envloop-cli 1.24.0__py3-none-any.whl → 1.28.0__py3-none-any.whl

envloop/_optional.py

@@ -1,4 +1,4 @@
-"""Lazy, static adapters for independently installed client features.
+"""Lazy, static adapters for features bundled in the single client distribution.
 
 No feature code is imported when the base client is imported or constructed.
 Legacy module names resolve to their single feature owner on explicit import.
@@ -16,15 +16,15 @@ from typing import Any, override
 FEATURES = {'data': 'envloop_data', 'experiment': 'envloop_experiment', 'rsi-loop': 'envloop_rsi_loop'}
 FEATURE_COMMANDS = {
     'data': {
-        'dataset': 'Discover datasets, revisions and tasks',
+        'dataset': 'Discover Datasets, revisions and tasks',
         'data': 'Manage versioned Data resources and verified file downloads',
         'runner': 'Discover available Runner revisions',
-        'checkpoint': 'List and download saved training checkpoints',
-        'profile': 'Manage platform runtime profiles',
+        'checkpoint': 'List and download saved training Checkpoints',
+        'profile': 'Manage platform runtime Profiles',
     },
     'experiment': {
         'job': 'Submit and manage Agent, Sandbox, Train and Inference Jobs',
-        'trail': 'Inspect and control existing trials',
+        'trial': 'Inspect and control existing Trials',
     },
 }
 
@@ -35,10 +35,10 @@ MODULES: dict[str, str] = {
 }
 CLIENTS = {
     **{name: ('data', 'client') for name in ('ProfileService', 'RunnerService', 'Profiles', 'Runners')},
-    **{name: ('experiment', 'client') for name in ('TaskService', 'RpcService', 'load_task', 'validate_command', 'dataset_selector', 'Tasks', 'runner_selector', 'job_budget', 'Jobs')},
+    **{name: ('experiment', 'client') for name in ('TrialService', 'RpcService', 'load_task', 'validate_command', 'dataset_selector', 'Trials', 'runner_selector', 'job_budget', 'Jobs')},
     **{name: ('base', 'downloads') for name in ('ArtifactError', 'artifact_path')},
 }
-DATA_ENDPOINTS = set('open_download resolve_dataset list_runners profile_path put_profile list_profiles get_profile resolve_profile set_default_profile archive_profile revoke_profile_secret export_profile import_profile open_checkpoint_archive'.split())
+DATA_ENDPOINTS = set('open_download resolve_dataset list_runners get_runner_revision register_runner_revision runner_path profile_path put_profile list_profiles get_profile resolve_profile set_default_profile archive_profile revoke_profile_secret export_profile import_profile open_checkpoint_archive'.split())
 EXPERIMENT_ENDPOINTS = set('submit_job get_job get_job_result get_job_logs list_jobs job_action job_events stop_job list_trials get_task_run get_trial_detail get_trial_training list_trial_metrics list_trial_checkpoints get_task_result get_task_snapshot stop_task list_trial_artifacts open_trial_artifact'.split())
 
 
@@ -48,7 +48,23 @@ class MissingFeatureError(ImportError):
 
     def __init__(self, feature: str):
         self.feature = feature
-        super().__init__(f'Install optional functionality with: pip install "envloop-cli[{feature}]"')
+        super().__init__(self.instruction(feature))
+
+    def instruction(self, feature: str) -> str:
+        return f'Install optional functionality with: pip install "envloop-cli[{feature}]"'
+
+
+class IncompleteInstallationError(MissingFeatureError):
+    """Feature code ships inside envloop-cli, so a missing module means removed files.
+
+    Uninstalling the separate envloop-cli-experiment package of 1.23.0/1.24.0 after an
+    upgrade deletes files it shared with the single distribution; an extra cannot restore them.
+    """
+
+    @override
+    def instruction(self, feature: str) -> str:
+        return ('Client files are missing. Reinstall with: '
+                'pip uninstall -y envloop-cli envloop-cli-experiment && pip install envloop-cli')
 
 
 class CommandExit(Exception):
@@ -60,9 +76,15 @@ def available(feature: str):
     return importlib.util.find_spec(FEATURES[feature]) is not None
 
 
+def require_data_dependencies():
+    """Only ANS operations need the public protocol/download dependency."""
+    if importlib.util.find_spec('envhub') is None:
+        raise MissingFeatureError('data')
+
+
 def feature_module(feature: str, module: str):
     if not available(feature):
-        raise MissingFeatureError(feature)
+        raise IncompleteInstallationError(feature)
     return importlib.import_module(f'{FEATURES[feature]}.{module}')
 
 
@@ -107,7 +129,7 @@ def client_resource(client: Any, name: str):
         return getattr(importlib.import_module(f'envloop.{module}'), cls)(server)
     if name == 'dashboard':
         if available('experiment'):
-            return feature_attribute('experiment', 'navigation_resources', 'Dashboard')(client.project, client.jobs, client.train)
+            return feature_attribute('experiment', 'navigation_resources', 'Dashboard')(client.project, client.jobs, client.training_jobs)
         from .navigation_resources import Dashboard
         return Dashboard(client.project)
     if name in {'profiles', 'runners'}:
@@ -121,17 +143,13 @@ def client_resource(client: Any, name: str):
     if name == 'jobs':
         return feature_attribute('experiment', 'client', 'Jobs')(server)
     if name == 'trials':
-        return client.tasks
-    if name == 'tasks':
-        return feature_attribute('experiment', 'client', 'Tasks')(server)
+        return feature_attribute('experiment', 'client', 'Trials')(server)
     if name == 'training_jobs':
-        return client.train
-    if name == 'train':
         return feature_attribute('experiment', 'train', 'TrainJobs')(server)
     if name == 'decision':
         return feature_attribute('experiment', 'decision', 'DecisionClient')(server)
     if name == 'agent_runs':
-        return feature_attribute('rsi-loop', 'agent_runs', 'AgentRuns')(client.train)
+        return feature_attribute('rsi-loop', 'agent_runs', 'AgentRuns')(client.training_jobs)
     if name in {'endpoints', 'adapters'}:
         return feature_attribute('experiment', 'resources', name.capitalize())(server)
     if name == 'inference':
@@ -140,7 +158,7 @@ def client_resource(client: Any, name: str):
 
 
 def execute_command(args: argparse.Namespace, client: Any, cli: Any):
-    if args.group in {'job', 'trail'}:
+    if args.group in {'job', 'trial'}:
         return getattr(feature_module('experiment', 'cli'), 'execute_' + args.group)(args, client, cli)
     if args.group == 'profile':
         return feature_module('data', 'cli').execute_profile(args, client, cli)

envloop/auth_cli.py

@@ -8,6 +8,8 @@ from typing import Any, cast
 from .config import ConfigError, ConfigStore, normalize_url, validate_key
 
 DEFAULT_BASE_URL = "https://api.envloop.ai"
+CONFIG_FIELDS = ["base-url", "api-key", "workspace-id", "project-id"]
+FIELD_HELP = "One of " + ", ".join(CONFIG_FIELDS)
 
 
 def add_auth_commands(groups: "argparse._SubParsersAction[argparse.ArgumentParser]") -> None:
@@ -16,36 +18,36 @@ def add_auth_commands(groups: "argparse._SubParsersAction[argparse.ArgumentParse
     login = commands.add_parser("login", help="Open the Clerk sign-in page and authorize CLI/SDK access")
     login.add_argument("--base-url", help="API Base URL; defaults to the effective connection or official API")
     login.add_argument("--no-browser", action="store_true", help="Print the login link without opening a browser")
-    login.add_argument("--timeout", type=int, choices=range(1, 601), metavar="SECONDS", default=300,
+    login.add_argument("--timeout-seconds", type=int, choices=range(1, 601), metavar="SECONDS", default=300,
                        help="Wait up to 1–600 seconds (default: 300)")
     configure = commands.add_parser("config", help="Save Base URL and API key for CLI and SDK")
     configure.add_argument("--no-check", action="store_true", help="Save without API verification (offline; key remains unverified)")
     actions = configure.add_subparsers(dest="config_action")
     init = actions.add_parser("init", help="Configure interactively with masked API key input")
     init.add_argument("--no-check", action="store_true", default=argparse.SUPPRESS, help="Save without API verification (offline)")
-    project = actions.add_parser("project", help="Select and verify a project with its own API key")
-    project.add_argument("project_id", nargs="?", help="Project ID; omit for an interactive list with names and IDs")
-    project.add_argument("--stdin", action="store_true", help="Read the selected project's API key from stdin")
+    project = actions.add_parser("project", help="Select and verify a Project with its own API key")
+    project.add_argument("project_id", metavar="PROJECT_ID", nargs="?", help="Project ID; omit for an interactive list with names and IDs")
+    project.add_argument("--stdin", action="store_true", help="Read the selected Project's API key from stdin")
     setting = actions.add_parser("set", help="Save one field (API key is masked or read from stdin)")
-    setting.add_argument("field", choices=["base-url", "api-key", "workspace-id", "project-id"])
-    setting.add_argument("value", nargs="?", help=f"Base URL (default: {DEFAULT_BASE_URL}) or workspace ID; API keys use masked input or --stdin")
+    setting.add_argument("field", metavar="FIELD", choices=CONFIG_FIELDS, help=FIELD_HELP)
+    setting.add_argument("value", metavar="VALUE", nargs="?", help=f"Base URL (default: {DEFAULT_BASE_URL}) or Workspace ID; API keys use masked input or --stdin")
     setting.add_argument("--stdin", action="store_true", help="Read a single API key from stdin")
     setting.add_argument("--no-check", action="store_true", default=argparse.SUPPRESS, help="Save API key without verification (offline)")
     getting = actions.add_parser("get", help="Read saved configuration; never export an API key")
-    getting.add_argument("field", choices=["base-url", "api-key", "workspace-id", "project-id"])
+    getting.add_argument("field", metavar="FIELD", choices=CONFIG_FIELDS, help=FIELD_HELP)
     actions.add_parser("path", help="Print configuration and credential file paths")
     show = actions.add_parser("show", help="Show saved and effective settings without revealing keys")
     show.add_argument("--json", action="store_true")
     remove = actions.add_parser("unset", help="Delete a saved field; does not revoke the server key")
-    remove.add_argument("field", choices=["base-url", "api-key", "workspace-id", "project-id"])
+    remove.add_argument("field", metavar="FIELD", choices=CONFIG_FIELDS, help=FIELD_HELP)
     status = commands.add_parser("status", help="Inspect local credentials; --check verifies read access")
     status.add_argument("--check", action="store_true", help="Make a read-only request to the effective Base URL")
     status.add_argument("--json", action="store_true")
     commands.add_parser("logout", help="Remove the saved key for the stored default Base URL (local only)")
-    workspace = commands.add_parser("workspace", help="Select and verify the active workspace")
-    workspace.add_argument("workspace_id", nargs="?", help="Workspace ID; omit for an interactive list")
-    workspace.add_argument("--project-id", help="Project within the workspace; its own API key is required")
-    workspace.add_argument("--stdin", action="store_true", help="Read the selected workspace's API key from stdin")
+    workspace = commands.add_parser("workspace", help="Select and verify the active Workspace")
+    workspace.add_argument("workspace_id", metavar="WORKSPACE_ID", nargs="?", help="Workspace ID; omit for an interactive list")
+    workspace.add_argument("--project-id", help="Project within the Workspace; its own API key is required")
+    workspace.add_argument("--stdin", action="store_true", help="Read the selected Workspace's API key from stdin")
 
 
 def _key_from_input(stdin: bool = False) -> str:

envloop/auth_login.py

@@ -70,13 +70,13 @@ def login(args: argparse.Namespace, store: Any) -> int:
 
     saved, credential = store.workspace_snapshot()
     url = normalize_url(args.base_url or resolve_cli_connection().api_url or DEFAULT_BASE_URL)
-    deadline = time.monotonic() + args.timeout
+    deadline = time.monotonic() + args.timeout_seconds
     key, poll_token = 'epk_' + secrets.token_hex(32), secrets.token_urlsafe(32)
     code = ''.join(secrets.choice('ABCDEFGHJKLMNPQRSTUVWXYZ23456789') for _ in range(8))
     def digest(value: str) -> str:
         return hashlib.sha256(value.encode()).hexdigest()
     response = _request(url, 'start', {'key_hash': digest(key), 'poll_hash': digest(poll_token),
-                                    'code_hash': digest(code)}, min(5, args.timeout))
+                                    'code_hash': digest(code)}, min(5, args.timeout_seconds))
     identifier, uri = _verification_url(url, response)
     interval, expires = response.get('interval'), response.get('expires_in')
     if (isinstance(interval, bool) or not isinstance(interval, (int, float)) or not 0 < interval <= 10 or

envloop/cli.py

@@ -14,7 +14,7 @@ from .http import CLI_VERSION
 
 SECTIONS = {
     'OVERVIEW': ('dashboard',),
-    'EXPERIMENT': ('job', 'trail'),
+    'EXPERIMENT': ('job', 'trial'),
     'DATA': ('dataset', 'data', 'runner', 'checkpoint', 'profile'),
     'MANAGE': ('billing', 'limit', 'member', 'setting'),
     'TOOLS': ('auth', 'help'),
@@ -43,6 +43,8 @@ class HelpArgumentParser(argparse.ArgumentParser):
 
     def __init__(self, *args: Any, **kwargs: Any):
         kwargs.setdefault('formatter_class', CommandHelpFormatter)
+        # Prefixes of an option would be unlisted aliases; only full option names are accepted.
+        kwargs.setdefault('allow_abbrev', False)
         super().__init__(*args, **kwargs)
         self.add_argument("--no-color", action="store_true", default=argparse.SUPPRESS,
                           help="Disable terminal highlighting")
@@ -140,7 +142,7 @@ def parser():
     cli = HelpArgumentParser(
         prog=Path(sys.argv[0]).name if Path(sys.argv[0]).name in {"envloop", "el"} else "el",
         usage="%(prog)s [options] [command]", formatter_class=CommandHelpFormatter,
-        description="Manage Agent, Sandbox, Train and Inference Jobs and worker trials with EnvLoop.\nConfigure your connection with 'auth config'.",
+        description="Manage Agent, Sandbox, Train and Inference Jobs and their Trials with EnvLoop.\nConfigure your connection with 'auth config'.",
     )
     cli._optionals.title = "Options"
     cli.set_defaults(api_url=None, workspace_id=None, no_color=False)
@@ -222,18 +224,18 @@ def _main(argv: list[str] | None = None):
         disable_color()
     if any(value == "--api-key" or value.startswith("--api-key=") for value in argv):
         cli.error("API keys must be entered with auth config or supplied through ENVLOOP_API_KEY")
-    from ._optional import MissingFeatureError, available
+    from ._optional import IncompleteInstallationError, available
     requested = next((value for value in argv if not value.startswith('-')), None)
-    feature = cast(dict[str | None, str], {'job': 'experiment', 'trail': 'experiment', 'data': 'data', 'dataset': 'data',
+    feature = cast(dict[str | None, str], {'job': 'experiment', 'trial': 'experiment', 'data': 'data', 'dataset': 'data',
                'runner': 'data', 'checkpoint': 'data', 'profile': 'data'}).get(requested)
     if feature is not None and not available(feature):
         from .cli_errors import format_error
-        print(format_error(MissingFeatureError(feature)), file=sys.stderr)
+        print(format_error(IncompleteInstallationError(feature)), file=sys.stderr)
         return 1
     job_action = next((value for value in argv[argv.index('job') + 1:] if not value.startswith('-')), None) if requested == 'job' else None
     if job_action == 'run' and not available('rsi-loop'):
         from .cli_errors import format_error
-        print(format_error(MissingFeatureError('rsi-loop')), file=sys.stderr)
+        print(format_error(IncompleteInstallationError('rsi-loop')), file=sys.stderr)
         return 1
     args = cli.parse_args(argv)
     if args.group == "help":
@@ -254,7 +256,7 @@ def _main(argv: list[str] | None = None):
 
             print(format_error(exc), file=sys.stderr)
             return 1
-    if args.group in {'job', 'trail'}:
+    if args.group in {'job', 'trial'}:
         from envloop_experiment.cli import validate
         status = validate(args, cli)
         if status is not None:
@@ -308,6 +310,11 @@ def _main(argv: list[str] | None = None):
             print(json.dumps(operation_output(exc.operation), ensure_ascii=False))
             print(format_error(exc), file=sys.stderr)
             return 1
+        from .http import WaitTimeoutError
+        if isinstance(exc, WaitTimeoutError) and isinstance(exc.last, dict):
+            # The work continues on the server; keep its ID so it can be queried or waited on again.
+            last = operation_output(exc.last) if 'operation_id' in exc.last else exc.last
+            print(json.dumps(last, ensure_ascii=False))
         # Do not emit arbitrary exception messages, file content or credentials.
         print(format_error(exc), file=sys.stderr)
         return 1

envloop/cli_errors.py

@@ -45,6 +45,13 @@ _register("EDGE_REJECTED", "The network edge (Cloudflare) rejected the request b
 _register("HUMAN_SESSION_REQUIRED WORKSPACE_LIST_REQUIRES_SESSION PROJECT_LIST_REQUIRES_SESSION", "This operation requires a browser session authorized by the server.")
 _register("CONFLICT VERSION_CONFLICT RESOURCE_VERSION_CONFLICT PRECONDITION_FAILED IDEMPOTENCY_CONFLICT", "The request conflicts with the current resource version or an earlier request.")
 _register("BAD_REQUEST VALIDATION_ERROR VALIDATION_FAILED INVALID_REQUEST INVALID_ARGUMENT INVALID_CURSOR INVALID_PROFILE INVALID_PROFILE_SECRETS", "The request or input is invalid.")
+_register("PROFILE_SECRET_NAME_INVALID", "A Secret parameter name must look like a credential, as the platform decides: it ends with API_KEY or _TOKEN, or contains PASSWORD, SECRET, CREDENTIAL, AUTHORIZATION, ACCESS_TOKEN, AUTH_TOKEN, BEARER_TOKEN or PRIVATE_KEY. Otherwise list the name in the Profile's secret_params. Names use letters, digits and underscores.")
+_register("PROFILE_SECRET_VALUE_INVALID", "A Secret parameter value is missing or unusable: it must be non-empty UTF-8 text of at most 64 KiB from a prompt, stdin, an environment variable or a file.")
+_register("PROFILE_SECRET_CONFLICT", "Give each Secret parameter once, by --secret only (not also in the Profile file or patch), and read at most one value from stdin.")
+_register("RUNNER_PACKAGE_INVALID", "The Runner package directory is invalid. It needs runner.toml whose [runner] name matches the Runner and has no version, the [execution] entrypoint main.py or main.sh, at most 100 regular files, no symlinks, and path parts of letters, digits, '_', '.' or '-' that do not start with '.'.")
+_register("RUNNER_REVISION_INVALID", "Use the full lowercase 40- or 64-character source commit as --revision and a NAMESPACE/NAME Runner name.")
+_register("RUNNER_SOURCE_REF_INVALID", "Use a branch or tag name such as main or v1 with --source-ref-kind branch, tag or commit; HEAD, latest, default, release, '..', spaces and ~^:?*[\\ are not allowed.")
+_register("RUNNER_REVISION_CONFLICT", "The platform catalog holds different package or index hashes for this Runner revision. Publish a new revision instead of changing an existing one.")
 _register("DATASET_REQUIRED", "Missing Dataset input (--dataset or --source) for this Agent Job.")
 _register("DATASET_CONFIG_REQUIRED", "An explicit Dataset configuration (--config) is required.")
 _register("RUNNER_REQUIRED", "Missing Runner input (--runner) for this Job.")
@@ -115,7 +122,7 @@ _register("INVALID_RSI_REQUEST INVALID_STEER INVALID_DIRECTIVE", "The RSI servic
 _register("RSI_CONFLICT RSI_RUN_NOT_ACTIVE", "The run id exists, the run is not in a state that allows this action, or no loop machine is free.")
 _register("RSI_CONTROL_UNCONFIGURED RSI_CONTROL_UNAVAILABLE RSI_CONTROL_TIMEOUT", "The RSI loop service is not available through this platform right now.")
 
-_register("UNSUPPORTED_ADAPTER_SOURCE", 'Register a training checkpoint with {"serving_profile": "NAME", "source": {"type": "train_checkpoint", "tinker_path": "envloop://..."}}. '
+_register("UNSUPPORTED_ADAPTER_SOURCE", 'Register a training checkpoint with {"serving_profile": "NAME", "source": {"type": "train_checkpoint", "uri": "envloop://..."}}. '
           "List serving profiles with `el job serving-profile list` and checkpoint paths with `el checkpoint list`.")
 _register("JOB_ACTION_UNSUPPORTED", "This Job type does not support the requested action.")
 _register("INFERENCE_ROUTE_RETIRED", "The global inference route has been retired.")
@@ -142,14 +149,14 @@ for _code, _resource in {
 _KNOWN_REMOTE_CODES = set("""
 ADAPTER_FILES_MISSING ADAPTER_FORMAT_UNSUPPORTED ADAPTER_RANK_EXCEEDS_PROFILE ADAPTER_TARGET_UNSUPPORTED
 DATASET_SELECTION_UNSUPPORTED INVALID_ADAPTERS INVALID_ADAPTER_ALIAS INVALID_AMOUNT INVALID_ATTEMPTS
-INVALID_BILLING_WINDOW INVALID_CHECKPOINT_PATH INVALID_CLEANUP_RESOURCES INVALID_COMMAND INVALID_DATASET_DELIVERY
+INVALID_BILLING_WINDOW INVALID_CHECKPOINT_PATH INVALID_CHECKPOINT_URI INVALID_CLEANUP_RESOURCES INVALID_COMMAND INVALID_DATASET_DELIVERY
 INVALID_DATASET_INPUT INVALID_DATASET_SELECTOR INVALID_ENDPOINT_NAME INVALID_ENFORCEMENT INVALID_ENTRY_ID
 INVALID_ENTRY_KIND INVALID_ENVHUB_REQUEST INVALID_GROUP_BY INVALID_JOB INVALID_JOB_ID INVALID_JOB_MEMBER
 INVALID_JOB_MODE INVALID_JOB_SIZE INVALID_JOB_STATUS INVALID_JOB_TYPE INVALID_LIMIT INVALID_LOG_CURSOR
 INVALID_LOG_PROCESS INVALID_LOG_QUERY INVALID_LOG_SOURCE INVALID_LOG_STREAM INVALID_PRIORITY
 INVALID_PROFILE_COMBINATION INVALID_PROJECT INVALID_QUOTE INVALID_REPOSITORY_COMMIT INVALID_REPOSITORY_ROOT
 INVALID_REQUEST_ID INVALID_RESOLVED_JOB INVALID_RUNNER INVALID_RUNNER_ENVIRONMENT INVALID_SANDBOX_RUNNER
-INVALID_SCALING INVALID_SCOPE_TTL INVALID_TAG INVALID_TINKER_PATH INVALID_TRAINING_LINEAGE INVALID_TRIALS
+INVALID_SCALING INVALID_SCOPE_TTL INVALID_TAG INVALID_TRAINING_LINEAGE INVALID_TRIALS
 INVALID_TRIAL_STATUS INVALID_WORKSPACE JOB_REQUIRED LEADERBOARD_PROVENANCE_REQUIRED LEADERBOARD_SCORE_REQUIRED
 PROFILE_IDENTITY_MISMATCH QUEUE_NOT_FOUND REPOSITORY_BINDING_REQUIRED RUNNER_GPU_UNAVAILABLE RUNNER_HASH_MISMATCH
 TOO_MANY_ADAPTERS UNSUPPORTED_ADAPTER_SOURCE UNSUPPORTED_CAPABILITY UNSUPPORTED_COMMAND UNSUPPORTED_HARDWARE

envloop/cli_output.py

@@ -49,7 +49,7 @@ def next_page(args: argparse.Namespace, cursor: object, program: str) -> str:
     if getattr(args, 'no_color', False):
         command.append('--no-color')
     from ._optional import feature_module
-    feature = 'data' if args.group in {'data', 'dataset', 'runner', 'checkpoint', 'profile'} else 'experiment' if args.group in {'job', 'trail'} else None
+    feature = 'data' if args.group in {'data', 'dataset', 'runner', 'checkpoint', 'profile'} else 'experiment' if args.group in {'job', 'trial'} else None
     if feature is not None:
         feature_module(feature, 'cli_output').pagination(command, args, cursor)
     else:
@@ -62,7 +62,7 @@ def next_page(args: argparse.Namespace, cursor: object, program: str) -> str:
 # Empty-list text names the listed resource, not the command group (`job adapter list` lists adapters).
 EMPTY_RESOURCES = {
     ('job', 'adapter'): 'adapters', ('job', 'serving-profile'): 'serving profiles',
-    ('trail',): 'trails', ('trail', 'artifact'): 'artifacts',
+    ('trial',): 'trials', ('trial', 'artifact'): 'artifacts',
     ('dataset',): 'datasets', ('dataset', 'revision'): 'dataset revisions', ('dataset', 'task'): 'dataset tasks',
     ('data',): 'resources', ('data', 'files'): 'files',
     ('billing', 'usage'): 'usage records', ('billing', 'ledger'): 'ledger entries', ('billing', 'price'): 'prices',
@@ -95,7 +95,7 @@ def list_output(result: Any, args: argparse.Namespace, program: str) -> str:
         items = [{'name': key, 'value': value} for key, value in items.items()]
     from ._optional import feature_module
     feature = ('rsi-loop' if args.group == 'job' and args.action == 'run' else
-               'experiment' if args.group in {'job', 'trail'} else
+               'experiment' if args.group in {'job', 'trial'} else
                'data' if args.group in {'data', 'dataset', 'runner', 'checkpoint', 'profile'} else None)
     if feature is not None:
         headers, render, empty = feature_module(feature, 'cli_output').list_layout(items, args)

envloop/http.py

@@ -27,6 +27,14 @@ def validate_public_execution(value: Any) -> None:
         validate_public_execution(value.get(key))
 
 
+class WaitTimeoutError(TimeoutError):
+    """A wait ended before the terminal state; ``last`` is the last resource or Operation read."""
+
+    def __init__(self, message: str, last: dict[str, Any] | None = None):
+        super().__init__(message)
+        self.last = last
+
+
 class RemoteError(RuntimeError):
     """Platform failure. Server-supplied text lives in bounded attributes, never in str()."""
 
@@ -239,9 +247,9 @@ class HttpService:
         self.opener = build_client_opener()
 
     def remote_error(self, error: HTTPError, body: Any = None, **options: Any) -> RemoteError:
-        submitted = body.get("secrets") if isinstance(body, dict) else None
-        submitted = [value for value in submitted.values() if isinstance(value, str)] if isinstance(submitted, dict) else []
-        fields = error_fields(error, (self.secret, *submitted))
+        from .profile_secrets import submitted_secrets
+
+        fields = error_fields(error, (self.secret, *submitted_secrets(body)))
         return RemoteError(fields.pop("code"), error.code, **fields, **options)
 
     def request(self, method: str, path: str, body: Any = None, *, headers: dict[str, str] | None = None) -> Any:

envloop/lifecycle_cli.py

@@ -6,18 +6,18 @@ from typing import Any
 
 
 def wait_options(parser: argparse.ArgumentParser):
-    parser.add_argument('--wait', action='store_true', help='Wait for the persisted cleanup operation')
-    parser.add_argument('--timeout-sec', type=float, default=600)
+    parser.add_argument('--wait', action='store_true', help='Wait for the persisted cleanup Operation')
+    parser.add_argument('--timeout-seconds', type=float, default=600)
 
 
 def add_management_commands(settings: "argparse._SubParsersAction[argparse.ArgumentParser]"):
     operations = settings.add_parser('operation', help='Inspect or retry persisted cleanup').add_subparsers(dest='operation_action', required=True)
     for action in ('get', 'retry', 'wait'):
         command = operations.add_parser(action)
-        command.add_argument('identifier')
+        command.add_argument('identifier', metavar='OPERATION_ID')
         if action == 'wait':
-            command.add_argument('--timeout-sec', type=float, default=600)
-    cleanup = settings.add_parser('cleanup', help='Clean an explicit set of project resource IDs')
+            command.add_argument('--timeout-seconds', type=float, default=600)
+    cleanup = settings.add_parser('cleanup', help='Clean an explicit set of Project resource IDs')
     cleanup.add_argument('--file', type=Path, required=True, help='JSON array of resource kind and ID objects')
     cleanup.add_argument('--request-id', required=True)
     wait_options(cleanup)
@@ -27,7 +27,7 @@ def add_management_commands(settings: "argparse._SubParsersAction[argparse.Argum
     create.add_argument('--request-id', required=True)
     for action in ('get', 'cleanup', 'retain'):
         command = scopes.add_parser(action)
-        command.add_argument('identifier')
+        command.add_argument('identifier', metavar='RESOURCE_SCOPE_ID')
         if action == 'cleanup':
             wait_options(command)
         if action == 'retain':
@@ -38,7 +38,7 @@ def run_management(client: Any, args: argparse.Namespace):
     from .resources import _id
 
     if args.action == 'operation':
-        return (client.operations.wait(args.identifier, timeout=args.timeout_sec) if args.operation_action == 'wait'
+        return (client.operations.wait(args.identifier, timeout=args.timeout_seconds) if args.operation_action == 'wait'
                 else getattr(client.operations, args.operation_action)(args.identifier))
     if args.action == 'resource-scope':
         if args.scope_action == 'create':
@@ -52,4 +52,4 @@ def run_management(client: Any, args: argparse.Namespace):
                       if args.scope_action == 'retain' else client._transport.request('DELETE' if args.scope_action == 'cleanup' else 'GET', path))
     else:
         result = client.operations.cleanup(json.loads(args.file.read_text()), request_id=args.request_id)
-    return client.operations.wait(result['operation_id'], timeout=args.timeout_sec) if getattr(args, 'wait', False) else result
+    return client.operations.wait(result['operation_id'], timeout=args.timeout_seconds) if getattr(args, 'wait', False) else result

envloop/navigation_resources.py

@@ -126,6 +126,30 @@ class Project:
             raise ValueError('enabled must be a boolean')
         return self._settings_write('/compose', {'enabled': enabled}, expected_version)
 
+    def model_access(self):
+        """Model access grants of this project and whether the platform can deliver them now."""
+        return self.execution_settings()['model_access']
+
+    def grant_model_access(self, runner: str, protocols: list[str], *, revision: str | None = None,
+                           expected_version: int | str | None = None):
+        """Let one published Runner (optionally one full commit Revision) receive the project's metered model
+        key for ``protocols`` (``anthropic``, ``openai``). Returns the settings view with the new ``grant``."""
+        validate_model_access_grant(runner, protocols, revision)
+        return self._settings_send('POST', '/model-access', {'runner': runner, 'revision': revision,
+                                                              'protocols': list(protocols)}, expected_version)
+
+    def revoke_model_access(self, grant_id: str, *, expected_version: int | str | None = None):
+        """Revoke a grant; Trials that have not started no longer receive the key."""
+        if not isinstance(grant_id, str) or not grant_id:
+            raise ValueError('grant_id is required')
+        return self._settings_send('DELETE', '/model-access/' + quote(grant_id, safe=''), None, expected_version)
+
+    def _settings_send(self, method: str, suffix: str, body: dict[str, Any] | None, expected_version: int | str | None):
+        path = self.path() + '/execution-settings'
+        if expected_version is None:
+            expected_version = self.transport.request('GET', path)['version']
+        return self.transport.request(method, path + suffix, body, headers={'If-Match': f'"{expected_version}"'})
+
     def set_max_concurrent_trials(self, value: int | None, *, expected_version: int | str | None = None):
         """Lower the project's concurrent Trial limit (None clears it); the operator ceiling still applies."""
         if value is not None and (type(value) is not int or not 1 <= value <= 10000):
@@ -133,6 +157,23 @@ class Project:
         return self._settings_write('/concurrency', {'max_concurrent_trials': value}, expected_version)
 
 
+MODEL_ACCESS_PROTOCOLS = ('anthropic', 'openai')
+# Copied from EnvPlatform env_platform/project_settings.py RUNNER / REVISION (keep in sync).
+_RUNNER_NAME = re.compile(r'[A-Za-z0-9][A-Za-z0-9._-]{0,127}/[A-Za-z0-9][A-Za-z0-9._-]{0,127}')
+_REVISION = re.compile(r'[0-9a-f]{40}|[0-9a-f]{64}')
+
+
+def validate_model_access_grant(runner: str, protocols: Any, revision: str | None) -> None:
+    """The same shape the platform accepts (EnvPlatform project_settings): checked before any request."""
+    if not isinstance(runner, str) or not _RUNNER_NAME.fullmatch(runner):
+        raise ValueError('runner must be namespace/name')
+    if (not isinstance(protocols, (list, tuple)) or not protocols or len(set(protocols)) != len(protocols)
+            or any(protocol not in MODEL_ACCESS_PROTOCOLS for protocol in protocols)):
+        raise ValueError('protocols must be anthropic, openai or both')
+    if revision is not None and (not isinstance(revision, str) or not _REVISION.fullmatch(revision)):
+        raise ValueError('revision must be a full 40- or 64-character lowercase commit')
+
+
 class Dashboard:
     def __init__(self, project: Any):
         self.project = project

envloop/profile_secrets.py

@@ -1,13 +1,29 @@
-"""Client validation for write-only Profile model credentials."""
-from collections.abc import Mapping
+"""Client validation for write-only Profile secrets.
+
+Two kinds exist: the encrypted model connection key (`secrets.model_api_key`) and
+Secret parameters, which the platform stores with the version but redacts on every
+read and restores at dispatch.
+"""
+import copy
+import re
+from collections.abc import Callable, Iterable, Mapping
 from typing import Any
 
+PROFILE_V2 = "envplatform.profile/v2"
+# Names that always hold credentials. Mirrors EnvPlatform SENSITIVE_PROFILE_KEY in
+# env_platform/profile_secrets.py and frontend/shared/profile-secrets.ts; keep all three identical.
+SENSITIVE_PROFILE_KEY = re.compile(
+    r'api[_-]?key$|authorization|auth[_-]?token|access[_-]?token|bearer[_-]?token|password|secret|credential|'
+    r'private[_-]?key|(?:^|_)token$', re.I)
+PARAMETER_NAME = re.compile(r"[A-Za-z_][A-Za-z0-9_]*")
+
 
 class InvalidProfileSecrets(ValueError):
     code = "INVALID_PROFILE_SECRETS"
 
-    def __init__(self):
-        super().__init__(self.code)
+    def __init__(self, code: str = "INVALID_PROFILE_SECRETS"):
+        self.code = code
+        super().__init__(code)
 
 
 def profile_payload(spec: Mapping[str, Any], secrets: Mapping[str, Any] | None = None) -> dict[str, Any]:
@@ -26,3 +42,92 @@ def profile_payload(spec: Mapping[str, Any], secrets: Mapping[str, Any] | None =
             raise InvalidProfileSecrets()
         result["secrets"] = dict(secrets)
     return result
+
+
+def _params(spec: Mapping[str, Any]) -> Any:
+    return spec.get("spec", {}).get("params") if spec.get("schema_version") == PROFILE_V2 else spec.get("params")
+
+
+def _literal(key: str) -> str:
+    return key
+
+
+def _fold(spec: Mapping[str, Any]) -> Callable[[str], str]:
+    # Profile v2 parameter names are case insensitive; v1 keys are literal.
+    return str.upper if spec.get("schema_version") == PROFILE_V2 else _literal
+
+
+def is_secret_param(spec: Mapping[str, Any], key: str) -> bool:
+    """The server's rule for params: a credential-shaped name or a name listed in secret_params."""
+    return bool(SENSITIVE_PROFILE_KEY.search(key)) or key in (spec.get("secret_params") or ())
+
+
+def check_secret_values(values: Any) -> dict[str, str]:
+    if not isinstance(values, Mapping) or not values:
+        raise InvalidProfileSecrets("PROFILE_SECRET_VALUE_INVALID")
+    for name, value in values.items():
+        if not isinstance(name, str) or not PARAMETER_NAME.fullmatch(name):
+            raise InvalidProfileSecrets("PROFILE_SECRET_NAME_INVALID")
+        if not isinstance(value, str) or not value or "\x00" in value or len(value.encode("utf-8")) > 65536:
+            raise InvalidProfileSecrets("PROFILE_SECRET_VALUE_INVALID")
+    return dict(values)
+
+
+def reject_supplied(spec: Mapping[str, Any], names: Iterable[str]):
+    """A Secret parameter is given once: by --secret / secret_values, not also by the file or patch."""
+    params = _params(spec)
+    fold = _fold(spec)
+    present = {fold(key) for key in params} if isinstance(params, Mapping) else set()
+    if any(fold(name) in present for name in names):
+        raise InvalidProfileSecrets("PROFILE_SECRET_CONFLICT")
+
+
+def with_secret_values(spec: Mapping[str, Any], values: Mapping[str, str]) -> dict[str, Any]:
+    """Return a copy with each value set as a marked Secret parameter; existing values of that name are replaced.
+
+    A name qualifies under the server's rule (`is_secret_param`): credential-shaped,
+    or already listed in secret_params. Qualifying names are added to secret_params,
+    which the public API requires for credential-named parameters.
+    """
+    values = check_secret_values(values)
+    result = copy.deepcopy(dict(spec))
+    fold = _fold(result)
+    if len({fold(name) for name in values}) != len(values):
+        raise InvalidProfileSecrets("PROFILE_SECRET_CONFLICT")
+    if result.get("schema_version") == PROFILE_V2:
+        body = result.setdefault("spec", {})
+        params = body.setdefault("params", {}) if isinstance(body, dict) else None
+    else:
+        params = result.setdefault("params", {})
+    if not isinstance(params, dict):
+        raise InvalidProfileSecrets()
+    markers = result.get("secret_params", [])
+    if not isinstance(markers, list):
+        raise InvalidProfileSecrets()
+    for name, value in values.items():
+        # Keep the spelling the Profile marks as Secret, as the server merge does.
+        key = next((marker for marker in markers if isinstance(marker, str) and fold(marker) == fold(name)), name)
+        if not is_secret_param(result, key):
+            raise InvalidProfileSecrets("PROFILE_SECRET_NAME_INVALID")
+        for existing in [item for item in params if fold(item) == fold(name)]:
+            del params[existing]
+        params[key] = value
+        # Mark it too: the public API rejects an unmarked credential-named parameter.
+        if key not in markers:
+            markers.append(key)
+    result["secret_params"] = markers
+    return result
+
+
+def submitted_secrets(body: Any) -> list[str]:
+    """Secret strings in a Profile request body, so error text echoing them can be redacted."""
+    if not isinstance(body, dict):
+        return []
+    values = [value for value in (body.get("secrets") or {}).values()] if isinstance(body.get("secrets"), dict) else []
+    sections = ([body["spec"].get(name) for name in ("params", "env")] if isinstance(body.get("spec"), dict)
+                and body.get("schema_version") == PROFILE_V2 else [body.get("params")])
+    for index, section in enumerate(sections):
+        if isinstance(section, dict):
+            values += [value for key, value in section.items()
+                       if isinstance(key, str) and (is_secret_param(body, key) if index == 0 else SENSITIVE_PROFILE_KEY.search(key))]
+    return [value for value in values if isinstance(value, str) and value]