veris-cli 2.25.0__tar.gz → 2.25.2__tar.gz

{veris_cli-2.25.0 → veris_cli-2.25.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: veris-cli
-Version: 2.25.0
+Version: 2.25.2
 Summary: CLI to connect local agents to the Veris backend
 Project-URL: Homepage, https://github.com/veris-ai/veris-cli
 Project-URL: Bug Tracker, https://github.com/veris-ai/veris-cli/issues
@@ -13,6 +13,7 @@ Requires-Dist: pydantic>=2.6
 Requires-Dist: pyyaml>=6.0.1
 Requires-Dist: questionary>=2.0.0
 Requires-Dist: rich>=13.7.0
+Requires-Dist: tenacity>=8.2.0
 Provides-Extra: dev
 Requires-Dist: pre-commit>=4.3.0; extra == 'dev'
 Provides-Extra: test

{veris_cli-2.25.0 → veris_cli-2.25.2}/pyproject.toml

@@ -1,6 +1,6 @@
 [project]
 name = "veris-cli"
-version = "2.25.0"
+version = "2.25.2"
 description = "CLI to connect local agents to the Veris backend"
 readme = "README.md"
 requires-python = ">=3.11"
@@ -15,6 +15,7 @@ dependencies = [
     "questionary>=2.0.0",
     "pyyaml>=6.0.1",
     "pydantic>=2.6",
+    "tenacity>=8.2.0",
 ]
 
 [project.scripts]

{veris_cli-2.25.0 → veris_cli-2.25.2}/src/veris_cli/api.py

@@ -3,6 +3,13 @@
 from typing import Any, Optional
 
 import httpx
+from tenacity import (
+    retry,
+    retry_if_exception,
+    retry_if_exception_type,
+    stop_after_attempt,
+    wait_exponential,
+)
 
 from veris_cli.config import Config
 
@@ -29,6 +36,26 @@ def _raise_for_status(response: httpx.Response) -> None:
     raise APIError(response.status_code, detail, str(response.url))
 
 
+_RETRYABLE_STATUSES = frozenset({502, 503, 504})
+
+
+def _is_transient_api_error(exc: BaseException) -> bool:
+    return isinstance(exc, APIError) and exc.status_code in _RETRYABLE_STATUSES
+
+
+# Retries transient failures (network errors, 502/503/504). Only applied to
+# idempotent reads — mutating calls (POST/PUT/DELETE) are left alone to avoid
+# duplicate side effects on retry.
+_retry_transient = retry(
+    reraise=True,
+    stop=stop_after_attempt(5),
+    wait=wait_exponential(multiplier=1, min=1, max=10),
+    retry=(
+        retry_if_exception_type(httpx.TransportError) | retry_if_exception(_is_transient_api_error)
+    ),
+)
+
+
 class VerisAPI:
     """Simple HTTP client for Veris backend API."""
 
@@ -66,6 +93,7 @@ class VerisAPI:
             _raise_for_status(response)
             return response.json()
 
+    @_retry_transient
     def list_environments(
         self, status: Optional[str] = None, limit: int = 20, offset: int = 0
     ) -> dict[str, Any]:
@@ -81,6 +109,7 @@ class VerisAPI:
             _raise_for_status(response)
             return response.json()
 
+    @_retry_transient
     def get_environment(self, environment_id: str) -> dict[str, Any]:
         """Get environment details."""
         with httpx.Client(
@@ -124,6 +153,7 @@ class VerisAPI:
             _raise_for_status(response)
             return response.json()
 
+    @_retry_transient
     def get_build_status(self, environment_id: str, build_id: str) -> dict[str, Any]:
         """Poll build status."""
         with httpx.Client(base_url=self.base_url, headers=self._headers(), timeout=30) as client:
@@ -133,6 +163,7 @@ class VerisAPI:
             _raise_for_status(response)
             return response.json()
 
+    @_retry_transient
     def get_build_logs(
         self, environment_id: str, build_id: str, cursor: str | None = None
     ) -> dict[str, Any]:
@@ -169,6 +200,7 @@ class VerisAPI:
             _raise_for_status(response)
 
     # Scenario Sets
+    @_retry_transient
     def list_scenario_sets(
         self, environment_id: Optional[str] = None, limit: int = 100, skip: int = 0
     ) -> list[dict[str, Any]]:
@@ -189,6 +221,7 @@ class VerisAPI:
                 else data
             )
 
+    @_retry_transient
     def get_scenario_set(self, set_id: str) -> dict[str, Any]:
         """Get scenario set details."""
         with httpx.Client(
@@ -232,6 +265,7 @@ class VerisAPI:
             _raise_for_status(response)
             return response.json()
 
+    @_retry_transient
     def list_runs(
         self,
         status: Optional[str] = None,
@@ -253,6 +287,7 @@ class VerisAPI:
             _raise_for_status(response)
             return response.json()
 
+    @_retry_transient
     def get_run(self, run_id: str) -> dict[str, Any]:
         """Get run details."""
         with httpx.Client(
@@ -270,6 +305,7 @@ class VerisAPI:
             response = client.delete(f"/v1/runs/{run_id}")
             _raise_for_status(response)
 
+    @_retry_transient
     def get_run_events(self, run_id: str, limit: int = 100, offset: int = 0) -> dict[str, Any]:
         """Get run events/logs."""
         params = {"limit": limit, "offset": offset}
@@ -280,6 +316,7 @@ class VerisAPI:
             _raise_for_status(response)
             return response.json()
 
+    @_retry_transient
     def list_run_simulations(self, run_id: str) -> dict[str, Any]:
         """List simulations for a run."""
         with httpx.Client(base_url=self.base_url, headers=self._headers(), timeout=30) as client:
@@ -307,6 +344,7 @@ class VerisAPI:
             return response.json()
 
     # Graders
+    @_retry_transient
     def list_graders(
         self,
         environment_id: str,
@@ -340,6 +378,7 @@ class VerisAPI:
             _raise_for_status(response)
             return response.json()
 
+    @_retry_transient
     def list_evaluation_runs(self, run_id: str, limit: int = 20, offset: int = 0) -> dict[str, Any]:
         """List evaluation runs for a given run."""
         params = {"limit": limit, "offset": offset}
@@ -350,6 +389,7 @@ class VerisAPI:
             _raise_for_status(response)
             return response.json()
 
+    @_retry_transient
     def get_evaluation_run(self, run_id: str, eval_run_id: str) -> dict[str, Any]:
         """Get evaluation run details including per-simulation results."""
         with httpx.Client(
@@ -360,6 +400,7 @@ class VerisAPI:
             return response.json()
 
     # Environment Variables
+    @_retry_transient
     def list_environment_variables(self, environment_id: str) -> dict[str, Any]:
         """List environment variables for an environment."""
         with httpx.Client(
@@ -404,6 +445,7 @@ class VerisAPI:
             _raise_for_status(response)
             return response.json()
 
+    @_retry_transient
     def list_reports(self, environment_id: str, limit: int = 20, offset: int = 0) -> dict[str, Any]:
         """List reports for an environment."""
         params: dict[str, Any] = {
@@ -418,6 +460,7 @@ class VerisAPI:
             _raise_for_status(response)
             return response.json()
 
+    @_retry_transient
     def get_report(self, report_id: str) -> dict[str, Any]:
         """Get report details including html_content."""
         with httpx.Client(base_url=self.base_url, headers=self._headers(), timeout=60) as client:
@@ -425,6 +468,7 @@ class VerisAPI:
             _raise_for_status(response)
             return response.json()
 
+    @_retry_transient
     def download_report(self, report_id: str, format: str) -> bytes:
         """Download report in the specified format (pdf, md)."""
         with httpx.Client(base_url=self.base_url, headers=self._headers(), timeout=120) as client:
@@ -449,6 +493,7 @@ class VerisAPI:
             _raise_for_status(response)
             return response.json()
 
+    @_retry_transient
     def get_managed_config(self, environment_id: str) -> dict[str, Any]:
         """Get managed config files (signed download URLs) for an environment."""
         with httpx.Client(
@@ -459,6 +504,7 @@ class VerisAPI:
             return response.json()
 
     # Sandbox metadata
+    @_retry_transient
     def list_services(self) -> dict[str, Any]:
         """List available sandbox mock services."""
         with httpx.Client(
@@ -468,6 +514,7 @@ class VerisAPI:
             _raise_for_status(response)
             return response.json()
 
+    @_retry_transient
     def list_channels(self) -> dict[str, Any]:
         """List available channel types."""
         with httpx.Client(

{veris_cli-2.25.0 → veris_cli-2.25.2}/src/veris_cli/commands/env.py

@@ -22,6 +22,63 @@ from veris_cli.config import Config, ProjectConfig
 from veris_cli.veris_yaml import DEFAULT_DOCKERFILE, VerisYaml, slugify
 
 
+def _check_sync_guard(
+    env_info: dict,
+    pc: ProjectConfig,
+    force: bool,
+) -> str | None:
+    """Check if remote managed config diverges from local and prompt user.
+
+    Returns:
+        "push"  — user chose to overwrite remote with local config
+        "pull"  — user chose to pull remote config
+        None    — guard didn't fire (proceed normally)
+
+    Exits via sys.exit(1) in non-interactive mode when divergence is detected.
+    Raises SystemExit on cancel.
+    """
+    if env_info.get("status") != "ready" or force:
+        return None
+
+    remote_config_at = env_info.get("config_updated_at")
+    local_synced_at = pc.get_config_synced_at()
+    if not remote_config_at or (local_synced_at and remote_config_at <= local_synced_at):
+        return None
+
+    if not sys.stdin.isatty():
+        output.print_error(
+            "Remote config was updated since your last sync. "
+            "Run 'veris env config pull' first, or pass --force to overwrite."
+        )
+        sys.exit(1)
+
+    import questionary
+
+    if not local_synced_at:
+        sync_message = "Your managed setup is complete. New config is available on the server."
+    else:
+        sync_message = "Remote config was updated since your last sync."
+
+    action = questionary.select(
+        sync_message,
+        choices=[
+            questionary.Choice(title="Pull remote config (overwrites local)", value="pull"),
+            questionary.Choice(title="Push local config (overwrites remote)", value="push"),
+            questionary.Choice(title="Cancel", value="cancel"),
+        ],
+    ).ask()
+    if action == "cancel" or action is None:
+        sys.exit(0)
+    if action == "push":
+        confirm = questionary.confirm(
+            "This will overwrite the managed config generated by the Veris team. Continue?",
+            default=False,
+        ).ask()
+        if not confirm:
+            sys.exit(0)
+    return action
+
+
 def _env_push_local(
     env_id: str,
     tag: str,
@@ -439,6 +496,10 @@ def env_create(ctx, name: str | None, agent_name: str | None):
         if target_obj is not None:
             try:
                 api.upload_environment_config(env_id, target_obj.to_upload_dict())
+                # Record sync timestamp so `env push` sync guard stays in sync.
+                # We just uploaded from this machine — no need to fetch the
+                # server timestamp; "now" is accurate enough.
+                project_config.set_config_synced_at(datetime.now(UTC).isoformat())
                 output.print_success("Config uploaded")
             except Exception as e:
                 output.print_warning(f"Config upload failed (non-fatal): {e}")
@@ -714,7 +775,7 @@ def env_submit(ctx, env_id: str | None, target: str | None):
         api.notify_submit_uploaded(env_id)
         output.print_success("Submitted for managed setup!")
         output.print_info("You'll receive an email when your environment is ready.")
-        output.print_info("Then run 'veris env push' to build and deploy.")
+        output.print_info("Then run 'veris env config pull' followed by 'veris env push'.")
 
     except ValueError as e:
         output.print_error(str(e))
@@ -730,9 +791,16 @@ def env_submit(ctx, env_id: str | None, target: str | None):
 @env.command(name="push")
 @click.option("--tag", default="latest", help="Image tag (default: latest)")
 @click.option("--env-id", default=None, help="Environment ID (overrides config)")
+@click.option(
+    "--force",
+    "-f",
+    is_flag=True,
+    default=False,
+    help="Skip the sync guard for managed-setup envs (use in CI).",
+)
 @target_option
 @click.pass_context
-def env_push(ctx, tag: str, env_id: str | None, target: str | None):
+def env_push(ctx, tag: str, env_id: str | None, force: bool, target: str | None):
     """Build and push environment image to Veris.
 
     Resolves the target's block from veris.yaml (including an optional
@@ -784,50 +852,63 @@ def env_push(ctx, tag: str, env_id: str | None, target: str | None):
 
     api = VerisAPI(profile=profile)
 
-    if not dockerfile_path.exists():
-        output.print_error(
-            f"{dockerfile_rel} not found. Run 'veris env create' or 'veris env config pull' first."
-        )
-        sys.exit(1)
-
-    # Config sync guard: check if remote config was updated since last sync.
-    # Prevents accidentally overwriting team-generated config with local scaffold.
+    # Fetch env info early — needed for Dockerfile check and sync guard.
     try:
         env_info = api.get_environment(env_id)
     except Exception:
         env_info = {}
 
-    remote_config_at = env_info.get("config_updated_at")
-    pc = ProjectConfig(profile=profile, target=resolved_target)
-    local_synced_at = pc.get_config_synced_at()
-
-    if remote_config_at and (not local_synced_at or remote_config_at > local_synced_at):
-        if sys.stdin.isatty():
-            import questionary
-
-            action = questionary.select(
-                "Remote config was updated since your last sync.",
-                choices=[
-                    questionary.Choice(title="Pull remote config (overwrites local)", value="pull"),
-                    questionary.Choice(title="Push local config (overwrites remote)", value="push"),
-                    questionary.Choice(title="Cancel", value="cancel"),
-                ],
-            ).ask()
-            if action == "cancel" or action is None:
-                return
-            if action == "pull":
-                ctx.invoke(config_pull, env_id=env_id, target=resolved_target)
-                # Reload target config after pull (resolved_target stays the same)
+    if not dockerfile_path.exists():
+        env_status = env_info.get("status", "")
+        if env_status == "pending":
+            output.print_error(
+                "Your environment is still being set up. You'll receive an email when it's ready."
+            )
+            sys.exit(1)
+        elif env_status == "ready":
+            # Config is ready on the server — offer to pull it.
+            if sys.stdin.isatty():
+                output.print_info(
+                    "Dockerfile not found locally, but config is ready on the server."
+                )
+                pulled = ctx.invoke(config_pull, env_id=env_id, target=resolved_target)
+                if not pulled:
+                    sys.exit(1)
+                # Reload after pull
                 parsed = _load_veris_yaml(veris_yaml_path)
                 target_obj = parsed.get_target(resolved_target)
                 dockerfile_rel = target_obj.resolved_dockerfile()
                 dockerfile_path = Path.cwd() / dockerfile_rel
+                if not dockerfile_path.exists():
+                    output.print_error("Dockerfile still missing after config pull.")
+                    sys.exit(1)
+            else:
+                output.print_error(
+                    "Dockerfile not found. Run 'veris env config pull' to download it."
+                )
+                sys.exit(1)
         else:
             output.print_error(
-                "Remote config was updated since your last sync. Run 'veris env config pull' first."
+                "Dockerfile not found. Create it locally, or run 'veris env submit' "
+                "for managed setup."
             )
             sys.exit(1)
 
+    # Config sync guard: only managed-setup envs (status=ready) have config
+    # that could be authored by someone other than this CLI user.
+    pc = ProjectConfig(profile=profile, target=resolved_target)
+    guard_action = _check_sync_guard(env_info, pc, force)
+    if guard_action == "pull":
+        pulled = ctx.invoke(config_pull, env_id=env_id, target=resolved_target)
+        if not pulled:
+            output.print_error("Config pull did not download files. Aborting push.")
+            sys.exit(1)
+        # Reload target config after pull (resolved_target stays the same)
+        parsed = _load_veris_yaml(veris_yaml_path)
+        target_obj = parsed.get_target(resolved_target)
+        dockerfile_rel = target_obj.resolved_dockerfile()
+        dockerfile_path = Path.cwd() / dockerfile_rel
+
     try:
         api.upload_environment_config(env_id, target_obj.to_upload_dict())
         # Re-fetch to get the server-assigned config_updated_at
@@ -982,9 +1063,16 @@ def config():
     help="Path to veris.yaml (default: .veris/veris.yaml)",
 )
 @click.option("--env-id", default=None, help="Environment ID (uses project config if omitted)")
+@click.option(
+    "--force",
+    "-f",
+    is_flag=True,
+    default=False,
+    help="Skip the sync guard for managed-setup envs (use in CI).",
+)
 @target_option
 @click.pass_context
-def config_push(ctx, file_path: str | None, env_id: str, target: str | None):
+def config_push(ctx, file_path: str | None, env_id: str, force: bool, target: str | None):
     """Upload veris.yaml config to the backend without building an image.
 
     Reads .veris/veris.yaml by default, or a custom path via --file. With
@@ -1012,39 +1100,16 @@ def config_push(ctx, file_path: str | None, env_id: str, target: str | None):
     api = VerisAPI(profile=profile)
     pc = ProjectConfig(profile=profile, target=resolved_target)
 
-    # Config sync guard
     try:
         env_info = api.get_environment(env_id)
     except Exception:
         env_info = {}
 
-    remote_config_at = env_info.get("config_updated_at")
-    local_synced_at = pc.get_config_synced_at()
-
-    if remote_config_at and (not local_synced_at or remote_config_at > local_synced_at):
-        if sys.stdin.isatty():
-            import questionary
-
-            action = questionary.select(
-                "Remote config was updated since your last sync.",
-                choices=[
-                    questionary.Choice(title="Pull remote config (overwrites local)", value="pull"),
-                    questionary.Choice(title="Push local config (overwrites remote)", value="push"),
-                    questionary.Choice(title="Cancel", value="cancel"),
-                ],
-            ).ask()
-            if action == "cancel" or action is None:
-                return
-            if action == "pull":
-                # Delegate to config pull logic
-                output.print_info("Pulling remote config...")
-                ctx.invoke(config_pull, env_id=env_id, target=resolved_target)
-                return
-        else:
-            output.print_error(
-                "Remote config was updated since your last sync. Run 'veris env config pull' first."
-            )
-            sys.exit(1)
+    guard_action = _check_sync_guard(env_info, pc, force)
+    if guard_action == "pull":
+        output.print_info("Pulling remote config...")
+        ctx.invoke(config_pull, env_id=env_id, target=resolved_target)
+        return
 
     try:
         api.upload_environment_config(env_id, target_obj.to_upload_dict())
@@ -1087,8 +1152,11 @@ def config_pull(ctx, env_id: str | None, target: str | None):
                     "Your environment is being set up. You'll receive an email when it's ready."
                 )
             else:
-                output.print_info("No remote config available. Run 'veris env submit' first.")
-            return
+                output.print_info(
+                    "No remote config available yet. "
+                    "If using managed setup, run 'veris env submit'."
+                )
+            return False
 
         veris_dir = Path.cwd() / ".veris"
         veris_dir.mkdir(parents=True, exist_ok=True)
@@ -1103,6 +1171,11 @@ def config_pull(ctx, env_id: str | None, target: str | None):
                 output.print_warning("Failed to download Dockerfile.sandbox")
 
         veris_yaml_url = result.get("veris_yaml_url")
+        if veris_yaml_url and not resolved_target:
+            output.print_warning(
+                "Skipped veris.yaml download — no target resolved. "
+                "Use --target or set an active target with 'veris env targets set <name>'."
+            )
         if veris_yaml_url and resolved_target:
             resp = httpx.get(veris_yaml_url, timeout=60)
             if resp.status_code == 200:
@@ -1124,6 +1197,7 @@ def config_pull(ctx, env_id: str | None, target: str | None):
         env_detail = api.get_environment(env_id)
         config_ts = env_detail.get("config_updated_at") or datetime.now(UTC).isoformat()
         ProjectConfig(profile=profile, target=resolved_target).set_config_synced_at(config_ts)
+        return True
 
     except Exception as e:
         output.print_error(f"Failed to pull config: {e}")