vortex-cli 6.0.0__tar.gz → 6.1.0__tar.gz

{vortex_cli-6.0.0/vortex_cli.egg-info → vortex_cli-6.1.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: vortex_cli
-Version: 6.0.0
+Version: 6.1.0
 Summary: Vortex CLI
 Author-email: Jordan Amos <jordan.amos@gmail.com>
 License: MIT License
@@ -150,15 +150,15 @@ For a full list of commands see `--help`.
 - `code`: Open the workspace in Visual Studio Code (`-s <server>` opens that server's own workspace with exactly its jars on the Java classpath).
 - `use`: Set the default server so you don't need to pass `--server` on every command. e.g. `vortex use production`
 - `list` (or `ls`): List Puakma Applications on the server or cloned locally. (`ls` is an alias for `vortex list --local`)
-- `clone`: Clone Puakma Applications and their design objects into the workspace. Apps can be referenced by ID (`vortex clone 13`), by TemplateName (`vortex clone bettrackr_app`), or by group/name (`vortex clone bettrackr/app`). A bare application group clones **every** application in it (`vortex clone BetTrackr`) - all optionally server-qualified (`dev:13`, `dev:bettrackr/app`, `dev:BetTrackr`). See [Cloning a whole group](#cloning-a-whole-group).
+- `clone`: Clone Puakma Applications and their design objects into the workspace. Apps can be referenced by ID (`vortex clone 13`), by TemplateName (`vortex clone bettrackr_app`), or by group/name (`vortex clone bettrackr/app`). A bare application group clones every active, non-inherited application in it (`vortex clone BetTrackr`; add `--all`/`-a` for the disabled and inherited ones too) - all optionally server-qualified (`dev:13`, `dev:bettrackr/app`, `dev:BetTrackr`). `--reclone` re-clones what is already cloned: every server's clones, or one server's with `--server`. See [Cloning a whole group](#cloning-a-whole-group).
 - `watch`: Watch the workspace for changes to Design Objects and automatically upload them to the server each app was cloned from. Watches all servers at once unless `--server` is given.
 - `clean`: Delete the locally cloned Puakma Application directories in the workspace.
   Takes optional `APP_ID`s to clean just those clones (all of the server's, if none are
-  given). Refuses to delete a clone holding local changes the server doesn't have -
-  naming each file - unless `--force` is given. Verifying that asks the server for its
-  design element hashes, so a non-forced `clean` needs a reachable `backend=gateway`
-  server; a clone it can't verify is refused, not silently deleted (`--force` needs no
-  network).
+  given). Deletes immediately and needs no network - there is no undo. With `--check`
+  it first asks the server for its design element hashes and refuses to delete a clone
+  holding local changes the server doesn't have, naming each file; that needs a
+  reachable `backend=gateway` server, and a clone it can't verify is refused rather
+  than silently deleted.
 - `config`: View and manage configuration. `--check-gateway` reports the agent gateway negotiation and which gateway roles your identity holds.
 - `log`: View the server log.
 - `status`: Show the server status - via the agent gateway when available, otherwise the raw console `status` output.
@@ -188,11 +188,16 @@ For a full list of commands see `--help`.
 vortex clone 13                 # by ID
 vortex clone bettrackr_app      # by TemplateName
 vortex clone bettrackr/app      # by group/name
-vortex clone BetTrackr          # every application in the BetTrackr group
+vortex clone BetTrackr          # every active application in the BetTrackr group
+vortex clone -a BetTrackr       # ... including its disabled and inherited ones
 vortex clone dev:BetTrackr      # ... on the 'dev' server
 vortex clone --group BetTrackr  # explicitly a group, never a TemplateName
 ```
 
+A group clone skips disabled and inherited applications (the ones `vortex list`
+hides by default) unless `--all`/`-a` is given. An application you name outright -
+by ID, TemplateName or `group/name` - is always cloned, whatever its state.
+
 Groups are matched the way `vortex list --group` matches them - a
 case-insensitive substring - except that an exact (case-insensitive) group name
 always wins, so cloning `BetTrackr` never drags in `BetTrackrLegacy`. If a
@@ -202,8 +207,8 @@ than cloning the lot.
 A bare word is looked up as **both** a TemplateName and a group. In the rare
 case that it is genuinely both, vortex refuses to guess: use `--group NAME` for
 the group, or the ID / `group/name` for the single application. Every flag
-(`--reclone`, `--get-resources`, `--open-urls`, `--timeout`, `--server`) applies
-to group clones as it does to single apps.
+(`--reclone`, `--all`, `--get-resources`, `--open-urls`, `--timeout`, `--server`)
+applies to group clones as it does to single apps.
 
 ### Working with Multiple Servers
 
@@ -303,7 +308,10 @@ backend = gateway            ; default is 'soap', which never contacts the gatew
 
 With `backend = gateway`, `watch`/`push` uploads, `delete`, `log`, `status`, `db`, `execute`
 and the journal commands route through it, and `agenda`, `pull`, `render` and `undo` become
-available. Check what you are talking to and what you may do:
+available. Everything the gateway does not offer goes to the **webdesign vortex API** (the
+JSON action served by `system/webdesign`) - see [SOAP-free on backend = gateway](#soap-free-on-backend--gateway).
+A `backend = gateway` server never talks to SOAPDesigner at all. Check what you are talking
+to and what you may do:
 
 ```
 vortex config --check-gateway -s dev
@@ -313,8 +321,9 @@ vortex config --check-gateway -s dev
 identity lacks the required role) is reported as an error - vortex never quietly retries the
 same operation over SOAP, because that would let anyone with SOAP access bypass every role,
 journal and guardrail above. Likewise `backend = soap` never contacts the gateway. The one
-deliberate exception is the gateway application's *own* deployments, which always use SOAP so
-that a broken gateway deploy never needs the gateway to fix itself.
+deliberate exception is the gateway application's *own* deployments, which never go through
+the gateway (webdesign on `backend = gateway`, SOAP on `backend = soap`) so that a broken
+gateway deploy never needs the gateway to fix itself.
 
 The gateway application is **not bundled with this CLI** - deploy it to a server with
 `vortex export` / `vortex import`, then run its `Setup` scheduled action. It ships its own
@@ -326,6 +335,55 @@ the running server documents its own endpoints, roles and setup steps.
 > grant itself any role. Keep webdesign access for operators; agent identities should not have
 > it.
 
+### SOAP-free on `backend = gateway`
+
+SOAPDesigner is legacy. On a `backend = gateway` server the commands the gateway does not
+cover use the JSON API of `system/webdesign`'s `vortex` action instead - with the same
+credentials, and the webdesign app's own ACL. SOAP is used only when a server is explicitly
+`backend = soap`. The data dictionary (`schema`, `db --list/--schema`) is the exception that
+proves the rule: the gateway's `dictionary` endpoint runs that same webdesign `vortex` action
+server-side behind `GatewayDBRead`/`GatewayDBWrite`, so an agent identity with no webdesign
+access gets a clean role answer rather than a login page, and a change to `vortex.java`
+needs no change to the gateway.
+
+| Command | `backend = gateway` | `backend = soap` |
+|---|---|---|
+| `push`, `watch` (modify), `compile --upload` | gateway `upload` (journalled); the gateway app itself: webdesign `PUT design` | SOAP `uploadDesign` |
+| `watch` (create / delete) | webdesign `POST` / `DELETE design` | SOAP |
+| `delete` | gateway `delete` (journalled); the gateway app itself: webdesign | SOAP |
+| `copy`, `new object` | webdesign `POST`/`PUT design`, `PUT design/params` | SOAP |
+| `new app` | webdesign `POST vortex` | SOAP `saveApplication` |
+| `new keyword` | gateway `keyword` (upsert) | SOAP `saveKeyword` |
+| `schema`, `db --list`, `db --schema` | gateway `dictionary` (webdesign's `database`/`table`/`column` routes run server-side; `GatewayDBRead`/`GatewayDBWrite`) | SOAP SQL + `savePuakma*` |
+| `export` | webdesign `ExportPMX` action | SOAP `downloadPmx` |
+| `import` | **still SOAP** - webdesign has no import route yet | SOAP `uploadPmx` |
+| `db --sql`, `list`, `log`, `execute`, `status`, `clone`, `pull` | gateway | SOAP |
+
+Where the webdesign API behaves differently from SOAP, the CLI compensates so the commands
+behave as they did. The differences that remain visible:
+
+- **Design element writes are whole-row.** The CLI reads the row back first and re-sends what
+  it does not model (the other blob, `Options`), so a `DATA`-only upload never wipes source.
+  One consequence: every write is one extra `GET`.
+- **Renaming with `new object --update --name` does not rewrite references.** SOAP's
+  `updateDesignObject` also updated design params in the app that referred to the old name;
+  the webdesign route does not. Fix `OpenAction`/`ParentPage`-style params by hand after a rename.
+- **`schema` cannot record `--default`, `--position` or the column half of `--ref`.** The
+  webdesign column write has no `DefaultValue`/`Position`/`RefColumn` fields (SOAP's
+  `savePuakmaAttribute2` had them). `--default`/`--position` are refused with a message;
+  `--ref TABLE.COLUMN` records the table and warns. Updates leave existing values untouched.
+  Extend `POST`/`PUT .../column` in webdesign's `vortex.java` to lift this.
+- **Every write flushes the application's design cache**, where SOAP flushed one element.
+- **No per-application `Developer` role check** - the webdesign app's ACL is the boundary. An
+  identity that can reach `system/webdesign` can edit every application through it.
+- **`db --list` orders by table name** (SOAP's `SELECT DISTINCT` had no order); `--schema`
+  output is identical.
+- **Database-name resolution is app-scoped.** `schema`/`db --list` find the connection whose
+  dictionary holds the tables (as SOAP did by `pmatable` count), asking locally cloned
+  applications first and scanning the server inventory only if none of them has it.
+- **`import` remains SOAP** on every backend until webdesign gains a PMX import route
+  (`SaveImportPMX` is a multipart UI form, not an API).
+
 ### Interactive Wizards
 
 Run `vortex new object` or `vortex new app` without any flags to launch a step-by-step wizard:
@@ -421,6 +479,11 @@ vortex schema mydb --add-column invoice customer_id --type BIGINT --ref customer
 vortex schema mydb --ddl invoice    # print CREATE TABLE from the dictionary
 ```
 
+On a `backend = gateway` server the dictionary is reached through webdesign's vortex API via
+the gateway's `dictionary` endpoint (`GatewayDBRead` to read, `GatewayDBWrite` to change).
+That API cannot record `--default` or `--position` (refused) nor the column half of `--ref`
+(warned) - see [SOAP-free on backend = gateway](#soap-free-on-backend--gateway).
+
 ### Agent Support Files
 
 `vortex agent` copies bundled support files into the workspace `.vscode` directory so they are

{vortex_cli-6.0.0 → vortex_cli-6.1.0}/README.md

@@ -106,15 +106,15 @@ For a full list of commands see `--help`.
 - `code`: Open the workspace in Visual Studio Code (`-s <server>` opens that server's own workspace with exactly its jars on the Java classpath).
 - `use`: Set the default server so you don't need to pass `--server` on every command. e.g. `vortex use production`
 - `list` (or `ls`): List Puakma Applications on the server or cloned locally. (`ls` is an alias for `vortex list --local`)
-- `clone`: Clone Puakma Applications and their design objects into the workspace. Apps can be referenced by ID (`vortex clone 13`), by TemplateName (`vortex clone bettrackr_app`), or by group/name (`vortex clone bettrackr/app`). A bare application group clones **every** application in it (`vortex clone BetTrackr`) - all optionally server-qualified (`dev:13`, `dev:bettrackr/app`, `dev:BetTrackr`). See [Cloning a whole group](#cloning-a-whole-group).
+- `clone`: Clone Puakma Applications and their design objects into the workspace. Apps can be referenced by ID (`vortex clone 13`), by TemplateName (`vortex clone bettrackr_app`), or by group/name (`vortex clone bettrackr/app`). A bare application group clones every active, non-inherited application in it (`vortex clone BetTrackr`; add `--all`/`-a` for the disabled and inherited ones too) - all optionally server-qualified (`dev:13`, `dev:bettrackr/app`, `dev:BetTrackr`). `--reclone` re-clones what is already cloned: every server's clones, or one server's with `--server`. See [Cloning a whole group](#cloning-a-whole-group).
 - `watch`: Watch the workspace for changes to Design Objects and automatically upload them to the server each app was cloned from. Watches all servers at once unless `--server` is given.
 - `clean`: Delete the locally cloned Puakma Application directories in the workspace.
   Takes optional `APP_ID`s to clean just those clones (all of the server's, if none are
-  given). Refuses to delete a clone holding local changes the server doesn't have -
-  naming each file - unless `--force` is given. Verifying that asks the server for its
-  design element hashes, so a non-forced `clean` needs a reachable `backend=gateway`
-  server; a clone it can't verify is refused, not silently deleted (`--force` needs no
-  network).
+  given). Deletes immediately and needs no network - there is no undo. With `--check`
+  it first asks the server for its design element hashes and refuses to delete a clone
+  holding local changes the server doesn't have, naming each file; that needs a
+  reachable `backend=gateway` server, and a clone it can't verify is refused rather
+  than silently deleted.
 - `config`: View and manage configuration. `--check-gateway` reports the agent gateway negotiation and which gateway roles your identity holds.
 - `log`: View the server log.
 - `status`: Show the server status - via the agent gateway when available, otherwise the raw console `status` output.
@@ -144,11 +144,16 @@ For a full list of commands see `--help`.
 vortex clone 13                 # by ID
 vortex clone bettrackr_app      # by TemplateName
 vortex clone bettrackr/app      # by group/name
-vortex clone BetTrackr          # every application in the BetTrackr group
+vortex clone BetTrackr          # every active application in the BetTrackr group
+vortex clone -a BetTrackr       # ... including its disabled and inherited ones
 vortex clone dev:BetTrackr      # ... on the 'dev' server
 vortex clone --group BetTrackr  # explicitly a group, never a TemplateName
 ```
 
+A group clone skips disabled and inherited applications (the ones `vortex list`
+hides by default) unless `--all`/`-a` is given. An application you name outright -
+by ID, TemplateName or `group/name` - is always cloned, whatever its state.
+
 Groups are matched the way `vortex list --group` matches them - a
 case-insensitive substring - except that an exact (case-insensitive) group name
 always wins, so cloning `BetTrackr` never drags in `BetTrackrLegacy`. If a
@@ -158,8 +163,8 @@ than cloning the lot.
 A bare word is looked up as **both** a TemplateName and a group. In the rare
 case that it is genuinely both, vortex refuses to guess: use `--group NAME` for
 the group, or the ID / `group/name` for the single application. Every flag
-(`--reclone`, `--get-resources`, `--open-urls`, `--timeout`, `--server`) applies
-to group clones as it does to single apps.
+(`--reclone`, `--all`, `--get-resources`, `--open-urls`, `--timeout`, `--server`)
+applies to group clones as it does to single apps.
 
 ### Working with Multiple Servers
 
@@ -259,7 +264,10 @@ backend = gateway            ; default is 'soap', which never contacts the gatew
 
 With `backend = gateway`, `watch`/`push` uploads, `delete`, `log`, `status`, `db`, `execute`
 and the journal commands route through it, and `agenda`, `pull`, `render` and `undo` become
-available. Check what you are talking to and what you may do:
+available. Everything the gateway does not offer goes to the **webdesign vortex API** (the
+JSON action served by `system/webdesign`) - see [SOAP-free on backend = gateway](#soap-free-on-backend--gateway).
+A `backend = gateway` server never talks to SOAPDesigner at all. Check what you are talking
+to and what you may do:
 
 ```
 vortex config --check-gateway -s dev
@@ -269,8 +277,9 @@ vortex config --check-gateway -s dev
 identity lacks the required role) is reported as an error - vortex never quietly retries the
 same operation over SOAP, because that would let anyone with SOAP access bypass every role,
 journal and guardrail above. Likewise `backend = soap` never contacts the gateway. The one
-deliberate exception is the gateway application's *own* deployments, which always use SOAP so
-that a broken gateway deploy never needs the gateway to fix itself.
+deliberate exception is the gateway application's *own* deployments, which never go through
+the gateway (webdesign on `backend = gateway`, SOAP on `backend = soap`) so that a broken
+gateway deploy never needs the gateway to fix itself.
 
 The gateway application is **not bundled with this CLI** - deploy it to a server with
 `vortex export` / `vortex import`, then run its `Setup` scheduled action. It ships its own
@@ -282,6 +291,55 @@ the running server documents its own endpoints, roles and setup steps.
 > grant itself any role. Keep webdesign access for operators; agent identities should not have
 > it.
 
+### SOAP-free on `backend = gateway`
+
+SOAPDesigner is legacy. On a `backend = gateway` server the commands the gateway does not
+cover use the JSON API of `system/webdesign`'s `vortex` action instead - with the same
+credentials, and the webdesign app's own ACL. SOAP is used only when a server is explicitly
+`backend = soap`. The data dictionary (`schema`, `db --list/--schema`) is the exception that
+proves the rule: the gateway's `dictionary` endpoint runs that same webdesign `vortex` action
+server-side behind `GatewayDBRead`/`GatewayDBWrite`, so an agent identity with no webdesign
+access gets a clean role answer rather than a login page, and a change to `vortex.java`
+needs no change to the gateway.
+
+| Command | `backend = gateway` | `backend = soap` |
+|---|---|---|
+| `push`, `watch` (modify), `compile --upload` | gateway `upload` (journalled); the gateway app itself: webdesign `PUT design` | SOAP `uploadDesign` |
+| `watch` (create / delete) | webdesign `POST` / `DELETE design` | SOAP |
+| `delete` | gateway `delete` (journalled); the gateway app itself: webdesign | SOAP |
+| `copy`, `new object` | webdesign `POST`/`PUT design`, `PUT design/params` | SOAP |
+| `new app` | webdesign `POST vortex` | SOAP `saveApplication` |
+| `new keyword` | gateway `keyword` (upsert) | SOAP `saveKeyword` |
+| `schema`, `db --list`, `db --schema` | gateway `dictionary` (webdesign's `database`/`table`/`column` routes run server-side; `GatewayDBRead`/`GatewayDBWrite`) | SOAP SQL + `savePuakma*` |
+| `export` | webdesign `ExportPMX` action | SOAP `downloadPmx` |
+| `import` | **still SOAP** - webdesign has no import route yet | SOAP `uploadPmx` |
+| `db --sql`, `list`, `log`, `execute`, `status`, `clone`, `pull` | gateway | SOAP |
+
+Where the webdesign API behaves differently from SOAP, the CLI compensates so the commands
+behave as they did. The differences that remain visible:
+
+- **Design element writes are whole-row.** The CLI reads the row back first and re-sends what
+  it does not model (the other blob, `Options`), so a `DATA`-only upload never wipes source.
+  One consequence: every write is one extra `GET`.
+- **Renaming with `new object --update --name` does not rewrite references.** SOAP's
+  `updateDesignObject` also updated design params in the app that referred to the old name;
+  the webdesign route does not. Fix `OpenAction`/`ParentPage`-style params by hand after a rename.
+- **`schema` cannot record `--default`, `--position` or the column half of `--ref`.** The
+  webdesign column write has no `DefaultValue`/`Position`/`RefColumn` fields (SOAP's
+  `savePuakmaAttribute2` had them). `--default`/`--position` are refused with a message;
+  `--ref TABLE.COLUMN` records the table and warns. Updates leave existing values untouched.
+  Extend `POST`/`PUT .../column` in webdesign's `vortex.java` to lift this.
+- **Every write flushes the application's design cache**, where SOAP flushed one element.
+- **No per-application `Developer` role check** - the webdesign app's ACL is the boundary. An
+  identity that can reach `system/webdesign` can edit every application through it.
+- **`db --list` orders by table name** (SOAP's `SELECT DISTINCT` had no order); `--schema`
+  output is identical.
+- **Database-name resolution is app-scoped.** `schema`/`db --list` find the connection whose
+  dictionary holds the tables (as SOAP did by `pmatable` count), asking locally cloned
+  applications first and scanning the server inventory only if none of them has it.
+- **`import` remains SOAP** on every backend until webdesign gains a PMX import route
+  (`SaveImportPMX` is a multipart UI form, not an API).
+
 ### Interactive Wizards
 
 Run `vortex new object` or `vortex new app` without any flags to launch a step-by-step wizard:
@@ -377,6 +435,11 @@ vortex schema mydb --add-column invoice customer_id --type BIGINT --ref customer
 vortex schema mydb --ddl invoice    # print CREATE TABLE from the dictionary
 ```
 
+On a `backend = gateway` server the dictionary is reached through webdesign's vortex API via
+the gateway's `dictionary` endpoint (`GatewayDBRead` to read, `GatewayDBWrite` to change).
+That API cannot record `--default` or `--position` (refused) nor the column half of `--ref`
+(warned) - see [SOAP-free on backend = gateway](#soap-free-on-backend--gateway).
+
 ### Agent Support Files
 
 `vortex agent` copies bundled support files into the workspace `.vscode` directory so they are

{vortex_cli-6.0.0 → vortex_cli-6.1.0}/pyproject.toml

@@ -5,7 +5,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "vortex_cli"
-version = "6.0.0"
+version = "6.1.0"
 description = "Vortex CLI"
 requires-python = ">=3.10"
 readme = { file = "README.md", content-type = "text/markdown" }

{vortex_cli-6.0.0 → vortex_cli-6.1.0}/vortex/cli.py

@@ -410,8 +410,22 @@ def add_clone_parser(
     )
     clone_parser.add_argument(
         "--reclone",
-        help="Reclone locally cloned applications",
+        help=(
+            "Reclone the locally cloned applications: every server's "
+            "clones, or only those of the given --server"
+        ),
+        action="store_true",
+    )
+    clone_parser.add_argument(
+        "--all",
+        "-a",
+        dest="include_all",
         action="store_true",
+        help=(
+            "When cloning a group, also clone its disabled and inherited "
+            "applications (skipped by default). An application named "
+            "outright is always cloned"
+        ),
     )
     clone_parser.add_argument(
         "--get-resources",
@@ -504,8 +518,8 @@ def add_clean_parser(command_parser: _SubParsersAction[ArgumentParser]) -> None:
         "clean",
         help=(
             "Delete the cloned Puakma Application directories in the "
-            "workspace. Refuses to delete a clone holding local changes "
-            "the server doesn't have, without --force"
+            "workspace. There is no undo; --check first asks the server "
+            "whether a clone holds local changes it doesn't have"
         ),
     )
     clean_parser.add_argument(
@@ -525,11 +539,13 @@ def add_clean_parser(command_parser: _SubParsersAction[ArgumentParser]) -> None:
         action="store_true",
     )
     clean_parser.add_argument(
-        "--force",
+        "--check",
         action="store_true",
         help=(
-            "Delete even clones with local changes the server doesn't "
-            "have (or that can't be verified against it). There is no undo"
+            "Before deleting, verify each clone against the server's design "
+            "element hashes and refuse any holding local changes the server "
+            "doesn't have (or that can't be verified). Needs a reachable "
+            "backend=gateway server"
         ),
     )
     clean_parser.add_argument(

{vortex_cli-6.0.0 → vortex_cli-6.1.0}/vortex/commands/clean.py

@@ -9,20 +9,21 @@ the same 'app_ids: list[int] | None' convention 'vortex pull' and
 'vortex push' use, APPLICATION ids, not the design-element ids
 'vortex delete' takes - narrows it to those clones.
 
-THE SAFETY GATE. There is no undo and no git inside an app folder, so
-clean refuses to delete a clone holding local work the server does not
-have, naming each file, unless --force is given. Deciding that is the
+THE OPT-IN SAFETY GATE. There is no undo and no git inside an app
+folder. With --check, clean refuses to delete a clone holding local
+work the server does not have, naming each file. Deciding that is the
 same three-way comparison pull makes (see pull.local_modifications)
 and it CANNOT be done offline: 'vortex push' does not move the
 manifest baseline, so after a push the local file differs from the
 baseline while matching the server. Telling 'already pushed, safe'
-from 'unsaved work' needs the server's hashes, which makes a
-non-forced clean a network operation. When the server can't answer -
-unreachable, refusing, or backend=soap, which has no hash endpoint at
-all - the clone is UNVERIFIABLE and clean refuses it rather than
-silently skipping the gate exactly when it matters; --force is the
-escape hatch (as is 'vortex clean --force' for an offline machine).
---force needs no network at all.
+from 'unsaved work' needs the server's hashes, which makes --check a
+network operation - one round trip per clone, and slow on a workspace
+with many. That is why it is opt-in: a plain 'vortex clean' deletes
+without asking the server anything (and so works offline). When
+--check is given and the server can't answer - unreachable, refusing,
+or backend=soap, which has no hash endpoint at all - the clone is
+UNVERIFIABLE and clean refuses it rather than silently skipping the
+gate exactly when it was asked for.
 """
 
 from __future__ import annotations
@@ -100,7 +101,7 @@ def _apply_gate(
         logger.error(
             f"{len(blocked)} application(s) hold unsaved local work (or could "
             "not be verified against the server) - push or pull them, or "
-            "re-run with --force to discard them. There is no undo"
+            "re-run without --check to discard them. There is no undo"
         )
     return blocked
 
@@ -112,7 +113,7 @@ def clean(
     include_libs: bool = False,
     app_ids: list[int] | None = None,
     *,
-    force: bool = False,
+    check: bool = False,
 ) -> int:
     cloned_apps = workspace.listapps(None if include_all else server)
 
@@ -124,7 +125,7 @@ def clean(
             return 1
         cloned_apps = [app for app in cloned_apps if app.id in wanted]
 
-    if not force and cloned_apps:
+    if check and cloned_apps:
         if _apply_gate(workspace, cloned_apps):
             return 1
 

{vortex_cli-6.0.0 → vortex_cli-6.1.0}/vortex/commands/clone.py

@@ -421,40 +421,28 @@ def _fetch_apps(
     group_filter: list[str],
     template_filter: list[str],
     strict_search: bool,
+    include_all: bool = True,
 ) -> list[PuakmaApplication]:
     """
-    Applications matching the filters, inherited and inactive included -
-    via the gateway when negotiated (client-side filtering, mirroring
-    the list command), otherwise the SOAP query. One matching semantics
-    for clone reference resolution on either backend.
+    Applications matching the filters - via the gateway when negotiated
+    (client-side filtering), otherwise the SOAP query - with exactly the
+    matching semantics of the list command on either backend. Inherited
+    and disabled applications are included only with include_all: an
+    explicitly named application is always looked up in full (the user
+    named it), a group expansion skips them unless 'clone --all'.
     """
-    client = server.negotiate_gateway()
-    if client is None:
-        return server.fetch_all_apps(
-            name_filter, group_filter, template_filter, strict_search, True, True
-        )
-    from vortex.commands.list import _filter_apps
-
-    try:
-        gateway_apps = client.get_apps()
-    except GatewayRefused as e:
-        raise GatewayUnavailable(
-            f"Gateway refused listing applications ({e.error_code}): "
-            "this identity needs GatewayDesignRead (or Admin)"
-        ) from e
-    apps = [
-        PuakmaApplication(
-            gw_app.id,
-            gw_app.name,
-            gw_app.group,
-            gw_app.inherit_from or "",
-            gw_app.template_name or "",
-            server.host,
-            server_name=server.name,
-        )
-        for gw_app in gateway_apps
-    ]
-    return _filter_apps(apps, name_filter, group_filter, template_filter, strict_search)
+    from vortex.commands.list import _fetch_apps as _list_fetch_apps
+
+    apps, _extras = _list_fetch_apps(
+        server,
+        name_filter,
+        group_filter,
+        template_filter,
+        strict_search,
+        include_all,
+        include_all,
+    )
+    return apps
 
 
 def _resolve_one(
@@ -476,29 +464,53 @@ def _resolve_one(
     return [app.id]
 
 
-def _fetch_group_apps(server: PuakmaServer, group: str) -> list[PuakmaApplication]:
+def _fetch_group_apps(
+    server: PuakmaServer, group: str, include_all: bool = False
+) -> list[PuakmaApplication]:
     """
     Applications whose group matches `group`, matched the way
     'vortex list --group' matches groups - a case-insensitive substring.
     An exact (case-insensitive) group name always wins, so cloning
-    'BetTrackr' never drags in 'BetTrackrLegacy'. Like every other clone
-    reference, inherited and inactive applications are included.
+    'BetTrackr' never drags in 'BetTrackrLegacy'. Inherited and disabled
+    applications are left out unless include_all ('clone --all').
     """
-    apps = _fetch_apps(server, [], [group], [], False)
+    apps = _fetch_apps(server, [], [group], [], False, include_all)
     exact = [app for app in apps if (app.group or "").casefold() == group.casefold()]
     return exact or apps
 
 
+def _group_has_only_hidden_apps(
+    server: PuakmaServer, group: str, include_all: bool
+) -> bool:
+    """
+    True when a group matched nothing only because every application in
+    it is disabled or inherited - the case '--all' exists for. Logs why.
+    """
+    if include_all or not _fetch_group_apps(server, group, True):
+        return False
+    logger.error(
+        f"Every application in a group matching '{group}' on '{server.name}' "
+        "is disabled or inherited. Use '--all' to clone them too"
+    )
+    return True
+
+
 def _resolve_group(
-    server: PuakmaServer, group: str, apps: list[PuakmaApplication] | None = None
+    server: PuakmaServer,
+    group: str,
+    apps: list[PuakmaApplication] | None = None,
+    *,
+    include_all: bool = False,
 ) -> list[int] | None:
     """Resolves a group reference to the ids of every application in it"""
     if apps is None:
-        apps = _fetch_group_apps(server, group)
+        apps = _fetch_group_apps(server, group, include_all)
     if not apps:
-        logger.error(
-            f"No applications in a group matching '{group}' found on '{server.name}'"
-        )
+        if not _group_has_only_hidden_apps(server, group, include_all):
+            logger.error(
+                f"No applications in a group matching '{group}' found on "
+                f"'{server.name}'"
+            )
         return None
     groups = sorted({app.group or "" for app in apps}, key=str.casefold)
     if len(groups) > 1:
@@ -513,15 +525,18 @@ def _resolve_group(
     return [app.id for app in apps]
 
 
-def _resolve_bare_word(server: PuakmaServer, word: str) -> list[int] | None:
+def _resolve_bare_word(
+    server: PuakmaServer, word: str, include_all: bool = False
+) -> list[int] | None:
     """
     A bare word is either a TemplateName or an application group. Both
     are looked up and a word that is somehow both is an error rather
     than a coin toss - the ID or 'group/name' clones the application,
-    '--group' clones the group.
+    '--group' clones the group. A TemplateName names one application,
+    so it is looked up in full; the group expansion honours include_all.
     """
     templates = _fetch_apps(server, [], [], [word], True)
-    group_apps = _fetch_group_apps(server, word)
+    group_apps = _fetch_group_apps(server, word, include_all)
     if templates and group_apps:
         logger.error(
             f"'{word}' is both a TemplateName and an application group on "
@@ -530,15 +545,21 @@ def _resolve_bare_word(server: PuakmaServer, word: str) -> list[int] | None:
         )
         return None
     if group_apps:
-        return _resolve_group(server, word, group_apps)
+        return _resolve_group(server, word, group_apps, include_all=include_all)
+    if not templates and _group_has_only_hidden_apps(server, word, include_all):
+        return None
     return _resolve_one(server, templates, f"TemplateName '{word}'")
 
 
-def _resolve_refs_to_ids(server: PuakmaServer, refs: list[AppRef]) -> list[int] | None:
+def _resolve_refs_to_ids(
+    server: PuakmaServer, refs: list[AppRef], *, include_all: bool = False
+) -> list[int] | None:
     """
     Resolves TemplateName, group and group/name references to
     application ids by querying the server. Returns None (having logged
-    an error) when a reference can't be resolved unambiguously.
+    an error) when a reference can't be resolved unambiguously. Group
+    references expand to their active, non-inherited applications
+    unless include_all; an application named outright always resolves.
     """
     ids: list[int] = []
     for ref in refs:
@@ -546,9 +567,9 @@ def _resolve_refs_to_ids(server: PuakmaServer, refs: list[AppRef]) -> list[int]
             ids.append(ref.id)
             continue
         if ref.is_group_only:
-            resolved = _resolve_group(server, ref.group or "")
+            resolved = _resolve_group(server, ref.group or "", include_all=include_all)
         elif ref.template is not None:
-            resolved = _resolve_bare_word(server, ref.template)
+            resolved = _resolve_bare_word(server, ref.template, include_all)
         else:
             matches = _fetch_apps(server, [ref.name or ""], [ref.group or ""], [], True)
             resolved = _resolve_one(
@@ -568,10 +589,13 @@ def clone(
     get_resources: bool = False,
     open_urls: bool = False,
     reclone: bool = False,
+    include_all: bool = False,
     timeout: int = 300,
 ) -> int:
     refs = list(app_refs)
     if reclone:
+        # Every application already cloned from THIS server. main()
+        # fans a bare '--reclone' out over every server with clones
         refs.extend(AppRef(None, id=app.id) for app in workspace.listapps(server))
 
     # Resolve credentials before the spinner starts so any interactive
@@ -580,7 +604,7 @@ def clone(
     # backend=gateway: negotiate now, before any locks - a gateway that
     # doesn't answer is an error here, never a silent SOAP fallback
     server.negotiate_gateway()
-    app_ids = _resolve_refs_to_ids(server, refs)
+    app_ids = _resolve_refs_to_ids(server, refs, include_all=include_all)
     if app_ids is None:
         return 1
 

{vortex_cli-6.0.0 → vortex_cli-6.1.0}/vortex/commands/compile.py

@@ -169,11 +169,16 @@ async def _aupload_classes(
     server: PuakmaServer,
     to_upload: list[tuple[PuakmaApplication, DesignObject]],
 ) -> int:
+    # The same routing as push: the gateway when negotiated (journalled,
+    # deploy-confirmed), the webdesign API for the gateway app itself,
+    # SOAP only on backend=soap - with the handshake lazy
+    from vortex.commands.watch import aupload_design_routed
+
     ret = 0
     async with server as s:
-        await s.server_designer.ainitiate_connection()
+        await asyncio.to_thread(s.negotiate_gateway)
         for _app, obj in to_upload:
-            ok = await obj.aupload(s.download_designer, upload_source=False)
+            ok = await aupload_design_routed(s, obj, False)
             ret |= 0 if ok else 1
     for app in {app for app, _obj in to_upload}:
         workspace.mkdir(app)