cmpnd 0.57.0__tar.gz → 0.59.0__tar.gz

{cmpnd-0.57.0 → cmpnd-0.59.0}/AGENTS.md

@@ -123,6 +123,40 @@ parameter, and a spec-less mock accepts one anyway.
 with real LLMs (`CMPND_E2E_*` keys). It never uses a mock or an in-process
 fake, and it runs only locally.
 
+## DSPy versions under test
+
+The SDK supports DSPy 3.3.x and 3.4.x, and `dependencies` floors DSPy at
+3.3.0. `pyproject.toml` declares one dependency group per DSPy version the
+`sdk-test` matrix tests, such as `dspy-3-4-1 = ["dspy==3.4.1"]`.
+`[tool.uv] conflicts` makes the groups mutually exclusive, so `uv.lock` holds a
+whole tree for each DSPy. Dependency groups never reach the wheel, so users
+still install against the `dspy>=…` floor in `dependencies`.
+
+- A plain `uv sync` or `uv run` installs the default group, the newest tested
+  DSPy.
+- `scripts/install-test-env.sh <python> <dspy>` builds `.venv` from one group's
+  locked tree, as each `sdk-test` leg in `ci-sdk.yml` does. From the repo root,
+  run `just sdk-test-env 3.13 3.3.0`, then, from `python-sdk/`,
+  `.venv/bin/python -m pytest tests/ -k "not e2e"`. `uv sync --extra dev` in
+  `python-sdk/` returns to the default group.
+- `--latest` resolves every package fresh, as a user's install today would.
+  With the DSPy version `newest` it pins no DSPy either. The daily
+  `sdk-latest-dependencies.yml` run uses both: every sdk-test leg, plus one
+  leg on the newest DSPy, which is the first to see a DSPy release no group
+  tests yet. A failure there alerts Slack.
+- A DSPy release can pin some packages exactly, such as gepa (`dspy==3.3.0`
+  pins gepa 0.1.1). Its group locks those packages at the pinned versions. The
+  `mcp` extra floors DSPy at 3.3.1, so it conflicts with the `dspy-3-3-0`
+  group.
+
+To test another DSPy version, add its group to `[dependency-groups]` and to
+the first `conflicts` list, add a conflict with the `mcp` extra if it is below
+3.3.1, add the leg to `sdk-test`'s matrix and to
+`sdk-latest-dependencies.yml`, and run `uv lock`.
+`.github/scripts/test_workflows.py` fails while the groups and the matrix
+disagree. To move the default, change `default-groups` and refresh the span
+reference fixture with `uv run python -m tests.span_reference_fixture`.
+
 ## Two packages, one published distribution
 
 `cmpnd` (`cmpnd/`) is the SDK. `cmpnd_ingest` (`ingest/cmpnd_ingest/`) is the

{cmpnd-0.57.0 → cmpnd-0.59.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: cmpnd
-Version: 0.57.0
+Version: 0.59.0
 Summary: DSPy observability and deployment SDK for cmpnd
 Project-URL: Homepage, https://cmpnd.ai
 Author-email: cmpnd <hello@cmpnd.ai>
@@ -17,7 +17,7 @@ Classifier: Programming Language :: Python :: 3.14
 Classifier: Programming Language :: Python :: 3.15
 Classifier: Topic :: Software Development :: Libraries :: Python Modules
 Requires-Python: >=3.11
-Requires-Dist: dspy>=3.1.3
+Requires-Dist: dspy>=3.3.0
 Requires-Dist: httpx>=0.27.0
 Requires-Dist: ipython>=8.20
 Requires-Dist: pydantic>=2.0

{cmpnd-0.57.0 → cmpnd-0.59.0}/cmpnd/_authored_import.py

@@ -25,7 +25,7 @@ def _built_lms(root: Path):
 
     The check reads objects the import built and parses no source. It wraps the
     ``__init__`` of ``dspy.BaseLM`` and of every LM class that defines its own, because
-    ``dspy.LM`` before dspy 3.3 never calls ``BaseLM.__init__``. It names the innermost
+    an LM subclass need not call ``BaseLM.__init__``. It names the innermost
     module of the bundle on the stack, so an LM a helper module builds is named by that
     module, and records each LM once, however many of the wrapped constructors it runs.
     """

{cmpnd-0.57.0 → cmpnd-0.59.0}/cmpnd/_gepa_patch.py

@@ -172,9 +172,6 @@ def patch_gepa() -> None:
 
     import dspy
 
-    if not hasattr(dspy, "GEPA"):
-        return
-
     # Resolve callback support once, at patch time — not per compile — so the
     # answer matches the installed gepa the patch bound to.
     has_callbacks = _gepa_supports_callbacks()
@@ -223,10 +220,10 @@ def unpatch_gepa() -> None:
         _gepa_patched = False
         return
 
-    GEPA = getattr(dspy, "GEPA", None)
-    if GEPA is not None and hasattr(GEPA, "_cmpnd_original_init"):
-        GEPA.__init__ = GEPA._cmpnd_original_init
-        GEPA.compile = GEPA._cmpnd_original_compile
-        del GEPA._cmpnd_original_init
-        del GEPA._cmpnd_original_compile
+    GEPA = dspy.GEPA
+    if hasattr(GEPA, "_cmpnd_original_init"):
+        GEPA.__init__ = GEPA._cmpnd_original_init  # pyright: ignore[reportAttributeAccessIssue]
+        GEPA.compile = GEPA._cmpnd_original_compile  # pyright: ignore[reportAttributeAccessIssue]
+        del GEPA._cmpnd_original_init  # pyright: ignore[reportAttributeAccessIssue]
+        del GEPA._cmpnd_original_compile  # pyright: ignore[reportAttributeAccessIssue]
     _gepa_patched = False

{cmpnd-0.57.0 → cmpnd-0.59.0}/cmpnd/callback.py

@@ -1101,7 +1101,7 @@ class _ModuleMixin(_CallbackBase):
         """Map DSPy module instance to span type."""
         if isinstance(instance, dspy.Retrieve):
             return models.SpanType.RETRIEVE
-        elif isinstance(instance, getattr(dspy, "RLM", type(None))):
+        elif isinstance(instance, dspy.RLM):
             return models.SpanType.RLM
         elif isinstance(instance, dspy.ReAct):
             return models.SpanType.REACT

{cmpnd-0.57.0 → cmpnd-0.59.0}/cmpnd/cli/commands/top.py

@@ -890,6 +890,34 @@ def _program_args(args: Any, verb: str, *, needs_name: bool = True) -> str | Non
     return name
 
 
+class _CredentialLookup:
+    """Turn a credential name a flag gave into the organization's ``cmpnd.Credential``.
+
+    Every command that takes a credential name looks it up here, before it stages or
+    sends anything. The lookup is ``cmpnd.credentials.get``, the line a Python caller
+    writes, so a mistyped name fails on the command line with the organization's names
+    and the nearest one. Serve checks the name again when the deploy or run names it,
+    which catches a credential revoked in between. Each distinct name is read once.
+    """
+
+    def __init__(self, client: api_client.ApiClient) -> None:
+        self._client = client
+        self._found: dict[str, Any] = {}
+
+    def __call__(self, flag: str, name: str) -> Any:
+        """The credential ``name``. ``flag`` is how the command line spelled it, for the error."""
+        from ... import credentials
+
+        if name not in self._found:
+            try:
+                self._found[name] = credentials.get(
+                    name, api_key=self._client._api_key, endpoint=self._client._endpoint
+                )
+            except credentials.CredentialNotFound as exc:
+                raise api_client.CliError(f"{flag}: {exc}") from exc
+        return self._found[name]
+
+
 def cmd_deploy(client: api_client.ApiClient, args: Any) -> None:
     """Stage authored Python and deploy the checked bundle.
 
@@ -904,12 +932,18 @@ def cmd_deploy(client: api_client.ApiClient, args: Any) -> None:
         dspy.configure(lm=lm)
         program = dspy.Predict("question -> answer")
         PY
+
+    ``--credential NAME`` names the credential the program's model spends, and is looked
+    up before the source is staged.
     """
     from pathlib import Path
 
     from ... import authored, deployment
 
     program_name = _program_args(args, "deploy")
+    credential_name = getattr(args, "credential", None)
+    if credential_name is not None:
+        credential_name = _CredentialLookup(client)(f"--credential {credential_name}", credential_name).name
     try:
         if args.source == "-" or args.source is None:
             prepared = authored.prepare_stdin(
@@ -939,7 +973,7 @@ def cmd_deploy(client: api_client.ApiClient, args: Any) -> None:
             metadata=metadata,
             program_name=program_name,
             config=sdk_config(client),
-            credential_name=getattr(args, "credential", None),
+            credential_name=credential_name,
         )
     except ValueError as exc:
         raise api_client.CliError(str(exc)) from exc
@@ -978,6 +1012,67 @@ def _optimizer_arg(value: str) -> str:
     return value
 
 
+def _lm_credential_arg(value: str) -> tuple[str, str]:
+    """Parse ``--lm-credential BINDING=NAME`` into the binding and the credential's name.
+
+    The program's own model is refused here, at parse time, because it spends the run's
+    credential and ``--credential`` already names that.
+    """
+    binding, sep, name = value.partition("=")
+    if not sep or not binding or not name:
+        raise ArgumentTypeError(
+            f"{value!r} is not BINDING=NAME. Give the name of an LM the optimize file's `lms` binds, then a "
+            "credential `cmpnd credentials list` shows, as in judge=typesafe"
+        )
+    from ... import optimization
+
+    if binding == optimization.DEFAULT_LM_BINDING:
+        raise ArgumentTypeError(
+            f"{binding} is the program's own model, which spends the run's credential. Name it with --credential"
+        )
+    return binding, name
+
+
+def _optimize_credentials(
+    client: api_client.ApiClient, args: Any
+) -> tuple[Any, str | Any | None, dict[str, Any] | None]:
+    """Look up every credential an optimize names, before the file is staged.
+
+    Returns the run's credential, the reflection LM to pass (the model name, wrapped in
+    ``cmpnd.HostedLM`` when ``--reflection-credential`` names its credential) and the
+    credential per binding. :class:`_CredentialLookup` turns each name into a
+    ``cmpnd.Credential``, so a mistyped one fails before the import and the deploy a run
+    makes ahead of its first step.
+    """
+    from ...lm_configuration import HostedLM
+
+    pairs: list[tuple[str, str]] = list(getattr(args, "lm_credential", None) or [])
+    seen: set[str] = set()
+    for binding, _ in pairs:
+        if binding in seen:
+            raise api_client.CliError(
+                f"--lm-credential names the binding {binding!r} more than once. Give each binding one credential."
+            )
+        seen.add(binding)
+    reflection_model = getattr(args, "reflection_model", None)
+    reflection_name = getattr(args, "reflection_credential", None)
+    if reflection_name is not None and reflection_model is None:
+        raise api_client.CliError(
+            "--reflection-credential names the credential the reflection model spends, so it needs --reflection-model."
+        )
+
+    lookup = _CredentialLookup(client)
+    run_name = getattr(args, "credential", None)
+    run = lookup(f"--credential {run_name}", run_name) if run_name is not None else None
+    reflection_lm: str | HostedLM | None = reflection_model
+    if reflection_name is not None and reflection_model is not None:
+        reflection_lm = HostedLM(
+            reflection_model, credential=lookup(f"--reflection-credential {reflection_name}", reflection_name)
+        )
+    lm_credentials = {binding: lookup(f"--lm-credential {binding}={name}", name) for binding, name in pairs}
+    return run, reflection_lm, lm_credentials or None
+
+
 def cmd_optimize(client: api_client.ApiClient, args: Any) -> Any:
     """Optimize the program, metric and proposer one authored file binds.
 
@@ -1001,6 +1096,11 @@ def cmd_optimize(client: api_client.ApiClient, args: Any) -> Any:
             return dspy.Prediction(score=float(ok),
                                    feedback="" if ok else f"expected {gold.answer}")
         PY
+
+    The file cannot name a credential, because the kernel that imports it reaches no
+    platform. ``--credential`` names the run's, ``--reflection-credential`` the
+    reflection model's and ``--lm-credential BINDING=NAME`` one of the file's ``lms``.
+    Each name is looked up before the file is staged.
     """
     from pathlib import Path
 
@@ -1008,6 +1108,7 @@ def cmd_optimize(client: api_client.ApiClient, args: Any) -> Any:
 
     deployment_id = getattr(args, "deployment_id", None)
     program_name = _program_args(args, "optimize", needs_name=deployment_id is None)
+    credential, reflection_lm, lm_credentials = _optimize_credentials(client, args)
     try:
         if args.source == "-" or args.source is None:
             prepared = authored.prepare_optimize_stdin(
@@ -1041,7 +1142,9 @@ def cmd_optimize(client: api_client.ApiClient, args: Any) -> Any:
             # The flag is named for what a command line can carry — a model name,
             # never an LM object — and the parameter for what the Python surface
             # accepts. Each layer's name says what that layer takes.
-            reflection_lm=getattr(args, "reflection_model", None),
+            reflection_lm=reflection_lm,
+            credential=credential,
+            lm_credentials=lm_credentials,
             max_metric_calls=getattr(args, "max_metric_calls", None),
             auto=getattr(args, "auto", None),
             max_steps=getattr(args, "max_steps", 10),
@@ -1402,6 +1505,8 @@ def register(subparsers: _SubParsersAction[ArgumentParser]) -> None:
             "--reflection-model openai/gpt-4o --auto light\n"
             "  cmpnd optimize gepa - capital-qa --reflection-model openai/gpt-4o "
             "--max-metric-calls 60 < task.py\n"
+            "  cmpnd optimize gepa task.py capital-qa --reflection-model openai/gpt-4o --auto light "
+            "--credential openai --lm-credential judge=typesafe\n"
             "  cmpnd optimize gepa task.py --reflection-model openai/gpt-4o --auto light --deployment-id d_a1b2c3d4\n"
         ),
         formatter_class=raw,
@@ -1438,6 +1543,31 @@ def register(subparsers: _SubParsersAction[ArgumentParser]) -> None:
         "instructions (required for gepa; the server will not substitute the "
         "deployment's own model)",
     )
+    opt.add_argument(
+        "--credential",
+        metavar="NAME",
+        default=None,
+        help="The provider credential the run spends: the program's model, and every model that names no "
+        "credential of its own (default: the organization's default credential). "
+        "`cmpnd credentials list` shows the names",
+    )
+    opt.add_argument(
+        "--reflection-credential",
+        dest="reflection_credential",
+        metavar="NAME",
+        default=None,
+        help="The credential the reflection model spends instead of the run's",
+    )
+    opt.add_argument(
+        "--lm-credential",
+        dest="lm_credential",
+        metavar="BINDING=NAME",
+        type=_lm_credential_arg,
+        action="append",
+        default=None,
+        help="The credential one LM of the file's `lms` spends instead of the run's, as judge=typesafe. Repeat it "
+        "for each binding",
+    )
     # A budget is mandatory and the optimizer will not choose one — see
     # `cmpnd.optimization._apply_budget`. Two flags rather than one because a
     # caller who does not yet know what a run costs reaches for `--auto`, and one

{cmpnd-0.57.0 → cmpnd-0.59.0}/cmpnd/optimization.py

@@ -508,6 +508,62 @@ def _lms_config(config: dict[str, Any], lms: Any) -> None:
     config["lms"] = declared
 
 
+def _lm_credentials_config(config: dict[str, Any], lm_credentials: Any) -> None:
+    """Name the credential each of the run's declared LM bindings spends.
+
+    An authored file declares its ``lms`` and cannot name a credential for one, because
+    the kernel that imports it again reaches no platform to look one up. So the call that
+    starts the run names it, by binding name, and the entry gains the ``credential`` field
+    that ``cmpnd.HostedLM(lm, credential=)`` and ``cmpnd.SystemOne(model, credential=)``
+    give it in a live-object call. The wire shape is the same either way.
+
+    Each binding must be one the run declares, and must not already name a credential:
+    a second credential for one binding is two answers to one question, the refusal
+    :func:`_reflection_config` makes of ``reflection_credential``. The program's own
+    model spends the run's ``credential=``, so ``default-lm`` is refused here.
+
+    ``config["lms"]`` is replaced rather than edited, because it may be the dict the
+    import child reported, which the caller's prepared file still holds.
+    """
+    if not lm_credentials:
+        return
+    if not isinstance(lm_credentials, dict):
+        raise ValueError(f"lm_credentials must map binding names to credentials (got {type(lm_credentials).__name__})")
+    declared: dict[str, Any] = config.get("lms") or {}
+    named: dict[str, str] = {}
+    for binding, credential in lm_credentials.items():
+        if binding == DEFAULT_LM_BINDING:
+            raise ValueError(
+                f"{DEFAULT_LM_BINDING!r} is the program's own model, and it spends the run's credential. "
+                "Name that credential for the run instead of for a binding."
+            )
+        name = credentials.name_of(credential, f"lm_credentials[{binding!r}]")
+        if name is None:
+            continue
+        if binding not in declared:
+            if not declared:
+                raise ValueError(
+                    f"a credential is named for the LM binding {binding!r}, and the optimize file binds no "
+                    "`lms`, so the run has no binding to spend it."
+                )
+            raise ValueError(
+                f"a credential is named for the LM binding {binding!r}, and the optimize file's `lms` binds no "
+                f"such name. It binds {', '.join(repr(each) for each in sorted(declared))}."
+            )
+        existing = declared[binding].get("credential")
+        if existing is not None:
+            raise ValueError(
+                f"the LM binding {binding!r} already names the credential {existing!r}, and a second one was "
+                f"named for it: these are two answers to which credential it spends. Keep one."
+            )
+        named[binding] = name
+    if named:
+        config["lms"] = {
+            binding: {**entry, "credential": named[binding]} if binding in named else entry
+            for binding, entry in declared.items()
+        }
+
+
 def _check_metric_call(metric: Callable[..., Any], optimizer: str) -> None:  # pyright: ignore[reportUnusedFunction]  # called by the authored import child
     """Check the authored metric against the kernel's positional and named arguments."""
     signature = inspect.signature(metric)
@@ -938,6 +994,7 @@ def optimize_authored(
     config: dict[str, Any] | None = None,
     reflection_lm: str | Any | None = None,
     lms: dict[str, Any] | None = None,
+    lm_credentials: dict[str, credentials.Credential] | None = None,
     credential: credentials.Credential | None = None,
     max_metric_calls: int | None = None,
     auto: str | None = None,
@@ -972,6 +1029,9 @@ def optimize_authored(
     resolves, because that deployment already has its program.
 
     ``credential`` is the run's credential, as on :func:`optimize_deployment`.
+    ``lm_credentials`` maps a binding the file's ``lms`` declares to the credential it
+    spends instead, which the file itself cannot name. A ``cmpnd.HostedLM`` or
+    ``cmpnd.SystemOne`` names one in a live-object call.
     """
     check_optimizer(optimizer)
     credential_name = credentials.name_of(credential, "optimize_authored(credential=)")
@@ -985,6 +1045,7 @@ def optimize_authored(
             config["lms"] = prepared.facts.lms
     _reflection_config(config, reflection_lm)
     _lms_config(config, lms)
+    _lm_credentials_config(config, lm_credentials)
     _apply_budget(config, max_metric_calls=max_metric_calls, auto=auto)
 
     if prepared.program_bundle is None and deployment_id is not None and program_name is not None:

{cmpnd-0.57.0 → cmpnd-0.59.0}/cmpnd/optimizers/tracker.py

@@ -1332,15 +1332,13 @@ def code_component_types(student: Any) -> dict[str, str]:
     serve cannot tell source from prose on its own, and without this a Flex's module
     source renders as a word-diffed paragraph.
 
-    Empty for a program with no Flex, for a dspy without `Flex`, and for anything that is
-    not a dspy module.
+    Empty for a program with no Flex, and for anything that is not a dspy module.
     """
     import dspy
 
-    flex_cls = getattr(dspy, "Flex", None)
-    if flex_cls is None or not isinstance(student, dspy.Module):
+    if not isinstance(student, dspy.Module):
         return {}
-    return {name: COMPONENT_KIND_CODE for name, sub in student.named_parameters() if isinstance(sub, flex_cls)}
+    return {name: COMPONENT_KIND_CODE for name, sub in student.named_parameters() if isinstance(sub, dspy.Flex)}
 
 
 def enrich_from_program(

{cmpnd-0.57.0 → cmpnd-0.59.0}/docs/cli.md

@@ -59,9 +59,6 @@ and sends the id.
   `cmpnd programs purge --all` empties the Trash. Nothing restores a purged
   program. Both ask for confirmation at a terminal and need `--force` anywhere
   else. A live program is never purged.
-  A program created by name cannot be purged yet. It stays in the Trash, where
-  it no longer counts toward a plan's program cap, and `purge --all` answers
-  how many such programs it kept.
 
 A program in the Trash or purged gives up its name. The next
 `cmpnd programs create`, `cmpnd deploy` or SDK run under that name gets a new
@@ -197,9 +194,11 @@ model and the field, never the value. Seal the key with
 `cmpnd credentials create` instead.
 
 `--credential NAME` names the provider credential the program's model spends.
-Without it, the deployment spends the organization's default. The CLI sends the
-name as typed, and the platform refuses a name the organization does not hold
-and names the nearest one. The deploy prints the protocol, model and
+Without it, the deployment spends the organization's default. The CLI looks
+the name up before it stages the source. A name the organization does not hold
+fails with the names it does hold and the nearest one, and nothing is sent.
+The platform checks the name again at the deploy, which catches a credential
+an owner revoked in between. The deploy prints the protocol, model and
 credential of each binding, such as
 `default-lm: chat_completions openai/deepseek-4.1-flash → luna-exec (https://gw.lunaroute.com)`.
 
@@ -621,6 +620,27 @@ organization must hold provider credentials for every model the run uses.
 Named model declarations hold model names and sampling settings, and the CLI
 refuses a provider key on them.
 
+A run spends the organization's default credential unless the command names
+another. `--credential NAME` names the run's credential. The program's model
+spends it, and so does every model that names no credential of its own.
+`--reflection-credential NAME` names the credential the reflection model
+spends. `--lm-credential BINDING=NAME` names the credential one model in the
+file's `lms` spends, and repeats once per binding:
+
+```bash
+cmpnd optimize gepa task.py capital-qa --reflection-model openai/gpt-5 --auto light \
+  --credential openai --lm-credential judge=typesafe
+```
+
+The file cannot name a credential itself, because the kernel imports it again
+and reaches no platform there. These flags send what `credential=`,
+`cmpnd.HostedLM(lm, credential=)` and `cmpnd.SystemOne(model, credential=)`
+send from Python. The CLI looks up every name before it stages the file. A
+name the organization does not hold fails with the names it does hold and the
+nearest one. The CLI also refuses `--lm-credential` for a binding the file's
+`lms` does not declare, for one binding twice and for `default-lm`. The
+program's own model spends the run's credential, so `--credential` names it.
+
 `cmpnd.Client.optimize_deployment(deployment, metric=fn)` in a notebook packages
 live objects and takes named models through its `lms` argument. An authored file's `lms`
 binding cannot be combined with `lms` in the parent call or `config["lms"]`.

{cmpnd-0.57.0 → cmpnd-0.59.0}/pyproject.toml

@@ -5,7 +5,7 @@ name = "cmpnd"
 # it's new) — no git tags. Bump with `uv version --bump {minor,patch}` or by
 # hand. Runtime `cmpnd.__version__` reads installed metadata, so it tracks
 # this automatically. See docs/plans/2026-07-02-sdk-pypi-tag-free-publish.md.
-version = "0.57.0"
+version = "0.59.0"
 description = "DSPy observability and deployment SDK for cmpnd"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -28,7 +28,7 @@ classifiers = [
 ]
 
 dependencies = [
-    "dspy>=3.1.3",
+    "dspy>=3.3.0",
     # Reached directly by the SDK (cmpnd/optimization.py's poll, cmpnd/datasets.py)
     # and by the ingest transport this wheel bundles (ingest/cmpnd_ingest), whose
     # only non-stdlib import it is.
@@ -129,6 +129,33 @@ fake-provider = [
 [tool.uv.sources]
 cmpnd-fake-provider = { path = "../fake-provider", editable = true }
 
+# One group per DSPy version the test matrix runs, so uv.lock locks a whole tree for
+# each and a test leg installs from the lock with only DSPy varying
+# (`scripts/install-test-env.sh`; AGENTS.md, "DSPy versions under test"). Dependency
+# groups never reach the wheel's metadata, so a user's install still takes
+# `dspy>=3.3.0` above. Each group name is `dspy-` and the version with dots turned to
+# dashes.
+[dependency-groups]
+dspy-3-4-1 = ["dspy==3.4.1"]
+dspy-3-4-0 = ["dspy==3.4.0"]
+dspy-3-3-1 = ["dspy==3.3.1"]
+dspy-3-3-0 = ["dspy==3.3.0"]
+
+[tool.uv]
+# A plain `uv sync` or `uv run` installs the newest tested DSPy.
+default-groups = ["dspy-3-4-1"]
+# The groups pin different DSPy versions, so uv resolves a separate fork for each.
+# The mcp extra floors dspy at 3.3.1, so it conflicts with the dspy-3-3-0 group.
+conflicts = [
+    [
+        { group = "dspy-3-4-1" },
+        { group = "dspy-3-4-0" },
+        { group = "dspy-3-3-1" },
+        { group = "dspy-3-3-0" },
+    ],
+    [{ extra = "mcp" }, { group = "dspy-3-3-0" }],
+]
+
 [project.scripts]
 cmpnd = "cmpnd.cli:main"
 
@@ -141,8 +168,8 @@ Homepage = "https://cmpnd.ai"
 # the two move together or a release fails at upload. hatchling 1.32.0 stamps
 # 2.5, and the twine inside the pinned pypa/gh-action-pypi-publish accepts it;
 # that pairing is what `twine check --strict` in sdk-lint proves on every PR.
-# `==` so a backend bump arrives as a Renovate PR that runs that check, rather
-# than as a silent resolution on release day.
+# `==` so a backend bump is a reviewed edit here that runs that check, rather
+# than a silent resolution on release day.
 requires = ["hatchling==1.32.0"]
 build-backend = "hatchling.build"
 

{cmpnd-0.57.0 → cmpnd-0.59.0}/scripts/check-pip-install.sh

@@ -1,7 +1,7 @@
 #!/usr/bin/env bash
 # Install cmpnd with pip's own resolver and check that the installed package
 # imports and instruments DSPy. Called by .github/workflows/ci-sdk.yml (the
-# sdk-test leg for Python 3.15).
+# sdk-test-py315 job, the sdk-test leg for Python 3.15).
 #
 # `pip install cmpnd` is the install PyPI advertises. pip honours the
 # requires-python upper bounds that uv ignores, so this check fails when no

cmpnd-0.59.0/scripts/install-test-env.sh

@@ -0,0 +1,67 @@
+#!/usr/bin/env bash
+# Build python-sdk/.venv for one sdk-test leg: the SDK and its dev extra, on one
+# Python, at one DSPy version.
+#
+# CALLED BY: .github/workflows/ci-sdk.yml (sdk-test and sdk-test-py315),
+# .github/workflows/sdk-latest-dependencies.yml (with --latest), `just
+# sdk-test-env` at the repo root, and scripts/test-in-linux.sh.
+#
+# The install reads uv.lock. pyproject.toml declares one dependency group per
+# tested DSPy, named `dspy-` and the version with dots turned to dashes, and the lock
+# holds a whole tree for each. A leg syncs its group's tree exactly, so only DSPy,
+# and whatever that DSPy itself pins, differs between legs. A red leg means the
+# change broke something rather than that an upstream release did. The lock moves only
+# by a reviewed commit: a security upgrade when bin/vulncheck fails on an advisory a
+# bump would fix, and any other upgrade as a deliberate lock bump.
+#
+# --latest resolves every package fresh, with only the Python and DSPy versions
+# pinned, as a user's install today would. With the DSPy version `newest`, it pins no
+# DSPy either, so the install takes the newest release `dspy>=…` admits, as `pip
+# install cmpnd` does. It prints the DSPy it installed. The daily run in
+# sdk-latest-dependencies.yml uses it.
+#
+# Usage: scripts/install-test-env.sh [--latest] <python-version> <dspy-version>
+#   e.g. scripts/install-test-env.sh 3.13 3.3.0
+#        scripts/install-test-env.sh --latest 3.13 3.4.1
+#        scripts/install-test-env.sh --latest 3.14 newest
+set -euo pipefail
+
+usage() {
+    echo "usage: $0 [--latest] <python-version> <dspy-version>" >&2
+    exit 2
+}
+
+latest=false
+if [ "${1:-}" = "--latest" ]; then
+    latest=true
+    shift
+fi
+[ "$#" -eq 2 ] || usage
+python_version=$1
+dspy_version=$2
+
+cd "$(dirname "${BASH_SOURCE[0]}")/.."
+
+if [ "$latest" = true ]; then
+    uv venv --clear --python "$python_version" .venv
+    if [ "$dspy_version" = newest ]; then
+        uv pip install --python .venv/bin/python -e ".[dev]"
+    else
+        uv pip install --python .venv/bin/python -e ".[dev]" "dspy==$dspy_version"
+    fi
+    echo "install-test-env: installed $(uv pip freeze --python .venv/bin/python | grep -i '^dspy==')"
+    exit 0
+fi
+if [ "$dspy_version" = newest ]; then
+    echo "install-test-env: the DSPy version newest needs --latest. uv.lock locks one tree per tested DSPy, and a locked install names one." >&2
+    exit 2
+fi
+
+group="dspy-${dspy_version//./-}"
+if ! grep -qE "^$group = " pyproject.toml; then
+    echo "install-test-env: pyproject.toml declares no dependency group $group. To test dspy $dspy_version, add $group = [\"dspy==$dspy_version\"] to [dependency-groups] and to the conflicts list in [tool.uv], then run uv lock." >&2
+    exit 2
+fi
+# --frozen installs exactly what uv.lock holds and never re-locks. sdk-lint's
+# `uv lock --check` fails when the lock is stale against pyproject.toml.
+uv sync --frozen --extra dev --no-default-groups --group "$group" --python "$python_version"

{cmpnd-0.57.0 → cmpnd-0.59.0}/scripts/test-in-linux.sh

@@ -1,5 +1,5 @@
 #!/usr/bin/env bash
-# Run the SDK suite (or a subset) on Linux, in a container that resolves its own
+# Run the SDK suite (or a subset) on Linux, in a container that installs its own
 # dependencies.
 #
 # The lane exists because some of what this SDK has to get right is only
@@ -16,14 +16,16 @@
 #
 # It deliberately does NOT mount the host `.venv`: those wheels are macOS
 # wheels, and a container reusing them fails in ways that teach you nothing about
-# the code. uv resolves fresh inside, which is also what makes this a real answer
-# to "would CI see this too". The copy also drops `.pyc` files because their
-# embedded source paths may name a worktree that moved or no longer exists.
+# the code. uv installs from uv.lock inside, which is also what makes this a real
+# answer to "would CI see this too". SDK_TEST_DSPY_VERSION picks a DSPy group the
+# way an sdk-test leg does (scripts/install-test-env.sh). The copy also drops
+# `.pyc` files because their embedded source paths may name a worktree that moved
+# or no longer exists.
 #
 # Usage — everything, or a pytest selector:
 #   python-sdk/scripts/test-in-linux.sh
 #   python-sdk/scripts/test-in-linux.sh tests/test_exporter_queue.py -v
-#   SDK_TEST_DSPY_VERSION=3.1.3 python-sdk/scripts/test-in-linux.sh tests/test_run_attribution_paths.py -v
+#   SDK_TEST_DSPY_VERSION=3.3.0 python-sdk/scripts/test-in-linux.sh tests/test_run_attribution_paths.py -v
 #
 # Called by: `just sdk-test-linux` (repo root). No CI workflow — CI already runs
 # on Linux; this is the local mirror of what it does.
@@ -31,7 +33,7 @@ set -euo pipefail
 
 SDK_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")/.." && pwd)"
 REPO_DIR="$(cd "${SDK_DIR}/.." && pwd)"
-IMAGE="${SDK_TEST_LINUX_IMAGE:-ghcr.io/astral-sh/uv:python3.12-bookworm-slim}"
+IMAGE="${SDK_TEST_LINUX_IMAGE:-ghcr.io/astral-sh/uv:python3.12-trixie-slim}"
 ARGS=("$@")
 if [ ${#ARGS[@]} -eq 0 ]; then
     ARGS=(tests/ -k "not e2e")
@@ -53,8 +55,7 @@ cp -r /repo/python-sdk /repo/fake-provider /repo/docs /work/
 rm -rf /work/python-sdk/.venv
 find /work/python-sdk -name "*.pyc" -delete
 if [ -n "$SDK_TEST_DSPY_VERSION" ]; then
-    uv venv --python 3.12 --quiet
-    uv pip install --quiet -e ".[dev]" "dspy==$SDK_TEST_DSPY_VERSION"
+    scripts/install-test-env.sh 3.12 "$SDK_TEST_DSPY_VERSION"
 else
     uv sync --extra dev --quiet
 fi