envloop-cli 1.29.0__tar.gz → 1.30.0__tar.gz

{envloop_cli-1.29.0 → envloop_cli-1.30.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: envloop-cli
-Version: 1.29.0
+Version: 1.30.0
 Summary: EnvLoop CLI and Python SDK for jobs, training, checkpoints and inference
 Project-URL: Homepage, https://envloop.ai
 Project-URL: Documentation, https://docs.envloop.ai
@@ -249,7 +249,7 @@ The platform starts the published Revision’s `main.sh` / `main.py` using the R
 CLI output uses compact timestamps and highlights statuses and log levels by default on terminals.
 Use `el --no-color job list` or append `--no-color` to a command to disable highlighting, including errors.
 `NO_COLOR=1`, `TERM=dumb`, pipes, and redirected output also disable colors. JSON preserves original values.
-List times use the local timezone; Job logs retain the recorded timezone, with full precision and offsets available through `--json`.
+List and table times are UTC with a `UTC` label; Job logs retain the recorded timezone and mark lines collected only after the Job ended with `(backfilled)`. Full precision, offsets and the `backfilled` field are available through `--json`.
 `el job run live RUN --follow --json` emits complete response frames as NDJSON; Ctrl-C stops reading without stopping the Run.
 
 ## Job-bound decision plugins
@@ -283,7 +283,7 @@ download a complete registered ANS object directory through EnvHub. Datasets req
 authorization the SDK uses GET URLs valid for up to five minutes, verifies file size/SHA-256,
 and installs the directory atomically. Matching platform support is required.
 
-A compatible server and an explicitly granted project Key with `envloop:data:read` are required; writes additionally need `envloop:data:write`. Default and older Keys do not gain these permissions. The current login selects the base URL, workspace and project; there is no `--env` flag. After configuring the Key using `el auth config`:
+A compatible server is required. Data uses the permission of the resource it touches: read (for example `datasets.read`) to query and download, write to publish and upload, delete to retire; a key from `el auth login` follows your project role. The current login selects the base URL, workspace and project; there is no `--env` flag. After configuring the Key using `el auth config`:
 
 ```bash
 el data list --type dataset --json

{envloop_cli-1.29.0 → envloop_cli-1.30.0}/README.pypi.md

@@ -232,7 +232,7 @@ The platform starts the published Revision’s `main.sh` / `main.py` using the R
 CLI output uses compact timestamps and highlights statuses and log levels by default on terminals.
 Use `el --no-color job list` or append `--no-color` to a command to disable highlighting, including errors.
 `NO_COLOR=1`, `TERM=dumb`, pipes, and redirected output also disable colors. JSON preserves original values.
-List times use the local timezone; Job logs retain the recorded timezone, with full precision and offsets available through `--json`.
+List and table times are UTC with a `UTC` label; Job logs retain the recorded timezone and mark lines collected only after the Job ended with `(backfilled)`. Full precision, offsets and the `backfilled` field are available through `--json`.
 `el job run live RUN --follow --json` emits complete response frames as NDJSON; Ctrl-C stops reading without stopping the Run.
 
 ## Job-bound decision plugins
@@ -266,7 +266,7 @@ download a complete registered ANS object directory through EnvHub. Datasets req
 authorization the SDK uses GET URLs valid for up to five minutes, verifies file size/SHA-256,
 and installs the directory atomically. Matching platform support is required.
 
-A compatible server and an explicitly granted project Key with `envloop:data:read` are required; writes additionally need `envloop:data:write`. Default and older Keys do not gain these permissions. The current login selects the base URL, workspace and project; there is no `--env` flag. After configuring the Key using `el auth config`:
+A compatible server is required. Data uses the permission of the resource it touches: read (for example `datasets.read`) to query and download, write to publish and upload, delete to retire; a key from `el auth login` follows your project role. The current login selects the base URL, workspace and project; there is no `--env` flag. After configuring the Key using `el auth config`:
 
 ```bash
 el data list --type dataset --json

{envloop_cli-1.29.0 → envloop_cli-1.30.0}/envloop/auth_cli.py

@@ -20,6 +20,9 @@ def add_auth_commands(groups: "argparse._SubParsersAction[argparse.ArgumentParse
     login.add_argument("--no-browser", action="store_true", help="Print the login link without opening a browser")
     login.add_argument("--timeout-seconds", type=int, choices=range(1, 601), metavar="SECONDS", default=300,
                        help="Wait up to 1–600 seconds (default: 300)")
+    login.add_argument("--read-only", action="store_true",
+                       help="Issue a read-only key, for example for CI that only reads results. "
+                            "Without it the key follows your project role")
     configure = commands.add_parser("config", help="Save Base URL and API key for CLI and SDK")
     configure.add_argument("--no-check", action="store_true", help="Save without API verification (offline; key remains unverified)")
     actions = configure.add_subparsers(dest="config_action")

{envloop_cli-1.29.0 → envloop_cli-1.30.0}/envloop/auth_login.py

@@ -76,7 +76,8 @@ def login(args: argparse.Namespace, store: Any) -> int:
     def digest(value: str) -> str:
         return hashlib.sha256(value.encode()).hexdigest()
     response = _request(url, 'start', {'key_hash': digest(key), 'poll_hash': digest(poll_token),
-                                    'code_hash': digest(code)}, min(5, args.timeout_seconds))
+                                    'code_hash': digest(code), **({'read_only': True} if args.read_only else {})},
+                        min(5, args.timeout_seconds))
     identifier, uri = _verification_url(url, response)
     interval, expires = response.get('interval'), response.get('expires_in')
     if (isinstance(interval, bool) or not isinstance(interval, (int, float)) or not 0 < interval <= 10 or
@@ -88,6 +89,8 @@ def login(args: argparse.Namespace, store: Any) -> int:
     try:
         print(f'Base URL: {url}\nConfirmation code: {code}\nOpen: {uri}', flush=True)
         print('Sign in with Clerk, enter this code, and authorize your workspace/project.', flush=True)
+        print('The key will be read only.' if args.read_only else
+              'The key follows your project role. The page lists its permissions before you authorize.', flush=True)
         if not args.no_browser:
             try:
                 opened = webbrowser.open(uri, new=1)

{envloop_cli-1.29.0 → envloop_cli-1.30.0}/envloop/cli_errors.py

@@ -27,10 +27,10 @@ def _register(codes: str, message: str) -> None:
         _MESSAGES[code] = message
 
 
-_register("DATA_SCOPE_REQUIRED", "Configure a project key with explicit Data read permission, plus Data write for publication and upload management.")
+_register("DATA_ACCESS_REQUIRED", "This key lacks the permission named above on the Dataset, Runner, Profile, Checkpoint or Trial artifact. Run el auth login to issue a new key that follows your project role: every role can read, and Developer or Admin can also write and delete (create, update, delete, upload, runner register). A key from el auth login --read-only cannot write; log in again without --read-only. Or give a key Read or Edit on that page in the Console under CONFIGURE > API Keys. Existing keys never gain permissions.")
 _register("DATA_NATIVE_INCOMPLETE DATA_NATIVE_UNAVAILABLE", "Native catalog registration is incomplete. Retry the same input after the platform is ready.")
 _register("DATA_DEPENDENCIES_ACTIVE DATA_DEPENDENCIES_UNKNOWN DATA_DEPENDENCIES_CHANGED DATA_DELETE_CONFLICT", "Retirement requires a complete, current dependency check. Resolve active or unknown dependencies, then retry the same resource.")
-_register("DATA_PUBLICATION_INVALID", "Check the immutable ANS URI, native manifest and exact file sizes and SHA-256 values.")
+_register("DATA_PUBLICATION_INVALID", "Check the immutable ANS URI, native manifest and exact file sizes and SHA-256 values. A record Dataset source is https://github.com/OWNER/REPO or https://huggingface.co/datasets/ORG/NAME with the full commit, not a branch or tag.")
 _register("DATA_PIN_CONFLICT DATA_REVISION_REQUIRED", "Publish a new immutable revision; existing and revoked references cannot be overwritten.")
 _register("DATA_QUOTA_EXCEEDED DATA_QUOTA_UNCONFIGURED", "Ask a project administrator to configure publication storage quota. Revoking publications does not free retained content.")
 _register("DATA_UPLOAD_CONFLICT DATA_UPLOAD_INCOMPLETE DATA_UPLOAD_RATE_LIMITED", "Inspect the upload with data upload get; resume matching parts or explicitly abort it.")
@@ -329,7 +329,11 @@ def upload_recovery(error: BaseException) -> str:
     if isinstance(upload_id, str) and re.fullmatch(r'upload_[a-f0-9]{32}', upload_id):
         lines.extend([f'  Upload retained: {upload_id}', f'  Inspect with: el data upload get {upload_id}'])
     generated = getattr(error, 'generated_idempotency_key', None)
-    if isinstance(generated, str) and re.fullmatch(r'[a-f0-9]{32}', generated):
+    # A definite refusal (permission, validation, not found) fails the same way again; offer the key only
+    # when the outcome is unknown or retryable.
+    status = getattr(error, 'status_code', None)
+    retryable = not isinstance(status, int) or status >= 500 or status in {408, 429}
+    if retryable and isinstance(generated, str) and re.fullmatch(r'[a-f0-9]{32}', generated):
         lines.append(f'  Retry the same input with --idempotency-key {generated}')
     return '\n'.join(lines)
 

{envloop_cli-1.29.0 → envloop_cli-1.30.0}/envloop/lifecycle_cli.py

@@ -18,7 +18,9 @@ def add_management_commands(settings: "argparse._SubParsersAction[argparse.Argum
         if action == 'wait':
             command.add_argument('--timeout-seconds', type=float, default=600)
     cleanup = settings.add_parser('cleanup', help='Clean an explicit set of Project resource IDs')
-    cleanup.add_argument('--file', type=Path, required=True, help='JSON array of resource kind and ID objects')
+    cleanup.add_argument('--file', type=Path, required=True,
+                         help='JSON array of {"kind": KIND, "id": ID} objects; KIND is job (a Train Job), endpoint, adapter '
+                              'or checkpoint, for example [{"kind": "job", "id": "job_..."}]')
     cleanup.add_argument('--request-id', required=True)
     wait_options(cleanup)
     scopes = settings.add_parser('resource-scope', help='Manage temporary resources with server TTL').add_subparsers(dest='scope_action', required=True)

{envloop_cli-1.29.0 → envloop_cli-1.30.0}/packages/data/envloop_data/data_cli.py

@@ -83,15 +83,19 @@ def add_commands(groups: "argparse._SubParsersAction[argparse.ArgumentParser]",
     command.add_argument('--json', action='store_true')
 
 
+MANIFEST_HELP = ('Native JSON content manifest; a record Dataset source.repository is https://github.com/OWNER/REPO '
+                 'or https://huggingface.co/datasets/ORG/NAME, with source.commit the full commit')
+
+
 def publication_arguments(command: argparse.ArgumentParser, *, source: bool = False):
     command.add_argument('--ref', required=not source, help='Exact immutable ANS URI')
     if source:
         inputs = command.add_mutually_exclusive_group(required=True)
-        inputs.add_argument('--manifest', type=Path, help='Native JSON content manifest')
+        inputs.add_argument('--manifest', type=Path, help=MANIFEST_HELP)
         inputs.add_argument('--model', help='Public Hugging Face model namespace/name; metadata only')
         command.add_argument('--revision', help='Explicit HF source ref; the server freezes its full commit')
     else:
-        command.add_argument('--manifest', type=Path, required=True, help='Native JSON content manifest')
+        command.add_argument('--manifest', type=Path, required=True, help=MANIFEST_HELP)
     command.add_argument('--directory', type=Path, required=not source, help='Directory containing exactly the declared files')
     command.add_argument('--executable', action='append', dest='executables', default=[],
                          help='Declared Runner file that must be executable; repeat for each path')

{envloop_cli-1.29.0 → envloop_cli-1.30.0}/packages/data/envloop_data/resource_cli.py

@@ -33,8 +33,8 @@ def add_resource_commands(groups: "argparse._SubParsersAction[argparse.ArgumentP
         'immutable Runner revision NAME@REVISION. The platform stores the bytes, computes the package and index '
         'SHA-256, creates the Runner on first use and registers the revision; identical retries are idempotent and '
         'changed content for an existing revision is refused. This is el data create --type runner with the native '
-        'manifest built for you; use that command to publish an existing manifest. The key needs envloop:data:write '
-        'and runners.write, and publish permission on a Runner owned by another Project.')
+        'manifest built for you; use that command to publish an existing manifest. The key needs runners.write '
+        '(el auth login issues it to a Developer or Admin), and publish permission on a Runner owned by another Project.')
     register.add_argument('directory', metavar='DIRECTORY', type=Path, help='Runner package directory; every file in it is published')
     register.add_argument('--revision', required=True, help='Full 40- or 64-character source commit, for example $(git rev-parse HEAD)')
     register.add_argument('--name', help='NAMESPACE/NAME; must equal [runner] name in runner.toml (default: that name)')
@@ -88,9 +88,10 @@ def execute(args: argparse.Namespace, client: Any):
                                        cursor=args.cursor, limit=args.limit)
 
 
-RUNNER_WRITE_HINT = ('Registering a Runner revision needs a project key with Data write (envloop:data:write) and '
-                     'Runners write (runners.write), and publish or admin permission when another project owns the '
-                     'Runner. Existing keys keep their original capabilities; issue a new key with these permissions.')
+RUNNER_WRITE_HINT = ('Registering a Runner revision needs a project key with Runners write (runners.write), and '
+                     'publish or admin permission when another project owns the Runner. Existing keys keep their '
+                     'original capabilities; run el auth login without --read-only (Developer or Admin role) to issue '
+                     'a new key with it.')
 
 
 def register_runner(client: Any, args: argparse.Namespace):
@@ -102,7 +103,7 @@ def register_runner(client: Any, args: argparse.Namespace):
                                          executables=args.executables, source_ref=args.source_ref,
                                          source_ref_kind=args.source_ref_kind, dry_run=args.dry_run)
     except RemoteError as error:
-        if error.code == 'ACCESS_DENIED' and not error.hint:
+        if error.code in {'ACCESS_DENIED', 'DATA_ACCESS_REQUIRED'} and not error.hint:
             error.hint = RUNNER_WRITE_HINT
         raise
     if not args.dry_run:

{envloop_cli-1.29.0 → envloop_cli-1.30.0}/packages/experiment/envloop_experiment/cli.py

@@ -5,6 +5,9 @@ import sys
 from pathlib import Path
 from typing import Any
 
+# Single-resource reads and actions print the response as JSON already; scripts may still pass --json.
+JSON_DEFAULT_HELP = "Output the complete response as JSON (the default; accepted for consistency with list commands)"
+
 
 def dataset_reference(value: str):
     name, separator, version = value.rpartition("@")
@@ -155,6 +158,8 @@ def add_commands(groups: "argparse._SubParsersAction[argparse.ArgumentParser]"):
         if action == 'event':
             command.add_argument('--json', action='store_true')
             command.set_defaults(_list_view=True)
+        else:
+            command.add_argument("--json", action="store_true", help=JSON_DEFAULT_HELP)
     regrade = jobs.add_parser("regrade", help="Re-run only the verifier of sealed compose Trials, optionally with a reward set",
                               allow_abbrev=False)
     regrade_source = regrade.add_mutually_exclusive_group(required=True)
@@ -218,7 +223,9 @@ def add_commands(groups: "argparse._SubParsersAction[argparse.ArgumentParser]"):
     snapshot = tasks.add_parser("snapshot")
     snapshot.add_argument("trial_id", metavar="TRIAL_ID")
     for action in ("get", "stop", "result"):
-        tasks.add_parser(action).add_argument("trial_id", metavar="TRIAL_ID")
+        command = tasks.add_parser(action)
+        command.add_argument("trial_id", metavar="TRIAL_ID")
+        command.add_argument("--json", action="store_true", help=JSON_DEFAULT_HELP)
     listing.add_argument("--json", action="store_true", help="Output the complete response as JSON")
     artifacts = tasks.add_parser("artifact", help="List or download a Trial's artifacts").add_subparsers(dest="artifact_action", required=True)
     artifact_list = artifacts.add_parser("list", help="List one page of artifacts")

{envloop_cli-1.29.0 → envloop_cli-1.30.0}/packages/experiment/envloop_experiment/train_log_cli.py

@@ -30,10 +30,13 @@ def log_line(item: dict[str, Any], *, color: bool = False):
         if item.get("phase"):
             diagnostic += f"; phase={safe_text(item['phase'])}"
         message = f"[{diagnostic}] {message}"
+    # The line had no write time and was read after the Job ended: its time is when it was collected.
+    backfilled = "(backfilled)" if item.get("backfilled") is True else ""
     if color:
         timestamp = style(timestamp, "2") if timestamp else ""
+        backfilled = style(backfilled, "2") if backfilled else ""
         level = status_text(level)
-    prefix = " ".join(part for part in (timestamp, level) if part)
+    prefix = " ".join(part for part in (timestamp, backfilled, level) if part)
     return f"{prefix} {message}"
 
 

{envloop_cli-1.29.0 → envloop_cli-1.30.0}/packages/experiment/envloop_experiment/train_metrics_cli.py

@@ -6,7 +6,7 @@ import math
 import re
 import sys
 import time
-from datetime import datetime
+from datetime import datetime, timezone
 from typing import Any
 
 from envloop.cli_output import display, table
@@ -20,7 +20,7 @@ FOLLOW_RETRIES = 3
 TERMINAL = {"completed", "succeeded", "failed", "cancelled", "SUCCEEDED", "FAILED", "CANCELLED"}
 HEADERS = ("STEP", "LOSS", "LEARNING RATE", "GRAD NORM", "EPOCH", "TOKENS", "SECONDS/STEP", "OBSERVED AT")
 # Column widths of --follow, which prints rows before later ones are known.
-WIDTHS = (6, 10, 13, 10, 8, 12, 12, 19)
+WIDTHS = (6, 10, 13, 10, 8, 12, 12, 23)
 
 
 def _number(value: Any) -> float | None:
@@ -41,8 +41,9 @@ def _value(value: Any, spec: str) -> str | None:
 
 
 def _observed(value: Any) -> str | None:
+    """``at`` is Unix time; like every table time it is shown in UTC, labelled (--json keeps the number)."""
     number = _number(value)
-    return None if number is None else datetime.fromtimestamp(number).strftime("%Y-%m-%d %H:%M:%S")
+    return None if number is None else datetime.fromtimestamp(number, timezone.utc).strftime("%Y-%m-%d %H:%M:%S UTC")
 
 
 def step_row(point: dict[str, Any], *, model: bool = False) -> tuple[object, ...]:

{envloop_cli-1.29.0 → envloop_cli-1.30.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "envloop-cli"
-version = "1.29.0"
+version = "1.30.0"
 description = "EnvLoop CLI and Python SDK for jobs, training, checkpoints and inference"
 requires-python = ">=3.12"
 readme = "README.pypi.md"
@@ -65,7 +65,7 @@ combine-as-imports = true
 known-first-party = ["envloop", "envloop_data", "envloop_experiment", "envloop_rsi_loop"]
 
 [tool.uv.sources]
-envloop-envhub = { git = "ssh://git@github.com/EnvLoop/EnvHub.git", rev = "8c96b155d7ab0153da6359508a40c5a4fe802e78" }
+envloop-envhub = { git = "ssh://git@github.com/EnvLoop/EnvHub.git", rev = "db09a00dc6cc2962e599b3c8adbab320e647b578" }
 
 [tool.pyrefly]
 preset = "strict"