Fix static exports, Space bucket handling, and other misc issues (#517)

Co-authored-by: gradio-pr-bot <gradio-pr-bot@users.noreply.github.com>
Co-authored-by: Claude Opus 4.7 (1M context) <noreply@anthropic.com>

Author: 3 people

.changeset/great-spiders-dance.md

@@ -0,0 +1,5 @@
+---
+"trackio": minor
+---
+
+feat:Fix static exports, Space bucket handling, and other misc issues

.github/workflows/test.yml

@@ -68,6 +68,12 @@ jobs:
         npm ci
         npm run build
 
+    - name: Run frontend unit tests
+      if: matrix.os == 'ubuntu-latest'
+      run: |
+        cd trackio/frontend
+        npm test
+
     - name: Install Playwright
       if: matrix.os == 'ubuntu-latest'
       run: |

tests/e2e-local/test_api.py

@@ -291,9 +291,20 @@ def test_local_dashboard_upload_api_accepts_only_server_uploaded_paths(temp_dir)
     write_headers = {"x-trackio-write-token": write_token}
 
     try:
+        blocked_upload_resp = httpx.post(
+            f"{url.rstrip('/')}/api/upload",
+            files={"files": (source_path.name, source_text.encode())},
+            timeout=5,
+        )
+        assert blocked_upload_resp.status_code == 400
+        assert blocked_upload_resp.json() == {
+            "error": "A write_token is required to upload files to this server. Use the write-access URL from trackio.show(), set TRACKIO_WRITE_TOKEN, or send header X-Trackio-Write-Token."
+        }
+
         with source_path.open("rb") as handle:
             upload_resp = httpx.post(
                 f"{url.rstrip('/')}/api/upload",
+                headers=write_headers,
                 files={"files": (source_path.name, handle)},
                 timeout=5,
             )
@@ -345,6 +356,7 @@ def test_local_dashboard_upload_api_accepts_only_server_uploaded_paths(temp_dir)
         assert allowed_resp.status_code == 200
         assert allowed_target is not None
         assert allowed_target.read_text() == source_text
+        assert not Path(uploaded_path).exists()
         assert blocked_resp.status_code == 400
         assert blocked_resp.json() == {
             "error": "Uploaded file was not created by this Trackio server."
@@ -356,6 +368,68 @@ def test_local_dashboard_upload_api_accepts_only_server_uploaded_paths(temp_dir)
         app.close()
 
 
+def test_local_dashboard_get_metric_values_honors_run_id(temp_dir):
+    project = "test_metric_values_run_id"
+    run_name = "duplicate-run"
+
+    first = trackio.init(project=project, name=run_name, resume="never")
+    trackio.log(metrics={"loss": 1.0})
+    trackio.finish()
+
+    second = trackio.init(project=project, name=run_name, resume="never")
+    trackio.log(metrics={"loss": 2.0})
+    trackio.finish()
+
+    app, url, _, _ = trackio.show(block_thread=False, open_browser=False)
+
+    try:
+        client = Client(url, verbose=False)
+        runs = client.predict(project, api_name="/get_runs_for_project")
+        first_run_id = first.id
+        second_run_id = second.id
+        assert [run["id"] for run in runs] == [first_run_id, second_run_id]
+
+        latest_resp = httpx.post(
+            f"{url.rstrip('/')}/api/get_metric_values",
+            json={
+                "project": project,
+                "run": run_name,
+                "metric_name": "loss",
+            },
+            timeout=5,
+        )
+        first_resp = httpx.post(
+            f"{url.rstrip('/')}/api/get_metric_values",
+            json={
+                "project": project,
+                "run": run_name,
+                "run_id": first_run_id,
+                "metric_name": "loss",
+            },
+            timeout=5,
+        )
+        second_resp = httpx.post(
+            f"{url.rstrip('/')}/api/get_metric_values",
+            json={
+                "project": project,
+                "run": run_name,
+                "run_id": second_run_id,
+                "metric_name": "loss",
+            },
+            timeout=5,
+        )
+
+        assert latest_resp.status_code == 200
+        assert first_resp.status_code == 200
+        assert second_resp.status_code == 200
+        assert [row["value"] for row in latest_resp.json()["data"]] == [2.0]
+        assert [row["value"] for row in first_resp.json()["data"]] == [1.0]
+        assert [row["value"] for row in second_resp.json()["data"]] == [2.0]
+    finally:
+        trackio.delete_project(project, force=True)
+        app.close()
+
+
 def test_local_dashboard_supports_mcp(temp_dir):
     pytest.importorskip("mcp")
     from mcp import ClientSession

tests/ui/test_ui_display.py

@@ -85,9 +85,9 @@ def test_latest_only_selects_last_run(temp_dir):
             latest_toggle = page.locator(".latest-toggle input[type='checkbox']")
             latest_toggle.check()
 
-            expect(checkboxes.nth(0)).not_to_be_checked()
+            expect(checkboxes.nth(0)).to_be_checked()
             expect(checkboxes.nth(1)).not_to_be_checked()
-            expect(checkboxes.nth(2)).to_be_checked()
+            expect(checkboxes.nth(2)).not_to_be_checked()
 
             browser.close()
     finally:

tests/unit/test_deploy.py

@@ -1,8 +1,6 @@
 from types import SimpleNamespace
 from unittest.mock import patch
 
-from huggingface_hub import Volume
-
 from trackio import deploy
 from trackio.bucket_storage import _list_bucket_file_paths
 
@@ -20,27 +18,6 @@ def test_get_space_install_requirement_includes_mcp_extra():
     assert requirement == f"trackio[spaces,mcp]=={deploy.trackio.__version__}"
 
 
-@patch("trackio.deploy.huggingface_hub.HfApi")
-def test_get_source_bucket_falls_back_to_space_info_runtime(mock_hf_api):
-    api = mock_hf_api.return_value
-    api.get_space_runtime.return_value = SimpleNamespace(volumes=None)
-    api.space_info.return_value = SimpleNamespace(
-        runtime=SimpleNamespace(
-            volumes=[
-                Volume(
-                    type="bucket",
-                    source="abidlabs/example-bucket",
-                    mount_path="/data",
-                )
-            ]
-        )
-    )
-
-    bucket_id = deploy._get_source_bucket("abidlabs/example-space")
-
-    assert bucket_id == "abidlabs/example-bucket"
-
-
 @patch("trackio.bucket_storage.huggingface_hub.list_bucket_tree")
 def test_list_bucket_file_paths_uses_list_bucket_tree(mock_list_bucket_tree):
     mock_list_bucket_tree.return_value = [

tests/unit/test_sqlite_storage.py

@@ -270,6 +270,38 @@ def test_get_runs_returns_chronological_order(temp_dir):
     assert runs == ["run-z", "run-a", "run-m"]
 
 
+def test_get_metric_values_respects_run_id_and_name_resolves_latest_run(temp_dir):
+    project = "proj_metric_values"
+    run_name = "dup-run"
+
+    SQLiteStorage.bulk_log(
+        project,
+        run_name,
+        [{"loss": 1.0}],
+        run_id="run-id-1",
+        timestamps=["2024-01-01T00:00:00+00:00"],
+    )
+    SQLiteStorage.bulk_log(
+        project,
+        run_name,
+        [{"loss": 2.0}],
+        run_id="run-id-2",
+        timestamps=["2024-01-02T00:00:00+00:00"],
+    )
+
+    latest_by_name = SQLiteStorage.get_metric_values(project, run_name, "loss")
+    first_by_id = SQLiteStorage.get_metric_values(
+        project, run_name, "loss", run_id="run-id-1"
+    )
+    second_by_id = SQLiteStorage.get_metric_values(
+        project, run_name, "loss", run_id="run-id-2"
+    )
+
+    assert [row["value"] for row in latest_by_name] == [2.0]
+    assert [row["value"] for row in first_by_id] == [1.0]
+    assert [row["value"] for row in second_by_id] == [2.0]
+
+
 def test_rename_run(temp_dir):
     project = "test_project"
     old_name = "old_run"

trackio/__init__.py

@@ -390,8 +390,10 @@ def init(
             "* Warning: settings is not used. Provided for compatibility with wandb.init(). Please create an issue at: https://github.com/gradio-app/trackio/issues if you need a specific feature implemented."
         )
 
+    bucket_id_was_explicit = bucket_id is not None
     space_id, server_url = utils.resolve_space_id_and_server_url(space_id, server_url)
-    bucket_id = bucket_id or os.environ.get("TRACKIO_BUCKET_ID")
+    if bucket_id is None and utils.on_spaces():
+        bucket_id = os.environ.get("TRACKIO_BUCKET_ID")
     if server_url is not None and not server_url.startswith(("http://", "https://")):
         raise ValueError(
             f"`server_url` must be a full URL starting with http:// or https://, got: {server_url!r}"
@@ -419,6 +421,14 @@ def init(
         space_id, dataset_id, bucket_id = utils.preprocess_space_and_dataset_ids(
             space_id, dataset_id, bucket_id
         )
+        if (
+            space_id is not None
+            and dataset_id is None
+            and bucket_id is not None
+            and not bucket_id_was_explicit
+            and not utils.on_spaces()
+        ):
+            bucket_id = deploy.resolve_auto_bucket_id(space_id, bucket_id)
     except LocalTokenNotFoundError as e:
         raise LocalTokenNotFoundError(
             f"You must be logged in to Hugging Face locally when `space_id` is provided to deploy to a Space. {e}"
@@ -438,17 +448,20 @@ def init(
 
     remote_source = space_id or server_base_url
 
-    url = context_vars.current_server.get()
-
     if remote_source is not None:
-        if url is None:
-            url = remote_source
-            context_vars.current_server.set(url)
-            if space_id is not None:
-                context_vars.current_space_id.set(space_id)
-                context_vars.current_server_write_token.set(None)
-            elif server_base_url is not None:
-                context_vars.current_server_write_token.set(write_token_resolved)
+        url = remote_source
+        context_vars.current_server.set(url)
+        if space_id is not None:
+            context_vars.current_space_id.set(space_id)
+            context_vars.current_server_write_token.set(None)
+        else:
+            context_vars.current_space_id.set(None)
+            context_vars.current_server_write_token.set(write_token_resolved)
+    else:
+        url = None
+        context_vars.current_server.set(None)
+        context_vars.current_space_id.set(None)
+        context_vars.current_server_write_token.set(None)
 
     _should_embed_local = False
 
@@ -459,13 +472,15 @@ def init(
         print(f"* Trackio project initialized: {project}")
 
         if bucket_id is not None:
-            os.environ["TRACKIO_BUCKET_ID"] = bucket_id
+            if utils.on_spaces():
+                os.environ["TRACKIO_BUCKET_ID"] = bucket_id
             bucket_url = f"https://huggingface.co/buckets/{bucket_id}"
             print(
                 f"* Trackio metrics will be synced to Hugging Face Bucket: {bucket_url}"
             )
         elif dataset_id is not None:
-            os.environ["TRACKIO_DATASET_ID"] = dataset_id
+            if utils.on_spaces():
+                os.environ["TRACKIO_DATASET_ID"] = dataset_id
             print(
                 f"* Trackio metrics will be synced to Hugging Face Dataset: {dataset_id}"
             )

trackio/api.py

@@ -31,13 +31,15 @@ def delete(self) -> bool:
         return SQLiteStorage.delete_run(self.project, self.name, run_id=self.id)
 
     def move(self, new_project: str) -> bool:
-        success = SQLiteStorage.move_run(self.project, self.name, new_project)
+        success = SQLiteStorage.move_run(
+            self.project, self.name, new_project, run_id=self.id
+        )
         if success:
             self.project = new_project
         return success
 
     def rename(self, new_name: str) -> "Run":
-        SQLiteStorage.rename_run(self.project, self.name, new_name)
+        SQLiteStorage.rename_run(self.project, self.name, new_name, run_id=self.id)
         self.name = new_name
         return self
 

trackio/asgi_app.py

@@ -7,6 +7,7 @@
 import secrets
 import tempfile
 import threading
+from collections.abc import Callable
 from pathlib import Path
 from typing import Any, get_args, get_origin
 from urllib.parse import unquote
@@ -88,6 +89,13 @@ def consume_uploaded_temp_file(request: Request, file_data: Any) -> Path:
     return resolved_path
 
 
+def cleanup_uploaded_temp_file(file_path: str | Path) -> None:
+    try:
+        Path(file_path).unlink(missing_ok=True)
+    except Exception:
+        pass
+
+
 def _invoke_handler(
     fn: Any,
     request: Request,
@@ -377,6 +385,13 @@ async def sse() -> Any:
 
 
 async def upload_handler(request: Request) -> Response:
+    upload_authorizer = getattr(request.app.state, "upload_authorizer", None)
+    if callable(upload_authorizer):
+        try:
+            upload_authorizer(request)
+        except TrackioAPIError as e:
+            return JSONResponse({"error": str(e)}, status_code=400)
+
     form = await request.form()
     uploads = form.getlist("files")
     saved_paths = []
@@ -397,11 +412,18 @@ async def gradio_upload_alias_handler(request: Request) -> Response:
     return await upload_handler(request)
 
 
+_DISALLOWED_FILE_SUFFIXES = frozenset(
+    {".db", ".db-journal", ".db-wal", ".db-shm", ".sqlite", ".sqlite3"}
+)
+
+
 async def file_handler(request: Request) -> Response:
     fs_path = request.query_params.get("path")
     if fs_path is None:
         return Response("Missing path", status_code=400)
     fp = Path(unquote(fs_path)).resolve(strict=False)
+    if fp.suffix.lower() in _DISALLOWED_FILE_SUFFIXES:
+        return Response("Not found", status_code=404)
     allowed_roots = getattr(request.app.state, "allowed_file_roots", ())
     if fp.is_file() and _is_allowed_file_path(fp, allowed_roots):
         return FileResponse(str(fp))
@@ -415,6 +437,7 @@ def create_trackio_starlette_app(
     mcp_lifespan: Any = None,
     mcp_enabled: bool = False,
     allowed_file_roots: list[str | Path] | None = None,
+    upload_authorizer: Callable[[Request], None] | None = None,
 ) -> Starlette:
     routes: list[Any] = list(oauth_routes)
     routes.extend(
@@ -475,6 +498,7 @@ def create_trackio_starlette_app(
     app.state.api_registry = api_registry
     app.state.mcp_enabled = mcp_enabled
     app.state.allowed_file_roots = _normalize_allowed_file_roots(allowed_file_roots)
+    app.state.upload_authorizer = upload_authorizer
     app.state.uploaded_temp_files = set()
     app.state.uploaded_temp_files_lock = threading.Lock()
     if on_spaces():