openrunner-sdk 2.37.5__tar.gz → 2.37.7__tar.gz

{openrunner_sdk-2.37.5 → openrunner_sdk-2.37.7}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: openrunner-sdk
-Version: 2.37.5
+Version: 2.37.7
 Summary: OpenRunner SDK - W&B-compatible ML experiment tracking client
 Project-URL: Homepage, https://github.com/jqueguiner/openrunner
 Project-URL: Repository, https://github.com/jqueguiner/openrunner

{openrunner_sdk-2.37.5 → openrunner_sdk-2.37.7}/openrunner/__init__.py

@@ -181,7 +181,7 @@ launch.from_run = _launch_from_run  # type: ignore[attr-defined]
 # openrunner.trace.patch_openai() syntax
 trace.patch_openai = _patch_openai  # type: ignore[attr-defined]
 
-__version__ = "2.37.5"
+__version__ = "2.37.7"
 
 logger = logging.getLogger("openrunner")
 

{openrunner_sdk-2.37.5 → openrunner_sdk-2.37.7}/openrunner/api_client.py

@@ -147,6 +147,39 @@ class APIClient:
             logger.warning("post_metrics failed: %s", e)
             return 0
 
+    def create_api_key(
+        self,
+        name: str,
+        scopes: list[str] | None = None,
+        scope_project_id: str | None = None,
+        scope_org_id: str | None = None,
+    ) -> dict[str, Any] | None:
+        """POST /users/me/api-keys -- mint a scoped API key.
+
+        ``scopes`` are fine-grained capability scopes, e.g.
+        ``["drift:read", "drift:write"]``; None/empty means full access.
+        ``scope_project_id`` / ``scope_org_id`` further restrict the key to a
+        single project/org. The plaintext key is returned ONCE, in the ``key``
+        field of the response dict -- it is never retrievable again.
+
+        Returns the created-key dict (incl. plaintext ``key``), or None on
+        failure.
+        """
+        try:
+            body: dict[str, Any] = {"name": name}
+            if scopes:
+                body["scopes"] = scopes
+            if scope_project_id:
+                body["scope_project_id"] = scope_project_id
+            if scope_org_id:
+                body["scope_org_id"] = scope_org_id
+            response = self._request("post", "/users/me/api-keys", json=body)
+            response.raise_for_status()
+            return response.json()
+        except Exception as e:
+            logger.warning("create_api_key failed: %s", e)
+            return None
+
     def post_inference_events(
         self,
         project_id: str,

{openrunner_sdk-2.37.5 → openrunner_sdk-2.37.7}/openrunner/cli.py

@@ -4339,6 +4339,39 @@ def drift_group() -> None:
     pass
 
 
+@drift_group.command("key")
+@click.option("--project", "-p", default=None, help="Project org/name or UUID to scope the key to")
+@click.option("--name", "-n", default=None, help="Key name (default: drift-<project>)")
+@click.option("--read-only", is_flag=True, help="Mint a drift:read-only key (no ingest)")
+@click.option("--json", "as_json", is_flag=True, help="Print the key record as JSON")
+def drift_key(project, name, read_only, as_json) -> None:
+    """Mint an API key scoped to inference-drift only (read+write by default).
+
+    The key carries ONLY ``drift:read``+``drift:write`` (or ``drift:read`` with
+    --read-only) and is bound to the project — it cannot touch runs, datasets,
+    artifacts, weights, or any other domain. Give this to a container/service
+    that reports drift events instead of a full-access key. The plaintext key is
+    shown ONCE; store it as the container's ``OPENRUNNER_API_KEY``.
+    """
+    import json as _json
+
+    client, pid = _drift_client_project(project)
+    scopes = ["drift:read"] if read_only else ["drift:read", "drift:write"]
+    key_name = name or f"drift-{(project or _load_settings().get('project') or pid)}".replace("/", "-")
+    rec = client.create_api_key(key_name, scopes=scopes, scope_project_id=pid)
+    client.close()
+    if not rec or not rec.get("key"):
+        click.echo("Error: failed to mint drift key (check login / project membership).", err=True)
+        raise SystemExit(1)
+    if as_json:
+        click.echo(_json.dumps(rec))
+        return
+    click.echo(f"name:   {rec.get('name')}")
+    click.echo(f"scopes: {','.join(rec.get('scopes') or scopes)}")
+    click.echo(f"key:    {rec['key']}")
+    click.echo("\nStore as the container env OPENRUNNER_API_KEY — shown only once.")
+
+
 @drift_group.command("report")
 @click.argument("events_json", type=click.Path(exists=True))
 @click.option("--project", "-p", default=None, help="Project org/name or UUID")

{openrunner_sdk-2.37.5 → openrunner_sdk-2.37.7}/openrunner/install_commands.py

@@ -2718,6 +2718,141 @@ openrunner drift report events.json --project ORG/NAME --monitor asr-prod
 """
 
 
+DRIFT_INSTALL_CMD = """---
+name: {prefix}drift-install
+description: Actually wire inference-drift monitoring INTO the API in THIS repo -- detect the framework + endpoints, add a non-blocking reporter, insert record_inference() after each prediction, add the dependency, and verify with a live event (vs /openrunner:drift which only explains it)
+argument-hint: "[project org/name] [--endpoint PATH] [--sample N]"
+allowed-tools:
+  - Bash
+  - Read
+  - Edit
+  - Write
+  - Grep
+  - Glob
+  - AskUserQuestion
+---
+
+Instrument the inference API in the **current repo** with OpenRunner drift
+monitoring -- edit the code, don't just describe it (see `/openrunner:drift` for
+the reference). Do each step; ask only when genuinely ambiguous.
+
+## Step 1 -- detect the API + inference endpoint(s)
+- Identify the framework (grep `fastapi`, `flask`, `django`, `express`,
+  `@app.post`, `APIRouter`, route decorators) and the file(s) with the
+  **inference** endpoint(s) -- the handlers that return model predictions.
+- If several, ask which to instrument (default: the prediction routes). Honour
+  `--endpoint PATH` when given.
+
+## Step 2 -- resolve project + mint a DRIFT-ONLY key for the container
+- `openrunner login` if needed. Resolve the project id (from the `org/name` arg,
+  else `APIClient.list_projects()`; ask if ambiguous).
+- **Mint a scoped key for this container** -- do NOT reuse the user's full key.
+  Run `openrunner drift key --project ORG/NAME --name drift-<service>` (add
+  `--json` to capture it). It returns a key carrying ONLY `drift:read` +
+  `drift:write`, bound to that project: it can report/read drift and nothing else
+  (no runs, datasets, artifacts, weights). Shown once.
+- Inject it as the container's `OPENRUNNER_API_KEY` (+ optional
+  `OPENRUNNER_BASE_URL`) via `.env.example` / deploy secret -- **never hardcode
+  the key** in source. Store `PROJECT_ID` as a module constant or env var.
+- If key minting fails (e.g. the user lacks membership), fall back to the
+  existing `OPENRUNNER_API_KEY` from env and note it is broader than needed.
+
+## Step 3 -- add the non-blocking reporter module
+Create `openrunner_drift.py` (match the repo layout) with a background batcher
+(thread + `queue`, drop on full, 200/flush, 429 backoff via the SDK) exposing
+`record_inference(inference_id, metadata, metrics)` -- the pattern from
+`/openrunner:drift`. For an async framework, use an asyncio task + `asyncio.Queue`
+instead of a thread.
+
+## Step 4 -- instrument each endpoint
+AFTER the response is produced, insert a wrapped `record_inference(...)`:
+- `inference_id` = the request id / a `uuid4().hex`.
+- `metadata` = input axes present in the handler: model version, language, route,
+  region, tenant/customer.
+- `metrics` = outputs + **latency measured around the model call** (wrap the
+  predict call with a monotonic timer), output confidence/score, input length,
+  token count.
+- Wrap in try/except (or the queue put_nowait) so monitoring **never** breaks or
+  slows the request. Apply `--sample N` (report 1 in N) if given.
+
+## Step 5 -- dependency + verify
+- Add `openrunner-sdk` to `requirements.txt` / `pyproject.toml` if missing.
+- Import-check the new module; send ONE synthetic event
+  (`post_inference_events(PROJECT_ID, [{{...}}])`) and confirm `ingested: 1`.
+- Point the user at the **Drift** UI and `openrunner drift check --project ORG/NAME
+  --metric confidence`.
+
+## Guardrails
+- NEVER block or fail the request path for monitoring (drop on queue-full).
+- NEVER store raw inputs/outputs -- only the chosen metrics + metadata.
+- NEVER hardcode the API key -- read from env.
+- Keep the diff minimal + match the repo's style/imports.
+"""
+
+
+BUILD_API_CMD = """---
+name: {prefix}build-api
+description: Scaffold a production inference API for a model in THIS repo -- FastAPI /predict + /health, typed request/response, Dockerfile (pushable via the OpenRunner registry), env config, and optional baked-in drift monitoring; ready to deploy on governed GPUs
+argument-hint: "[--model PATH_OR_ARTIFACT] [--framework fastapi] [--drift] [--registry NAME/ns]"
+allowed-tools:
+  - Bash
+  - Read
+  - Edit
+  - Write
+  - Grep
+  - Glob
+  - AskUserQuestion
+---
+
+Scaffold a serving API for a model in the **current repo** -- a real, runnable
+skeleton, not a description. Ask only what you can't infer.
+
+## Step 1 -- understand the model
+- Find the model: a local checkpoint, an `openrunner.use_model(...)` artifact, a
+  HF id, or a `predict()` the user points at (`--model`). Ask if unclear.
+- Determine input -> output shape (text/audio/image in; label/score/text out) to
+  type the request/response.
+
+## Step 2 -- scaffold the API (default FastAPI)
+Write a minimal, production-shaped service:
+- `app/main.py` -- FastAPI app; load the model ONCE at startup (lifespan), a typed
+  `POST /predict` (pydantic request/response), `GET /health` (model-loaded probe),
+  `GET /` version. Batch-friendly handler; no blocking work in the event loop for
+  heavy models (run in a threadpool / worker).
+- `app/model.py` -- load + `predict()` wrapper (pull weights via
+  `openrunner.use_model` when the model is an OpenRunner artifact).
+- `requirements.txt` / `pyproject.toml`, `.env.example` (PORT, model ref,
+  `OPENRUNNER_*`), `README.md` (run + curl example).
+- `Dockerfile` -- slim base, install deps, copy app, `CMD` uvicorn on `$PORT`;
+  GPU base image if the model needs CUDA.
+
+## Step 3 -- (optional) bake in drift monitoring
+If `--drift` (or the user wants it): run the `/openrunner:drift-install` flow on
+the freshly scaffolded `/predict` -- add the non-blocking reporter + a
+`record_inference(...)` after the prediction (latency, confidence, input length).
+
+## Step 4 -- (optional) container + deploy path
+- If `--registry NAME/ns`: show the governed push --
+  `docker build -t registry.openrun.gladia.io/<ns>/<name>:v1 . && openrunner
+  registry login && docker push ...` (the OpenRunner broker proxies to the org's
+  upstream; see `/openrunner:registry`).
+- Note the deploy path: `openrunner gpu run --image <that image> ...` today, and
+  the governed **Deployments** UI (image + GPU + min/max nodes) when available.
+
+## Step 5 -- verify it runs
+- `uvicorn app.main:app` locally (or `python -m app`), `curl /health` -> ok,
+  `curl -X POST /predict` with a sample payload -> a real response.
+- Report the run command, the curl example, and the build/push/deploy one-liners.
+
+## Guardrails
+- Load the model once (startup), not per request; run heavy inference off the
+  event loop.
+- Type the API (pydantic) and add `/health` so it's deploy/LB-ready.
+- Read config (model ref, keys, port) from env -- never hardcode secrets.
+- Keep it minimal + runnable; match the repo's language/stack if one exists.
+"""
+
+
 def install_claude_code() -> list[str]:
     """Install commands in ~/.claude/commands/openrunner/."""
     cmd_dir = Path.home() / ".claude" / "commands" / "openrunner"
@@ -2753,6 +2888,8 @@ def install_claude_code() -> list[str]:
         "launch-gpu.md": LAUNCH_GPU_CMD,
         "registry.md": REGISTRY_CMD,
         "drift.md": DRIFT_CMD,
+        "drift-install.md": DRIFT_INSTALL_CMD,
+        "build-api.md": BUILD_API_CMD,
     }
 
     files = []
@@ -2956,6 +3093,8 @@ def _install_all_commands_to_dir(cmd_dir: Path, prefix: str = "openrunner:") ->
         "launch-gpu.md": LAUNCH_GPU_CMD,
         "registry.md": REGISTRY_CMD,
         "drift.md": DRIFT_CMD,
+        "drift-install.md": DRIFT_INSTALL_CMD,
+        "build-api.md": BUILD_API_CMD,
     }
 
     files = []

{openrunner_sdk-2.37.5 → openrunner_sdk-2.37.7}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "openrunner-sdk"
-version = "2.37.5"
+version = "2.37.7"
 description = "OpenRunner SDK - W&B-compatible ML experiment tracking client"
 readme = "README.md"
 license = {text = "MIT"}