envloop-cli 1.13.0__tar.gz → 1.16.0__tar.gz

{envloop_cli-1.13.0 → envloop_cli-1.16.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: envloop-cli
-Version: 1.13.0
+Version: 1.16.0
 Summary: EnvLoop CLI and Python SDK for jobs, training, checkpoints and inference
 Project-URL: Homepage, https://envloop.ai
 Project-URL: Documentation, https://docs.envloop.ai
@@ -192,8 +192,8 @@ Choose a published Runner readable in your project. Save this request as `gpu-ru
 {
   "request_id": "gpu-run-001",
   "trials": [
-    {"name": "first", "spec": {"runner": "envhub/bash-runner@FULL_COMMIT", "resources": {"gpu_type": "H100", "gpus": 4}, "timeout_sec": 600}},
-    {"name": "second", "spec": {"runner": "envhub/bash-runner@FULL_COMMIT", "resources": {"gpu_type": "H100", "gpus": 4}, "timeout_sec": 600}}
+    {"name": "first", "spec": {"runner": "envhub/bash@FULL_COMMIT", "resources": {"gpu_type": "H100", "gpus": 4}, "timeout_sec": 600}},
+    {"name": "second", "spec": {"runner": "envhub/bash@FULL_COMMIT", "resources": {"gpu_type": "H100", "gpus": 4}, "timeout_sec": 600}}
   ]
 }
 ```
@@ -217,3 +217,26 @@ Use `el --no-color job list` or append `--no-color` to a command to disable high
 `NO_COLOR=1`, `TERM=dumb`, pipes, and redirected output also disable colors. JSON preserves original values.
 List times use the local timezone; Job logs retain the recorded timezone, with full precision and offsets available through `--json`.
 `el job run live RUN --follow --json` emits complete response frames as NDJSON; Ctrl-C stops reading without stopping the Run.
+
+## Job-bound decision plugins
+
+When the platform and published Runner support Job Profiles, include the authorized
+`profile` snapshot in the Train or Inference request's `spec`. The platform freezes
+its inputs, recipe and approved plugin pins. This does not select an executor or provider.
+
+For an Inference Job with a bound decision plugin, save the plugin payload as JSON:
+
+```bash
+el job decision JOB_ID --model WORKSPACE/MODEL --spec payload.json
+```
+
+```python
+with Client.remote() as client:
+    result = client.decision.evaluate(
+        "JOB_ID", model="WORKSPACE/MODEL", payload=payload
+    )
+```
+
+Use the exact model returned by the Job. The SDK forwards the payload to the
+Job's `/Inference/decision` API; the approved plugin validates its business fields.
+Availability requires matching platform support and approved content in your project.

{envloop_cli-1.13.0 → envloop_cli-1.16.0}/README.pypi.md

@@ -178,8 +178,8 @@ Choose a published Runner readable in your project. Save this request as `gpu-ru
 {
   "request_id": "gpu-run-001",
   "trials": [
-    {"name": "first", "spec": {"runner": "envhub/bash-runner@FULL_COMMIT", "resources": {"gpu_type": "H100", "gpus": 4}, "timeout_sec": 600}},
-    {"name": "second", "spec": {"runner": "envhub/bash-runner@FULL_COMMIT", "resources": {"gpu_type": "H100", "gpus": 4}, "timeout_sec": 600}}
+    {"name": "first", "spec": {"runner": "envhub/bash@FULL_COMMIT", "resources": {"gpu_type": "H100", "gpus": 4}, "timeout_sec": 600}},
+    {"name": "second", "spec": {"runner": "envhub/bash@FULL_COMMIT", "resources": {"gpu_type": "H100", "gpus": 4}, "timeout_sec": 600}}
   ]
 }
 ```
@@ -203,3 +203,26 @@ Use `el --no-color job list` or append `--no-color` to a command to disable high
 `NO_COLOR=1`, `TERM=dumb`, pipes, and redirected output also disable colors. JSON preserves original values.
 List times use the local timezone; Job logs retain the recorded timezone, with full precision and offsets available through `--json`.
 `el job run live RUN --follow --json` emits complete response frames as NDJSON; Ctrl-C stops reading without stopping the Run.
+
+## Job-bound decision plugins
+
+When the platform and published Runner support Job Profiles, include the authorized
+`profile` snapshot in the Train or Inference request's `spec`. The platform freezes
+its inputs, recipe and approved plugin pins. This does not select an executor or provider.
+
+For an Inference Job with a bound decision plugin, save the plugin payload as JSON:
+
+```bash
+el job decision JOB_ID --model WORKSPACE/MODEL --spec payload.json
+```
+
+```python
+with Client.remote() as client:
+    result = client.decision.evaluate(
+        "JOB_ID", model="WORKSPACE/MODEL", payload=payload
+    )
+```
+
+Use the exact model returned by the Job. The SDK forwards the payload to the
+Job's `/Inference/decision` API; the approved plugin validates its business fields.
+Availability requires matching platform support and approved content in your project.

envloop_cli-1.16.0/envloop/__init__.py

@@ -0,0 +1,6 @@
+"""EnvLoop Python client."""
+
+from .client import Client
+from .decision import DecisionClient
+
+__all__ = ["Client", "DecisionClient"]

{envloop_cli-1.13.0 → envloop_cli-1.16.0}/envloop/auth_cli.py

@@ -130,7 +130,8 @@ def _verify_key(url, key, workspace_id=None, project_id=None):
         response = HttpService(url, timeout=5, api_key=key, project_id=project_id, config=False,
                                environment=False).request("GET", "/v1/me")
     except RemoteError as error:
-        code = {401: "AUTHENTICATION_REJECTED", 403: "AUTHORIZATION_DENIED"}.get(error.status_code)
+        code = "EDGE_REJECTED" if error.code == "EDGE_REJECTED" else {
+            401: "AUTHENTICATION_REJECTED", 403: "AUTHORIZATION_DENIED"}.get(error.status_code)
         if code is None:
             code = error.code if error.status_code is None and error.code in {
                 "NETWORK_ERROR", "INVALID_RESPONSE", "RESPONSE_TOO_LARGE",
@@ -279,7 +280,8 @@ def run_auth(args, parser):
             except (ConfigError, RemoteError) as error:
                 from .cli_errors import format_error, safe_error_code
 
-                report["check"] = {401: "authentication_rejected", 403: "authorization_denied"}.get(
+                report["check"] = "edge_rejected" if getattr(error, "code", None) == "EDGE_REJECTED" else {
+                    401: "authentication_rejected", 403: "authorization_denied"}.get(
                     getattr(error, "status_code", None), safe_error_code(error))
                 _print(report, args.json)
                 print(format_error(error), file=sys.stderr)

{envloop_cli-1.13.0 → envloop_cli-1.16.0}/envloop/auth_login.py

@@ -7,18 +7,18 @@ import webbrowser
 from http.client import InvalidURL
 from urllib.error import HTTPError, URLError
 from urllib.parse import parse_qs, urlsplit
-from urllib.request import ProxyHandler, Request, build_opener
+from urllib.request import Request
 
 from .auth_workspace import _identity
 from .config import ConfigError, normalize_url
-from .http import NoRedirect
+from .http import build_client_opener, error_fields
 
 
 def _request(url, action, body, timeout):
     request = Request(url + '/v1/auth/cli/' + action, data=json.dumps(body).encode(),
                       headers={'Content-Type': 'application/json'}, method='POST')
     try:
-        with build_opener(ProxyHandler(), NoRedirect()).open(request, timeout=timeout) as response:
+        with build_client_opener().open(request, timeout=timeout) as response:
             raw = response.read(8193)
             if len(raw) > 8192:
                 raise ConfigError('AUTH_LOGIN_INVALID_RESPONSE')
@@ -27,6 +27,8 @@ def _request(url, action, body, timeout):
                 raise ConfigError('AUTH_LOGIN_INVALID_RESPONSE')
             return result
     except HTTPError as error:
+        if error.code == 403 and error_fields(error)['code'] == 'EDGE_REJECTED':
+            raise ConfigError('EDGE_REJECTED') from None
         code = {403: 'AUTHORIZATION_DENIED', 409: 'AUTH_LOGIN_UNAVAILABLE', 410: 'AUTH_LOGIN_EXPIRED',
                 429: 'AUTH_LOGIN_BUSY', 503: 'AUTH_LOGIN_UNAVAILABLE'}.get(error.code, 'AUTH_LOGIN_HTTP_ERROR')
         raise ConfigError(code) from None

{envloop_cli-1.13.0 → envloop_cli-1.16.0}/envloop/cli.py

@@ -6,16 +6,10 @@ import math
 import os
 import shlex
 import sys
-from importlib.metadata import PackageNotFoundError, version
 from pathlib import Path
 
 from .client import Client
-
-try:
-    CLI_VERSION = version("envloop-cli")
-except PackageNotFoundError:
-    CLI_VERSION = "unknown"
-
+from .http import CLI_VERSION
 
 SECTIONS = {
     'OVERVIEW': ('dashboard',),
@@ -210,6 +204,10 @@ def parser():
         if action == 'event':
             command.add_argument('--json', action='store_true')
             command.set_defaults(_list_view=True)
+    decision = jobs.add_parser("decision", help="Invoke the frozen decision plugin of an Inference Job")
+    decision.add_argument("job_id")
+    decision.add_argument("--model", required=True)
+    decision.add_argument("--spec", type=Path, required=True, metavar="PAYLOAD.json")
     from .resource_cli import add_job_resources
     add_job_resources(jobs)
     listing = jobs.add_parser("list")
@@ -434,6 +432,15 @@ def _main(argv=None):
 
             print(format_error(exc), file=sys.stderr)
             return 1
+    if args.group == "job" and args.action == "decision":
+        from .decision import DecisionClient
+        try:
+            if args.spec.stat().st_size > 1024 * 1024:
+                raise ValueError("Decision payload exceeds 1 MiB")
+            args.payload = json.loads(args.spec.read_text(encoding="utf-8"))
+            DecisionClient.validate(args.job_id, args.model, args.payload)
+        except (OSError, ValueError, UnicodeError):
+            cli.error("decision requires a readable JSON object of at most 1 MiB, without model")
     if args.group == "job" and args.action == "submit":
         from .train_runner_cli import SHORTCUT_FIELDS, runner_request
 
@@ -586,6 +593,8 @@ def _main(argv=None):
                     if args.wait:
                         wait_options = {"timeout": args.timeout_sec} if args.type == "train" and args.spec is not None and args.timeout_sec is not None else {}
                         result = client.jobs.wait(result["job_id"], **wait_options)
+                elif args.action == "decision":
+                    result = client.decision.evaluate(args.job_id, model=args.model, payload=args.payload)
                 elif args.action == 'event':
                     result = client.jobs.events(args.job_id)
                 elif args.action in {'serving-profile', 'adapter'}:

{envloop_cli-1.13.0 → envloop_cli-1.16.0}/envloop/cli_errors.py

@@ -29,6 +29,7 @@ _register("HTTP_ERROR", "The API request failed.")
 _register("NOT_FOUND RESOURCE_NOT_FOUND JOB_NOT_FOUND RUNNER_NOT_FOUND DATASET_REVISION_NOT_FOUND PROFILE_NOT_FOUND WORKSPACE_NOT_FOUND CHECKPOINT_NOT_FOUND AGENT_RUN_NOT_FOUND ARTIFACT_NOT_FOUND", "The requested API resource or route was not found.")
 _register("UNAUTHORIZED UNAUTHENTICATED INVALID_AUTH AUTHENTICATION_REQUIRED AUTHENTICATION_REJECTED API_KEY_REQUIRED", "API key authentication is required or was rejected.")
 _register("FORBIDDEN ACCESS_DENIED AUTHORIZATION_DENIED PERMISSION_DENIED WORKSPACE_ACCESS_DENIED PROJECT_ACCESS_DENIED", "The current credentials do not have permission for this operation.")
+_register("EDGE_REJECTED", "The network edge (Cloudflare) rejected the request before it reached the EnvLoop API; this is not a permission decision. Upgrade envloop-cli, check any proxy or custom User-Agent, or contact support with the HTTP status.")
 _register("HUMAN_SESSION_REQUIRED WORKSPACE_LIST_REQUIRES_SESSION PROJECT_LIST_REQUIRES_SESSION", "This operation requires a browser session authorized by the server.")
 _register("CONFLICT VERSION_CONFLICT RESOURCE_VERSION_CONFLICT PRECONDITION_FAILED IDEMPOTENCY_CONFLICT", "The request conflicts with the current resource version or an earlier request.")
 _register("BAD_REQUEST VALIDATION_ERROR VALIDATION_FAILED INVALID_REQUEST INVALID_ARGUMENT INVALID_CURSOR INVALID_PROFILE INVALID_PROFILE_SECRETS", "The request or input is invalid.")

{envloop_cli-1.13.0 → envloop_cli-1.16.0}/envloop/client.py

@@ -621,6 +621,7 @@ class Client:
     """A client for a caller-owned service, or use local() for an owned server."""
 
     def __init__(self, server: RpcService) -> None:
+        from .decision import DecisionClient
         from .navigation_resources import (
             Billing,
             Checkpoints,
@@ -632,6 +633,7 @@ class Client:
         from .resources import Adapters, Endpoints, Operations
 
         self._transport = server
+        self.decision = DecisionClient(server)
         self.tasks = Tasks(server)
         self.trials = self.tasks
         self.profiles = Profiles(server)

envloop_cli-1.16.0/envloop/decision.py

@@ -0,0 +1,19 @@
+"""Thin Job-bound decision transport. Business logic stays in approved plugins."""
+from urllib.parse import quote
+
+
+class DecisionClient:
+    def __init__(self, transport):
+        self.transport = transport
+
+    @staticmethod
+    def validate(job_id, model, payload):
+        if (not isinstance(job_id, str) or not job_id.strip()
+                or not isinstance(model, str) or not model.strip()
+                or not isinstance(payload, dict) or 'model' in payload):
+            raise ValueError('decision requires job_id, model and a payload object without model')
+
+    def evaluate(self, job_id, *, model, payload):
+        self.validate(job_id, model, payload)
+        return self.transport.request('POST', f'/v1/job/{quote(job_id, safe="")}/Inference/decision',
+                                      {'model': model, **payload})

{envloop_cli-1.13.0 → envloop_cli-1.16.0}/envloop/http.py

@@ -3,10 +3,12 @@
 import base64
 import json
 import math
+import platform
 import re
 from datetime import datetime, timezone
 from email.utils import parsedate_to_datetime
 from http.client import HTTPException, InvalidURL
+from importlib.metadata import PackageNotFoundError, version
 from urllib.error import HTTPError, URLError
 from urllib.parse import quote, urlencode, urljoin, urlsplit
 from urllib.request import HTTPRedirectHandler, ProxyHandler, Request, build_opener
@@ -66,6 +68,23 @@ class NoRedirect(HTTPRedirectHandler):
         return None
 
 
+try:
+    CLI_VERSION = version("envloop-cli")
+except PackageNotFoundError:
+    CLI_VERSION = "unknown"
+
+# Cloudflare bot rules answer urllib's default "Python-urllib/3.x" with error 1010 (staging workers.dev).
+USER_AGENT = (f"envloop-cli/{CLI_VERSION} (python/{platform.python_version()}; "
+              f"{'-'.join(filter(None, (platform.system().lower(), platform.machine().lower()))) or 'unknown'})")
+
+
+def build_client_opener():
+    """Proxy-aware opener that never follows redirects and names the client in every request."""
+    opener = build_opener(ProxyHandler(), NoRedirect())
+    opener.addheaders = [("User-Agent", USER_AGENT)]
+    return opener
+
+
 def _text(value, limit, secrets=()):
     """One printable line: no control characters, no submitted secret or URL query, bounded length."""
     if not isinstance(value, str):
@@ -101,10 +120,12 @@ def error_fields(error, secrets=()):
     Reads top-level `code/message/hint/request_id/fields/details` or the same
     keys nested in `error: {...}`; request_id falls back to X-Request-ID.
     """
+    raw, parsed = b"", True
     try:
-        data = json.loads(error.read(8192))
+        raw = error.read(8192)
+        data = json.loads(raw)
     except (ValueError, UnicodeError, OSError, HTTPException):
-        data = None
+        data, parsed = None, False
     finally:
         error.close()
     data = data if isinstance(data, dict) else {}
@@ -115,6 +136,13 @@ def error_fields(error, secrets=()):
         return nested[key] if key in nested else data.get(key)
 
     code = pick("code")
+    # The platform answers in JSON. A 403 whose body is non-JSON text (Cloudflare's "error code: 1010") or carries
+    # Cloudflare's numeric error_code was produced by the edge before the API saw the credential: not an RBAC
+    # decision. A JSON 403 without a code, even an empty one, stays a platform authorization answer.
+    edge_text = not parsed and bool(raw.strip())
+    edge_code = isinstance(data.get("error_code"), int) and not isinstance(data.get("error_code"), bool)
+    if error.code == 403 and not isinstance(code, str) and (edge_text or edge_code):
+        code = "EDGE_REJECTED"
     if (not isinstance(code, str) or not code or len(code) > 128 or not code.isascii()
             or not all("A" <= character <= "Z" or character.isdigit() or character == "_" for character in code)):
         code = "HTTP_ERROR"
@@ -169,7 +197,7 @@ class HttpService:
         self.base = connection.api_url
         self.secret = connection.api_key
         self.timeout = timeout
-        self.opener = build_opener(ProxyHandler(), NoRedirect())
+        self.opener = build_client_opener()
 
     def remote_error(self, error, body=None, **options):
         submitted = body.get("secrets") if isinstance(body, dict) else None
@@ -210,7 +238,7 @@ class HttpService:
                 or parts.username is not None or parts.password is not None or parts.fragment):
             raise RemoteError('UNSAFE_ARTIFACT_REDIRECT')
         try:
-            return Download(build_opener(ProxyHandler(), NoRedirect()).open(url, timeout=self.timeout))
+            return Download(build_client_opener().open(url, timeout=self.timeout))
         except HTTPError as error:
             error.close()
             raise RemoteError('ARTIFACT_DOWNLOAD_FAILED', error.code) from None
@@ -309,7 +337,7 @@ class HttpService:
             # A presigned object URL carries its own authority: use a separate opener
             # with no Authorization / workspace / project headers and no further hops.
             try:
-                return Download(build_opener(ProxyHandler(), NoRedirect()).open(target, timeout=self.timeout))
+                return Download(build_client_opener().open(target, timeout=self.timeout))
             except HTTPError as error:
                 error.close()
                 raise RemoteError("ARTIFACT_DOWNLOAD_FAILED", error.code) from None

{envloop_cli-1.13.0 → envloop_cli-1.16.0}/envloop/inference.py

@@ -2,7 +2,7 @@
 import re
 
 _FIELDS = {'name', 'runner', 'inputs', 'serving_profile', 'hardware', 'weights_format',
-           'scaling', 'temporary_scope_id'}
+           'scaling', 'temporary_scope_id', 'profile'}
 
 
 def validate_submission(body):

{envloop_cli-1.13.0 → envloop_cli-1.16.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "envloop-cli"
-version = "1.13.0"
+version = "1.16.0"
 description = "EnvLoop CLI and Python SDK for jobs, training, checkpoints and inference"
 requires-python = ">=3.11"
 readme = "README.pypi.md"

envloop_cli-1.13.0/envloop/__init__.py

@@ -1,5 +0,0 @@
-"""EnvLoop Python client."""
-
-from .client import Client
-
-__all__ = ["Client"]