Add resource group billing support (#2571)
* ML Intern: bill jobs and sandboxes to the user's billing organisation
The billing setting redirected inference spend only (#2559): X-HF-Bill-To
went on the OpenAI client, and the jobs and sandboxes the mode launches
billed the user's own account. The Hub has no bill-to header for Jobs. A
job is charged to the namespace it is created under, and the Hub MCP
server takes that namespace as an argument — `namespace` on every hf_jobs
operation, `--namespace` on hf_sandbox create — defaulting to the signed-in
user. Headers on the MCP transport never reach the Jobs API.
So the setting becomes an argument on the way out. executeToolCalls gains
a rewrite hook applied at parse time, before the guards price the call and
before the UI's Call update is built, so all three see the same arguments.
For Hub servers in an ML Intern conversation it sets the namespace on every
hf_jobs call and on hf_sandbox create. Submissions are overwritten, since
who pays is the setting and not the model's call; reads are filled in only
when the model named none, so a job living elsewhere can still be read by
its URL. Nested sub-agents get the same rewrite, which is what lets
check_job find an org-owned job from a bare id. The rewrite stands down
when an operator-pinned Hub token launches the work, since that account
cannot write to the user's organisations.
The session context stamps BillTo after User, and the jobs contract puts
"Who pays" on the pre-flight list. The settings copy that #2559 narrowed
now says the setting covers ML Intern's jobs and sandboxes too, in builds
that ship the mode.
* Rewrite the calls, not the dispatch; one --namespace; no pinned exception
Review follow-ups on the billing-namespace rewrite.
The rewrite now applies to the tool calls themselves, ahead of everything
that reads them: the assistant tool_calls message the model sees next
round, the argumentsRaw the Call update persists and replay prefers, the
guards and the dispatch. Applied only at dispatch, history said what the
model wrote while the server received something else, and a model that had
named another namespace on a submission could read the org's job back with
that stale value and 404. Nested sub-agents echo the rewritten arguments in
their assistant turn for the same reason.
hf_sandbox create now canonicalises every --namespace occurrence to one
final pair. The Hub's parser takes the option once and rejects a repeat, so
replacing only the first left a duplicated call to be refused.
The pinned-token exception is gone. It read the environment's server list
rather than the request's effective one, so a deployment whose preset ran
with the user's own credential could still have the setting suppressed, and
an authenticated Hub entry under another name suppressed it for a preset it
did not own. Beyond that, the heuristic is wrong in one direction or the
other: an operator's token may well belong to the organisation the user
picked. Whether a credential may bill the organisation is the Hub's call. A
refused submission is loud; a silently redirected charge is not.
* Add resource group billing targets
* Address resource group billing review
---------
Co-authored-by: pngwn <hello@pngwn.io>
