openrunner-sdk 2.41.6__tar.gz → 2.41.8__tar.gz

{openrunner_sdk-2.41.6 → openrunner_sdk-2.41.8}/.gitignore

@@ -153,6 +153,8 @@ activemq-data/
 # Environments
 .env
 .envrc
+.forge.env
+.forge-venv/
 
 # Docker secrets (real values — only examples tracked)
 secrets/

{openrunner_sdk-2.41.6 → openrunner_sdk-2.41.8}/PKG-INFO

@@ -1,10 +1,10 @@
-Metadata-Version: 2.4
+Metadata-Version: 2.5
 Name: openrunner-sdk
-Version: 2.41.6
+Version: 2.41.8
 Summary: OpenRunner SDK - W&B-compatible ML experiment tracking client
-Project-URL: Homepage, https://github.com/jqueguiner/openrunner
-Project-URL: Repository, https://github.com/jqueguiner/openrunner
-Project-URL: Issues, https://github.com/jqueguiner/openrunner/issues
+Project-URL: Homepage, https://github.com/gladiaio/openrunner
+Project-URL: Repository, https://github.com/gladiaio/openrunner
+Project-URL: Issues, https://github.com/gladiaio/openrunner/issues
 Author-email: JL Queguiner <jl@gladia.io>
 License: MIT
 Keywords: experiment-tracking,invention-disclosure,machine-learning,ml,mlops,patent,wandb
@@ -656,7 +656,7 @@ W&B env vars (`WANDB_API_KEY`, `WANDB_BASE_URL`) are also supported as fallback
 
 ## Self-Hosting
 
-OpenRunner is designed to be self-hosted. See the [main repo](https://github.com/jqueguiner/openrunner) for server setup with Docker Compose.
+OpenRunner is designed to be self-hosted. See the [main repo](https://github.com/gladiaio/openrunner) for server setup with Docker Compose.
 
 ## License
 

{openrunner_sdk-2.41.6 → openrunner_sdk-2.41.8}/README.md

@@ -541,7 +541,7 @@ W&B env vars (`WANDB_API_KEY`, `WANDB_BASE_URL`) are also supported as fallback
 
 ## Self-Hosting
 
-OpenRunner is designed to be self-hosted. See the [main repo](https://github.com/jqueguiner/openrunner) for server setup with Docker Compose.
+OpenRunner is designed to be self-hosted. See the [main repo](https://github.com/gladiaio/openrunner) for server setup with Docker Compose.
 
 ## License
 

{openrunner_sdk-2.41.6 → openrunner_sdk-2.41.8}/openrunner/CLAUDE.md

@@ -176,3 +176,45 @@ When the user asks about papers, research, or sessions:
 - Use `mcp__openrunner__openrunner_search_research` for research plans
 - Use `mcp__openrunner__openrunner_search_sessions` for AI session history
 - Use `mcp__openrunner__openrunner_update_paper` to modify paper sections
+
+## Container registry & serverless deployment
+
+Register a container registry (Docker Hub, GHCR, Google Artifact Registry, AWS
+ECR, Azure ACR, OVH/Harbor) once; the upstream credential is stored encrypted
+server-side and the OpenRunner **broker** proxies pull/push — the client never
+holds the upstream key.
+
+```
+openrunner registry add --name "Harbor ML" --url REG_URL --username U --token T --namespace NS
+openrunner registry set-default <id>     # broker fallback when the repo path is ambiguous
+openrunner registry login                # docker login the broker (short-lived token)
+docker push <registry_host>/<namespace>/<project-slug>:<user>-<name>-<tag>
+```
+
+Repo convention (`canonical_image_name`): `{namespace}/{project_slug}`, tag leads
+with the user — e.g. `model-team/ner-email:jl-int8-v1`.
+
+**Images link to a project = the deploy gate.** An image pushed **through the
+broker** is **auto-linked** to its project on the manifest PUT (project resolved
+from the repo's project-slug segment), so it appears under the project's
+**Registry** tab (artifact page) and the project-overview **Registry** panel with
+no manual step. Direct-to-upstream pushes (or registries that hide their catalog,
+e.g. OVH Harbor robots can't list `_catalog`) must be linked explicitly:
+
+```
+openrunner deploy link IMAGE -p ORG/NAME [--registry-id UUID]
+openrunner deploy images -p ORG/NAME     # list linked images
+openrunner deploy gpus  -p ORG/NAME      # deployable GPU offers
+openrunner deploy create ... ; openrunner deploy scale <id> N ; openrunner deploy call <id> ...
+```
+API: `GET/POST /projects/{id}/images`, `.../deployments`. SDK:
+`client.list_project_images(pid)`, `client.link_project_image(pid, image, registry_id=)`.
+Slash: `/openrunner:registry`, `/openrunner:deploy`, `/openrunner:build-api`.
+
+## Full LLM map: llms.txt
+
+The complete end-to-end, LLM-oriented map of OpenRunner (dataset → run
+instrumentation → GPU training → sweep → registry → deploy → handover) lives at
+**https://openrun.gladia.io/llms-full.txt** (source: `src/web/public/llms-full.txt`),
+with a short index at **/llms.txt**. Read the full doc to ground yourself in the
+real commands + conventions before driving OpenRunner end-to-end for a new project.

{openrunner_sdk-2.41.6 → openrunner_sdk-2.41.8}/openrunner/__init__.py

@@ -93,6 +93,7 @@ import openrunner.datasets as datasets
 from openrunner.datasets import (
     DatasetInfo,
     DatasetsClient,
+    DeriveIncomplete,
     create_dataset,
     dataset_info,
     index_dataset,
@@ -101,6 +102,7 @@ from openrunner.datasets import (
     link_project,
     load_dataset,
     add_derivation,
+    derive_by_ids,
     derive_by_query,
     derived_rows,
     keyword_expand,
@@ -112,11 +114,20 @@ from openrunner.datasets import (
     word_lookup,
     set_dataset_card,
     set_storage_policy,
+    update_dataset,
     upload_file,
     upload_sharded,
     upload_folder,
 )
 from openrunner.config import Config
+from openrunner.llms import (
+    llms_txt,
+    llms_txt_path,
+    LLMS_TXT_URL,
+    LLMS_FULL_TXT_URL,
+    LLMS_TXT_PATH,
+    LLMS_FULL_TXT_PATH,
+)
 from openrunner.model import Model
 from openrunner.prompt import MessagesPrompt, Prompt, StringPrompt
 from openrunner.launch import LaunchJob, launch, from_run as _launch_from_run
@@ -843,11 +854,21 @@ def alert(
         return None
 
 
-def log_artifact(artifact: Artifact) -> dict[str, Any] | None:
+def log_artifact(
+    artifact: "Artifact | str | Path",
+    *,
+    name: str | None = None,
+    type: str | None = None,
+    aliases: list[str] | None = None,
+) -> dict[str, Any] | None:
     """Upload an artifact to the active run. Never raises.
 
     Args:
-        artifact: The Artifact object with files added via add_file/add_dir.
+        artifact: An Artifact with files added via add_file/add_dir, OR a path
+            to a file or directory (W&B-style), built into an Artifact for you.
+        name: Artifact name when ``artifact`` is a path.
+        type: Advisory type when ``artifact`` is a path.
+        aliases: Aliases to set on the created version.
 
     Returns:
         Server response dict with version info, or None on failure.
@@ -856,7 +877,9 @@ def log_artifact(artifact: Artifact) -> dict[str, Any] | None:
         if _active_run is None:
             logger.warning("openrunner.log_artifact(): no active run")
             return None
-        return _active_run.log_artifact(artifact)
+        return _active_run.log_artifact(
+            artifact, name=name, type=type, aliases=aliases
+        )
     except Exception as e:
         logger.warning("openrunner.log_artifact() failed: %s", e)
         return None

{openrunner_sdk-2.41.6 → openrunner_sdk-2.41.8}/openrunner/artifact.py

@@ -29,6 +29,55 @@ def _sha256_file(path: Path, chunk_size: int = 8192) -> str:
     return h.hexdigest()
 
 
+def coerce_artifact(
+    source: "Artifact | str | Path",
+    *,
+    name: str | None = None,
+    type: str | None = None,
+    description: str | None = None,
+    metadata: dict[str, Any] | None = None,
+) -> "Artifact":
+    """Return an Artifact, building one from a path if that's what was given.
+
+    ``log_artifact`` historically took a fully built ``Artifact``. Users coming
+    from W&B -- which this repo actively courts, see
+    ``examples/migrate-from-wandb/`` -- write the path form instead::
+
+        run.log_artifact("out/final", name="my-model", type="model")
+
+    and used to get ``TypeError: unexpected keyword argument 'name'``. Accept
+    both. A directory becomes ``add_dir``, a file ``add_file``; ``name``
+    defaults to the path's own name so the common case needs no kwargs.
+    """
+    if isinstance(source, Artifact):
+        # Already built: kwargs only fill gaps, they never silently override
+        # what the caller put on the object.
+        if name and not source.name:
+            source.name = name
+        if type and source.type is None:
+            source.type = type
+        return source
+
+    path = Path(source)
+    if not path.exists():
+        raise FileNotFoundError(f"artifact path does not exist: {path}")
+    art = Artifact(
+        name or path.name or path.stem,
+        type,
+        description,
+        metadata,
+    )
+    if path.is_dir():
+        # Existing add_dir semantics: files are prefixed with the directory
+        # name. Kept as-is so a coerced artifact lays out identically to a
+        # hand-built one -- changing it would silently move every existing
+        # caller's files.
+        art.add_dir(str(path))
+    else:
+        art.add_file(str(path))
+    return art
+
+
 class Artifact:
     """An untyped, versioned bucket of files for experiment tracking.
 

{openrunner_sdk-2.41.6 → openrunner_sdk-2.41.8}/openrunner/cli.py

@@ -145,6 +145,45 @@ def _save_settings(settings: dict[str, Any]) -> None:
     )
 
 
+def _resolve_api_key(settings: dict[str, Any] | None = None) -> str:
+    """API key with the same precedence the SDK uses: env, then the
+    session-synced ~/.openrunner/session_config.json, then settings.json.
+
+    Historically the CLI read settings.json FIRST and most subcommands never
+    looked at session_config at all — so a stale key in settings.json made
+    `openrunner catalog ...` fail with "API key has expired" while
+    `openrunner datasets ...` (SDK-backed) worked with the fresh session key.
+    """
+    try:
+        from openrunner.settings import _global_creds
+        session = _global_creds()
+    except Exception:
+        session = {}
+    return (
+        os.environ.get("OPENRUNNER_API_KEY")
+        or os.environ.get("OPENRUN_API_KEY")
+        or session.get("api_key")
+        or (settings or _load_settings()).get("api_key")
+        or ""
+    )
+
+
+def _resolve_base_url(settings: dict[str, Any] | None = None) -> str:
+    """Base URL with the same precedence chain as ``_resolve_api_key``."""
+    try:
+        from openrunner.settings import _global_creds
+        session = _global_creds()
+    except Exception:
+        session = {}
+    return (
+        os.environ.get("OPENRUNNER_BASE_URL")
+        or os.environ.get("OPENRUN_BASE_URL")
+        or session.get("base_url")
+        or (settings or _load_settings()).get("base_url")
+        or ""
+    )
+
+
 # ---------------------------------------------------------------------------
 # CLI group
 # ---------------------------------------------------------------------------
@@ -420,7 +459,7 @@ def sync(
         --sync-tensorboard                Import TensorBoard event files as metrics
     """
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = settings.get("base_url", "http://localhost:8000")
 
     if not api_key:
@@ -545,7 +584,7 @@ def ls(project: str | None) -> None:
     in the specified project.
     """
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = settings.get("base_url", "http://localhost:8000")
 
     if not api_key:
@@ -607,7 +646,7 @@ def _get_client() -> "APIClient":
     import os
 
     settings = _load_settings()
-    api_key = os.environ.get("OPENRUNNER_API_KEY") or settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = os.environ.get("OPENRUNNER_BASE_URL") or settings.get(
         "base_url", "http://localhost:8000"
     )
@@ -863,8 +902,11 @@ def artifact_list(project: str | None, project_opt: str | None) -> None:
 
 @artifact.command("get")
 @click.argument("name")
-@click.option("--root", "-r", default=".", help="Download directory (default: .)")
-def artifact_get(name: str, root: str) -> None:
+@click.option("--root", "-r", "--output", "-o", "root", default=".",
+              help="Download directory (default: .). --output/-o is an alias.")
+@click.option("--project", "-p", default=None,
+              help="Scope the lookup to ORG/PROJECT (else searches all accessible projects)")
+def artifact_get(name: str, root: str, project: str | None = None) -> None:
     """Download an artifact to a local directory.
 
     NAME can use colon syntax: my-dataset:latest or my-model:v3.
@@ -886,8 +928,16 @@ def artifact_get(name: str, root: str) -> None:
         else:
             alias = ref
 
-    # Find artifact by listing all accessible projects
+    # Find artifact by listing accessible projects. When --project is given we
+    # only search that one (faster, and disambiguates a name shared across
+    # projects); otherwise fall back to scanning every accessible project.
     projects = client.list_projects()
+    if project:
+        projects = [
+            p for p in projects
+            if project in (p.get("id"), p.get("name"), p.get("slug"),
+                           f"{p.get('org_slug')}/{p.get('slug')}")
+        ] or projects
     artifact_detail = None
     target_version_id = None
 
@@ -1135,9 +1185,12 @@ def cache_cleanup(max_size: float | None) -> None:
 
 @main.command("download-artifact")
 @click.argument("name")
-@click.option("--root", "-r", default=".", help="Download directory (default: .)")
+@click.option("--root", "-r", "--output", "-o", "root", default=".",
+              help="Download directory (default: .). --output/-o is an alias.")
+@click.option("--project", "-p", default=None,
+              help="Scope the lookup to ORG/PROJECT (else searches all accessible projects)")
 @click.pass_context
-def download_artifact_cmd(ctx: click.Context, name: str, root: str) -> None:
+def download_artifact_cmd(ctx: click.Context, name: str, root: str, project: str | None) -> None:
     """Download an artifact to a local directory.
 
     NAME can use colon syntax: my-dataset:latest or my-model:v3.
@@ -1145,7 +1198,7 @@ def download_artifact_cmd(ctx: click.Context, name: str, root: str) -> None:
 
     This is a top-level alias for `openrunner artifact get`.
     """
-    ctx.invoke(artifact_get, name=name, root=root)
+    ctx.invoke(artifact_get, name=name, root=root, project=project)
 
 
 @main.command("upload-artifact")
@@ -1520,7 +1573,7 @@ def launch(
     from openrunner.launch import launch as launch_fn
 
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     if not api_key:
         click.echo("Error: Not logged in. Run 'openrunner login' first.", err=True)
         raise SystemExit(1)
@@ -1586,7 +1639,7 @@ def launch(
 def jobs(project: str, state: str | None) -> None:
     """List jobs for a project."""
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = settings.get("base_url", "http://localhost:8000")
 
     if not api_key:
@@ -1642,7 +1695,7 @@ def job_logs(job_id: str) -> None:
     JOB_ID is the UUID of the job.
     """
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = settings.get("base_url", "http://localhost:8000")
 
     if not api_key:
@@ -2230,7 +2283,7 @@ def docker(
     import subprocess
 
     settings = _load_settings()
-    api_key = os.environ.get("OPENRUNNER_API_KEY") or settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = os.environ.get("OPENRUNNER_BASE_URL") or settings.get(
         "base_url", "http://localhost:8000"
     )
@@ -3221,6 +3274,24 @@ def version_cmd(check: bool) -> None:
         click.echo("Up to date.")
 
 
+@main.command("llms")
+@click.option("--full", is_flag=True, help="Print the complete guide (llms-full.txt) instead of the index")
+@click.option("--path", "show_path", is_flag=True, help="Print the bundled file path instead of its content")
+def llms_cmd(full: bool, show_path: bool) -> None:
+    """Print the bundled LLM-oriented OpenRunner doc.
+
+    The short index by default, or the complete end-to-end guide with --full.
+    Bundled in the package (works offline); also served at /llms.txt and
+    /llms-full.txt on the instance.
+    """
+    from openrunner import llms as _llms
+
+    if show_path:
+        click.echo(_llms.llms_txt_path(full=full))
+    else:
+        click.echo(_llms.llms_txt(full=full))
+
+
 @main.command("_update_nudge", hidden=True)
 def update_nudge_cmd() -> None:
     """Print ONE update-hint line if a newer SDK exists, else nothing. Cheap:
@@ -3547,8 +3618,8 @@ def catalog_tables(org: str):
     """List catalog tables and their row counts."""
     settings = _load_settings()
     client = APIClient(
-        base_url=settings.get("base_url", os.environ.get("OPENRUNNER_BASE_URL", "")),
-        api_key=settings.get("api_key", os.environ.get("OPENRUNNER_API_KEY", "")),
+        base_url=_resolve_base_url(settings),
+        api_key=_resolve_api_key(settings),
     )
     resp = client._request("get", f"/organizations/{org}/catalog/status")
     if resp.status_code != 200:
@@ -3586,8 +3657,8 @@ def catalog_init(org: str):
     """Initialize catalog tables on the configured storage connection."""
     settings = _load_settings()
     client = APIClient(
-        base_url=settings.get("base_url", os.environ.get("OPENRUNNER_BASE_URL", "")),
-        api_key=settings.get("api_key", os.environ.get("OPENRUNNER_API_KEY", "")),
+        base_url=_resolve_base_url(settings),
+        api_key=_resolve_api_key(settings),
     )
     resp = client._request("post", f"/organizations/{org}/catalog/init")
     if resp.status_code != 200:
@@ -3608,8 +3679,8 @@ def catalog_query(org: str, table: str, where: str, limit: int, offset: int, fmt
     """Query rows from a catalog table."""
     settings = _load_settings()
     client = APIClient(
-        base_url=settings.get("base_url", os.environ.get("OPENRUNNER_BASE_URL", "")),
-        api_key=settings.get("api_key", os.environ.get("OPENRUNNER_API_KEY", "")),
+        base_url=_resolve_base_url(settings),
+        api_key=_resolve_api_key(settings),
     )
     params = {"limit": limit, "offset": offset}
     if where:
@@ -3655,8 +3726,8 @@ def catalog_export(org: str, table: str, fmt: str, where: str, limit: int, outpu
     """Export catalog table data to file or stdout."""
     settings = _load_settings()
     client = APIClient(
-        base_url=settings.get("base_url", os.environ.get("OPENRUNNER_BASE_URL", "")),
-        api_key=settings.get("api_key", os.environ.get("OPENRUNNER_API_KEY", "")),
+        base_url=_resolve_base_url(settings),
+        api_key=_resolve_api_key(settings),
     )
     params: dict[str, Any] = {"format": fmt}
     if where:
@@ -3698,8 +3769,8 @@ def catalog_upload(org: str, table: str, path: str, validate: bool):
 
     settings = _load_settings()
     client = APIClient(
-        base_url=settings.get("base_url", os.environ.get("OPENRUNNER_BASE_URL", "")),
-        api_key=settings.get("api_key", os.environ.get("OPENRUNNER_API_KEY", "")),
+        base_url=_resolve_base_url(settings),
+        api_key=_resolve_api_key(settings),
     )
 
     # Collect files
@@ -3760,6 +3831,56 @@ def catalog_upload(org: str, table: str, path: str, validate: bool):
     click.echo(f"\nDone. {total_rows} total rows uploaded to '{table}'.")
 
 
+@catalog.command("merge")
+@click.option("--org", required=True, help="Organization ID or slug")
+@click.option("--table", required=True, help="Table name (e.g. transcriptions)")
+@click.option("--key", default="request_id", show_default=True,
+              help="Match column for the upsert")
+@click.option("--insert", is_flag=True, default=False,
+              help="Also insert rows whose key has no match (default: skip them)")
+@click.option("--batch", default=500, show_default=True, help="Rows per request")
+@click.argument("path", type=click.Path(exists=True))
+def catalog_merge(org: str, table: str, key: str, insert: bool, batch: int, path: str):
+    """Upsert JSONL rows into a catalog table by key (enrichment merge).
+
+    Unlike `catalog upload` (append-only), matched rows get ONLY the uploaded
+    columns updated; new columns are created automatically (nullable, typed
+    from the first non-null value). Nested values must be pre-serialized to
+    JSON strings.
+
+    Example:
+      openrunner catalog merge --org my-org --table transcriptions \\
+          --key request_id enriched.jsonl
+    """
+    settings = _load_settings()
+    client = APIClient(
+        base_url=_resolve_base_url(settings),
+        api_key=_resolve_api_key(settings),
+    )
+    lines = [ln for ln in Path(path).read_text(encoding="utf-8").splitlines() if ln.strip()]
+    total = 0
+    new_cols: set = set()
+    for start in range(0, len(lines), max(1, batch)):
+        chunk = lines[start:start + max(1, batch)]
+        resp = client._request(
+            "POST",
+            f"/organizations/{org}/catalog/tables/{table}/merge?key={key}"
+            + ("&insert=true" if insert else ""),
+            content=("\n".join(chunk)).encode("utf-8"),
+            headers={"Content-Type": "application/x-ndjson"},
+        )
+        if resp.status_code not in (200, 201):
+            click.echo(f"Merge failed at row {start + 1}: {resp.text}", err=True)
+            sys.exit(1)
+        result = resp.json()
+        total += result.get("rows_merged", 0)
+        new_cols.update(result.get("new_columns", []))
+        click.echo(f"  merged {total}/{len(lines)}")
+    if new_cols:
+        click.echo(f"New columns created: {', '.join(sorted(new_cols))}")
+    click.echo(f"Done. {total} rows merged into '{table}'.")
+
+
 # ---------------------------------------------------------------------------
 # patent-scan command
 # ---------------------------------------------------------------------------
@@ -3805,7 +3926,7 @@ def patent_scan(
     from openrunner.patent_scan import scan_commit, _run_git
 
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = settings.get("base_url", "https://api.openrun.gladia.io")
     project = project or settings.get("project")
 
@@ -3922,7 +4043,7 @@ def patent_lab(project: str | None, min_score: int, status: str | None, limit: i
         openrunner patent-lab --min-score 70 --status detected
     """
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = settings.get("base_url", "https://api.openrun.gladia.io")
     project = project or settings.get("project")
 
@@ -4340,7 +4461,7 @@ def gpu_credentials_add(org_id: str, provider: str, provider_key: str | None,
     from openrunner.gpu.api_integration import GpuAPIClient
 
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = settings.get("base_url", "http://localhost:8000")
     if not api_key:
         click.echo("Error: Not logged in. Run 'openrunner login' first.", err=True)
@@ -4361,7 +4482,7 @@ def gpu_credentials_ls() -> None:
     from openrunner.gpu.api_integration import GpuAPIClient
 
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = settings.get("base_url", "http://localhost:8000")
     if not api_key:
         click.echo("Error: Not logged in.", err=True)
@@ -4398,9 +4519,10 @@ def gpu_run(command, provider, gpu, gpu_count, image, disk_gb, env, ssh_keys, pr
 
     Forge is serverless (no pod / no SSH): COMMAND is the App script and it runs
     through the forge client, streaming the fleet's logs. The GPU is declared in
-    the script, so --gpu is not used.
+    the script, so --gpu is not used. -e KEY=VALUE reaches the App's
+    local_entrypoint as an environment variable.
 
-        openrunner gpu run --provider forge get_started.py
+        openrunner gpu run --provider forge -e EPOCHS=3 get_started.py
 
     Example:
 
@@ -4415,7 +4537,7 @@ def gpu_run(command, provider, gpu, gpu_count, image, disk_gb, env, ssh_keys, pr
         raise SystemExit(1)
 
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = settings.get("base_url")
     if not api_key:
         click.echo("Error: Not logged in. Run 'openrunner login' first.", err=True)
@@ -4495,7 +4617,7 @@ def gpu_run(command, provider, gpu, gpu_count, image, disk_gb, env, ssh_keys, pr
                 from openrunner.gpu.runner import run_engine_serverside_sync
                 result = run_engine_serverside_sync(
                     provider=provider, command=command, project=project,
-                    emit=lambda m: click.echo(m),
+                    env=env_dict, emit=lambda m: click.echo(m),
                 )
         except Exception as exc:  # noqa: BLE001
             click.echo(f"gpu run failed: {exc}", err=True)
@@ -4585,7 +4707,7 @@ def _registry_http():
     import httpx
 
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = settings.get("base_url", "http://localhost:8000")
     if not api_key:
         click.echo("Error: Not logged in. Run 'openrunner login' first.", err=True)
@@ -4783,7 +4905,7 @@ def registry_logout() -> None:
 def _drift_client_project(project: str | None):
     """Return (APIClient, project_id) resolving project name/slug -> UUID."""
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = settings.get("base_url", "http://localhost:8000")
     if not api_key:
         click.echo("Error: Not logged in. Run 'openrunner login' first.", err=True)
@@ -5120,7 +5242,7 @@ def deploy_call(deployment_id, path, project, method, data, headers) -> None:
       openrunner deploy call <id> predict -p ORG/NAME -d '{"text":"hi"}'
     """
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = settings.get("base_url", "http://localhost:8000").rstrip("/")
     if not api_key:
         click.echo("Error: Not logged in.", err=True); raise SystemExit(1)
@@ -5164,7 +5286,7 @@ def deploy_call(deployment_id, path, project, method, data, headers) -> None:
 def _plain_client():
     """Build an APIClient from settings, or exit if not logged in."""
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = settings.get("base_url", "http://localhost:8000")
     if not api_key:
         click.echo("Error: Not logged in. Run 'openrunner login' first.", err=True)
@@ -5388,7 +5510,7 @@ def runner_start(org, name, labels, gpu, gpu_count, poll_interval, once, token,
         if not org or not name:
             click.echo("Error: pass --org and --name to register, or --token to run with a pre-minted token.", err=True)
             raise SystemExit(1)
-        api_key = settings.get("api_key")
+        api_key = _resolve_api_key(settings)
         if not api_key:
             click.echo("Error: Not logged in. Run 'openrunner login' first (or pass --token).", err=True)
             raise SystemExit(1)
@@ -5645,7 +5767,7 @@ def runner_launch(org, name, provider, gpu, gpu_count, labels, image, web, poll_
     from openrunner.gpu.api_integration import GpuAPIClient
 
     settings = _load_settings()
-    api_key = settings.get("api_key")
+    api_key = _resolve_api_key(settings)
     base_url = settings.get("base_url", "http://localhost:8000").rstrip("/")
     if not api_key:
         click.echo("Error: Not logged in. Run 'openrunner login' first.", err=True)