envloop-cli 1.29.0__tar.gz → 1.31.0__tar.gz

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: envloop-cli
-Version: 1.29.0
+Version: 1.31.0
 Summary: EnvLoop CLI and Python SDK for jobs, training, checkpoints and inference
 Project-URL: Homepage, https://envloop.ai
 Project-URL: Documentation, https://docs.envloop.ai
@@ -249,7 +249,7 @@ The platform starts the published Revision’s `main.sh` / `main.py` using the R
 CLI output uses compact timestamps and highlights statuses and log levels by default on terminals.
 Use `el --no-color job list` or append `--no-color` to a command to disable highlighting, including errors.
 `NO_COLOR=1`, `TERM=dumb`, pipes, and redirected output also disable colors. JSON preserves original values.
-List times use the local timezone; Job logs retain the recorded timezone, with full precision and offsets available through `--json`.
+List and table times are UTC with a `UTC` label; Job logs retain the recorded timezone and mark lines collected only after the Job ended with `(backfilled)`. Full precision, offsets and the `backfilled` field are available through `--json`.
 `el job run live RUN --follow --json` emits complete response frames as NDJSON; Ctrl-C stops reading without stopping the Run.
 
 ## Job-bound decision plugins
@@ -283,7 +283,7 @@ download a complete registered ANS object directory through EnvHub. Datasets req
 authorization the SDK uses GET URLs valid for up to five minutes, verifies file size/SHA-256,
 and installs the directory atomically. Matching platform support is required.
 
-A compatible server and an explicitly granted project Key with `envloop:data:read` are required; writes additionally need `envloop:data:write`. Default and older Keys do not gain these permissions. The current login selects the base URL, workspace and project; there is no `--env` flag. After configuring the Key using `el auth config`:
+A compatible server is required. Data uses the permission of the resource it touches: read (for example `datasets.read`) to query and download, write to publish and upload, delete to retire; a key from `el auth login` follows your project role. The current login selects the base URL, workspace and project; there is no `--env` flag. After configuring the Key using `el auth config`:
 
 ```bash
 el data list --type dataset --json

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/README.pypi.md

@@ -232,7 +232,7 @@ The platform starts the published Revision’s `main.sh` / `main.py` using the R
 CLI output uses compact timestamps and highlights statuses and log levels by default on terminals.
 Use `el --no-color job list` or append `--no-color` to a command to disable highlighting, including errors.
 `NO_COLOR=1`, `TERM=dumb`, pipes, and redirected output also disable colors. JSON preserves original values.
-List times use the local timezone; Job logs retain the recorded timezone, with full precision and offsets available through `--json`.
+List and table times are UTC with a `UTC` label; Job logs retain the recorded timezone and mark lines collected only after the Job ended with `(backfilled)`. Full precision, offsets and the `backfilled` field are available through `--json`.
 `el job run live RUN --follow --json` emits complete response frames as NDJSON; Ctrl-C stops reading without stopping the Run.
 
 ## Job-bound decision plugins
@@ -266,7 +266,7 @@ download a complete registered ANS object directory through EnvHub. Datasets req
 authorization the SDK uses GET URLs valid for up to five minutes, verifies file size/SHA-256,
 and installs the directory atomically. Matching platform support is required.
 
-A compatible server and an explicitly granted project Key with `envloop:data:read` are required; writes additionally need `envloop:data:write`. Default and older Keys do not gain these permissions. The current login selects the base URL, workspace and project; there is no `--env` flag. After configuring the Key using `el auth config`:
+A compatible server is required. Data uses the permission of the resource it touches: read (for example `datasets.read`) to query and download, write to publish and upload, delete to retire; a key from `el auth login` follows your project role. The current login selects the base URL, workspace and project; there is no `--env` flag. After configuring the Key using `el auth config`:
 
 ```bash
 el data list --type dataset --json

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/envloop/auth_cli.py

@@ -20,6 +20,9 @@ def add_auth_commands(groups: "argparse._SubParsersAction[argparse.ArgumentParse
     login.add_argument("--no-browser", action="store_true", help="Print the login link without opening a browser")
     login.add_argument("--timeout-seconds", type=int, choices=range(1, 601), metavar="SECONDS", default=300,
                        help="Wait up to 1–600 seconds (default: 300)")
+    login.add_argument("--read-only", action="store_true",
+                       help="Issue a read-only key, for example for CI that only reads results. "
+                            "Without it the key follows your project role")
     configure = commands.add_parser("config", help="Save Base URL and API key for CLI and SDK")
     configure.add_argument("--no-check", action="store_true", help="Save without API verification (offline; key remains unverified)")
     actions = configure.add_subparsers(dest="config_action")

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/envloop/auth_login.py

@@ -76,7 +76,8 @@ def login(args: argparse.Namespace, store: Any) -> int:
     def digest(value: str) -> str:
         return hashlib.sha256(value.encode()).hexdigest()
     response = _request(url, 'start', {'key_hash': digest(key), 'poll_hash': digest(poll_token),
-                                    'code_hash': digest(code)}, min(5, args.timeout_seconds))
+                                    'code_hash': digest(code), **({'read_only': True} if args.read_only else {})},
+                        min(5, args.timeout_seconds))
     identifier, uri = _verification_url(url, response)
     interval, expires = response.get('interval'), response.get('expires_in')
     if (isinstance(interval, bool) or not isinstance(interval, (int, float)) or not 0 < interval <= 10 or
@@ -88,6 +89,8 @@ def login(args: argparse.Namespace, store: Any) -> int:
     try:
         print(f'Base URL: {url}\nConfirmation code: {code}\nOpen: {uri}', flush=True)
         print('Sign in with Clerk, enter this code, and authorize your workspace/project.', flush=True)
+        print('The key will be read only.' if args.read_only else
+              'The key follows your project role. The page lists its permissions before you authorize.', flush=True)
         if not args.no_browser:
             try:
                 opened = webbrowser.open(uri, new=1)

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/envloop/cli_errors.py

@@ -27,10 +27,10 @@ def _register(codes: str, message: str) -> None:
         _MESSAGES[code] = message
 
 
-_register("DATA_SCOPE_REQUIRED", "Configure a project key with explicit Data read permission, plus Data write for publication and upload management.")
+_register("DATA_ACCESS_REQUIRED", "This key lacks the permission named above on the Dataset, Runner, Profile, Checkpoint or Trial artifact. Run el auth login to issue a new key that follows your project role: every role can read, and Developer or Admin can also write and delete (create, update, delete, upload, runner register). A key from el auth login --read-only cannot write; log in again without --read-only. Or give a key Read or Edit on that page in the Console under CONFIGURE > API Keys. Existing keys never gain permissions.")
 _register("DATA_NATIVE_INCOMPLETE DATA_NATIVE_UNAVAILABLE", "Native catalog registration is incomplete. Retry the same input after the platform is ready.")
 _register("DATA_DEPENDENCIES_ACTIVE DATA_DEPENDENCIES_UNKNOWN DATA_DEPENDENCIES_CHANGED DATA_DELETE_CONFLICT", "Retirement requires a complete, current dependency check. Resolve active or unknown dependencies, then retry the same resource.")
-_register("DATA_PUBLICATION_INVALID", "Check the immutable ANS URI, native manifest and exact file sizes and SHA-256 values.")
+_register("DATA_PUBLICATION_INVALID", "Check the immutable ANS URI, native manifest and exact file sizes and SHA-256 values. A record Dataset source is https://github.com/OWNER/REPO or https://huggingface.co/datasets/ORG/NAME with the full commit, not a branch or tag.")
 _register("DATA_PIN_CONFLICT DATA_REVISION_REQUIRED", "Publish a new immutable revision; existing and revoked references cannot be overwritten.")
 _register("DATA_QUOTA_EXCEEDED DATA_QUOTA_UNCONFIGURED", "Ask a project administrator to configure publication storage quota. Revoking publications does not free retained content.")
 _register("DATA_UPLOAD_CONFLICT DATA_UPLOAD_INCOMPLETE DATA_UPLOAD_RATE_LIMITED", "Inspect the upload with data upload get; resume matching parts or explicitly abort it.")
@@ -305,6 +305,9 @@ def format_error(error: BaseException) -> str:
         code = remote.code
     local = _http_message(status) if code == "HTTP_ERROR" or code not in _MESSAGES else _MESSAGES[code]
     extra: dict[str, Any] = {"hint": remote.hint, "details": remote.details, "request_id": remote.request_id} if remote else {}
+    if remote and remote.message and remote.details:
+        # A detail that repeats the message (one refused field) only adds where it is: show the field alone.
+        extra["details"] = [line.removesuffix(": " + remote.message) for line in remote.details if line != remote.message]
     if remote and remote.message:
         # Local text only adds guidance for codes the CLI documents.
         # A gateway timeout always adds that the request may have been processed.
@@ -329,7 +332,11 @@ def upload_recovery(error: BaseException) -> str:
     if isinstance(upload_id, str) and re.fullmatch(r'upload_[a-f0-9]{32}', upload_id):
         lines.extend([f'  Upload retained: {upload_id}', f'  Inspect with: el data upload get {upload_id}'])
     generated = getattr(error, 'generated_idempotency_key', None)
-    if isinstance(generated, str) and re.fullmatch(r'[a-f0-9]{32}', generated):
+    # A definite refusal (permission, validation, not found) fails the same way again; offer the key only
+    # when the outcome is unknown or retryable.
+    status = getattr(error, 'status_code', None)
+    retryable = not isinstance(status, int) or status >= 500 or status in {408, 429}
+    if retryable and isinstance(generated, str) and re.fullmatch(r'[a-f0-9]{32}', generated):
         lines.append(f'  Retry the same input with --idempotency-key {generated}')
     return '\n'.join(lines)
 

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/envloop/http.py

@@ -127,6 +127,9 @@ def _text(value: Any, limit: int, secrets: tuple[str | None, ...] = ()) -> str |
     return (value[:limit - 1] + "\u2026" if len(value) > limit else value) or None
 
 
+_DETAIL_TEXT = frozenset({"field", "loc", "name", "message", "msg", "error"})
+
+
 def _detail_lines(value: Any, secrets: tuple[str | None, ...]) -> list[str]:
     """Field-level validation detail from `fields`/`details`, as at most 10 short lines."""
     if isinstance(value, dict):
@@ -137,10 +140,13 @@ def _detail_lines(value: Any, secrets: tuple[str | None, ...]) -> list[str]:
             field = item.get("field") or item.get("loc") or item.get("name")
             field = ".".join(map(str, field)) if isinstance(field, list) else field
             message = item.get("message") or item.get("msg") or item.get("error")
-            # A flat record such as {task, size_bytes, limit_bytes} reads as key=value pairs.
-            item = f"{field}: {message}" if field and message else message or field or ", ".join(
-                f"{key}={value}" for key, value in list(item.items())[:16]
-                if isinstance(key, str) and isinstance(value, (str, int, float)) and not isinstance(value, bool))
+            # A flat record such as {task, size_bytes, limit_bytes} reads as key=value pairs; next to a field the
+            # same pairs locate it, e.g. `records (record_index=2): ...`.
+            pairs = ", ".join(f"{key}={value}" for key, value in list(item.items())[:16]
+                              if isinstance(key, str) and key not in _DETAIL_TEXT
+                              and isinstance(value, (str, int, float)) and not isinstance(value, bool))
+            located = f"{field} ({pairs})" if field and pairs else field
+            item = f"{located}: {message}" if field and message else message or located or pairs
         if line := _text(item, 200, secrets):
             lines.append(line)
     return lines

envloop_cli-1.31.0/envloop/lifecycle_cli.py

@@ -0,0 +1,118 @@
+"""Project lifecycle commands nested under Console Settings."""
+import argparse
+import json
+import sys
+from pathlib import Path
+from typing import Any
+
+TIMEOUT_HELP = ('Seconds to wait (default 600); on timeout the command exits 1 with WAIT_TIMEOUT and prints the '
+                'Operation, and cleanup continues on the server')
+OPERATION_READ = ('Reading an Operation needs the Key permission Resource cleanup, under MANAGE (resources.read); without '
+                  'it the read returns ACCESS_DENIED (HTTP 403).')
+OPERATION = ('An Operation is the persisted record of one cleanup request. el setting cleanup, el setting '
+             'resource-scope cleanup, el job adapter delete and el checkpoint delete return one (operation_id), and '
+             'a stopped Inference Job names its own in inference.cleanup_operation_id. Status is PENDING or RUNNING '
+             'while cleanup works, RETRYING after a failure the server retries by itself, and SUCCEEDED when every '
+             'resource is released; resources_deleted, retained and errors give the outcome per resource. '
+             'FAILED, BLOCKED, RETRYABLE_FAILED, CANCELLED or SUCCEEDED with errors mean cleanup is incomplete: '
+             'fix the named cause and run el setting operation retry OPERATION_ID. ' + OPERATION_READ)
+DENIED_HINT = ('This Key cannot read cleanup Operations: it needs the Resource cleanup permission, under MANAGE '
+               '(resources.read). Without it, check the resource itself: el job get JOB_ID shows cleanup_confirmed, '
+               'and el job adapter get ID returns 404 once the Adapter is deleted.')
+
+
+def wait_options(parser: argparse.ArgumentParser):
+    parser.add_argument('--wait', action='store_true',
+                        help='Then wait for the cleanup Operation to finish (see el setting operation wait --help). If '
+                             'this Key cannot read Operations, print the Operation and exit 0, since the request '
+                             'itself succeeded')
+    parser.add_argument('--timeout-seconds', type=float, default=600, help=TIMEOUT_HELP)
+
+
+def wait_after_request(client: Any, result: Any, *, timeout: float, check: str) -> Any:
+    """``--wait`` after an accepted cleanup request (delete, cleanup, scope cleanup).
+
+    The request already succeeded. A Key may delete without being allowed to read Operations; a
+    denied read then reports the Operation and how to confirm the outcome instead of failing.
+    """
+    if not isinstance(result, dict) or result.get('status') == 'SUCCEEDED' and not result.get('errors'):
+        return result
+    from .http import RemoteError
+
+    try:
+        return client.operations.wait(result['operation_id'], timeout=timeout)
+    except RemoteError as error:
+        if error.status_code != 403:
+            raise
+    print(f"Cleanup accepted as Operation {result['operation_id']}, but this Key cannot read cleanup Operations "
+          f"(resources.read), so --wait stopped. {check}", file=sys.stderr)
+    return result
+
+
+def add_management_commands(settings: "argparse._SubParsersAction[argparse.ArgumentParser]"):
+    operations = settings.add_parser('operation', help='Inspect, wait for or retry a cleanup Operation',
+                                     description=OPERATION).add_subparsers(dest='operation_action', required=True)
+    get = operations.add_parser('get', help='Show a cleanup Operation once', description='Show the current state of a '
+                                'cleanup Operation without waiting. ' + OPERATION)
+    retry = operations.add_parser('retry', help='Retry an incomplete cleanup Operation', description=(
+        'Start the remaining work of an incomplete cleanup Operation again; needs Resource cleanup edit '
+        'permission, under MANAGE (resources.cleanup). ' + OPERATION))
+    wait = operations.add_parser('wait', help='Poll a cleanup Operation until it finishes', description=(
+        'Read the Operation every 2 seconds until it finishes, then print it. Exit 0 when it is SUCCEEDED without '
+        'errors, exit 1 with CLEANUP_INCOMPLETE when cleanup is incomplete, and exit 1 with WAIT_TIMEOUT after '
+        '--timeout-seconds (default 600) while cleanup continues on the server; run wait again later. ' + OPERATION))
+    for command in (get, retry, wait):
+        command.add_argument('identifier', metavar='OPERATION_ID', help='Operation ID (op_...)')
+    wait.add_argument('--timeout-seconds', type=float, default=600, help=TIMEOUT_HELP)
+    cleanup = settings.add_parser('cleanup', help='Clean an explicit set of Project resource IDs')
+    cleanup.add_argument('--file', type=Path, required=True,
+                         help='JSON array of {"kind": KIND, "id": ID} objects; KIND is job (a Train Job), endpoint, adapter '
+                              'or checkpoint, for example [{"kind": "job", "id": "job_..."}]')
+    cleanup.add_argument('--request-id', required=True)
+    wait_options(cleanup)
+    scopes = settings.add_parser('resource-scope', help='Manage temporary resources with server TTL').add_subparsers(dest='scope_action', required=True)
+    create = scopes.add_parser('create')
+    create.add_argument('--ttl-seconds', type=int, default=1800)
+    create.add_argument('--request-id', required=True)
+    for action in ('get', 'cleanup', 'retain'):
+        command = scopes.add_parser(action)
+        command.add_argument('identifier', metavar='RESOURCE_SCOPE_ID')
+        if action == 'cleanup':
+            wait_options(command)
+        if action == 'retain':
+            command.add_argument('--file', type=Path, required=True, help='JSON array of resources to retain')
+
+
+def run_management(client: Any, args: argparse.Namespace):
+    from .resources import _id
+
+    if args.action == 'operation':
+        from .http import RemoteError
+
+        try:
+            return (client.operations.wait(args.identifier, timeout=args.timeout_seconds) if args.operation_action == 'wait'
+                    else getattr(client.operations, args.operation_action)(args.identifier))
+        except RemoteError as error:
+            if error.status_code == 403 and args.operation_action != 'retry' and not error.hint:
+                error.hint = DENIED_HINT
+            raise
+    if args.action == 'resource-scope':
+        if args.scope_action == 'create':
+            client.temporary_resources(ttl_seconds=args.ttl_seconds)
+        base = client.operations.project_path + '/temporary-resource-scopes'
+        if args.scope_action == 'create':
+            result = client._transport.request('POST', base, {'ttl_seconds': args.ttl_seconds, 'request_id': args.request_id})
+        else:
+            path = base + '/' + _id(args.identifier)
+            result = (client._transport.request('POST', path + '/retain', {'resources': json.loads(args.file.read_text())})
+                      if args.scope_action == 'retain' else client._transport.request('DELETE' if args.scope_action == 'cleanup' else 'GET', path))
+        if args.scope_action != 'cleanup':
+            return result
+        check = f'Check with: el setting resource-scope get {args.identifier} (status CLEANED).'
+    else:
+        result = client.operations.cleanup(json.loads(args.file.read_text()), request_id=args.request_id)
+        check = ('Check each resource: el job get JOB_ID (training.cleanup_confirmed true), el job adapter get ID '
+                 '(404 = deleted), el checkpoint list (deleted Checkpoints are gone).')
+    if not getattr(args, 'wait', False):
+        return result
+    return wait_after_request(client, result, timeout=args.timeout_seconds, check=check)

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/envloop/resource_cli.py

@@ -1,10 +1,22 @@
 import argparse
 import sys
 from collections.abc import Sequence
+from datetime import datetime, timedelta, timezone
 from typing import Any
 
 from .navigation_resources import billing_timestamp
 
+USAGE_HELP = ('List recorded usage in a time window; without --start and --end, the last 7 days ending now (UTC). '
+              'Example: el billing usage list --start 2026-11-01 --end 2026-11-05 --group-by day')
+USAGE_DAYS = 7
+
+
+def usage_window(start: str | None, end: str | None) -> tuple[str, str]:
+    """An omitted end is now (UTC, whole seconds); an omitted start is USAGE_DAYS before the end."""
+    end_at = datetime.fromisoformat(end) if end else datetime.now(timezone.utc).replace(microsecond=0)
+    start_at = datetime.fromisoformat(start) if start else end_at - timedelta(days=USAGE_DAYS)
+    return start_at.isoformat(), end_at.isoformat()
+
 
 def listing(commands: "argparse._SubParsersAction[argparse.ArgumentParser]", *, name: str = 'list', paged: bool = True, help: str = 'List visible resources') -> argparse.ArgumentParser:
     parser = commands.add_parser(name, help=help)
@@ -23,10 +35,13 @@ def add_resource_commands(groups: "argparse._SubParsersAction[argparse.ArgumentP
     billing = groups.add_parser('billing', help='Inspect Project billing and recorded usage').add_subparsers(dest='resource', required=True)
     for resource in ('account', 'usage', 'ledger', 'price'):
         commands = billing.add_parser(resource, help=f'Inspect billing {resource}').add_subparsers(dest='action', required=True)
-        command = commands.add_parser('get', help='Show the billing account') if resource == 'account' else listing(commands, paged=False)
+        command = (commands.add_parser('get', help='Show the billing account') if resource == 'account'
+                   else listing(commands, paged=False, help=USAGE_HELP) if resource == 'usage' else listing(commands, paged=False))
         if resource == 'usage':
-            command.add_argument('--start', required=True, type=billing_timestamp, help='Start: YYYY-MM-DD (UTC) or ISO timestamp with timezone')
-            command.add_argument('--end', required=True, type=billing_timestamp, help='Exclusive end: YYYY-MM-DD (UTC) or ISO timestamp with timezone')
+            command.add_argument('--start', type=billing_timestamp,
+                                 help='Start: YYYY-MM-DD (UTC) or ISO timestamp with timezone (default: 7 days before the end)')
+            command.add_argument('--end', type=billing_timestamp,
+                                 help='Exclusive end: YYYY-MM-DD (UTC) or ISO timestamp with timezone (default: now, UTC)')
             command.add_argument('--group-by', choices=['day', 'product', 'endpoint', 'sku'])
         if resource == 'ledger':
             command.add_argument('--limit', type=int, default=25)
@@ -194,7 +209,8 @@ def execute(args: argparse.Namespace, client: Any) -> Any:
         return client.dashboard.get()
     if group == 'billing':
         if args.resource == 'usage':
-            return client.billing.usage(start=args.start, end=args.end, group_by=args.group_by)
+            start, end = usage_window(args.start, args.end)
+            return client.billing.usage(start=start, end=end, group_by=args.group_by)
         if args.resource == 'ledger':
             return client.billing.ledger(limit=args.limit)
         return getattr(client.billing, {'account': 'account', 'price': 'prices'}[args.resource])()

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/packages/data/envloop_data/data.py

@@ -222,9 +222,16 @@ class Data:
         if (isinstance(resource, dict) and resource.get('type') == data_type
                 and resource.get('native_registered') is True and resource.get('native_ready') is True
                 and isinstance(resource.get('data_id', resource.get('id')), str)
-                and re.fullmatch(r'ans_[A-Za-z0-9_-]+', resource.get('data_id', resource.get('id')))):
+                # Resource IDs are opaque. Native completion is established by
+                # resource type and ready/registered state, never by an encoding prefix.
+                and re.fullmatch(r'[A-Za-z0-9_-]{1,8192}', resource.get('data_id', resource.get('id')))):
             return resource
-        error = RemoteError('DATA_NATIVE_INCOMPLETE', 409)
+        # The platform answered successfully; this is the client's completion check, not an HTTP
+        # refusal. Report no HTTP status and only the platform's own bounded resource state.
+        returned = resource if isinstance(resource, dict) else {}
+        state = [f'{key}: {returned[key]}' for key in ('status', 'unavailable_reason')
+                 if isinstance(returned.get(key), str) and re.fullmatch(r'[A-Za-z_]{1,64}', returned[key])]
+        error = RemoteError('DATA_NATIVE_INCOMPLETE', details=state)
         if isinstance(resource, dict):
             staging = resource.get('staging_id') or resource.get('data_id') or resource.get('id')
             if isinstance(staging, str) and re.fullmatch(r'pub_[A-Za-z0-9_-]{1,200}', staging):

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/packages/data/envloop_data/data_cli.py

@@ -83,15 +83,19 @@ def add_commands(groups: "argparse._SubParsersAction[argparse.ArgumentParser]",
     command.add_argument('--json', action='store_true')
 
 
+MANIFEST_HELP = ('Native JSON content manifest; a record Dataset source.repository is https://github.com/OWNER/REPO '
+                 'or https://huggingface.co/datasets/ORG/NAME, with source.commit the full commit')
+
+
 def publication_arguments(command: argparse.ArgumentParser, *, source: bool = False):
     command.add_argument('--ref', required=not source, help='Exact immutable ANS URI')
     if source:
         inputs = command.add_mutually_exclusive_group(required=True)
-        inputs.add_argument('--manifest', type=Path, help='Native JSON content manifest')
+        inputs.add_argument('--manifest', type=Path, help=MANIFEST_HELP)
         inputs.add_argument('--model', help='Public Hugging Face model namespace/name; metadata only')
         command.add_argument('--revision', help='Explicit HF source ref; the server freezes its full commit')
     else:
-        command.add_argument('--manifest', type=Path, required=True, help='Native JSON content manifest')
+        command.add_argument('--manifest', type=Path, required=True, help=MANIFEST_HELP)
     command.add_argument('--directory', type=Path, required=not source, help='Directory containing exactly the declared files')
     command.add_argument('--executable', action='append', dest='executables', default=[],
                          help='Declared Runner file that must be executable; repeat for each path')

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/packages/data/envloop_data/resource_cli.py

@@ -33,8 +33,8 @@ def add_resource_commands(groups: "argparse._SubParsersAction[argparse.ArgumentP
         'immutable Runner revision NAME@REVISION. The platform stores the bytes, computes the package and index '
         'SHA-256, creates the Runner on first use and registers the revision; identical retries are idempotent and '
         'changed content for an existing revision is refused. This is el data create --type runner with the native '
-        'manifest built for you; use that command to publish an existing manifest. The key needs envloop:data:write '
-        'and runners.write, and publish permission on a Runner owned by another Project.')
+        'manifest built for you; use that command to publish an existing manifest. The key needs runners.write '
+        '(el auth login issues it to a Developer or Admin), and publish permission on a Runner owned by another Project.')
     register.add_argument('directory', metavar='DIRECTORY', type=Path, help='Runner package directory; every file in it is published')
     register.add_argument('--revision', required=True, help='Full 40- or 64-character source commit, for example $(git rev-parse HEAD)')
     register.add_argument('--name', help='NAMESPACE/NAME; must equal [runner] name in runner.toml (default: that name)')
@@ -81,16 +81,21 @@ def execute(args: argparse.Namespace, client: Any):
     if group == 'checkpoint':
         if action == 'delete':
             result = client.checkpoints.delete(args.identifier)
-            return client.operations.wait(result['operation_id'], timeout=args.timeout_seconds) if args.wait else result
+            if not args.wait:
+                return result
+            from envloop.lifecycle_cli import wait_after_request
+            return wait_after_request(client, result, timeout=args.timeout_seconds,
+                                      check=f'Check that el checkpoint list no longer shows {args.identifier}.')
         if action == 'download':
             return client.checkpoints.download(args.checkpoint, args.directory, job_id=args.job_id, trial_id=args.trial_id)
         return client.checkpoints.list(job_id=args.job_id, trial_id=args.trial_id,
                                        cursor=args.cursor, limit=args.limit)
 
 
-RUNNER_WRITE_HINT = ('Registering a Runner revision needs a project key with Data write (envloop:data:write) and '
-                     'Runners write (runners.write), and publish or admin permission when another project owns the '
-                     'Runner. Existing keys keep their original capabilities; issue a new key with these permissions.')
+RUNNER_WRITE_HINT = ('Registering a Runner revision needs a project key with Runners write (runners.write), and '
+                     'publish or admin permission when another project owns the Runner. Existing keys keep their '
+                     'original capabilities; run el auth login without --read-only (Developer or Admin role) to issue '
+                     'a new key with it.')
 
 
 def register_runner(client: Any, args: argparse.Namespace):
@@ -102,7 +107,7 @@ def register_runner(client: Any, args: argparse.Namespace):
                                          executables=args.executables, source_ref=args.source_ref,
                                          source_ref_kind=args.source_ref_kind, dry_run=args.dry_run)
     except RemoteError as error:
-        if error.code == 'ACCESS_DENIED' and not error.hint:
+        if error.code in {'ACCESS_DENIED', 'DATA_ACCESS_REQUIRED'} and not error.hint:
             error.hint = RUNNER_WRITE_HINT
         raise
     if not args.dry_run:

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/packages/experiment/envloop_experiment/cli.py

@@ -5,6 +5,9 @@ import sys
 from pathlib import Path
 from typing import Any
 
+# Single-resource reads and actions print the response as JSON already; scripts may still pass --json.
+JSON_DEFAULT_HELP = "Output the complete response as JSON (the default; accepted for consistency with list commands)"
+
 
 def dataset_reference(value: str):
     name, separator, version = value.rpartition("@")
@@ -155,6 +158,8 @@ def add_commands(groups: "argparse._SubParsersAction[argparse.ArgumentParser]"):
         if action == 'event':
             command.add_argument('--json', action='store_true')
             command.set_defaults(_list_view=True)
+        else:
+            command.add_argument("--json", action="store_true", help=JSON_DEFAULT_HELP)
     regrade = jobs.add_parser("regrade", help="Re-run only the verifier of sealed compose Trials, optionally with a reward set",
                               allow_abbrev=False)
     regrade_source = regrade.add_mutually_exclusive_group(required=True)
@@ -218,7 +223,9 @@ def add_commands(groups: "argparse._SubParsersAction[argparse.ArgumentParser]"):
     snapshot = tasks.add_parser("snapshot")
     snapshot.add_argument("trial_id", metavar="TRIAL_ID")
     for action in ("get", "stop", "result"):
-        tasks.add_parser(action).add_argument("trial_id", metavar="TRIAL_ID")
+        command = tasks.add_parser(action)
+        command.add_argument("trial_id", metavar="TRIAL_ID")
+        command.add_argument("--json", action="store_true", help=JSON_DEFAULT_HELP)
     listing.add_argument("--json", action="store_true", help="Output the complete response as JSON")
     artifacts = tasks.add_parser("artifact", help="List or download a Trial's artifacts").add_subparsers(dest="artifact_action", required=True)
     artifact_list = artifacts.add_parser("list", help="List one page of artifacts")
@@ -440,11 +447,18 @@ def execute_job(args: argparse.Namespace, client: Any, cli: argparse.ArgumentPar
     else:
         result = getattr(client.jobs, 'status' if args.action == 'get' else args.action)(args.job_id)
         if args.action == 'get':
+            from envloop_experiment.inference import service_line
             from envloop_experiment.train_metrics_cli import availability_line
-            from envloop_experiment.train_progress import job_progress, progress_line
+            from envloop_experiment.train_progress import (
+                job_progress,
+                progress_line,
+                waiting_line,
+            )
 
-            # The JSON on stdout is unchanged; a Train Job's live progress is a readable stderr line.
-            for line in (progress_line(job_progress(result)), availability_line(result)):
+            # The JSON on stdout is unchanged; a Train Job's queue wait and live progress and an Inference
+            # Job's service state are readable stderr lines.
+            for line in (waiting_line(result), progress_line(job_progress(result)), availability_line(result),
+                         service_line(result)):
                 if line:
                     print(line, file=sys.stderr)
         if args.action in {'get', 'result'}:

envloop_cli-1.31.0/packages/experiment/envloop_experiment/inference.py

@@ -0,0 +1,79 @@
+"""Public inference intent validation and a one-line Job view; resolution and admission remain server owned."""
+import re
+from typing import Any
+
+from envloop.terminal import safe_text
+
+_FIELDS = {'name', 'runner', 'inputs', 'serving_profile', 'hardware', 'weights_format',
+           'scaling', 'temporary_scope_id', 'profile', 'resources'}
+
+
+def validate_submission(body: Any):
+    if (not isinstance(body, dict) or set(body) - {'type', 'request_id', 'spec'}
+            or body.get('type', 'inference') != 'inference'):
+        raise ValueError('inference submission requires spec and request_id')
+    spec = body.get('spec')
+    if not isinstance(spec, dict):
+        raise ValueError('inference submission requires a spec object')
+    if 'request_id' in body and (not isinstance(body['request_id'], str)
+            or not body['request_id'].strip() or len(body['request_id']) > 128):
+        raise ValueError('request_id must be a non-empty string of at most 128 characters')
+    if any(key in spec for key in ('provider', 'executor', 'resolved_runner', 'runtime')):
+        raise ValueError('execution configuration and Runner resolution are owned by the server')
+    if 'runner' not in spec:
+        return  # Explicit legacy compatibility: existing adapter specs still reach the API.
+    if set(spec) - _FIELDS:
+        raise ValueError('fixed-input inference cannot mix legacy or runtime fields')
+    runner = spec['runner']
+    if (not isinstance(runner, str)
+            or not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9._-]*/[A-Za-z0-9][A-Za-z0-9._-]*@[^\s@]+', runner)):
+        raise ValueError('runner requires namespace/name@revision')
+    if not isinstance(spec.get('name'), str) or not spec['name'].strip():
+        raise ValueError('fixed-input inference requires name')
+    profile = spec.get('profile')
+    recipe_driven = (isinstance(profile, dict) and profile.get('schema') == 'envloop.job-profile/v2'
+                     and isinstance(profile.get('recipe'), dict))
+    if ('serving_profile' in spec or not recipe_driven) and (
+            not isinstance(spec.get('serving_profile'), str) or not spec['serving_profile'].strip()):
+        raise ValueError('fixed-input inference requires serving_profile or an executable Recipe profile')
+    if 'resources' in spec:
+        resources = spec['resources']
+        bounds = {'gpus': (0, 8), 'cpus': (1, 256), 'memory_mb': (512, 2097152),
+                  'storage_mb': (1024, 16777216), 'shm_mb': (1, 2097152)}
+        if (not isinstance(resources, dict) or resources.keys() - (bounds.keys() | {'gpu_type'})
+                or any(type(value) is not int or not bounds[key][0] <= value <= bounds[key][1]
+                       for key, value in resources.items() if key in bounds)
+                or 'gpu_type' in resources and (not isinstance(resources['gpu_type'], str)
+                    or not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9._-]{0,63}', resources['gpu_type']))):
+            raise ValueError('invalid inference resources override')
+    inputs = spec.get('inputs', {})
+    if (not isinstance(inputs, dict) or set(inputs) - {'checkpoint'}
+            or 'checkpoint' in inputs and (not isinstance(inputs['checkpoint'], str)
+            or not inputs['checkpoint'].startswith('envloop://') or not inputs['checkpoint'][10:])):
+        raise ValueError('inputs accepts one Checkpoint ANS URI')
+
+
+def _word(value: Any) -> str | None:
+    return " ".join(safe_text(value).split())[:200] if isinstance(value, str) and value.strip() else None
+
+
+def service_line(job: Any) -> str | None:
+    """``Inference: READY, replicas 1 ready / 1 active, model ws/chat`` for an Inference Job, else None.
+
+    A stopped Job adds whether its resource release is confirmed; a value never reported is omitted.
+    """
+    inference = job.get("inference") if isinstance(job, dict) and job.get("type") == "inference" else None
+    if not isinstance(inference, dict):
+        return None
+    parts = [_word(inference.get("service_status")) or "status unknown"]
+    replicas = inference.get("replicas")
+    if isinstance(replicas, dict) and all(type(replicas.get(key)) is int for key in ("ready", "active")):
+        parts.append(f"replicas {replicas['ready']} ready / {replicas['active']} active")
+    if model := _word(inference.get("model")):
+        parts.append(f"model {model}")
+    if error := _word(inference.get("error_code")):
+        parts.append(f"error {error}")
+    if job.get("status") in {"cancelled", "failed", "succeeded", "completed"} or parts[0] == "DELETED":
+        confirmed = inference.get("cleanup_confirmed")
+        parts.append("cleanup confirmed" if confirmed is True else "cleanup not confirmed yet")
+    return "Inference: " + ", ".join(parts)

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/packages/experiment/envloop_experiment/job_spec_cli.py

@@ -29,9 +29,13 @@ def train_dataset(spec: dict[str, Any], dataset: str | None, split: str | None)
         if not separator:
             raise ValueError('Train --dataset needs an exact NAMESPACE/NAME@VERSION')
         if (name, version) != (current.get('name'), current.get('version')):
-            selector.pop('manifest_sha256', None)  # a pin belongs to the version it was read from
+            for pin in ('manifest_sha256', 'sha256', 'row_count'):
+                selector.pop(pin, None)  # a pin belongs to the version it was read from
         selector.update(name=name, version=version)
     if split is not None:
+        if split != current.get('split'):
+            for pin in ('sha256', 'row_count'):
+                selector.pop(pin, None)  # a frozen spec's split pins name that split's rows only
         selector['split'] = split
     if not {'name', 'version', 'split'} <= set(selector):
         raise ValueError('Train --dataset needs NAMESPACE/NAME@VERSION and --split')

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/packages/experiment/envloop_experiment/resource_cli.py

@@ -35,4 +35,8 @@ def run_job_resource(client: Any, args: argparse.Namespace):
         # The platform requires an idempotency key; generate one like the SDK's Adapters.register.
         return resource.create({'request_id': str(uuid4())} | body if isinstance(body, dict) else body)
     result = resource.action(args.identifier, 'delete')
-    return client.operations.wait(result['operation_id'], timeout=args.timeout_seconds) if args.wait else result
+    if not args.wait:
+        return result
+    from envloop.lifecycle_cli import wait_after_request
+    return wait_after_request(client, result, timeout=args.timeout_seconds,
+                              check=f'Check with: el job adapter get {args.identifier} (404 = deleted).')

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/packages/experiment/envloop_experiment/train_log_cli.py

@@ -30,10 +30,13 @@ def log_line(item: dict[str, Any], *, color: bool = False):
         if item.get("phase"):
             diagnostic += f"; phase={safe_text(item['phase'])}"
         message = f"[{diagnostic}] {message}"
+    # The line had no write time and was read after the Job ended: its time is when it was collected.
+    backfilled = "(backfilled)" if item.get("backfilled") is True else ""
     if color:
         timestamp = style(timestamp, "2") if timestamp else ""
+        backfilled = style(backfilled, "2") if backfilled else ""
         level = status_text(level)
-    prefix = " ".join(part for part in (timestamp, level) if part)
+    prefix = " ".join(part for part in (timestamp, backfilled, level) if part)
     return f"{prefix} {message}"
 
 

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/packages/experiment/envloop_experiment/train_metrics_cli.py

@@ -6,7 +6,7 @@ import math
 import re
 import sys
 import time
-from datetime import datetime
+from datetime import datetime, timezone
 from typing import Any
 
 from envloop.cli_output import display, table
@@ -20,7 +20,7 @@ FOLLOW_RETRIES = 3
 TERMINAL = {"completed", "succeeded", "failed", "cancelled", "SUCCEEDED", "FAILED", "CANCELLED"}
 HEADERS = ("STEP", "LOSS", "LEARNING RATE", "GRAD NORM", "EPOCH", "TOKENS", "SECONDS/STEP", "OBSERVED AT")
 # Column widths of --follow, which prints rows before later ones are known.
-WIDTHS = (6, 10, 13, 10, 8, 12, 12, 19)
+WIDTHS = (6, 10, 13, 10, 8, 12, 12, 23)
 
 
 def _number(value: Any) -> float | None:
@@ -41,8 +41,9 @@ def _value(value: Any, spec: str) -> str | None:
 
 
 def _observed(value: Any) -> str | None:
+    """``at`` is Unix time; like every table time it is shown in UTC, labelled (--json keeps the number)."""
     number = _number(value)
-    return None if number is None else datetime.fromtimestamp(number).strftime("%Y-%m-%d %H:%M:%S")
+    return None if number is None else datetime.fromtimestamp(number, timezone.utc).strftime("%Y-%m-%d %H:%M:%S UTC")
 
 
 def step_row(point: dict[str, Any], *, model: bool = False) -> tuple[object, ...]:

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/packages/experiment/envloop_experiment/train_progress.py

@@ -1,4 +1,4 @@
-"""One-line view of a Train Job's live ``training.progress``; reading never changes the Job."""
+"""One-line views of a Train Job's queue wait and live ``training.progress``; reading never changes the Job."""
 
 import math
 from typing import Any
@@ -50,3 +50,19 @@ def progress_line(progress: dict[str, Any] | None) -> str | None:
     if isinstance(progress.get("updated_at"), str):
         parts.append(f"updated {safe_text(compact_time(progress['updated_at'], utc=True))}")
     return "Training progress: " + ", ".join(parts)
+
+
+# What a queued Train Job is waiting for, in words; other reasons are shown as the platform names them.
+_WAITING = {"EXECUTION_CAPACITY_UNAVAILABLE": "no matching GPU is free yet. The Job keeps its place until the queue "
+                                              "limit, then fails with EXECUTION_QUEUE_TIMEOUT and costs nothing"}
+
+
+def waiting_line(job: Any) -> str | None:
+    """``Waiting: EXECUTION_CAPACITY_UNAVAILABLE (...)`` while a Train Job waits in the queue, else None."""
+    training = job.get("training") if isinstance(job, dict) else None
+    reason = (training.get("waiting_reason") if isinstance(training, dict) else None) or (
+        job.get("waiting_reason") if isinstance(job, dict) else None)
+    if not isinstance(reason, str) or not reason.strip():
+        return None
+    reason = " ".join(safe_text(reason).split())[:200]
+    return f"Waiting: {reason}" + (f" ({_WAITING[reason]})" if reason in _WAITING else "")

{envloop_cli-1.29.0 → envloop_cli-1.31.0}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "envloop-cli"
-version = "1.29.0"
+version = "1.31.0"
 description = "EnvLoop CLI and Python SDK for jobs, training, checkpoints and inference"
 requires-python = ">=3.12"
 readme = "README.pypi.md"
@@ -65,7 +65,7 @@ combine-as-imports = true
 known-first-party = ["envloop", "envloop_data", "envloop_experiment", "envloop_rsi_loop"]
 
 [tool.uv.sources]
-envloop-envhub = { git = "ssh://git@github.com/EnvLoop/EnvHub.git", rev = "8c96b155d7ab0153da6359508a40c5a4fe802e78" }
+envloop-envhub = { git = "ssh://git@github.com/EnvLoop/EnvHub.git", rev = "b346ac728626602da745a36249ab35f12f6d313f" }
 
 [tool.pyrefly]
 preset = "strict"

envloop_cli-1.29.0/envloop/lifecycle_cli.py

@@ -1,55 +0,0 @@
-"""Project lifecycle commands nested under Console Settings."""
-import argparse
-import json
-from pathlib import Path
-from typing import Any
-
-
-def wait_options(parser: argparse.ArgumentParser):
-    parser.add_argument('--wait', action='store_true', help='Wait for the persisted cleanup Operation')
-    parser.add_argument('--timeout-seconds', type=float, default=600)
-
-
-def add_management_commands(settings: "argparse._SubParsersAction[argparse.ArgumentParser]"):
-    operations = settings.add_parser('operation', help='Inspect or retry persisted cleanup').add_subparsers(dest='operation_action', required=True)
-    for action in ('get', 'retry', 'wait'):
-        command = operations.add_parser(action)
-        command.add_argument('identifier', metavar='OPERATION_ID')
-        if action == 'wait':
-            command.add_argument('--timeout-seconds', type=float, default=600)
-    cleanup = settings.add_parser('cleanup', help='Clean an explicit set of Project resource IDs')
-    cleanup.add_argument('--file', type=Path, required=True, help='JSON array of resource kind and ID objects')
-    cleanup.add_argument('--request-id', required=True)
-    wait_options(cleanup)
-    scopes = settings.add_parser('resource-scope', help='Manage temporary resources with server TTL').add_subparsers(dest='scope_action', required=True)
-    create = scopes.add_parser('create')
-    create.add_argument('--ttl-seconds', type=int, default=1800)
-    create.add_argument('--request-id', required=True)
-    for action in ('get', 'cleanup', 'retain'):
-        command = scopes.add_parser(action)
-        command.add_argument('identifier', metavar='RESOURCE_SCOPE_ID')
-        if action == 'cleanup':
-            wait_options(command)
-        if action == 'retain':
-            command.add_argument('--file', type=Path, required=True, help='JSON array of resources to retain')
-
-
-def run_management(client: Any, args: argparse.Namespace):
-    from .resources import _id
-
-    if args.action == 'operation':
-        return (client.operations.wait(args.identifier, timeout=args.timeout_seconds) if args.operation_action == 'wait'
-                else getattr(client.operations, args.operation_action)(args.identifier))
-    if args.action == 'resource-scope':
-        if args.scope_action == 'create':
-            client.temporary_resources(ttl_seconds=args.ttl_seconds)
-        base = client.operations.project_path + '/temporary-resource-scopes'
-        if args.scope_action == 'create':
-            result = client._transport.request('POST', base, {'ttl_seconds': args.ttl_seconds, 'request_id': args.request_id})
-        else:
-            path = base + '/' + _id(args.identifier)
-            result = (client._transport.request('POST', path + '/retain', {'resources': json.loads(args.file.read_text())})
-                      if args.scope_action == 'retain' else client._transport.request('DELETE' if args.scope_action == 'cleanup' else 'GET', path))
-    else:
-        result = client.operations.cleanup(json.loads(args.file.read_text()), request_id=args.request_id)
-    return client.operations.wait(result['operation_id'], timeout=args.timeout_seconds) if getattr(args, 'wait', False) else result

envloop_cli-1.29.0/packages/experiment/envloop_experiment/inference.py

@@ -1,36 +0,0 @@
-"""Public inference intent validation; resolution and admission remain server owned."""
-import re
-from typing import Any
-
-_FIELDS = {'name', 'runner', 'inputs', 'serving_profile', 'hardware', 'weights_format',
-           'scaling', 'temporary_scope_id', 'profile'}
-
-
-def validate_submission(body: Any):
-    if (not isinstance(body, dict) or set(body) - {'type', 'request_id', 'spec'}
-            or body.get('type', 'inference') != 'inference'):
-        raise ValueError('inference submission requires spec and request_id')
-    spec = body.get('spec')
-    if not isinstance(spec, dict):
-        raise ValueError('inference submission requires a spec object')
-    if 'request_id' in body and (not isinstance(body['request_id'], str)
-            or not body['request_id'].strip() or len(body['request_id']) > 128):
-        raise ValueError('request_id must be a non-empty string of at most 128 characters')
-    if any(key in spec for key in ('provider', 'executor', 'resolved_runner', 'runtime')):
-        raise ValueError('execution configuration and Runner resolution are owned by the server')
-    if 'runner' not in spec:
-        return  # Explicit legacy compatibility: existing adapter specs still reach the API.
-    if set(spec) - _FIELDS:
-        raise ValueError('fixed-input inference cannot mix legacy or runtime fields')
-    runner = spec['runner']
-    if (not isinstance(runner, str)
-            or not re.fullmatch(r'[A-Za-z0-9][A-Za-z0-9._-]*/[A-Za-z0-9][A-Za-z0-9._-]*@[^\s@]+', runner)):
-        raise ValueError('runner requires namespace/name@revision')
-    if any(not isinstance(spec.get(key), str) or not spec[key].strip()
-           for key in ('name', 'serving_profile')):
-        raise ValueError('fixed-input inference requires name and serving_profile')
-    inputs = spec.get('inputs', {})
-    if (not isinstance(inputs, dict) or set(inputs) - {'checkpoint'}
-            or 'checkpoint' in inputs and (not isinstance(inputs['checkpoint'], str)
-            or not inputs['checkpoint'].startswith('envloop://') or not inputs['checkpoint'][10:])):
-        raise ValueError('inputs accepts one Checkpoint ANS URI')