plato-sdk-v2 2.0.64__py3-none-any.whl → 2.3.4__py3-none-any.whl

plato/v1/cli/sandbox.py

@@ -17,12 +17,8 @@ from urllib.parse import quote
 
 import typer
 import yaml
-from playwright.async_api import async_playwright
 from rich.logging import RichHandler
 
-# UUID pattern for detecting artifact IDs in colon notation
-UUID_PATTERN = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.IGNORECASE)
-
 from plato._generated.api.v1.gitea import (
     create_simulator_repository,
     get_accessible_simulators,
@@ -51,6 +47,7 @@ from plato._generated.api.v2.sessions import (
     state as sessions_state,
 )
 from plato._generated.models import (
+    AppSchemasBuildModelsSetupSandboxRequest,
     AppSchemasBuildModelsSimConfigCompute,
     AppSchemasBuildModelsSimConfigDataset,
     AppSchemasBuildModelsSimConfigMetadata,
@@ -58,7 +55,6 @@ from plato._generated.models import (
     ExecuteCommandRequest,
     Flow,
     SetupRootPasswordRequest,
-    SetupSandboxRequest,
     VMManagementRequest,
 )
 from plato.v1.cli.ssh import setup_ssh_for_sandbox
@@ -74,11 +70,16 @@ from plato.v1.cli.utils import (
     require_sandbox_state,
     save_sandbox_state,
 )
+from plato.v1.cli.verify import sandbox_verify_app
 from plato.v2.async_.flow_executor import FlowExecutor
 from plato.v2.sync.client import Plato as PlatoV2
 from plato.v2.types import Env, SimConfigCompute
 
+# UUID pattern for detecting artifact IDs in colon notation
+UUID_PATTERN = re.compile(r"^[0-9a-f]{8}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{4}-[0-9a-f]{12}$", re.IGNORECASE)
+
 sandbox_app = typer.Typer(help="Manage sandboxes for simulator development")
+sandbox_app.add_typer(sandbox_verify_app, name="verify")
 
 
 def format_public_url_with_router_target(public_url: str | None, service_name: str | None) -> str | None:
@@ -423,9 +424,10 @@ def sandbox_start(
                         listeners=listeners_dict,
                     )
 
-                    setup_request = SetupSandboxRequest(
+                    dataset_value = dataset_name or state_extras.get("dataset", "base")
+                    setup_request = AppSchemasBuildModelsSetupSandboxRequest(
                         service=sim_name or "",
-                        dataset=dataset_name or state_extras.get("dataset", "base") or "",
+                        dataset=str(dataset_value) if dataset_value else "",
                         plato_dataset_config=dataset_config_obj,
                         ssh_public_key=ssh_public_key,
                     )
@@ -514,7 +516,6 @@ def sandbox_start(
                 console.print(f"  [cyan]Public URL:[/cyan]  {display_url}")
             if ssh_host and ssh_config_path:
                 console.print(f"  [cyan]SSH:[/cyan]         ssh -F {ssh_config_path} {ssh_host}")
-            console.print("  [cyan]Docker:[/cyan]      export DOCKER_HOST=unix:///var/run/docker-user.sock")
             console.print(f"\n[dim]State saved to {SANDBOX_FILE}[/dim]")
 
     except Exception as e:
@@ -1047,6 +1048,9 @@ def sandbox_start_worker(
                     console.print(f"[cyan]Waiting for worker to be ready (timeout: {wait_timeout}s)...[/cyan]")
 
                 session_id = state.get("session_id")
+                if not session_id:
+                    console.print("[red]Session ID not found in .sandbox.yaml[/red]")
+                    raise typer.Exit(1)
                 start_time = time.time()
                 poll_interval = 10  # seconds between polls
                 worker_ready = False
@@ -1530,17 +1534,31 @@ def sandbox_flow(
             console.print(f"[red]❌ Failed to fetch flows from API: {e}[/red]")
             raise typer.Exit(1) from e
 
+    # At this point, url and flow_obj must be set (validated above)
+    if not url:
+        console.print("[red]❌ URL is not set[/red]")
+        raise typer.Exit(1)
+    if not flow_obj:
+        console.print("[red]❌ Flow object could not be loaded[/red]")
+        raise typer.Exit(1)
+
     console.print(f"[cyan]URL: {url}[/cyan]")
     console.print(f"[cyan]Flow name: {flow_name}[/cyan]")
 
+    # Capture for closure (narrowed types)
+    _url: str = url
+    _flow_obj: Flow = flow_obj
+
     async def _run():
+        from playwright.async_api import async_playwright
+
         browser = None
         try:
             async with async_playwright() as p:
                 browser = await p.chromium.launch(headless=False)
                 page = await browser.new_page()
-                await page.goto(url)
-                executor = FlowExecutor(page, flow_obj, screenshots_dir, log=_flow_logger)
+                await page.goto(_url)
+                executor = FlowExecutor(page, _flow_obj, screenshots_dir, log=_flow_logger)
                 await executor.execute()
                 console.print("[green]✅ Flow executed successfully[/green]")
         except Exception as e:
@@ -1601,8 +1619,23 @@ def sandbox_state_cmd(
     def check_mutations(result_dict: dict) -> tuple[bool, bool, str | None]:
         """Check if result has mutations or errors. Returns (has_mutations, has_error, error_msg)."""
         if isinstance(result_dict, dict):
-            if "error" in result_dict:
-                return False, True, result_dict.get("error")
+            # Check for state
+            state = result_dict.get("state", {})
+            if isinstance(state, dict):
+                # Check for error wrapped in state (from API layer transformation)
+                if "error" in state:
+                    return False, True, state["error"]
+                # Check for db state
+                db_state = state.get("db", {})
+                if isinstance(db_state, dict):
+                    mutations = db_state.get("mutations", [])
+                    if mutations:
+                        return True, False, None
+                    # Also check audit_log_count
+                    audit_count = db_state.get("audit_log_count", 0)
+                    if audit_count > 0:
+                        return True, False, None
+            # Check top-level mutations as fallback
             mutations = result_dict.get("mutations", [])
             if mutations:
                 return True, False, None
@@ -1703,6 +1736,148 @@ def sandbox_state_cmd(
         raise typer.Exit(1)
 
 
+@sandbox_app.command(name="clear-audit")
+def sandbox_clear_audit(
+    config_path: Path | None = typer.Option(None, "--config-path", help="Path to plato-config.yml"),
+    dataset: str = typer.Option("base", "--dataset", "-d", help="Dataset name"),
+    json_output: bool = typer.Option(False, "--json", "-j", help="Output as JSON"),
+):
+    """
+    Clear the audit_log table(s) in the sandbox database.
+
+    Truncates all audit_log tables to reset mutation tracking. Use this after
+    initial setup/login to clear any mutations before running a clean login flow.
+
+    REQUIRES:
+
+        .sandbox.yaml in current directory (created by 'plato sandbox start')
+        plato-config.yml with database listener config
+
+    USAGE:
+
+        plato sandbox clear-audit                # Uses plato-config.yml in cwd
+        plato sandbox clear-audit -d base        # Specify dataset
+        plato sandbox clear-audit --json         # JSON output
+
+    WORKFLOW POSITION:
+
+        1. plato sandbox start -c
+        2. plato sandbox start-services
+        3. plato sandbox start-worker --wait
+        4. (agent does initial login/setup, generating mutations)
+        5. plato sandbox clear-audit            ← you are here
+        6. plato sandbox flow                   ← clean login flow
+        7. plato sandbox state --verify-no-mutations  ← should pass now
+        8. plato sandbox snapshot
+    """
+    state = require_sandbox_state()
+
+    # Get SSH info
+    ssh_host = state.get("ssh_host")
+    ssh_config_path = state.get("ssh_config_path")
+
+    if not ssh_host or not ssh_config_path:
+        console.print("[red]❌ SSH not configured. Missing ssh_host or ssh_config_path in .sandbox.yaml[/red]")
+        raise typer.Exit(1)
+
+    # Find plato-config.yml
+    if not config_path:
+        config_path = Path.cwd() / "plato-config.yml"
+        if not config_path.exists():
+            config_path = Path.cwd() / "plato-config.yaml"
+        if not config_path.exists():
+            console.print("[red]❌ plato-config.yml not found[/red]")
+            raise typer.Exit(1)
+
+    with open(config_path) as f:
+        plato_config = yaml.safe_load(f)
+
+    # Get dataset config
+    datasets = plato_config.get("datasets", {})
+    if dataset not in datasets:
+        console.print(f"[red]❌ Dataset '{dataset}' not found[/red]")
+        raise typer.Exit(1)
+
+    dataset_config = datasets[dataset]
+    listeners = dataset_config.get("listeners", {})
+
+    # Find DB listeners
+    db_listeners = []
+    for name, listener in listeners.items():
+        if isinstance(listener, dict) and listener.get("type") == "db":
+            db_listeners.append((name, listener))
+
+    if not db_listeners:
+        console.print("[red]❌ No database listeners found in plato-config.yml[/red]")
+        console.print("[yellow]Expected: datasets.<dataset>.listeners.<name>.type = 'db'[/yellow]")
+        raise typer.Exit(1)
+
+    results = []
+
+    for name, db_config in db_listeners:
+        db_type = db_config.get("db_type", "postgresql").lower()
+        db_host = db_config.get("db_host", "127.0.0.1")
+        db_port = db_config.get("db_port", 5432 if db_type == "postgresql" else 3306)
+        db_user = db_config.get("db_user", "postgres" if db_type == "postgresql" else "root")
+        db_password = db_config.get("db_password", "")
+        db_database = db_config.get("db_database", "postgres")
+
+        if not json_output:
+            console.print(f"[cyan]Clearing audit_log for listener '{name}' ({db_type})...[/cyan]")
+
+        # Build SQL command based on db_type
+        if db_type == "postgresql":
+            sql_cmd = f"PGPASSWORD='{db_password}' psql -h {db_host} -p {db_port} -U {db_user} -d {db_database} -c 'TRUNCATE TABLE audit_log RESTART IDENTITY CASCADE'"
+        elif db_type in ("mysql", "mariadb"):
+            sql_cmd = f"mysql -h {db_host} -P {db_port} -u {db_user} -p'{db_password}' {db_database} -e 'SET FOREIGN_KEY_CHECKS=0; DELETE FROM audit_log; SET FOREIGN_KEY_CHECKS=1;'"
+        else:
+            if not json_output:
+                console.print(f"[yellow]⚠ Unsupported db_type '{db_type}' for listener '{name}'[/yellow]")
+            results.append({"listener": name, "success": False, "error": f"Unsupported db_type: {db_type}"})
+            continue
+
+        # Run via SSH
+        ret, stdout, stderr = _run_ssh_command(ssh_config_path, ssh_host, sql_cmd)
+
+        if ret == 0:
+            if not json_output:
+                console.print(f"[green]✅ Cleared audit_log for '{name}'[/green]")
+            results.append({"listener": name, "success": True})
+        else:
+            if not json_output:
+                console.print(f"[red]❌ Failed to clear audit_log for '{name}': {stderr}[/red]")
+            results.append({"listener": name, "success": False, "error": stderr})
+
+    # Call state API to refresh in-memory mutation cache
+    session_id = state.get("session_id")
+    api_key = require_api_key()
+    if session_id:
+        if not json_output:
+            console.print("[dim]Refreshing state cache...[/dim]")
+        try:
+            with get_http_client() as client:
+                sessions_state.sync(
+                    client=client,
+                    session_id=session_id,
+                    x_api_key=api_key,
+                )
+        except Exception as e:
+            if not json_output:
+                console.print(f"[yellow]⚠ Failed to refresh state cache: {e}[/yellow]")
+
+    if json_output:
+        console.print(json.dumps({"results": results}))
+    else:
+        # Summary
+        success_count = sum(1 for r in results if r["success"])
+        total = len(results)
+        if success_count == total:
+            console.print(f"\n[green]✅ All {total} audit logs cleared successfully[/green]")
+        else:
+            console.print(f"\n[yellow]⚠ {success_count}/{total} audit logs cleared[/yellow]")
+            raise typer.Exit(1)
+
+
 @sandbox_app.command(name="audit-ui")
 def sandbox_audit_ui():
     """
@@ -1752,31 +1927,24 @@ def sandbox_audit_ui():
 
 
 def _copy_files_respecting_gitignore(src_dir: Path, dst_dir: Path) -> None:
-    """Copy files from src to dst respecting .gitignore rules."""
-    # Copy .gitignore first if it exists
-    gitignore_src = src_dir / ".gitignore"
-    if gitignore_src.exists():
-        gitignore_dst = dst_dir / ".gitignore"
-        if not gitignore_dst.exists():
-            shutil.copy2(gitignore_src, gitignore_dst)
-
-    def should_copy(file_path: Path) -> bool:
-        """Check if file should be copied (not ignored by git)."""
-        base_name = file_path.name
-        # Skip .git directories and .plato-hub.json
-        if base_name.startswith(".git") or base_name == ".plato-hub.json":
-            return False
-        # Use git check-ignore to respect .gitignore rules
-        try:
-            result = subprocess.run(
-                ["git", "check-ignore", "-q", str(file_path)],
-                cwd=src_dir,
-                capture_output=True,
-            )
-            # git check-ignore returns 0 if path IS ignored, 1 if NOT ignored
-            return result.returncode != 0
-        except Exception:
+    """Copy files from src to dst, skipping .git/ and .plato-hub.json.
+
+    Note: This function intentionally does NOT respect .gitignore because
+    start-services needs to copy all workspace files to the VM, including
+    config files that might be gitignored locally (like docker-compose.yml
+    in a 'base/' directory).
+    """
+
+    def should_skip(rel_path: Path) -> bool:
+        """Check if path should be skipped."""
+        parts = rel_path.parts
+        # Skip anything inside .git/ directory
+        if ".git" in parts:
+            return True
+        # Skip .plato-hub.json
+        if rel_path.name == ".plato-hub.json":
             return True
+        return False
 
     # Walk through source directory
     for src_path in src_dir.rglob("*"):
@@ -1786,8 +1954,8 @@ def _copy_files_respecting_gitignore(src_dir: Path, dst_dir: Path) -> None:
         if str(rel_path) == ".":
             continue
 
-        # Check if should copy
-        if not should_copy(src_path):
+        # Check if should skip
+        if should_skip(rel_path):
             continue
 
         dst_path = dst_dir / rel_path
@@ -1973,6 +2141,34 @@ def sandbox_start_services(
 
     try:
         with get_http_client() as client:
+
+            def start_services_on_vm(repo_dir: str) -> list[dict[str, str]]:
+                """Start docker compose services on the VM."""
+                services_started: list[dict[str, str]] = []
+                for svc_name, svc_config in services_config.items():
+                    svc_type = svc_config.get("type", "")
+                    if svc_type == "docker-compose":
+                        compose_file = svc_config.get("file", "docker-compose.yml")
+                        compose_cmd = f"cd {repo_dir} && docker compose -f {compose_file} up -d"
+
+                        if not json_output:
+                            console.print(f"[cyan]  Starting docker compose service: {svc_name}...[/cyan]")
+
+                        ret, stdout, stderr = _run_ssh_command(ssh_config_path, ssh_host, compose_cmd)
+                        if ret != 0:
+                            console.print(f"[red]❌ Failed to start service '{svc_name}': {stderr}[/red]")
+                            raise typer.Exit(1)
+
+                        services_started.append({"name": svc_name, "type": "docker-compose", "file": compose_file})
+                        if not json_output:
+                            console.print(f"[green]  ✓ Started docker compose service: {svc_name}[/green]")
+                    else:
+                        if not json_output:
+                            console.print(
+                                f"[yellow]  ⚠ Skipped service '{svc_name}' (unknown type: {svc_type})[/yellow]"
+                            )
+                return services_started
+
             # Step 1: Get Gitea credentials
             if not json_output:
                 console.print("[cyan]Step 1: Getting Gitea credentials...[/cyan]")
@@ -2004,6 +2200,10 @@ def sandbox_start_services(
             if not json_output:
                 console.print("[cyan]Step 3: Getting/creating repository...[/cyan]")
 
+            if sim_id is None:
+                console.print("[red]❌ Simulator ID not available[/red]")
+                raise typer.Exit(1)
+
             if has_repo:
                 repo = get_simulator_repository.sync(client=client, simulator_id=sim_id, x_api_key=api_key)
             else:
@@ -2026,6 +2226,8 @@ def sandbox_start_services(
             if not json_output:
                 console.print("[cyan]Step 4: Pushing code to hub...[/cyan]")
 
+            repo_dir = f"/home/plato/worktree/{service_name}"
+
             with tempfile.TemporaryDirectory(prefix="plato-hub-") as temp_dir:
                 temp_repo = Path(temp_dir) / "repo"
 
@@ -2110,8 +2312,6 @@ def sandbox_start_services(
             if not json_output:
                 console.print("[cyan]Step 5: Cloning repo on VM...[/cyan]")
 
-            repo_dir = f"/home/plato/worktree/{service_name}"
-
             # Create worktree directory
             _run_ssh_command(ssh_config_path, ssh_host, "mkdir -p /home/plato/worktree")
 
@@ -2132,27 +2332,7 @@ def sandbox_start_services(
             if not json_output:
                 console.print("[cyan]Step 6: Starting services...[/cyan]")
 
-            services_started = []
-            for svc_name, svc_config in services_config.items():
-                svc_type = svc_config.get("type", "")
-                if svc_type == "docker-compose":
-                    compose_file = svc_config.get("file", "docker-compose.yml")
-                    compose_cmd = f"cd {repo_dir} && DOCKER_HOST=unix:///var/run/docker-user.sock docker compose -f {compose_file} up -d"
-
-                    if not json_output:
-                        console.print(f"[cyan]  Starting docker compose service: {svc_name}...[/cyan]")
-
-                    ret, stdout, stderr = _run_ssh_command(ssh_config_path, ssh_host, compose_cmd)
-                    if ret != 0:
-                        console.print(f"[red]❌ Failed to start service '{svc_name}': {stderr}[/red]")
-                        raise typer.Exit(1)
-
-                    services_started.append({"name": svc_name, "type": "docker-compose", "file": compose_file})
-                    if not json_output:
-                        console.print(f"[green]  ✓ Started docker compose service: {svc_name}[/green]")
-                else:
-                    if not json_output:
-                        console.print(f"[yellow]  ⚠ Skipped service '{svc_name}' (unknown type: {svc_type})[/yellow]")
+            services_started = start_services_on_vm(repo_dir)
 
             # Output results
             if json_output:

plato/v1/cli/ssh.py

@@ -9,9 +9,21 @@ from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric import ed25519
 
 
+def get_plato_dir() -> Path:
+    """Get the directory for plato config/SSH files.
+
+    Uses /workspace/.plato if /workspace exists (container environment),
+    otherwise uses ~/.plato (local development).
+    """
+    workspace = Path("/workspace")
+    if workspace.exists() and workspace.is_dir():
+        return workspace / ".plato"
+    return Path.home() / ".plato"
+
+
 def get_next_sandbox_number() -> int:
-    """Find next available sandbox number by checking existing config files in ~/.plato/."""
-    plato_dir = Path.home() / ".plato"
+    """Find next available sandbox number by checking existing config files."""
+    plato_dir = get_plato_dir()
     if not plato_dir.exists():
         return 1
 
@@ -35,7 +47,7 @@ def generate_ssh_key_pair(sandbox_num: int) -> tuple[str, str]:
 
     Returns (public_key_str, private_key_path).
     """
-    plato_dir = Path.home() / ".plato"
+    plato_dir = get_plato_dir()
     plato_dir.mkdir(mode=0o700, exist_ok=True)
 
     private_key_path = plato_dir / f"ssh_{sandbox_num}_key"
@@ -160,7 +172,7 @@ def create_ssh_config(
     TCPKeepAlive yes
 """
 
-    plato_dir = Path.home() / ".plato"
+    plato_dir = get_plato_dir()
     plato_dir.mkdir(mode=0o700, exist_ok=True)
 
     config_path = plato_dir / f"ssh_{sandbox_num}.conf"