
+### The same source on your laptop and hosted
+
+A program's logic runs unchanged on your laptop and hosted. On your laptop it
+spends the key in your environment. Hosted, it spends a credential your
+organization sealed. Keep the logic in one file and let a small entry point
+choose where it runs.
+
+The program file holds the logic and names its model. It holds no key:
+
+```python
+# qa.py
+import dspy
+
+lm = dspy.LM("openai/gpt-5-mini")  # no api_key: litellm reads OPENAI_API_KEY on your laptop
+program = dspy.Predict("question -> answer")
+
+
+def metric(gold, pred, trace=None, pred_name=None, pred_trace=None, lms=None):
+    verdict = dspy.Predict("answer, gold -> correct: bool")(answer=pred.answer, gold=gold.answer, lm=lms["critic"])
+    return dspy.Prediction(score=float(verdict.correct), feedback="correct" if verdict.correct else "wrong")
+```
+
+Seal the key once for the organization and make it the default:
+
+```bash
+printf '%s' "$OPENAI_API_KEY" | cmpnd credentials create --name openai --preset openai
+cmpnd credentials default openai
+```
+
+The entry point is the only code that knows where the run happens:
+
+```python
+# main.py
+import functools
+import sys
+
+import cmpnd
+import dspy
+
+from qa import lm, metric, program
+
+HOSTED = "--hosted" in sys.argv
+
+sdk = cmpnd.Client()
+qa = cmpnd.Program("qa", module=program, lm=lm)
+reflection = dspy.LM("openai/gpt-5", max_tokens=32000)
+lms = {"critic": dspy.LM("openai/gpt-5-mini")}
+train, val = load_examples()  # your dspy.Example lists
+
+if HOSTED:
+    deployed = sdk.deploy_program(qa)  # spends the default credential, openai
+    print(sdk.run_deployment(deployed, question="What is DSPy?"))
+    best = sdk.optimize_deployment(
+        deployed,
+        trainset=train,
+        valset=val,
+        metric=metric,  # the platform hands it lms
+        reflection_lm=cmpnd.HostedLM(reflection),
+        lms={name: cmpnd.HostedLM(model) for name, model in lms.items()},
+        auto="light",
+    )
+else:
+    print(sdk.run_program(qa, question="What is DSPy?"))  # spends $OPENAI_API_KEY
+    gepa = dspy.GEPA(metric=functools.partial(metric, lms=lms), reflection_lm=reflection, auto="light")
+    best = sdk.optimize_program(qa, gepa, trainset=train, valset=val)
+```
+
+`python main.py` runs everything on your laptop, and `python main.py --hosted`
+runs it on the platform. `cmpnd deploy qa.py qa` deploys the same file from the
+terminal.
+
+| | On your laptop | Hosted |
+|---|---|---|
+| Key | the provider's variable in your environment, such as `OPENAI_API_KEY` | the credential the call names, else the organization's default |
+| Address | the LM's `api_base`, else the provider's endpoint | the credential's `api_base` |
+| Model | `gpt-5-mini`, the model after its first `/` | `gpt-5-mini` |
+| The metric's `lms` | the dict the entry point binds | the run's `lms=`, which the platform hands it |
+
+These rules keep the program file portable:
+
+- **Leave the key off the program's LM** and let litellm read the provider's
+  own variable. For a key in a variable litellm does not read, write
+  `api_key=os.environ.get("NAME")`. cmpnd imports a deploy file with an empty
+  environment, so the key is `None` there and present on your laptop.
+- **Never write a key into the file, and never read it as
+  `os.environ["NAME"]` at module scope.** The deploy refuses the first. The
+  second raises `KeyError` hosted, where the environment holds no key.
+- **Seal the credential at the address your laptop LM reaches.** A program
+  that sets `api_base="https://gw.lunaroute.com/v1"` needs a credential sealed
+  there, with `--preset lunaroute` or `--api-base`. Hosted calls go to the
+  credential's address and ignore the LM's `api_base`. The deploy prints the
+  address it chose, so you can compare the two.
+- **Wrap a model you hand the hosted optimization in `cmpnd.HostedLM`.** The
+  entry point builds `reflection_lm=` and each `lms=` entry, so those LMs may
+  hold a key for the laptop run. The wrapper leaves that key on your machine.
+  `optimize_deployment` refuses a key on an unwrapped LM, because there it would
+  look spent. `cmpnd.HostedLM(model, credential=c)` makes a model spend a
+  credential other than the run's.
+
+A judge built on `dspy.experimental.TypeSafe` also runs unchanged in both
+places. [`docs/sdk-instrumentation.md`](docs/sdk-instrumentation.md), under
+"System One judges", describes the hosted side.
+
 ### Options
 
 ```python
@@ -162,6 +301,7 @@ sdk.deploy_program(
     metric=None,       # optional: a metric callable, packaged for optimization
     timeout=300,       # optional: seconds to wait for the deployment to be ready
     metadata=None,     # optional: a JSON-serializable dict, at most 64 KiB, stored with the deployment
+    credential=None,   # optional: a cmpnd.Credential the program's model spends
 )
 ```
 
@@ -219,11 +359,32 @@ from the deployment.
 `reflection_lm` is the model that proposes each new instruction. The search is
 only as good as this model, so it is usually a strong model and not the one
 being optimized. A `dspy.LM` passes its sampling settings to the provider. A
-bare model name gives the same model with no sampling settings. The platform
-supplies the credential and the endpoint, so the SDK refuses an `api_key`,
-`api_base` or `base_url` on the LM before any network call. On a hosted org,
-both live on the provider credential (Account → Model Providers), keyed by the
-model's protocol. One `openai` credential serves every `openai/*` model.
+bare model name gives the same model with no sampling settings. A run spends
+sealed credentials only, so the SDK refuses a key on the LM before any network
+call. `cmpnd.HostedLM(lm)` keeps a key your laptop runs spend on this machine
+and passes the LM's model and sampling.
+
+`credential=` names the run's credential, which every binding that names none
+spends: the program's model, the reflection model and each entry of `lms`. A
+binding names its own credential through a wrapper for its protocol:
+
+```python
+luna = cmpnd.credentials.get("luna-exec")      # serves chat_completions and system_one
+openai = cmpnd.credentials.get("openai")
+best = sdk.optimize_deployment(
+    deployed, trainset=train, valset=val, metric=metric,
+    credential=luna,
+    reflection_lm=cmpnd.HostedLM(dspy.LM("openai/gpt-5"), credential=openai),
+    lms={"judge": cmpnd.SystemOne("lunaroute/djev", credential=luna)},
+    auto="light",
+)
+```
+
+`cmpnd.HostedLM(lm, credential=c)` wraps a chat LM, and
+`cmpnd.SystemOne(model, credential=c)` declares a System One model. A binding
+without a credential spends the run's, or the organization's default. The
+platform refuses a credential whose endpoint does not serve a binding's
+protocol, and names the `credential=` to add.
 
 The SDK checks the metric before any network call. GEPA writes each new
 instruction from the textual feedback the metric returns, so it needs a
@@ -271,9 +432,9 @@ rules:
   names.
 - `"default-lm"` is reserved for the program's own model, which comes from the
   deployment. Declaring it raises an error that names it.
-- The platform refuses a model your org holds no credential for when it dispatches
-  the run, before the run starts. These LMs, like `reflection_lm`, must not set
-  `api_key`, `api_base` or `base_url`.
+- The platform refuses a binding it finds no credential for when it dispatches
+  the run, before the run starts. These LMs, like `reflection_lm`, must not
+  carry a key.
 
 The `lms` parameter does not change the arity check. Five or more positional
 arguments make a feedback metric, and a metric without `lms` never receives
@@ -289,8 +450,9 @@ sdk.optimize_deployment(
     valset=val,              # required: validation examples
     metric=metric,           # required: the metric, arity-checked
     config=None,             # optional: optimizer config, allow-listed by the platform
-    reflection_lm=None,      # required: a dspy.LM or a bare model name
-    lms=None,                # optional: name -> dspy.LM, the run's named models
+    reflection_lm=None,      # required: a dspy.LM, a bare model name or a cmpnd.HostedLM
+    lms=None,                # optional: name -> dspy.LM, cmpnd.HostedLM or cmpnd.SystemOne
+    credential=None,         # optional: the cmpnd.Credential every other binding spends
     max_metric_calls=None,   # budget: the metric-call ceiling for one step
     auto=None,               # budget: "light", "medium" or "heavy"
     may_author_code=None,    # optional: False keeps each dspy.Flex at its deployed source

{cmpnd-0.55.0 → cmpnd-0.57.0}/cmpnd/__init__.py

@@ -17,7 +17,7 @@ from typing import TYPE_CHECKING
 
 from cmpnd_ingest.client_floor import UpgradeRequiredWarning
 
-from . import authored, programs, traces
+from . import authored, credentials, programs, traces
 from ._http import ApiError
 from .callback import CmpndCallback, trace_id
 from .client import Client
@@ -27,6 +27,7 @@ from .context import (
     get_current_span,
     get_current_trace,
 )
+from .credentials import Credential, CredentialNotFound
 from .datasets import DatasetNotFoundError, VersionNotFoundError, load_dataset
 from .decorators import start_span, trace
 from .deployment import DeployFailed
@@ -39,7 +40,7 @@ from .deployment_metadata import (
 from .deployment_runs import RunResultExpired, RunSubmissionUncertain, RunWaitTimeout
 from .execution import DeployedProgram, RetryableProviderError
 from .exporter import flush_exporter, shutdown_exporter
-from .lm_configuration import SystemOne, configure_lm
+from .lm_configuration import HostedLM, SystemOne, configure_lm
 from .mcp_servers import (
     Bearer,
     McpToolReference,
@@ -70,6 +71,7 @@ __all__ = [
     "configure",
     "configure_lm",
     "SystemOne",
+    "HostedLM",
     "get_config",
     "require_config",
     # Main callback
@@ -95,6 +97,10 @@ __all__ = [
     "traces",
     # Program name checks (cmpnd.programs.validate_program_name)
     "programs",
+    # The organization's provider credentials (cmpnd.credentials.get / list)
+    "credentials",
+    "Credential",
+    "CredentialNotFound",
     # A program declared by name
     "Program",
     "program",

{cmpnd-0.55.0 → cmpnd-0.57.0}/cmpnd/_authored_import.py

@@ -15,6 +15,103 @@ from pathlib import Path
 from typing import Any
 
 
+class BundleCarriesCredential(ValueError):
+    """The bundle's import built an LM that holds a provider credential."""
+
+
+@contextlib.contextmanager
+def _built_lms(root: Path):
+    """Record every dspy LM built inside the block, with the bundle module that built it.
+
+    The check reads objects the import built and parses no source. It wraps the
+    ``__init__`` of ``dspy.BaseLM`` and of every LM class that defines its own, because
+    ``dspy.LM`` before dspy 3.3 never calls ``BaseLM.__init__``. It names the innermost
+    module of the bundle on the stack, so an LM a helper module builds is named by that
+    module, and records each LM once, however many of the wrapped constructors it runs.
+    """
+    from dspy.clients.base_lm import BaseLM  # pyright: ignore[reportMissingTypeStubs]  # dspy re-exports BaseLM untyped
+
+    built: list[tuple[Any, str | None]] = []
+    seen: set[int] = set()
+
+    def lm_classes(cls: type) -> list[type]:
+        found = [cls]
+        for sub in cls.__subclasses__():
+            found.extend(lm_classes(sub))
+        return found
+
+    def recording(original: Any) -> Any:
+        def init(self: Any, *args: Any, **kwargs: Any) -> None:
+            original(self, *args, **kwargs)
+            if id(self) not in seen:
+                seen.add(id(self))
+                built.append((self, _bundle_module(root)))
+
+        return init
+
+    originals = {cls: cls.__dict__["__init__"] for cls in lm_classes(BaseLM) if "__init__" in cls.__dict__}
+    for cls, original in originals.items():
+        cls.__init__ = recording(original)
+    try:
+        yield built
+    finally:
+        for cls, original in originals.items():
+            cls.__init__ = original
+
+
+def _bundle_module(root: Path) -> str | None:
+    """The name of the innermost module on the stack whose file sits in the staged bundle."""
+    frame = sys._getframe(2)  # the caller of the LM's __init__
+    prefix = str(root.resolve()) + "/"
+    while frame is not None:
+        if str(Path(frame.f_code.co_filename).resolve()).startswith(prefix):
+            name = frame.f_globals.get("__name__")
+            return name if isinstance(name, str) else None
+        frame = frame.f_back
+    return None
+
+
+def _refuse_bundled_credentials(built: list[tuple[Any, str | None]], entry: str) -> None:
+    """Refuse a bundle whose import built an LM that holds a provider credential.
+
+    The import ran with no environment, so a field set here came from the bundle: a
+    literal, or a file it ships, such as a ``.env`` it loads. The platform stores the
+    source it deploys, and a key belongs only in a sealed credential. The refusal names
+    the module, the model and the field, and never the value.
+    """
+    from . import helpers
+
+    findings: list[tuple[str, str, str]] = []
+    for lm, module in built:
+        model = str(getattr(lm, "model", None) or "?")
+        for field in helpers.credential_fields(getattr(lm, "kwargs", None)):
+            findings.append((module or entry, model, field))
+    if not findings:
+        return
+    lines = [f"  module {module!r} builds an LM for {model!r} with {field} set" for module, model, field in findings]
+    module, model, field = findings[0]
+    holder, bracket, header = field.partition("[")
+    prefix = model.split("/", 1)[0].upper()
+    variable = f"{prefix}_API_KEY" if bracket or field == "api_key" else field.upper()
+    variable = "".join(char if char.isalnum() else "_" for char in variable)
+    if bracket:
+        header = header.removesuffix("]")
+        value = '"Bearer " + key' if "authorization" in header.lower() else "key"
+        advice = (
+            "Read the key from the environment instead, and send the header only where it is set, as "
+            f'{holder}={{{header}: {value}}} if (key := os.environ.get("{variable}")) else None.'
+        )
+    else:
+        advice = f'Read the key from the environment instead, as {field}=os.environ.get("{variable}").'
+    raise BundleCarriesCredential(
+        "the source carries a provider credential, and the platform stores the source it deploys:\n"
+        + "\n".join(lines)
+        + f"\n{advice} This check and the hosted kernel run with no "
+        "environment, so it yields None there, and your own runs keep their key. Seal the key for "
+        "hosted runs with `cmpnd credentials create --name NAME --preset PROVIDER`."
+    )
+
+
 def _program(module: Any, entrypoint: str) -> tuple[Any, str]:
     import dspy
 
@@ -188,10 +285,11 @@ def _check(request: dict[str, Any]) -> dict[str, Any]:
     from . import lm_configuration, packaging
 
     authored_limits = _configured(request)
-    with _staged(request) as root:
+    with _staged(request) as root, _built_lms(root) as built:
         manifest = json.loads((root / "manifest.json").read_text())
         module = _import_member(str(manifest["program"]))
         program, kind = _program(module, str(manifest["entrypoint"]))
+        _refuse_bundled_credentials(built, module.__name__)
         facts = _program_facts(program, kind, authored_limits)
         bindings = dict(getattr(module, "lms", None) or {})
         default_lm = packaging._extract_lm_object(program)
@@ -212,7 +310,7 @@ def _check_optimize(request: dict[str, Any]) -> dict[str, Any]:
 
     ask = request["optimize"]
     authored_limits = _configured(request)
-    with _staged(request):
+    with _staged(request) as root, _built_lms(root) as built:
         module = _import_member(str(ask["entry"]))
         declared_lms: dict[str, Any] | None = None
         if hasattr(module, "lms"):
@@ -256,6 +354,7 @@ def _check_optimize(request: dict[str, Any]) -> dict[str, Any]:
             program, kind = _program(module, program_entrypoint)
             facts = _program_facts(program, kind, authored_limits)
             found_program = program_entrypoint
+        _refuse_bundled_credentials(built, module.__name__)
 
         proposer_entrypoint = str(ask["proposer_entrypoint"])
         declared_proposer = getattr(module, proposer_entrypoint, None)
@@ -331,6 +430,8 @@ def main() -> int:
             answer = _check_optimize(request) if request.get("optimize") else _check(request)
         print(json.dumps(answer))
         return 0
+    except BundleCarriesCredential as exc:
+        print(json.dumps({"error": str(exc)}))
     except ModuleNotFoundError as exc:
         print(
             json.dumps(
@@ -344,14 +445,22 @@ def main() -> int:
             )
         )
     except KeyError as exc:
+        from . import helpers
+
+        variable = helpers.environment_variable_missing(exc)
+        advice = (
+            helpers.environment_read_advice(variable)
+            if variable is not None
+            else 'Read a key with os.environ.get("VARIABLE"), which yields None here.'
+        )
         print(
             json.dumps(
                 {
                     "error": (
                         f"authored source import failed with KeyError: {exc}. The check runs without your "
                         "environment because the worker has none. Do not read provider or MCP credentials at "
-                        "module scope. Name the model without its key and use cmpnd.mcp_tools(url) for a "
-                        "registered server.\n" + _concise_traceback()
+                        f"module scope. {advice} Use cmpnd.mcp_tools(url) for a registered server.\n"
+                        + _concise_traceback()
                     )
                 }
             )

{cmpnd-0.55.0 → cmpnd-0.57.0}/cmpnd/callback.py

@@ -1403,9 +1403,10 @@ class _LMMixin(_CallbackBase):
         if parent_span and getattr(parent_span, "span_type", None) == models.SpanType.RLM:
             span.attributes["rlm.subcall"] = "true"
 
-        # Capture prompt/messages if enabled
+        # Capture prompt/messages if enabled. A credential passed to the call itself, as in
+        # `lm(prompt, api_key=...)`, is stripped first: every member of the org reads a span.
         if self._capture_prompts:
-            cleaned_inputs = helpers.clean_inputs(inputs, dspy, self._max_input_field_size)
+            cleaned_inputs = helpers.clean_inputs(helpers.without_credentials(inputs), dspy, self._max_input_field_size)
             self._reference_rendered_messages(parent_span, inputs, cleaned_inputs)
             span.set_inputs(cleaned_inputs)