plato-sdk-v2 2.3.0__py3-none-any.whl → 2.4.1__py3-none-any.whl

plato/v1/cli/main.py

@@ -9,9 +9,9 @@ import typer
 from dotenv import load_dotenv
 
 from plato.v1.cli.agent import agent_app
+from plato.v1.cli.chronos import chronos_app
 from plato.v1.cli.pm import pm_app
 from plato.v1.cli.sandbox import sandbox_app
-from plato.v1.cli.sim import sim_app
 from plato.v1.cli.utils import console
 from plato.v1.cli.world import world_app
 
@@ -70,9 +70,9 @@ app = typer.Typer(help="[bold blue]Plato CLI[/bold blue] - Manage Plato environm
 # Register sub-apps
 app.add_typer(sandbox_app, name="sandbox")
 app.add_typer(pm_app, name="pm")
-app.add_typer(sim_app, name="sim")
 app.add_typer(agent_app, name="agent")
 app.add_typer(world_app, name="world")
+app.add_typer(chronos_app, name="chronos")
 
 
 # =============================================================================

plato/v1/cli/pm.py

@@ -753,16 +753,16 @@ def review_data(
     is_installed = "site-packages" in str(package_dir)
 
     if is_installed:
-        extension_source_path = package_dir / "extensions" / "envgen-recorder"
+        extension_source_path = package_dir / "extensions" / "envgen-recorder-old"
     else:
         repo_root = package_dir.parent.parent.parent  # plato-client/
-        extension_source_path = repo_root / "extensions" / "envgen-recorder"
+        extension_source_path = repo_root / "extensions" / "envgen-recorder-old"
 
     # Fallback to env var
     if not extension_source_path.exists():
         plato_client_dir_env = os.getenv("PLATO_CLIENT_DIR")
         if plato_client_dir_env:
-            env_path = Path(plato_client_dir_env) / "extensions" / "envgen-recorder"
+            env_path = Path(plato_client_dir_env) / "extensions" / "envgen-recorder-old"
             if env_path.exists():
                 extension_source_path = env_path
 

plato/v1/cli/sandbox.py

@@ -131,6 +131,9 @@ def sandbox_start(
     timeout: int = typer.Option(1800, "--timeout", help="VM lifetime in seconds (default: 30 minutes)"),
     no_reset: bool = typer.Option(False, "--no-reset", help="Skip initial reset after ready"),
     json_output: bool = typer.Option(False, "--json", "-j", help="Output as JSON"),
+    working_dir: Path = typer.Option(
+        None, "--working-dir", "-w", help="Working directory for .sandbox.yaml and .plato/"
+    ),
 ):
     """
     Start a sandbox environment.
@@ -377,7 +380,7 @@ def sandbox_start(
                     console.print("[cyan]  Generating SSH key pair...[/cyan]")
 
                 base_url = os.getenv("PLATO_BASE_URL", "https://plato.so")
-                ssh_info = setup_ssh_for_sandbox(base_url, job_id, username=ssh_username)
+                ssh_info = setup_ssh_for_sandbox(base_url, job_id, username=ssh_username, working_dir=working_dir)
                 ssh_host = ssh_info["ssh_host"]
                 ssh_config_path = ssh_info["config_path"]
                 ssh_private_key_path = ssh_info["private_key_path"]
@@ -489,7 +492,7 @@ def sandbox_start(
         # Add heartbeat PID
         if heartbeat_pid:
             state["heartbeat_pid"] = heartbeat_pid
-        save_sandbox_state(state)
+        save_sandbox_state(state, working_dir)
 
         # Close the plato client (heartbeat process keeps session alive)
         plato.close()
@@ -516,7 +519,6 @@ def sandbox_start(
                 console.print(f"  [cyan]Public URL:[/cyan]  {display_url}")
             if ssh_host and ssh_config_path:
                 console.print(f"  [cyan]SSH:[/cyan]         ssh -F {ssh_config_path} {ssh_host}")
-            console.print("  [cyan]Docker:[/cyan]      export DOCKER_HOST=unix:///var/run/docker-user.sock")
             console.print(f"\n[dim]State saved to {SANDBOX_FILE}[/dim]")
 
     except Exception as e:
@@ -1642,6 +1644,8 @@ def sandbox_state_cmd(
                 return True, False, None
         return False, False, None
 
+    all_mutations = []
+
     if session_id:
         if not json_output:
             console.print(f"[cyan]Getting state for session: {session_id}[/cyan]")
@@ -1649,6 +1653,7 @@ def sandbox_state_cmd(
             response = sessions_state.sync(
                 client=client,
                 session_id=session_id,
+                merge_mutations=True,
                 x_api_key=api_key,
             )
             if response and response.results:
@@ -1662,6 +1667,13 @@ def sandbox_state_cmd(
                     has_error = has_error or e
                     if msg:
                         error_message = msg
+                    # Extract mutations from state
+                    if isinstance(result, dict) and "state" in result:
+                        state_data = result.get("state", {})
+                        if isinstance(state_data, dict):
+                            mutations = state_data.get("mutations", [])
+                            if mutations:
+                                all_mutations.extend(mutations)
     elif job_id:
         if not json_output:
             console.print(f"[cyan]Getting state for job: {job_id}[/cyan]")
@@ -1677,6 +1689,13 @@ def sandbox_state_cmd(
                 has_mutations = m
                 has_error = e
                 error_message = msg
+                # Extract mutations from state
+                if isinstance(state_dict, dict) and "state" in state_dict:
+                    state_data = state_dict.get("state", {})
+                    if isinstance(state_data, dict):
+                        mutations = state_data.get("mutations", [])
+                        if mutations:
+                            all_mutations.extend(mutations)
     elif job_group_id:
         if not json_output:
             console.print(f"[cyan]Getting state for job_group: {job_group_id}[/cyan]")
@@ -1684,6 +1703,7 @@ def sandbox_state_cmd(
             response = sessions_state.sync(
                 client=client,
                 session_id=job_group_id,
+                merge_mutations=True,
                 x_api_key=api_key,
             )
             if response and response.results:
@@ -1697,6 +1717,13 @@ def sandbox_state_cmd(
                     has_error = has_error or e
                     if msg:
                         error_message = msg
+                    # Extract mutations from state
+                    if isinstance(result, dict) and "state" in result:
+                        state_data = result.get("state", {})
+                        if isinstance(state_data, dict):
+                            mutations = state_data.get("mutations", [])
+                            if mutations:
+                                all_mutations.extend(mutations)
     else:
         console.print("[red]❌ .sandbox.yaml missing session_id, job_id, or job_group_id[/red]")
         raise typer.Exit(1)
@@ -1717,6 +1744,26 @@ def sandbox_state_cmd(
         elif state_dict:
             console.print("\n[bold]Environment State:[/bold]")
             console.print(json.dumps(state_dict, indent=2, default=str))
+
+            # Display mutations if any
+            if all_mutations:
+                console.print(f"\n[bold red]Mutations ({len(all_mutations)}):[/bold red]")
+                # Group by table and action for summary
+                from collections import defaultdict
+
+                table_ops: dict[str, dict[str, int]] = defaultdict(lambda: {"INSERT": 0, "UPDATE": 0, "DELETE": 0})
+                for mutation in all_mutations:
+                    table = mutation.get("table_name", mutation.get("table", "unknown"))
+                    op = mutation.get("action", mutation.get("operation", "UNKNOWN")).upper()
+                    if op in table_ops[table]:
+                        table_ops[table][op] += 1
+
+                console.print("\n  [dim]Table                           INSERT  UPDATE  DELETE[/dim]")
+                console.print("  [dim]───────────────────────────────────────────────────────[/dim]")
+                for table, ops in sorted(table_ops.items(), key=lambda x: sum(x[1].values()), reverse=True):
+                    console.print(f"  {table:<30} {ops['INSERT']:>6}  {ops['UPDATE']:>6}  {ops['DELETE']:>6}")
+            else:
+                console.print("\n[green]No mutations recorded[/green]")
         else:
             console.print("[yellow]No state returned[/yellow]")
 
@@ -1737,6 +1784,152 @@ def sandbox_state_cmd(
         raise typer.Exit(1)
 
 
+@sandbox_app.command(name="clear-audit")
+def sandbox_clear_audit(
+    config_path: Path | None = typer.Option(None, "--config-path", help="Path to plato-config.yml"),
+    dataset: str = typer.Option("base", "--dataset", "-d", help="Dataset name"),
+    json_output: bool = typer.Option(False, "--json", "-j", help="Output as JSON"),
+):
+    """
+    Clear the audit_log table(s) in the sandbox database.
+
+    Truncates all audit_log tables to reset mutation tracking. Use this after
+    initial setup/login to clear any mutations before running a clean login flow.
+
+    REQUIRES:
+
+        .sandbox.yaml in current directory (created by 'plato sandbox start')
+        plato-config.yml with database listener config
+
+    USAGE:
+
+        plato sandbox clear-audit                # Uses plato-config.yml in cwd
+        plato sandbox clear-audit -d base        # Specify dataset
+        plato sandbox clear-audit --json         # JSON output
+
+    WORKFLOW POSITION:
+
+        1. plato sandbox start -c
+        2. plato sandbox start-services
+        3. plato sandbox start-worker --wait
+        4. (agent does initial login/setup, generating mutations)
+        5. plato sandbox clear-audit            ← you are here
+        6. plato sandbox flow                   ← clean login flow
+        7. plato sandbox state --verify-no-mutations  ← should pass now
+        8. plato sandbox snapshot
+    """
+    state = require_sandbox_state()
+
+    # Get SSH info
+    ssh_host = state.get("ssh_host")
+    ssh_config_path = state.get("ssh_config_path")
+
+    if not ssh_host or not ssh_config_path:
+        console.print("[red]❌ SSH not configured. Missing ssh_host or ssh_config_path in .sandbox.yaml[/red]")
+        raise typer.Exit(1)
+
+    # Find plato-config.yml
+    if not config_path:
+        config_path = Path.cwd() / "plato-config.yml"
+        if not config_path.exists():
+            config_path = Path.cwd() / "plato-config.yaml"
+        if not config_path.exists():
+            console.print("[red]❌ plato-config.yml not found[/red]")
+            raise typer.Exit(1)
+
+    with open(config_path) as f:
+        plato_config = yaml.safe_load(f)
+
+    # Get dataset config
+    datasets = plato_config.get("datasets", {})
+    if dataset not in datasets:
+        console.print(f"[red]❌ Dataset '{dataset}' not found[/red]")
+        raise typer.Exit(1)
+
+    dataset_config = datasets[dataset]
+    listeners = dataset_config.get("listeners", {})
+
+    # Find DB listeners
+    db_listeners = []
+    for name, listener in listeners.items():
+        if isinstance(listener, dict) and listener.get("type") == "db":
+            db_listeners.append((name, listener))
+
+    if not db_listeners:
+        console.print("[red]❌ No database listeners found in plato-config.yml[/red]")
+        console.print("[yellow]Expected: datasets.<dataset>.listeners.<name>.type = 'db'[/yellow]")
+        raise typer.Exit(1)
+
+    results = []
+
+    for name, db_config in db_listeners:
+        db_type = db_config.get("db_type", "postgresql").lower()
+        db_user = db_config.get("db_user", "postgres" if db_type == "postgresql" else "root")
+        db_password = db_config.get("db_password", "")
+        db_database = db_config.get("db_database", "postgres")
+
+        if not json_output:
+            console.print(f"[cyan]Clearing audit_log for listener '{name}' ({db_type})...[/cyan]")
+
+        # Build SQL command based on db_type
+        # Use docker exec since psql/mysql aren't installed on the VM directly
+        if db_type == "postgresql":
+            # Find the postgres container and truncate all audit_log tables across all schemas
+            # Use $body$ delimiter instead of $$ to avoid shell expansion
+            truncate_sql = "DO \\$body\\$ DECLARE r RECORD; BEGIN FOR r IN SELECT schemaname FROM pg_tables WHERE tablename = 'audit_log' LOOP EXECUTE format('TRUNCATE TABLE %I.audit_log RESTART IDENTITY CASCADE', r.schemaname); END LOOP; END \\$body\\$;"
+            sql_cmd = f"CONTAINER=$(docker ps --format '{{{{.Names}}}}\\t{{{{.Image}}}}' | grep -i postgres | head -1 | cut -f1) && docker exec $CONTAINER psql -U {db_user} -d {db_database} -c \"{truncate_sql}\""
+        elif db_type in ("mysql", "mariadb"):
+            # Find the mysql/mariadb container and exec into it
+            # Use mariadb client (mysql is a symlink or may not exist in newer mariadb images)
+            sql_cmd = f"CONTAINER=$(docker ps --format '{{{{.Names}}}}\\t{{{{.Image}}}}' | grep -iE 'mysql|mariadb' | head -1 | cut -f1) && docker exec $CONTAINER mariadb -u {db_user} -p'{db_password}' {db_database} -e 'SET FOREIGN_KEY_CHECKS=0; DELETE FROM audit_log; SET FOREIGN_KEY_CHECKS=1;'"
+        else:
+            if not json_output:
+                console.print(f"[yellow]⚠ Unsupported db_type '{db_type}' for listener '{name}'[/yellow]")
+            results.append({"listener": name, "success": False, "error": f"Unsupported db_type: {db_type}"})
+            continue
+
+        # Run via SSH
+        ret, stdout, stderr = _run_ssh_command(ssh_config_path, ssh_host, sql_cmd)
+
+        if ret == 0:
+            if not json_output:
+                console.print(f"[green]✅ Cleared audit_log for '{name}'[/green]")
+            results.append({"listener": name, "success": True})
+        else:
+            if not json_output:
+                console.print(f"[red]❌ Failed to clear audit_log for '{name}': {stderr}[/red]")
+            results.append({"listener": name, "success": False, "error": stderr})
+
+    # Call state API to refresh in-memory mutation cache
+    session_id = state.get("session_id")
+    api_key = require_api_key()
+    if session_id:
+        if not json_output:
+            console.print("[dim]Refreshing state cache...[/dim]")
+        try:
+            with get_http_client() as client:
+                sessions_state.sync(
+                    client=client,
+                    session_id=session_id,
+                    x_api_key=api_key,
+                )
+        except Exception as e:
+            if not json_output:
+                console.print(f"[yellow]⚠ Failed to refresh state cache: {e}[/yellow]")
+
+    if json_output:
+        console.print(json.dumps({"results": results}))
+    else:
+        # Summary
+        success_count = sum(1 for r in results if r["success"])
+        total = len(results)
+        if success_count == total:
+            console.print(f"\n[green]✅ All {total} audit logs cleared successfully[/green]")
+        else:
+            console.print(f"\n[yellow]⚠ {success_count}/{total} audit logs cleared[/yellow]")
+            raise typer.Exit(1)
+
+
 @sandbox_app.command(name="audit-ui")
 def sandbox_audit_ui():
     """
@@ -1786,31 +1979,24 @@ def sandbox_audit_ui():
 
 
 def _copy_files_respecting_gitignore(src_dir: Path, dst_dir: Path) -> None:
-    """Copy files from src to dst respecting .gitignore rules."""
-    # Copy .gitignore first if it exists
-    gitignore_src = src_dir / ".gitignore"
-    if gitignore_src.exists():
-        gitignore_dst = dst_dir / ".gitignore"
-        if not gitignore_dst.exists():
-            shutil.copy2(gitignore_src, gitignore_dst)
-
-    def should_copy(file_path: Path) -> bool:
-        """Check if file should be copied (not ignored by git)."""
-        base_name = file_path.name
-        # Skip .git directories and .plato-hub.json
-        if base_name.startswith(".git") or base_name == ".plato-hub.json":
-            return False
-        # Use git check-ignore to respect .gitignore rules
-        try:
-            result = subprocess.run(
-                ["git", "check-ignore", "-q", str(file_path)],
-                cwd=src_dir,
-                capture_output=True,
-            )
-            # git check-ignore returns 0 if path IS ignored, 1 if NOT ignored
-            return result.returncode != 0
-        except Exception:
+    """Copy files from src to dst, skipping .git/ and .plato-hub.json.
+
+    Note: This function intentionally does NOT respect .gitignore because
+    start-services needs to copy all workspace files to the VM, including
+    config files that might be gitignored locally (like docker-compose.yml
+    in a 'base/' directory).
+    """
+
+    def should_skip(rel_path: Path) -> bool:
+        """Check if path should be skipped."""
+        parts = rel_path.parts
+        # Skip anything inside .git/ directory
+        if ".git" in parts:
+            return True
+        # Skip .plato-hub.json
+        if rel_path.name == ".plato-hub.json":
             return True
+        return False
 
     # Walk through source directory
     for src_path in src_dir.rglob("*"):
@@ -1820,8 +2006,8 @@ def _copy_files_respecting_gitignore(src_dir: Path, dst_dir: Path) -> None:
         if str(rel_path) == ".":
             continue
 
-        # Check if should copy
-        if not should_copy(src_path):
+        # Check if should skip
+        if should_skip(rel_path):
             continue
 
         dst_path = dst_dir / rel_path
@@ -2007,6 +2193,34 @@ def sandbox_start_services(
 
     try:
         with get_http_client() as client:
+
+            def start_services_on_vm(repo_dir: str) -> list[dict[str, str]]:
+                """Start docker compose services on the VM."""
+                services_started: list[dict[str, str]] = []
+                for svc_name, svc_config in services_config.items():
+                    svc_type = svc_config.get("type", "")
+                    if svc_type == "docker-compose":
+                        compose_file = svc_config.get("file", "docker-compose.yml")
+                        compose_cmd = f"cd {repo_dir} && docker compose -f {compose_file} up -d"
+
+                        if not json_output:
+                            console.print(f"[cyan]  Starting docker compose service: {svc_name}...[/cyan]")
+
+                        ret, stdout, stderr = _run_ssh_command(ssh_config_path, ssh_host, compose_cmd)
+                        if ret != 0:
+                            console.print(f"[red]❌ Failed to start service '{svc_name}': {stderr}[/red]")
+                            raise typer.Exit(1)
+
+                        services_started.append({"name": svc_name, "type": "docker-compose", "file": compose_file})
+                        if not json_output:
+                            console.print(f"[green]  ✓ Started docker compose service: {svc_name}[/green]")
+                    else:
+                        if not json_output:
+                            console.print(
+                                f"[yellow]  ⚠ Skipped service '{svc_name}' (unknown type: {svc_type})[/yellow]"
+                            )
+                return services_started
+
             # Step 1: Get Gitea credentials
             if not json_output:
                 console.print("[cyan]Step 1: Getting Gitea credentials...[/cyan]")
@@ -2064,6 +2278,8 @@ def sandbox_start_services(
             if not json_output:
                 console.print("[cyan]Step 4: Pushing code to hub...[/cyan]")
 
+            repo_dir = f"/home/plato/worktree/{service_name}"
+
             with tempfile.TemporaryDirectory(prefix="plato-hub-") as temp_dir:
                 temp_repo = Path(temp_dir) / "repo"
 
@@ -2148,8 +2364,6 @@ def sandbox_start_services(
             if not json_output:
                 console.print("[cyan]Step 5: Cloning repo on VM...[/cyan]")
 
-            repo_dir = f"/home/plato/worktree/{service_name}"
-
             # Create worktree directory
             _run_ssh_command(ssh_config_path, ssh_host, "mkdir -p /home/plato/worktree")
 
@@ -2170,27 +2384,7 @@ def sandbox_start_services(
             if not json_output:
                 console.print("[cyan]Step 6: Starting services...[/cyan]")
 
-            services_started = []
-            for svc_name, svc_config in services_config.items():
-                svc_type = svc_config.get("type", "")
-                if svc_type == "docker-compose":
-                    compose_file = svc_config.get("file", "docker-compose.yml")
-                    compose_cmd = f"cd {repo_dir} && DOCKER_HOST=unix:///var/run/docker-user.sock docker compose -f {compose_file} up -d"
-
-                    if not json_output:
-                        console.print(f"[cyan]  Starting docker compose service: {svc_name}...[/cyan]")
-
-                    ret, stdout, stderr = _run_ssh_command(ssh_config_path, ssh_host, compose_cmd)
-                    if ret != 0:
-                        console.print(f"[red]❌ Failed to start service '{svc_name}': {stderr}[/red]")
-                        raise typer.Exit(1)
-
-                    services_started.append({"name": svc_name, "type": "docker-compose", "file": compose_file})
-                    if not json_output:
-                        console.print(f"[green]  ✓ Started docker compose service: {svc_name}[/green]")
-                else:
-                    if not json_output:
-                        console.print(f"[yellow]  ⚠ Skipped service '{svc_name}' (unknown type: {svc_type})[/yellow]")
+            services_started = start_services_on_vm(repo_dir)
 
             # Output results
             if json_output:

plato/v1/cli/ssh.py

@@ -9,9 +9,21 @@ from cryptography.hazmat.primitives import serialization
 from cryptography.hazmat.primitives.asymmetric import ed25519
 
 
-def get_next_sandbox_number() -> int:
-    """Find next available sandbox number by checking existing config files in ~/.plato/."""
-    plato_dir = Path.home() / ".plato"
+def get_plato_dir(working_dir: Path | str | None = None) -> Path:
+    """Get the directory for plato config/SSH files.
+
+    Args:
+        working_dir: If provided, returns working_dir/.plato (for container/agent use).
+                     If None, returns ~/.plato (local development).
+    """
+    if working_dir is not None:
+        return Path(working_dir) / ".plato"
+    return Path.home() / ".plato"
+
+
+def get_next_sandbox_number(working_dir: Path | str | None = None) -> int:
+    """Find next available sandbox number by checking existing config files."""
+    plato_dir = get_plato_dir(working_dir)
     if not plato_dir.exists():
         return 1
 
@@ -29,13 +41,13 @@ def get_next_sandbox_number() -> int:
     return max_num + 1
 
 
-def generate_ssh_key_pair(sandbox_num: int) -> tuple[str, str]:
+def generate_ssh_key_pair(sandbox_num: int, working_dir: Path | str | None = None) -> tuple[str, str]:
     """
     Generate a new ed25519 SSH key pair for a specific sandbox.
 
     Returns (public_key_str, private_key_path).
     """
-    plato_dir = Path.home() / ".plato"
+    plato_dir = get_plato_dir(working_dir)
     plato_dir.mkdir(mode=0o700, exist_ok=True)
 
     private_key_path = plato_dir / f"ssh_{sandbox_num}_key"
@@ -124,6 +136,7 @@ def create_ssh_config(
     username: str,
     private_key_path: str,
     sandbox_num: int,
+    working_dir: Path | str | None = None,
 ) -> str:
     """
     Create a temporary SSH config file for a specific sandbox.
@@ -160,7 +173,7 @@ def create_ssh_config(
     TCPKeepAlive yes
 """
 
-    plato_dir = Path.home() / ".plato"
+    plato_dir = get_plato_dir(working_dir)
     plato_dir.mkdir(mode=0o700, exist_ok=True)
 
     config_path = plato_dir / f"ssh_{sandbox_num}.conf"
@@ -170,7 +183,12 @@ def create_ssh_config(
     return str(config_path)
 
 
-def setup_ssh_for_sandbox(base_url: str, job_public_id: str, username: str = "plato") -> dict:
+def setup_ssh_for_sandbox(
+    base_url: str,
+    job_public_id: str,
+    username: str = "plato",
+    working_dir: Path | str | None = None,
+) -> dict:
     """
     Set up SSH access for a sandbox - generates keys and creates config.
 
@@ -178,14 +196,14 @@ def setup_ssh_for_sandbox(base_url: str, job_public_id: str, username: str = "pl
 
     Returns dict with: ssh_host, config_path, public_key, private_key_path
     """
-    sandbox_num = get_next_sandbox_number()
+    sandbox_num = get_next_sandbox_number(working_dir)
     ssh_host = f"sandbox-{sandbox_num}"
 
     # Choose random port between 2200 and 2299
     local_port = random.randint(2200, 2299)
 
     # Generate SSH key pair
-    public_key, private_key_path = generate_ssh_key_pair(sandbox_num)
+    public_key, private_key_path = generate_ssh_key_pair(sandbox_num, working_dir)
 
     # Create SSH config file
     config_path = create_ssh_config(
@@ -196,6 +214,7 @@ def setup_ssh_for_sandbox(base_url: str, job_public_id: str, username: str = "pl
         username=username,
         private_key_path=private_key_path,
         sandbox_num=sandbox_num,
+        working_dir=working_dir,
     )
 
     return {

plato/v1/cli/templates/world-runner.Dockerfile

@@ -0,0 +1,27 @@
+# World runner image for plato chronos dev
+# Includes git, docker CLI, and Python dependencies
+
+FROM python:3.12-slim
+
+# Install git and docker CLI
+RUN apt-get update && apt-get install -y --no-install-recommends \
+    git \
+    curl \
+    ca-certificates \
+    && curl -fsSL https://get.docker.com -o get-docker.sh \
+    && sh get-docker.sh \
+    && rm get-docker.sh \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/*
+
+# Install uv for fast package installation
+RUN pip install --no-cache-dir uv
+
+WORKDIR /world
+
+# Entry point expects:
+# - /world mounted with world source
+# - /python-sdk mounted with plato SDK source (optional, for dev)
+# - /config.json mounted with config
+# - WORLD_NAME env var set
+CMD ["bash", "-c", "if [ -d /python-sdk ]; then uv pip install --system /python-sdk; fi && uv pip install --system . 2>/dev/null || pip install -q . && plato-world-runner run --world $WORLD_NAME --config /config.json"]

plato/v1/cli/utils.py

@@ -15,32 +15,52 @@ console = Console()
 SANDBOX_FILE = ".sandbox.yaml"
 
 
-def get_sandbox_state() -> dict | None:
-    """Read sandbox state from .sandbox.yaml in current directory."""
-    sandbox_file = Path.cwd() / SANDBOX_FILE
+def get_sandbox_state(working_dir: Path | str | None = None) -> dict | None:
+    """Read sandbox state from .sandbox.yaml.
+
+    Args:
+        working_dir: Directory containing .sandbox.yaml. If None, uses cwd.
+    """
+    base_dir = Path(working_dir) if working_dir else Path.cwd()
+    sandbox_file = base_dir / SANDBOX_FILE
     if not sandbox_file.exists():
         return None
     with open(sandbox_file) as f:
         return yaml.safe_load(f)
 
 
-def save_sandbox_state(state: dict) -> None:
-    """Save sandbox state to .sandbox.yaml in current directory."""
-    sandbox_file = Path.cwd() / SANDBOX_FILE
+def save_sandbox_state(state: dict, working_dir: Path | str | None = None) -> None:
+    """Save sandbox state to .sandbox.yaml.
+
+    Args:
+        state: State dict to save.
+        working_dir: Directory to save .sandbox.yaml in. If None, uses cwd.
+    """
+    base_dir = Path(working_dir) if working_dir else Path.cwd()
+    sandbox_file = base_dir / SANDBOX_FILE
     with open(sandbox_file, "w") as f:
         yaml.dump(state, f, default_flow_style=False)
 
 
-def remove_sandbox_state() -> None:
-    """Remove .sandbox.yaml from current directory."""
-    sandbox_file = Path.cwd() / SANDBOX_FILE
+def remove_sandbox_state(working_dir: Path | str | None = None) -> None:
+    """Remove .sandbox.yaml.
+
+    Args:
+        working_dir: Directory containing .sandbox.yaml. If None, uses cwd.
+    """
+    base_dir = Path(working_dir) if working_dir else Path.cwd()
+    sandbox_file = base_dir / SANDBOX_FILE
     if sandbox_file.exists():
         sandbox_file.unlink()
 
 
-def require_sandbox_state() -> dict:
-    """Get sandbox state or exit with error."""
-    state = get_sandbox_state()
+def require_sandbox_state(working_dir: Path | str | None = None) -> dict:
+    """Get sandbox state or exit with error.
+
+    Args:
+        working_dir: Directory containing .sandbox.yaml. If None, uses cwd.
+    """
+    state = get_sandbox_state(working_dir)
     if not state:
         console.print("[red]No sandbox found in current directory[/red]")
         console.print("\n[yellow]Start a sandbox with:[/yellow]")