envloop-cli 0.3.0__py3-none-any.whl → 1.4.0__py3-none-any.whl

envloop/agent_runs.py

@@ -7,6 +7,7 @@ using the same rules as the Console's agent runs page.
 """
 
 from datetime import datetime
+from urllib.parse import quote, urlencode
 
 from .train import TrainJobs
 
@@ -206,3 +207,38 @@ class AgentRuns:
         if run not in runs:
             raise AgentRunError("AGENT_RUN_NOT_FOUND")
         return {**_detail(run, runs[run]), "observed_at": observed_at}
+
+    # The RSI loop service behind the platform (``/v1/agent-runs/rsi``). Starting spends money, so
+    # ``start`` needs a key with ``training.run``; ``control(stop)`` also needs ``training.stop``.
+    def _rsi(self, method: str, path: str, body=None) -> dict:
+        return self._train_jobs.transport.request(method, "/v1/agent-runs/rsi" + path, body)
+
+    def start(self, run: str, brief: str, *, model_usd_cap: float, usd_cap: float | None = None,
+              model_request_cap: int | None = None, domain: str | None = None, rounds: int | None = None,
+              dry_run: bool = False, student_model: str | None = None) -> dict:
+        """Start a new RSI run; the platform validates every field. ``dry_run`` uses no GPU."""
+        limits = {"model_usd_cap": model_usd_cap}
+        for key, value in (("usd_cap", usd_cap), ("model_request_cap", model_request_cap)):
+            if value is not None:
+                limits[key] = value
+        body = {"run": run, "brief": brief, "limits": limits}
+        for key, value in (("domain", domain), ("rounds", rounds), ("student_model", student_model)):
+            if value is not None:
+                body[key] = value
+        if dry_run:
+            body["dry_run"] = True
+        return self._rsi("POST", "/runs", body)
+
+    def live(self, run: str, since: int | None = None) -> dict:
+        """What a run does now; pass the previous ``next_cursor`` as ``since`` for newer events."""
+        query = "?" + urlencode({"since": since}) if since is not None else ""
+        return self._rsi("GET", f"/runs/{quote(run, safe='')}/live{query}")
+
+    def steer(self, run: str, text: str) -> dict:
+        """Queue a message for the running operator (1 to 4000 characters)."""
+        return self._rsi("POST", f"/runs/{quote(run, safe='')}/steer", {"text": text})
+
+    def control(self, run: str, action: str, rounds: int | None = None) -> dict:
+        """``extend`` (needs ``rounds``), ``stop`` (after the current round) or ``resume``."""
+        return self._rsi("POST", f"/runs/{quote(run, safe='')}/control",
+                         {"action": action, **({} if rounds is None else {"rounds": rounds})})

envloop/cli.py

@@ -208,6 +208,27 @@ def parser():
     runs_get = runs.add_parser("get", help="Show a run's rounds, Train Jobs and checkpoints")
     runs_get.add_argument("run", metavar="RUN", help="run label: user_metadata.rsi_run or agent_run")
     runs_get.add_argument("--json", action="store_true", help="Output the complete run as JSON (default: tables)")
+    runs_start = runs.add_parser("start", help="Start a new RSI loop run (paid; needs training.run)")
+    runs_start.add_argument("run", metavar="RUN", help="new run id: lower-case letters, digits and dashes")
+    brief = runs_start.add_mutually_exclusive_group(required=True)
+    brief.add_argument("--brief", help="the goal of the run (up to 4000 characters)")
+    brief.add_argument("--brief-file", metavar="PATH", help="read the goal from a file, or - for standard input")
+    runs_start.add_argument("--model-usd-cap", type=float, required=True, help="strong-model spend cap in USD (the hard stop)")
+    runs_start.add_argument("--usd-cap", type=float, help="cap in USD for model plus GPU training together")
+    runs_start.add_argument("--model-request-cap", type=int, help="cap on model requests")
+    runs_start.add_argument("--domain", help="task family (default: the service's default; an unknown value is rejected)")
+    runs_start.add_argument("--rounds", type=int, help="target rounds (default: the service's default)")
+    runs_start.add_argument("--dry-run", action="store_true", help="GPU-free run: trains nothing; exercises the loop, spends model budget only")
+    runs_start.add_argument("--student-model", help="gateway student model of a dry run")
+    runs_live = runs.add_parser("live", help="Show what a run does now; --follow streams new events")
+    runs_live.add_argument("run", metavar="RUN")
+    runs_live.add_argument("--since", type=int, help="only events after this cursor (the previous next_cursor)")
+    runs_live.add_argument("--follow", action="store_true", help="poll and print new events until the run ends; Ctrl-C exits without stopping it")
+    runs_steer = runs.add_parser("steer", help="Message the running operator now (needs training.run)")
+    runs_steer.add_argument("run", metavar="RUN")
+    runs_steer.add_argument("text", metavar="TEXT", help="1 to 4000 characters")
+    runs_stop = runs.add_parser("stop", help="Stop a run after its current round (needs training.run and training.stop)")
+    runs_stop.add_argument("run", metavar="RUN")
     tasks = groups.add_parser("trail", help="Inspect and control existing trials").add_subparsers(dest="action", required=True)
     listing = tasks.add_parser("list", help="List Agent, Sandbox, Train and Inference worker Trials")
     listing.add_argument("--type", choices=("agent", "sandbox", "train", "inference"), help="Filter by Trial type")
@@ -230,10 +251,11 @@ def parser():
     download.add_argument("trial_id")
     download.add_argument("directory", type=Path)
     profiles = groups.add_parser("profile", help="Manage platform runtime profiles").add_subparsers(dest="action", required=True)
-    put = profiles.add_parser("create", help="Create an immutable Profile version from JSON")
+    put = profiles.add_parser("create", help="Create an immutable Profile version from TOML or JSON")
     put.add_argument("name")
     put.add_argument("version")
-    put.add_argument("--file", type=Path, required=True, help="ProfileSpec JSON file")
+    put.add_argument("--file", type=Path, required=True, help="Profile TOML or JSON file")
+    put.add_argument("--runner", metavar="RUNNER", help="Bind a Runner revision to this version")
     secret_input = put.add_mutually_exclusive_group()
     secret_input.add_argument("--prompt-model-api-key", action="store_true", help="Read the model API key from a non-echoing prompt")
     secret_input.add_argument("--model-api-key-stdin", action="store_true", help="Read the model API key from one line of standard input")
@@ -241,10 +263,16 @@ def parser():
     update.add_argument("name")
     update.add_argument("version", help="New version; existing versions cannot be overwritten")
     update.add_argument("--from-version", help="Source version; omit to use the explicit default")
-    update.add_argument("--file", type=Path, required=True, help="JSON patch: merge literal params keys, replace supplied metadata; preserve omitted fields")
+    update.add_argument("--file", type=Path, required=True, help="TOML or JSON patch: merge params keys, replace supplied metadata; preserve omitted fields")
+    update.add_argument("--runner", metavar="RUNNER", help="Bind a Runner revision; v1 requires a full commit; omit to preserve the source binding")
     update_secret = update.add_mutually_exclusive_group()
     update_secret.add_argument("--prompt-model-api-key", action="store_true", help="Read an encrypted model connection key from a non-echoing prompt")
     update_secret.add_argument("--model-api-key-stdin", action="store_true", help="Read an encrypted model connection key from one line of standard input")
+    fork = profiles.add_parser('fork', help='Fork an existing Profile into a new immutable identity')
+    fork.add_argument('source_name')
+    fork.add_argument('source_version')
+    fork.add_argument('name')
+    fork.add_argument('version')
     get = profiles.add_parser("get")
     get.add_argument("name")
     get.add_argument("--version")
@@ -404,7 +432,8 @@ def main(argv=None):
                     args.runner = runner_selector(args.runner)
                 except ValueError as exc:
                     cli.error(str(exc))
-            if sum(value is not None for value in (args.dataset, args.dataset_option, args.source)) != 1:
+            selections = sum(value is not None for value in (args.dataset, args.dataset_option, args.source))
+            if selections != 1 and not (selections == 0 and args.profile):
                 cli.error("provide exactly one positional dataset, --dataset or --source")
             args.dataset = args.dataset if args.dataset is not None else args.dataset_option
             if args.source is not None and any(getattr(args, key) is not None for key in ("runner", "task_id", "config", "split", "revision")):
@@ -424,6 +453,13 @@ def main(argv=None):
         with connection as client:
             if args.group == "profile":
                 if args.action in {"create", "update"}:
+                    from .profile_updates import read_profile_patch, with_runner
+
+                    raw = args.file.read_bytes()
+                    patch = read_profile_patch(raw)
+                    if args.action == 'update' and args.runner is not None:
+                        patch = with_runner(patch, args.runner)
+                        raw = json.dumps(patch).encode('utf-8')
                     secrets = None
                     if args.prompt_model_api_key:
                         import getpass
@@ -437,14 +473,14 @@ def main(argv=None):
                     elif args.model_api_key_stdin:
                         secrets = {"model_api_key": sys.stdin.readline(4098).rstrip("\r\n")}
                     if args.action == "update":
-                        from .profile_updates import read_profile_patch
-
                         result = client.profiles.update(args.name, args.version,
-                            patch=read_profile_patch(args.file.read_bytes()), from_version=args.from_version, secrets=secrets)
+                            patch=patch, from_version=args.from_version, secrets=secrets)
                     else:
                         result = client.profiles.import_spec(
-                            args.file.read_bytes(), name=args.name, version=args.version, secrets=secrets
+                            raw, name=args.name, version=args.version, secrets=secrets, runner=args.runner
                         )
+                elif args.action == 'fork':
+                    result = client.profiles.fork(args.source_name, args.source_version, name=args.name, version=args.version)
                 elif args.action == "get":
                     result = client.profiles.get(args.name, args.version)
                 elif args.action == "list":
@@ -488,6 +524,12 @@ def main(argv=None):
                     from .train_log_cli import read_logs
 
                     return read_logs(client.jobs, args)
+                elif args.action == "run" and args.run_action in {"start", "live", "steer", "stop"}:
+                    from .rsi_cli import run_rsi
+
+                    result = run_rsi(client.agent_runs, args)
+                    if result is None:
+                        return 0
                 elif args.action == "run":
                     result = client.agent_runs.list() if args.run_action == "list" else client.agent_runs.get(args.run)
                 elif args.action == "list":

envloop/cli_errors.py

@@ -66,6 +66,9 @@ _register("AUTH_LOGIN_INVALID_RESPONSE INVALID_PROJECT_RESPONSE INVALID_WORKSPAC
 _register("WORKSPACE_PAGINATION_UNSUPPORTED PROJECT_PAGINATION_UNSUPPORTED", "The complete workspace or project selection could not be loaded.", "Select the intended workspace/project by ID and verify its own API key; check client/server API version compatibility.")
 _register("NO_WORKSPACES NO_PROJECTS", "No selectable workspace or project was found.", "Use an API key authorized for the intended workspace/project, or add a verified selection through '{program} auth config'.")
 _register("PROFILE_DEFAULT_REQUIRED", "This Profile has no explicit default version.", "Specify org/name@VERSION, or set an authorized default with '{program} profile set-default'.")
+_register("INVALID_PROFILE_RUNNER", "The Profile Runner binding is invalid.", "Use org/name@<full-commit> from '{program} runner list'; file and --runner must agree.")
+_register("PROFILE_RUNNER_CONFLICT", "The explicit Runner conflicts with the Profile binding.", "Omit --runner, use the bound Revision, or publish a new Profile version.")
+_register("PROFILE_RUNNER_UNSUPPORTED", "This submission path cannot execute the Profile-bound Runner.", "Use a catalog Dataset Job with this Profile; retain the existing training path for unbound Profiles.")
 _register("PROFILE_ARCHIVED PROFILE_HASH_MISMATCH", "The selected Profile is archived or does not match its frozen version.", "Select an available immutable Profile version and resubmit with the verified reference.")
 _register("CHECKPOINT_AMBIGUOUS", "More than one checkpoint matches this selection.", "Provide --job-id or --run-id and an unambiguous checkpoint path.")
 _register("CHECKPOINT_FILES_UNAVAILABLE ARTIFACT_NOT_READY", "The requested download is not available yet.", "Inspect the Job result and artifact/checkpoint listing before retrying the download.")
@@ -79,6 +82,11 @@ _register("RUNNER_NOT_FOUND", "The Runner reference was not found or is not read
 _register("INVALID_SANDBOX_RUNNER", "The Runner revision cannot execute as a standalone Sandbox Job.", "Check '{program} runner list' and select a frozen Runner revision whose environment supports execution without a Dataset.")
 _register("INVALID_SANDBOX_IMAGE", "The Sandbox image reference is invalid.", "Use a Docker image reference name[:tag][@sha256:digest] and check '{command} --help'.")
 
+_register("RSI_RUN_NOT_FOUND", "No RSI run with this name is visible in the current project.", "Check the name with '{program} job run list' and the scope with '{program} auth config show'; a run you just started appears once the service has accepted it.")
+_register("INVALID_RSI_REQUEST INVALID_STEER INVALID_DIRECTIVE", "The RSI service rejected the request fields.", "Check '{command} --help' and https://docs.envloop.ai/agent-docs/en/guides/agent-runs.md for the run id format, the allowed domain and rounds, and the required spend cap.")
+_register("RSI_CONFLICT RSI_RUN_NOT_ACTIVE", "The run id exists, the run is not in a state that allows this action, or no loop machine is free.", "Pick a new run id for a start; read the run with '{program} job run live RUN' before steering or stopping it.")
+_register("RSI_CONTROL_UNCONFIGURED RSI_CONTROL_UNAVAILABLE RSI_CONTROL_TIMEOUT", "The RSI loop service is not available through this platform right now.", _RETRY_HINT)
+
 _register("JOB_ACTION_UNSUPPORTED", "This Job type does not support the requested action.", "Check the Job type with '{program} job get JOB_ID' and use its supported actions.")
 _register("INFERENCE_ROUTE_RETIRED", "The global inference route has been retired.", "Use the owning Job's base URL: API_BASE/v1/job/JOB_ID/Inference, and a model deployed by that Job.")
 

envloop/client.py

@@ -343,16 +343,38 @@ class Profiles:
 
         Omitted fields and Secret markers are preserved. Supplied metadata,
         including secret_params, replaces that field. Parameter values replace
-        whole values, including objects; keys are literal. The default is unchanged.
+        whole values, including objects. V1 keys are literal; v2 keys are case
+        insensitive and live in spec.params. The default is unchanged.
         """
-        from .profile_updates import checked_patch
+        from .profile_updates import checked_patch, merge_v2_params
 
         patch = checked_patch(patch, name, version)
         original = self.get(name, from_version)["spec"]
-        spec = {**original, **patch, "name": name, "version": version,
-                "params": {**original.get("params", {}), **patch.get("params", {})}}
+        spec = {**original, **patch, "name": name, "version": version}
+        if original.get('schema_version') == 'envplatform.profile/v2':
+            if 'params' in patch:
+                from .http import RemoteError
+                raise RemoteError('INVALID_PROFILE', 422)
+            before, changes = original.get('spec', {}), patch.get('spec', {})
+            spec['spec'] = {**before, **changes, 'params': merge_v2_params(before.get('params', {}), changes.get('params', {}), spec.get('secret_params', []))}
+        else:
+            spec['params'] = {**original.get('params', {}), **patch.get('params', {})}
         return self.put(spec, secrets=secrets)
 
+    def fork(self, source_name, source_version, *, name, version, patch=None, secrets=None):
+        """Publish a new identity from an authorized source; never change its default."""
+        from .profile_updates import checked_patch, merge_v2_params
+
+        original = self.get(source_name, source_version)['spec']
+        changes = checked_patch({} if patch is None else patch, name, version)
+        result = {**original, **changes, 'name': name, 'version': version}
+        if original.get('schema_version') == 'envplatform.profile/v2':
+            before, updates = original.get('spec', {}), changes.get('spec', {})
+            result['spec'] = {**before, **updates, 'params': merge_v2_params(before.get('params', {}), updates.get('params', {}), result.get('secret_params', []))}
+        else:
+            result['params'] = {**original.get('params', {}), **changes.get('params', {})}
+        return self.put(result, secrets=secrets)
+
     def get(self, name: str, version: str | None = None) -> dict:
         return self._server.get_profile(name, version)
 
@@ -377,7 +399,31 @@ class Profiles:
         """Revoke model access for a scoped immutable secret revision."""
         return self._server.revoke_profile_secret(name, version)
 
-    def import_spec(self, raw: bytes, *, name=None, version=None, secrets=None):
+    def import_spec(self, raw: bytes, *, name=None, version=None, secrets=None, runner=None):
+        import json
+
+        from .profile_updates import read_profile_patch, with_runner
+
+        value = read_profile_patch(raw)
+        if isinstance(value, dict) and value.get('schema_version') == 'envhub.runner/v1':
+            from .http import RemoteError
+
+            definition = value.get('runner')
+            declarations = value.get('params', {})
+            if (not isinstance(definition, dict) or not isinstance(definition.get('name'), str)
+                    or not definition['name'] or not isinstance(declarations, dict)
+                    or any(not isinstance(item, dict) for item in declarations.values())):
+                raise RemoteError('INVALID_PROFILE', 422)
+            if runner is not None and runner.partition('@')[0] != definition['name']:
+                raise RemoteError('INVALID_PROFILE_RUNNER', 422)
+            defaults = {key: declaration['default'] for key, declaration in declarations.items()
+                        if 'default' in declaration}
+            value = {'schema_version': 'envplatform.profile/v2', 'name': name, 'version': version,
+                     'runner': runner if runner is not None else definition['name'] + '@main',
+                     'spec': {'params': defaults, **({'env': value['env']} if 'env' in value else {})}}
+        if runner is not None:
+            value = with_runner(value, runner)
+        raw = json.dumps(value, allow_nan=False, ensure_ascii=False).encode('utf-8')
         options = {} if secrets is None else {"secrets": secrets}
         return self._server.import_profile(raw, name=name, version=version, **options)
 
@@ -454,9 +500,10 @@ class Jobs:
                 body['image'] = validate_image(image)
             validate_public_execution(body)
             return self._server.submit_job(body)
-        if sum(value is not None for value in (dataset, source, task_ref)) != 1:
+        profile_only = all(value is None for value in (dataset, source, task_ref)) and (profile_id is not None or options.get("profile_name") is not None)
+        if sum(value is not None for value in (dataset, source, task_ref)) != 1 and not profile_only:
             raise ValueError("provide exactly one dataset, source or task_ref")
-        if dataset is None and (runner is not None or any(value is not None for value in (task_id, namespace, config, split, revision))):
+        if dataset is None and not profile_only and (runner is not None or any(value is not None for value in (task_id, namespace, config, split, revision))):
             raise ValueError("dataset selection options require a dataset")
         if runner is not None:
             runner = runner_selector(runner)
@@ -464,7 +511,9 @@ class Jobs:
             options["command"] = validate_command(command)
         selection = {key: value for key, value in dict(task_id=task_id, namespace=namespace, config=config,
                                                       split=split, revision=revision).items() if value is not None}
-        if source is not None:
+        if profile_only:
+            source = {"dataset": selection} if selection else {}
+        elif source is not None:
             source = {"task": load_task(source)}
         elif task_ref is not None:
             source = {"task_ref": dict(task_ref)}
@@ -535,7 +584,12 @@ class Jobs:
     def stop(self, job_id):
         return self._server.stop_job(job_id)
 
-    def wait(self, job_id, *, timeout=600, poll_interval=.1):
+    def wait(self, job_id, *, timeout=600, poll_interval=.1, max_poll_interval=5):
+        """Poll until terminal; the interval grows 1.5x per poll up to ``max_poll_interval``.
+
+        Jobs that run for tens of minutes (large-model training) would otherwise
+        issue ten status requests a second for the whole wait.
+        """
         if not math.isfinite(timeout) or timeout < 0:
             raise ValueError("timeout must be finite and non-negative")
         if not math.isfinite(poll_interval) or poll_interval <= 0:
@@ -549,6 +603,7 @@ class Jobs:
             if remaining <= 0:
                 raise TimeoutError("job did not reach a terminal state")
             time.sleep(min(poll_interval, remaining))
+            poll_interval = max(poll_interval, min(poll_interval * 1.5, max_poll_interval))
 
 
 class Client:
@@ -603,13 +658,23 @@ class Client:
 
         if 'http_client' in options:
             raise ValueError('Client.training_service manages its authenticated HTTP client')
+        if any(name in options for name in ('base_url', 'api_key', 'default_headers')):
+            raise ValueError('Client.training_service manages its connection and credential headers')
+        overrides = options.get('default_headers_overrides') or {}
+        protected_headers = {'authorization', 'x-api-key', 'cookie', 'x-workspace-id',
+                             'x-project-id', 'x-envloop-temporary-scope'}
+        if any(name.lower() in protected_headers for name in overrides):
+            raise ValueError('Client.training_service manages authentication, project and temporary scope headers')
         transport = self._transport
+        project_id = transport.headers.get("X-Project-ID", "")
+        if 'project_id' in options and options.pop('project_id') != project_id:
+            raise ValueError('Select the training project through Client.remote(project_id=...)')
         token = transport.request("POST", "/v1/job/tinker/api/v1/auth/token", {})["jwt"]
         headers = {name: value for name, value in transport.headers.items() if name in {"X-Workspace-ID", "X-Project-ID"}}
         if temporary_scope_id is not None:
             headers["X-EnvLoop-Temporary-Scope"] = temporary_scope_id
         base_url = transport.base + "/v1/job/tinker"
-        return ServiceClient(base_url=base_url, api_key=token, default_headers=headers,
+        return ServiceClient(base_url=base_url, api_key=token, project_id=project_id, default_headers=headers,
                              http_client=TrainingHttpClient(base_url, transport.headers["Authorization"]), **options)
 
     @classmethod

envloop/http.py

@@ -307,22 +307,10 @@ class HttpService:
                           sort_keys=True, separators=(",", ":"), allow_nan=False).encode("utf-8")
 
     def import_profile(self, raw, *, name=None, version=None, secrets=None):
-        def unique_object(pairs):
-            result = {}
-            for key, value in pairs:
-                if key in result:
-                    raise ValueError("duplicate key")
-                result[key] = value
-            return result
+        from .profile_updates import read_profile_patch
 
-        def invalid_constant(value):
-            raise ValueError("non-finite JSON value")
-
-        try:
-            spec = json.loads(raw, object_pairs_hook=unique_object, parse_constant=invalid_constant)
-            if (not isinstance(spec, dict) or (name is not None and spec.get("name") != name)
-                    or (version is not None and spec.get("version") != version)):
-                raise ValueError("Profile name/version mismatch")
-        except (ValueError, UnicodeError, TypeError):
-            raise RemoteError("INVALID_PROFILE", 422) from None
+        spec = read_profile_patch(raw)
+        if (not isinstance(spec, dict) or (name is not None and spec.get("name") != name)
+                or (version is not None and spec.get("version") != version)):
+            raise RemoteError("INVALID_PROFILE", 422)
         return self.put_profile(profile_payload(spec, secrets))

envloop/navigation_resources.py

@@ -167,7 +167,8 @@ def _checkpoint_matches(path, item):
         return True
     # The bare-session alias is resolved by the server for either kind.
     return (parsed.netloc == item.get('job_id') and name in {
-        'weights/' + str(item.get('checkpoint_id')), 'sampler_weights/' + str(item.get('checkpoint_id'))})
+        'weights/' + str(item.get('checkpoint_id')), 'sampler_weights/' + str(item.get('checkpoint_id')),
+        'external_weights/' + str(item.get('checkpoint_id'))})
 
 
 def _checkpoint_target(directory, name):

envloop/profile_updates.py

@@ -1,5 +1,6 @@
 """Build new Profile versions without changing the source or its default."""
 import json
+import tomllib
 from collections.abc import Mapping
 
 from .http import RemoteError
@@ -18,13 +19,19 @@ def read_profile_patch(raw):
         raise ValueError
 
     try:
-        return json.loads(raw, object_pairs_hook=unique, parse_constant=invalid_constant)
+        text = raw.decode('utf-8') if isinstance(raw, bytes) else raw
+        try:
+            value = json.loads(text, object_pairs_hook=unique, parse_constant=invalid_constant)
+        except ValueError:
+            value = tomllib.loads(text)
+        json.dumps(value, allow_nan=False)
+        return value
     except (ValueError, UnicodeError, TypeError):
         raise RemoteError("INVALID_PROFILE", 422) from None
 
 
 def checked_patch(patch, name, version):
-    allowed = {"schema_version", "name", "version", "params", "description", "created_for", "secret_params"}
+    allowed = {"schema_version", "name", "version", "params", "description", "created_for", "secret_params", "agent", "runner", "dataset", "dataset_mode", "task", "tags", "spec"}
 
     def string_keys(value):
         if isinstance(value, Mapping):
@@ -39,7 +46,8 @@ def checked_patch(patch, name, version):
     try:
         if (not isinstance(patch, Mapping) or set(patch) - allowed
                 or patch.get("name", name) != name or patch.get("version", version) != version
-                or not isinstance(patch.get("params", {}), Mapping)):
+                or not isinstance(patch.get("params", {}), Mapping)
+                or not isinstance(patch.get("spec", {}), Mapping)):
             raise ValueError
         # Reject non-finite numbers for SDK input as well as CLI JSON files.
         json.dumps(patch, allow_nan=False)
@@ -47,3 +55,22 @@ def checked_patch(patch, name, version):
     except (ValueError, TypeError, OverflowError):
         raise RemoteError("INVALID_PROFILE", 422) from None
     return dict(patch)
+
+
+def merge_v2_params(base, override, secrets=()):
+    """Overlay parameter values using the Runner's case insensitive names."""
+    if not isinstance(base, Mapping) or not isinstance(override, Mapping):
+        raise RemoteError("INVALID_PROFILE", 422)
+    targets = [key.upper() for key in override]
+    if len(set(targets)) != len(targets):
+        raise RemoteError("INVALID_PROFILE", 422)
+    marked = {key.upper(): key for key in secrets}
+    changes = {marked.get(key.upper(), key): item for key, item in override.items()}
+    return {key: item for key, item in base.items() if key.upper() not in targets} | changes
+
+
+def with_runner(value, runner):
+    """Keep a file binding and explicit CLI binding unambiguous."""
+    if not isinstance(value, Mapping) or value.get('runner', runner) != runner:
+        raise RemoteError('INVALID_PROFILE_RUNNER', 422)
+    return dict(value, runner=runner)

envloop/rsi_cli.py

@@ -0,0 +1,49 @@
+"""``el job run start|live|steer|stop``: thin wrappers over the platform's RSI routes."""
+
+import sys
+import time
+
+FINISHED = frozenset({"finished", "failed", "stopped", "unreadable"})
+POLL_SECONDS = 3.0
+
+
+def _brief(args):
+    if args.brief is not None:
+        return args.brief
+    if args.brief_file == "-":
+        return sys.stdin.read()
+    with open(args.brief_file, encoding="utf-8") as handle:
+        return handle.read()
+
+
+def _follow(runs, run, since):
+    """Print new events as ``seq kind: text`` until the run ends; the run itself is left alone."""
+    while True:
+        live = runs.live(run, since)
+        for event in live.get("events") or []:
+            print(f"{event.get('seq')} {event.get('kind')}: {event.get('text') or ''}", flush=True)
+        if isinstance(live.get("next_cursor"), int):
+            since = live["next_cursor"]
+        if live.get("state") in FINISHED:
+            print(f"state: {live['state']}", flush=True)
+            return
+        time.sleep(POLL_SECONDS)
+
+
+def run_rsi(runs, args):
+    """Run one action; returns the result to print, or None when it printed its own output."""
+    if args.run_action == "start":
+        return runs.start(args.run, _brief(args), model_usd_cap=args.model_usd_cap, usd_cap=args.usd_cap,
+                          model_request_cap=args.model_request_cap, domain=args.domain, rounds=args.rounds,
+                          dry_run=args.dry_run, student_model=args.student_model)
+    if args.run_action == "live":
+        if not args.follow:
+            return runs.live(args.run, args.since)
+        try:
+            _follow(runs, args.run, args.since)
+        except KeyboardInterrupt:
+            pass
+        return None
+    if args.run_action == "steer":
+        return runs.steer(args.run, args.text)
+    return runs.control(args.run, "stop")

envloop/training/__init__.py

@@ -44,7 +44,6 @@ from tinker import (
     SampledSequence as SampledSequence,
     SampleRequest as SampleRequest,
     SampleResponse as SampleResponse,
-    SamplingClient as SamplingClient,
     SamplingParams as SamplingParams,
     StopReason as StopReason,
     TensorData as TensorData,
@@ -59,7 +58,9 @@ from tinker import (
     auth as auth,
     types as types,
 )
+from tinker.types import ImageChunk as ImageChunk
 
+from .sampling_client import SamplingClient as SamplingClient
 from .service_client import RestClient as RestClient, ServiceClient as ServiceClient
 
 __all__ = [
@@ -79,6 +80,7 @@ __all__ = [
     "Datum",
     "DmelChunk",
     "EncodedTextChunk",
+    "ImageChunk",
     "ForwardBackwardOutput",
     "SampledProvenanceSpan",
     "LoraConfig",

envloop/training/credentials.py

@@ -1,9 +1,58 @@
 """Per-service HTTP auth boundary for the pinned Tinker client's JWT renewals."""
 
+import dataclasses
 import re
 
 import httpx
 from tinker._base_client import DefaultAsyncHttpxClient
+from tinker.lib.internal_client_holder import InternalClientHolder, _ShadowHolderConfig
+
+_SCOPE_HEADERS = {'x-workspace-id', 'x-project-id', 'x-envloop-temporary-scope'}
+
+
+class _ProcessLocalShadowConfig(_ShadowHolderConfig):
+    """Prevent native SamplingClient pickle from exporting the bootstrap JWT.
+
+    Upstream serializes shadow_config rather than the holder itself. Its handle
+    export first calls without_credentials(), which returns the official plain
+    config shape without this process boundary or any authentication headers.
+    """
+
+    def __reduce__(self):
+        raise TypeError('EnvLoop training services are process-local; export a sampler handle instead')
+
+    def without_credentials(self):
+        fields = dataclasses.asdict(self)
+        fields['api_key'] = None
+        fields['default_headers_overrides'] = {
+            name: value for name, value in self.default_headers_overrides.items()
+            if name.lower() in _SCOPE_HEADERS
+        }
+        return _ShadowHolderConfig(**fields)
+
+
+class TrainingClientHolder(InternalClientHolder):
+    """Instance-local transport options for the pinned Tinker 0.34 holder.
+
+    The high-level upstream constructor no longer forwards transport options.
+    Inject them before its first config request, so config, refresh, session and
+    REST pools all retain the same authenticated transport and timeout policy.
+    """
+
+    def __init__(self, *, transport_options, **kwargs):
+        self._envloop_transport_options = transport_options
+        super().__init__(**kwargs)
+
+    async def _fetch_client_config(self, auth):
+        self._constructor_kwargs.update(self._envloop_transport_options)
+        return await super()._fetch_client_config(auth)
+
+    def __reduce__(self):
+        raise TypeError('EnvLoop training services are process-local; create a new training_service in each process')
+
+    @property
+    def shadow_config(self):
+        return _ProcessLocalShadowConfig(**dataclasses.asdict(super().shadow_config))
 
 
 class _PlatformCredential(httpx.Auth):
@@ -21,21 +70,23 @@ class TrainingHttpClient(DefaultAsyncHttpxClient):
     """Keep upstream JWT refresh, but authenticate each exchange with its source.
 
     Only the exact configured config/exchange URLs receive the original key.
-    This uses Tinker's supported http_client option; no global auth/environment
-    hooks or changes to the server token lifetime are required.
+    TrainingClientHolder forwards this through the pinned low-level client's
+    http_client option without global auth/environment hooks.
     """
 
     def __init__(self, base_url, authorization):
-        super().__init__()
+        super().__init__(follow_redirects=False)
         self._credential_urls = {httpx.URL(base_url + path) for path in
                                  ('/api/v1/client/config', '/api/v1/auth/token')}
         self._platform_credential = _PlatformCredential(authorization)
 
     async def send(self, request, **kwargs):
+        # X-API-Key is not stripped by HTTPX on cross-origin redirects. Both
+        # bootstrap exchanges and ordinary JWT requests must stay on their URL.
+        kwargs['follow_redirects'] = False
         exchange = request.method == 'POST' and request.url in self._credential_urls
         if exchange:
             kwargs['auth'] = self._platform_credential
-            kwargs['follow_redirects'] = False
         response = await super().send(request, **kwargs)
         if exchange and not 200 <= response.status_code < 300:
             # Upstream logs refresh failures. Retain a bounded code/status, never

envloop/training/sampling_client.py

@@ -0,0 +1,58 @@
+"""Restore official sampler handles using an explicit EnvLoop credential."""
+
+import base64
+import json
+from urllib.parse import urlsplit
+
+from tinker import SamplingClient as TinkerSamplingClient
+from tinker.lib.internal_client_holder import _ShadowHolderConfig
+from tinker.lib.public_interfaces.sampling_client import _SamplingClientPickleState
+
+from .credentials import TrainingClientHolder
+
+
+class SamplingClient(TinkerSamplingClient):
+    @staticmethod
+    def from_sampler_handle(handle, *, api_key=None):
+        fields = json.loads(base64.urlsafe_b64decode(handle))
+        config = _ShadowHolderConfig(**fields.pop('holder'))
+        state = _SamplingClientPickleState(**fields, holder=config)
+        url = urlsplit(config.base_url)
+        if not url.path.rstrip('/').endswith('/v1/job/tinker'):
+            return TinkerSamplingClient.from_sampler_handle(handle, api_key=api_key)
+        if not isinstance(api_key, str) or not api_key.strip():
+            raise ValueError('EnvLoop sampler handles require an explicit original EnvLoop api_key')
+        if url.scheme not in {'http', 'https'} or not url.hostname or url.username or url.password or url.query or url.fragment:
+            raise ValueError('invalid EnvLoop sampler API URL')
+        if config.api_key is not None:
+            raise ValueError('EnvLoop sampler handles must not contain credentials')
+        headers = {name.lower(): value for name, value in config.default_headers_overrides.items()}
+        if set(headers) - {'x-workspace-id', 'x-project-id', 'x-envloop-temporary-scope'}:
+            raise ValueError('EnvLoop sampler handles may contain only workspace, project and temporary scope headers')
+
+        from envloop import Client
+        from envloop.http import HttpService
+
+        base_url = config.base_url.rstrip('/')
+        # A missing scope means key-selected scope, never this worker's ambient
+        # EnvLoop configuration or environment.
+        client = Client(HttpService(base_url.removesuffix('/v1/job/tinker'), api_key=api_key,
+                                    workspace_id=headers.get('x-workspace-id'),
+                                    project_id=headers.get('x-project-id'), config=False, environment=False))
+        try:
+            service = client.training_service(temporary_scope_id=headers.get('x-envloop-temporary-scope'))
+            # Fetch current server flags with the explicit original key. Never
+            # trust cached auth flags from a portable handle or create a new job.
+            holder = TrainingClientHolder(
+                session_id=state.session_id, base_url=service._base_url, api_key=service._api_key,
+                default_headers_overrides=service._default_headers_overrides,
+                transport_options=service._envloop_transport_options,
+            )
+            return SamplingClient(holder, sampling_session_id=state.sampling_session_id,
+                                  shadow=True, record_stability_info=state.record_stability_info)
+        finally:
+            client.close()
+
+    def close(self):
+        """Release this restored client's local resources without finishing its job."""
+        return self.holder.run_coroutine_threadsafe(self.holder.aclose())

envloop/training/service_client.py

@@ -72,11 +72,32 @@ class RestClient(TinkerRestClient):
     async def set_checkpoint_ttl_from_tinker_path_async(self, tinker_path_, ttl_seconds):
         return await super().set_checkpoint_ttl_from_tinker_path_async(tinker_path(tinker_path_), ttl_seconds)
 
+    def copy_weights(self, path, destination_project_id=None, *, ttl_seconds=None, weights_access_token=None):
+        return super().copy_weights(tinker_path(path), destination_project_id,
+                                    ttl_seconds=ttl_seconds, weights_access_token=weights_access_token)
+
+    async def copy_weights_async(self, path, destination_project_id=None, *, ttl_seconds=None, weights_access_token=None):
+        return await super().copy_weights_async(tinker_path(path), destination_project_id,
+                                               ttl_seconds=ttl_seconds, weights_access_token=weights_access_token)
+
+    def get_external_weights_urls(self, path):
+        return super().get_external_weights_urls(self._external_path(path))
+
+    async def get_external_weights_urls_async(self, path):
+        return await super().get_external_weights_urls_async(self._external_path(path))
+
+    @staticmethod
+    def _external_path(path):
+        if isinstance(path, str) and path.startswith("envloop://"):
+            match = _checked(path)
+            return f"tinker://{match['session']}/external_weights/{match['checkpoint']}"
+        return path
+
 
 class ServiceClient(TinkerServiceClient):
     """Tinker ServiceClient accepting EnvLoop checkpoint paths.
 
-    Tinker 0.30.2 validates sampling paths in its shared session holder, and its
+    Tinker validates sampling paths in its shared session holder, and its
     RestClient parses paths client-side, before sending HTTP. Adapt those boundaries
     so ServiceClient, its TrainingClients and RestClients accept envloop:// without
     replacing native futures, training clients, authentication, or globally patching
@@ -84,6 +105,13 @@ class ServiceClient(TinkerServiceClient):
     """
 
     def __init__(self, *args, **kwargs):
+        # 0.34's public constructor silently ignores these previously supported
+        # options. Keep EnvLoop's per-service auth/timeout boundary explicit.
+        self._envloop_transport_options = {name: kwargs.pop(name) for name in
+                                           ('http_client', 'timeout', 'max_retries') if name in kwargs}
+        headers = kwargs.pop('default_headers', None)
+        if headers is not None:
+            kwargs['default_headers_overrides'] = dict(headers) | dict(kwargs.get('default_headers_overrides') or {})
         super().__init__(*args, **kwargs)
         self._checkpoint_adapter_lock = threading.Lock()
         self._checkpoint_adapter_holder = None
@@ -92,7 +120,7 @@ class ServiceClient(TinkerServiceClient):
         return RestClient(self._get_rest_holder())
 
     def _get_session_holder(self):
-        holder = super()._get_session_holder()
+        holder = self._envloop_holder(session=True) if self._envloop_transport_options else super()._get_session_holder()
         with self._checkpoint_adapter_lock:
             if self._checkpoint_adapter_holder is not holder:
                 create = holder._create_sampling_session
@@ -106,3 +134,32 @@ class ServiceClient(TinkerServiceClient):
                 holder._create_sampling_session = create_sampling_session
                 self._checkpoint_adapter_holder = holder
         return holder
+
+    def _get_rest_holder(self):
+        return self._envloop_holder(session=False) if self._envloop_transport_options else super()._get_rest_holder()
+
+    def _envloop_holder(self, *, session):
+        from .credentials import TrainingClientHolder
+
+        attribute = '_session_holder' if session else '_rest_holder'
+        lock = self._session_holder_lock if session else self._rest_holder_lock
+        with self._lifecycle_lock:
+            if self._closed:
+                raise RuntimeError('ServiceClient is closed')
+            holder = getattr(self, attribute)
+            if holder is not None:
+                return holder
+        with lock:
+            with self._lifecycle_lock:
+                if self._closed:
+                    raise RuntimeError('ServiceClient is closed')
+                holder = getattr(self, attribute)
+                if holder is None:
+                    options = dict(user_metadata=self._user_metadata, project_id=self._project_id,
+                                   display_name=self._display_name) if session else {'_skip_session': True}
+                    holder = TrainingClientHolder(
+                        base_url=self._base_url, api_key=self._api_key,
+                        default_headers_overrides=self._default_headers_overrides,
+                        transport_options=self._envloop_transport_options, **options)
+                    setattr(self, attribute, holder)
+                return holder

{envloop_cli-0.3.0.dist-info → envloop_cli-1.4.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: envloop-cli
-Version: 0.3.0
+Version: 1.4.0
 Summary: EnvLoop CLI and Python SDK for jobs, training, checkpoints and inference
 Project-URL: Homepage, https://envloop.ai
 Project-URL: Documentation, https://docs.envloop.ai
@@ -8,7 +8,7 @@ Project-URL: Repository, https://github.com/EnvLoop/envloop-cli
 Project-URL: Issues, https://github.com/EnvLoop/envloop-cli/issues
 Project-URL: Agent instructions, https://docs.envloop.ai/skill.md
 Requires-Python: >=3.11
-Requires-Dist: tinker==0.30.2
+Requires-Dist: tinker==0.34.0
 Description-Content-Type: text/markdown
 
 # envloop-cli: EnvLoop CLI and Python SDK

{envloop_cli-0.3.0.dist-info → envloop_cli-1.4.0.dist-info}/RECORD

@@ -1,30 +1,32 @@
 envloop/__init__.py,sha256=B5YMYMBLKix-teWpKXcOcXiVKMg7salHKp7J3Xdnwco,79
-envloop/agent_runs.py,sha256=X0v1HkID5NrL1NoUDfa2zAhNvh8utwd_5q3KJOA05Kg,7972
+envloop/agent_runs.py,sha256=ohBuiv6G2DcyItfPcMh68N9NpAmHwDkaZkyEqKwVQM8,10178
 envloop/auth_cli.py,sha256=yTzNaqFFBBZ-rEp7XUW7Yn2K9Uz6IGe3i3Ye61_vccc,14826
 envloop/auth_login.py,sha256=wURCu4HEhRlW3EGWn0MJvgPfe1wXhdplMmeQybNIWwQ,6527
 envloop/auth_workspace.py,sha256=CC1EToAOcKW69Mvb4xZRkVltmXY4OpApfZaUc2ChB-c,14377
-envloop/cli.py,sha256=KjP1VhfDDqlae79hGlwUtGJF1Oebu9guPNpQzjQ4xTI,29724
-envloop/cli_errors.py,sha256=6pzRrsSutDzruQFxdPnW6qVCQII28eqot9HycwQW49s,22314
+envloop/cli.py,sha256=6RnXTIDigLmlhJxSQwwkRCnU8f02ciaCgk8-dSOHo3w,33123
+envloop/cli_errors.py,sha256=6adjPGRvbA98Cic1E2RUtLk3xCKW4G9b1jWnmfqhCxU,23835
 envloop/cli_output.py,sha256=bW2J7aCo9WqPqzIl2WHwVgpuQ7nGaaA2GEz1reMJczs,11151
-envloop/client.py,sha256=fR-uRGDv0e1yLvvq9gNVxeTwl7cliBcXYmhvnq0oYck,29733
+envloop/client.py,sha256=wDcO2GrCr60cykpuIdfPJGGoiZ57iKW-ke3--m__MdA,34207
 envloop/config.py,sha256=aSTztNusGD4JOvwMmTy6GpjlDs4eZrwnntnvzbjO1f8,19699
-envloop/http.py,sha256=tPMZcnysy66EvIoLPDCE1RhLdL85OImM6Zy0j8BEkaQ,15555
+envloop/http.py,sha256=8pmCZRc3-Z70dLdE4nmgxbcFICKhxDO1XbfbcU-Bytc,15061
 envloop/job_logs.py,sha256=n1rOAg4XvRlqhuGl5Z1AazxhjwzgnDT0FGrtJFCI1AY,892
 envloop/lifecycle_cli.py,sha256=Di7zzslJI09CBWJXgi2PrAqzCvvo8UfDh3fcFew7Fng,2966
-envloop/navigation_resources.py,sha256=s1BMcgAHdn-rZRWDidDGIePNi51PvckoGUpba_4Ct5g,15491
+envloop/navigation_resources.py,sha256=sTXBdPvSvekW2eQeQHp6nvf5kKqNfE0ZE7mZOkuJacg,15553
 envloop/profile_secrets.py,sha256=jDDmBTO5D8hAUc74zkq7u44QWFTz-J0-brYBrk7zgqU,1107
-envloop/profile_updates.py,sha256=QYPSBoGb4_NN51AJ1qGxgyxKuywvFuQ42m0DzMHY910,1704
+envloop/profile_updates.py,sha256=YUQky5SSU7PZrjGFvVSVEcxm8CnayX4hsQljTGyc7zU,2975
 envloop/resource_cli.py,sha256=YHDzA476SSqgarAIi5C61hGYWX0KJ9PWLPhbWmCDNtA,9846
 envloop/resources.py,sha256=SQ5EcFZ7V0mwMe3CFI5lClx6Ccdy9r1z6plhJlvAcx4,9526
+envloop/rsi_cli.py,sha256=YQIGKqADS1cDIlsBlMTIfMXImOKiN8KOJ9yZRtMtLis,1831
 envloop/sandbox.py,sha256=hqKq3MST89p47PuAtk1lm3lpk3f796I_5T6P_yV9uW4,1208
 envloop/train.py,sha256=_2ULNs9370e8ub5xdYW4bAl18fxvW9WG5dC92_6EawQ,3340
 envloop/train_log_cli.py,sha256=eqHYLLu1ohk4hYeio0qVhanrqBRpGRMRUcqkI-LWIuA,4201
-envloop/training/__init__.py,sha256=sJZNe-MchKjbmRBfSsbbuThuR-PvvTa0LUJWVTJJJ1k,3551
-envloop/training/credentials.py,sha256=yLy2M4ia8SAqrdIKZyF-glarVfWsKb99nSPS1RPK4EY,2447
-envloop/training/service_client.py,sha256=MR9xiCmA6EvsFOtFR_2z27Bk3W64miYc53fzOLUTvKE,5047
+envloop/training/__init__.py,sha256=NtifOnEHcA1aM5zn4-ZTn2IaCRy6RFAFLY_WEYgO6rY,3643
+envloop/training/credentials.py,sha256=V4uDZxGXn8387aZF6BpUNX1AunwkPxDXivC70FOkiE0,4638
+envloop/training/sampling_client.py,sha256=195ze2IcbV0kcTIXmGiV8r6MJ5tdKyd-g73WJzxRQsY,3226
+envloop/training/service_client.py,sha256=UF0nxQdSCrfas5mPsGKWXyNF5uYzNJGdTfUynDpk2sA,8277
 envloop/utils/__init__.py,sha256=huB3qPQuKNr3JxfH3Ys09YWFtHiDamCHFsBa4epANgQ,25
 envloop/utils/logging.py,sha256=rXN0qyxhfGEq4vWXxjwfaczPPZf_7atnOkkBTgNNRPc,1017
-envloop_cli-0.3.0.dist-info/METADATA,sha256=kLw1JFqo3REkCkYKH3HburFlZjamgJFH_TFlYTAeiLI,4197
-envloop_cli-0.3.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-envloop_cli-0.3.0.dist-info/entry_points.txt,sha256=8aXOpgtVk4GndhChA4XNecShkb1w0xGHBHrKla78ofI,67
-envloop_cli-0.3.0.dist-info/RECORD,,
+envloop_cli-1.4.0.dist-info/METADATA,sha256=3S_8xVBPxjIPRt17qYBiuxLPx9KKKHz0Ol0Y0cplPP8,4197
+envloop_cli-1.4.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+envloop_cli-1.4.0.dist-info/entry_points.txt,sha256=8aXOpgtVk4GndhChA4XNecShkb1w0xGHBHrKla78ofI,67
+envloop_cli-1.4.0.dist-info/RECORD,,