terradev-cli 5.3.0__tar.gz → 5.3.2__tar.gz

{terradev_cli-5.3.0 → terradev_cli-5.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: terradev-cli
-Version: 5.3.0
+Version: 5.3.2
 Summary: An imperative command-line-interface for AI workload orchestration.
 Author-email: Terradev Team <team@terradev.com>
 Maintainer-email: Terradev Team <team@terradev.com>
@@ -93,7 +93,7 @@ Requires-Dist: redis>=5.0.0; extra == "enterprise"
 Requires-Dist: PyJWT>=2.8.0; extra == "enterprise"
 Dynamic: license-file
 
-# Terradev CLI v5.3.0
+# Terradev CLI v5.3.2
 
 **An imperative command-line-interface for AI workload orchestration.**
 

{terradev_cli-5.3.0/terradev_cli → terradev_cli-5.3.2}/README.md

@@ -1,4 +1,4 @@
-# Terradev CLI v5.3.0
+# Terradev CLI v5.3.2
 
 **An imperative command-line-interface for AI workload orchestration.**
 

{terradev_cli-5.3.0 → terradev_cli-5.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "terradev-cli"
-version = "5.3.0"
+version = "5.3.2"
 description = "An imperative command-line-interface for AI workload orchestration."
 readme = "README.md"
 license = {text = "Apache-2.0"}

{terradev_cli-5.3.0 → terradev_cli-5.3.2/terradev_cli}/README.md

@@ -1,4 +1,4 @@
-# Terradev CLI v5.3.0
+# Terradev CLI v5.3.2
 
 **An imperative command-line-interface for AI workload orchestration.**
 

{terradev_cli-5.3.0 → terradev_cli-5.3.2}/terradev_cli/__init__.py

@@ -3,6 +3,6 @@ Terradev CLI - Cross-Cloud Compute Optimization Platform
 Parallel provisioning and orchestration for optimized compute costs
 """
 
-__version__ = "5.0.1"
+__version__ = "5.3.2"
 __author__ = "Terradev Team"
 __description__ = "Open Source BYOAPI Multi-Cloud GPU Infrastructure Platform"

{terradev_cli-5.3.0 → terradev_cli-5.3.2}/terradev_cli/cli.py

@@ -14533,6 +14533,10 @@ def agent_teardown(fleet_id, yes):
     click.echo(_json.dumps(result, indent=2))
 
 
+# Register agent command group (defined above)
+cli.add_command(agent)
+
+
 if __name__ == "__main__":
     cli()
 

{terradev_cli-5.3.0 → terradev_cli-5.3.2}/terradev_cli/core/auth.py

@@ -6,6 +6,7 @@ Handles secure credential storage and management
 
 import json
 import os
+import tempfile
 from pathlib import Path
 from typing import Dict, Optional
 from cryptography.fernet import Fernet
@@ -116,11 +117,22 @@ class AuthManager:
             "version": "2.0",
         }
 
-        with open(auth_file_path, "w") as f:
-            json.dump(data, f, indent=2)
-
-        # Set secure permissions
-        os.chmod(auth_file_path, 0o600)
+        # Atomic write: write to a temp file in the same directory, then
+        # rename into place. On POSIX, os.replace() is atomic, so a crash
+        # mid-write cannot corrupt the existing credentials file.
+        dir_path = auth_file_path.parent
+        fd, tmp_path = tempfile.mkstemp(dir=dir_path, prefix=".auth_tmp_")
+        try:
+            with os.fdopen(fd, "w") as f:
+                json.dump(data, f, indent=2)
+            os.chmod(tmp_path, 0o600)
+            os.replace(tmp_path, auth_file_path)
+        except Exception:
+            try:
+                os.unlink(tmp_path)
+            except OSError:
+                pass
+            raise
 
     def set_credentials(
         self, provider: str, api_key: str, secret_key: Optional[str] = None

{terradev_cli-5.3.0 → terradev_cli-5.3.2}/terradev_cli/core/checkpoint_manager.py

@@ -221,7 +221,7 @@ def _run_on(
     import re
 
     # Allow alphanumeric, spaces, and basic shell-safe characters
-    if not re.match(r'^[a-zA-Z0-9_\-./:=@, \n\t"\']+$', cmd):
+    if not re.match(r'^[a-zA-Z0-9_\-./:=@, \n\t|>&]+$', cmd):
         return -1, "", "Unsafe command characters detected"
 
     if host and host not in ("localhost", "127.0.0.1"):

{terradev_cli-5.3.0 → terradev_cli-5.3.2}/terradev_cli/core/dag_executor.py

@@ -197,9 +197,6 @@ class DAGExecutor:
         def dfs(name: str, path: List[str]):
             color[name] = GRAY
             path.append(name)
-            for dep_name, dep_node in self._nodes.items():
-                # Check reverse: who depends on `name`
-                pass
             # Check forward: what does `name` depend on
             for dep in self._nodes[name].dependencies:
                 if color[dep] == GRAY:
@@ -327,7 +324,6 @@ class DAGExecutor:
 
                 for node_name in wave.nodes:
                     node = self._nodes[node_name]
-                    node.status = "running"
 
                     # Build dependency context for this node
                     dep_ctx = {dep: context.get(dep) for dep in node.dependencies}
@@ -340,20 +336,14 @@ class DAGExecutor:
                 # Collect wave results
                 for future in as_completed(futures):
                     node_name = futures[future]
-                    node = self._nodes[node_name]
 
                     try:
                         output, latency = future.result()
-                        node.output = output
-                        node.latency_ms = latency
-                        node.status = "done"
                         context[node_name] = output
                         result.outputs[node_name] = output
                         result.node_latencies[node_name] = latency
                         result.node_statuses[node_name] = "done"
                     except Exception as e:
-                        node.status = "failed"
-                        node.error = str(e)
                         result.errors[node_name] = str(e)
                         result.node_statuses[node_name] = "failed"
                         logger.error(

{terradev_cli-5.3.0 → terradev_cli-5.3.2}/terradev_cli/core/data_governance.py

@@ -4,9 +4,17 @@ Terradev Data Governance Module
 Handles explicit consent, comprehensive logging, and OPA policy enforcement for data movement
 """
 
+import json
 import logging
 from datetime import datetime, timezone, timedelta
-from typing import Dict, List, Any, Optional
+from collections import deque
+from typing import Deque, Dict, List, Any, Optional
+
+_MAX_MOVEMENT_LOGS = 10_000
+_MAX_OPA_EVALUATIONS = 10_000
+_MAX_CONSENT_REQUESTS = 5_000
+_AUDIT_MAX_BYTES = 50 * 1024 * 1024  # 50 MB before rotation
+_AUDIT_BACKUP_COUNT = 5
 from dataclasses import dataclass, asdict
 from enum import Enum
 import hashlib
@@ -143,8 +151,8 @@ class DataGovernanceManager:
         self.auth = auth
         self.consent_requests: Dict[str, ConsentRequest] = {}
         self.consent_responses: Dict[str, ConsentResponse] = {}
-        self.movement_logs: List[DataMovementLog] = []
-        self.opa_evaluations: List[OPAPolicyEvaluation] = []
+        self.movement_logs: Deque[DataMovementLog] = deque(maxlen=_MAX_MOVEMENT_LOGS)
+        self.opa_evaluations: Deque[OPAPolicyEvaluation] = deque(maxlen=_MAX_OPA_EVALUATIONS)
 
         # Governance settings
         self.consent_required = True
@@ -156,6 +164,8 @@ class DataGovernanceManager:
         self._log_dir = Path.home() / ".terradev" / "governance"
         self._log_dir.mkdir(parents=True, exist_ok=True)
         self._audit_file = self._log_dir / "audit_log.jsonl"
+        self._audit_max_bytes = _AUDIT_MAX_BYTES
+        self._audit_backup_count = _AUDIT_BACKUP_COUNT
 
         # Initialize OPA policies
         self._initialize_opa_policies()
@@ -269,6 +279,10 @@ class DataGovernanceManager:
             },
         )
 
+        # H-C: Evict oldest consent requests when cap is reached
+        if len(self.consent_requests) >= _MAX_CONSENT_REQUESTS:
+            oldest_key = next(iter(self.consent_requests))
+            del self.consent_requests[oldest_key]
         self.consent_requests[request_id] = consent_request
 
         # Log consent request
@@ -737,45 +751,62 @@ class DataGovernanceManager:
             f"Consent notification sent to user {consent_request.user_id} for request {consent_request.request_id}"
         )
 
+    def _write_audit_entry(self, entry: Dict[str, Any]) -> None:
+        """Write a single JSONL audit entry with log rotation."""
+        if not self.logging_enabled:
+            return
+        try:
+            if (
+                self._audit_file.exists()
+                and self._audit_file.stat().st_size >= self._audit_max_bytes
+            ):
+                # Rotate: shift backup files down, rename current → .1
+                for i in range(self._audit_backup_count - 1, 0, -1):
+                    src = self._audit_file.with_suffix(f".jsonl.{i}")
+                    dst = self._audit_file.with_suffix(f".jsonl.{i + 1}")
+                    if src.exists():
+                        src.rename(dst)
+                self._audit_file.rename(self._audit_file.with_suffix(".jsonl.1"))
+            with open(self._audit_file, "a") as af:
+                af.write(json.dumps(entry, default=str) + "\n")
+        except Exception as exc:
+            logger.warning(f"Audit log write failed: {exc}")
+
     async def _log_consent_request(self, consent_request: ConsentRequest):
         """Log consent request"""
-        if self.logging_enabled:
-            {
-                "type": "consent_request",
-                "timestamp": datetime.now(timezone.utc).isoformat(),
-                "data": asdict(consent_request),
-            }
-            logger.info(f"Consent request logged: {consent_request.request_id}")
+        self._write_audit_entry({
+            "type": "consent_request",
+            "timestamp": datetime.now(timezone.utc).isoformat(),
+            "data": asdict(consent_request),
+        })
+        logger.info(f"Consent request logged: {consent_request.request_id}")
 
     async def _log_consent_response(self, consent_response: ConsentResponse):
         """Log consent response"""
-        if self.logging_enabled:
-            {
-                "type": "consent_response",
-                "timestamp": datetime.now(timezone.utc).isoformat(),
-                "data": asdict(consent_response),
-            }
-            logger.info(f"Consent response logged: {consent_response.request_id}")
+        self._write_audit_entry({
+            "type": "consent_response",
+            "timestamp": datetime.now(timezone.utc).isoformat(),
+            "data": asdict(consent_response),
+        })
+        logger.info(f"Consent response logged: {consent_response.request_id}")
 
     async def _log_opa_evaluation(self, evaluation: OPAPolicyEvaluation):
         """Log OPA policy evaluation"""
-        if self.logging_enabled:
-            {
-                "type": "opa_evaluation",
-                "timestamp": datetime.now(timezone.utc).isoformat(),
-                "data": asdict(evaluation),
-            }
-            logger.info(f"OPA evaluation logged: {evaluation.policy_id}")
+        self._write_audit_entry({
+            "type": "opa_evaluation",
+            "timestamp": datetime.now(timezone.utc).isoformat(),
+            "data": asdict(evaluation),
+        })
+        logger.info(f"OPA evaluation logged: {evaluation.policy_id}")
 
     async def _log_data_movement(self, movement_log: DataMovementLog):
         """Log data movement"""
-        if self.logging_enabled:
-            {
-                "type": "data_movement",
-                "timestamp": datetime.now(timezone.utc).isoformat(),
-                "data": asdict(movement_log),
-            }
-            logger.info(f"Data movement logged: {movement_log.movement_id}")
+        self._write_audit_entry({
+            "type": "data_movement",
+            "timestamp": datetime.now(timezone.utc).isoformat(),
+            "data": asdict(movement_log),
+        })
+        logger.info(f"Data movement logged: {movement_log.movement_id}")
 
     async def _evaluate_single_policy(
         self, policy_config: Dict[str, Any], input_data: Dict[str, Any]

{terradev_cli-5.3.0 → terradev_cli-5.3.2}/terradev_cli/core/distributed_lock.py

@@ -10,6 +10,7 @@ Rust implementation provides:
 """
 
 import logging
+import threading
 import uuid
 from datetime import datetime, timedelta
 from typing import Dict, Optional, Tuple
@@ -35,6 +36,7 @@ class DistributedLockManager:
             self._rust_lock = PyDistributedLock()
         else:
             self._locks: Dict[str, Tuple[str, datetime]] = {}
+            self._lock = threading.Lock()
 
     async def acquire(
         self, key: str, holder: str, ttl_seconds: int = 3600
@@ -45,15 +47,16 @@ class DistributedLockManager:
             return grant.lease_id
         else:
             # Python fallback with in-memory dict
-            if key in self._locks:
-                holder, expiry = self._locks[key]
-                if datetime.now() < expiry:
-                    return None
-            lease_id = str(uuid.uuid4())
-            self._locks[key] = (
-                lease_id,
-                datetime.now() + timedelta(seconds=ttl_seconds),
-            )
+            with self._lock:
+                if key in self._locks:
+                    _stored_lease, expiry = self._locks[key]
+                    if datetime.now() < expiry:
+                        return None
+                lease_id = str(uuid.uuid4())
+                self._locks[key] = (
+                    lease_id,
+                    datetime.now() + timedelta(seconds=ttl_seconds),
+                )
             return lease_id
 
     async def release(self, key: str, holder: str, lease_id: str) -> bool:
@@ -62,11 +65,12 @@ class DistributedLockManager:
             return await self._rust_lock.release(key, holder, lease_id)
         else:
             # Python fallback
-            if key in self._locks:
-                stored_lease, _ = self._locks[key]
-                if stored_lease == lease_id:
-                    del self._locks[key]
-                    return True
+            with self._lock:
+                if key in self._locks:
+                    stored_lease, _ = self._locks[key]
+                    if stored_lease == lease_id:
+                        del self._locks[key]
+                        return True
             return False
 
     async def renew(
@@ -77,12 +81,13 @@ class DistributedLockManager:
             return await self._rust_lock.renew(key, holder, lease_id, ttl_seconds)
         else:
             # Python fallback
-            if key in self._locks:
-                stored_lease, _ = self._locks[key]
-                if stored_lease == lease_id:
-                    self._locks[key] = (
-                        lease_id,
-                        datetime.now() + timedelta(seconds=ttl_seconds),
-                    )
-                    return True
+            with self._lock:
+                if key in self._locks:
+                    stored_lease, _ = self._locks[key]
+                    if stored_lease == lease_id:
+                        self._locks[key] = (
+                            lease_id,
+                            datetime.now() + timedelta(seconds=ttl_seconds),
+                        )
+                        return True
             return False

{terradev_cli-5.3.0 → terradev_cli-5.3.2}/terradev_cli/core/event_system.py

@@ -4,13 +4,17 @@ Terradev Event System - Triggers, Environment Promotion, and Artifact Lineage
 Production-grade automation infrastructure for ML workflows
 """
 
-from typing import Dict, List, Any, Optional, Callable
+import threading
+from collections import deque
+from typing import Dict, Deque, List, Any, Optional, Callable
 from dataclasses import dataclass, field
 from enum import Enum
 import uuid
 from datetime import datetime
 import logging
 
+_EVENT_HISTORY_MAX = 1000  # Maximum events retained in memory
+
 # Rust event bus integration
 try:
     from terradev_event_bus import PyEventBus, PyEvent
@@ -153,27 +157,29 @@ class EventBus:
     """Event bus for publishing and subscribing to events"""
 
     def __init__(self):
+        self._lock = threading.Lock()
         self.subscribers: Dict[EventType, List[Callable]] = {}
-        self.event_history: List[Event] = []
+        self.event_history: Deque[Event] = deque(maxlen=_EVENT_HISTORY_MAX)
         self.logger = logging.getLogger(__name__)
 
     def subscribe(self, event_type: EventType, callback: Callable[[Event], None]):
         """Subscribe to event type"""
-        if event_type not in self.subscribers:
-            self.subscribers[event_type] = []
-        self.subscribers[event_type].append(callback)
+        with self._lock:
+            if event_type not in self.subscribers:
+                self.subscribers[event_type] = []
+            self.subscribers[event_type].append(callback)
 
     def publish(self, event: Event):
         """Publish event to all subscribers"""
-        self.event_history.append(event)
+        with self._lock:
+            self.event_history.append(event)  # deque auto-evicts oldest when full
+            callbacks = list(self.subscribers.get(event.type, []))
         self.logger.info(f"Published event: {event.type.value} from {event.source}")
-
-        if event.type in self.subscribers:
-            for callback in self.subscribers[event.type]:
-                try:
-                    callback(event)
-                except Exception as e:
-                    self.logger.error(f"Error in event callback: {e}")
+        for callback in callbacks:
+            try:
+                callback(event)
+            except Exception as e:
+                self.logger.error(f"Error in event callback: {e}")
 
     def get_events(
         self,
@@ -182,7 +188,8 @@ class EventBus:
         limit: int = 100,
     ) -> List[Event]:
         """Get events with optional filtering"""
-        events = self.event_history
+        with self._lock:
+            events: List[Event] = list(self.event_history)
 
         if event_type:
             events = [e for e in events if e.type == event_type]
@@ -199,6 +206,7 @@ class TriggerManager:
     def __init__(self, event_bus: EventBus):
         self.event_bus = event_bus
         self.triggers: Dict[str, Trigger] = {}
+        self._lock = threading.Lock()
         self.logger = logging.getLogger(__name__)
 
         # Subscribe to all event types
@@ -212,15 +220,16 @@ class TriggerManager:
         trigger = Trigger(
             name=name, type=trigger_type, target_pipeline=target_pipeline, **kwargs
         )
-
-        self.triggers[trigger.id] = trigger
+        with self._lock:
+            self.triggers[trigger.id] = trigger
         self.logger.info(f"Created trigger: {name} ({trigger_type.value})")
-
         return trigger
 
     def _handle_event(self, event: Event):
         """Handle incoming events and check triggers"""
-        for trigger in self.triggers.values():
+        with self._lock:
+            triggers = list(self.triggers.values())
+        for trigger in triggers:
             if not trigger.enabled:
                 continue
 
@@ -256,8 +265,9 @@ class TriggerManager:
 
     def _execute_trigger(self, trigger: Trigger, event: Event):
         """Execute trigger (launch pipeline)"""
-        trigger.last_triggered = datetime.now()
-        trigger.trigger_count += 1
+        with self._lock:
+            trigger.last_triggered = datetime.now()
+            trigger.trigger_count += 1
 
         self.logger.info(f"Trigger '{trigger.name}' fired by event {event.type.value}")
 
@@ -284,6 +294,7 @@ class LineageService:
 
     def __init__(self):
         self.artifacts: Dict[str, Artifact] = {}
+        self._lock = threading.Lock()
         self.logger = logging.getLogger(__name__)
 
     def register_artifact(
@@ -298,26 +309,27 @@ class LineageService:
         artifact = Artifact(
             type=artifact_type, name=name, uri=uri, environment=environment, **kwargs
         )
-
-        self.artifacts[artifact.id] = artifact
+        with self._lock:
+            self.artifacts[artifact.id] = artifact
         self.logger.info(
             f"Registered artifact: {artifact_type.value} {name} in {environment.value}"
         )
-
         return artifact
 
     def add_relationship(self, parent_id: str, child_id: str):
         """Add parent-child relationship between artifacts"""
-        if parent_id in self.artifacts and child_id in self.artifacts:
-            self.artifacts[parent_id].child_ids.append(child_id)
-            self.artifacts[child_id].parent_ids.append(parent_id)
+        with self._lock:
+            if parent_id in self.artifacts and child_id in self.artifacts:
+                self.artifacts[parent_id].child_ids.append(child_id)
+                self.artifacts[child_id].parent_ids.append(parent_id)
 
     def get_lineage(
         self, artifact_id: str, direction: str = "both"
     ) -> Dict[str, List[Artifact]]:
         """Get lineage graph for artifact"""
-        if artifact_id not in self.artifacts:
-            return {}
+        with self._lock:
+            if artifact_id not in self.artifacts:
+                return {}
 
         result = {"parents": [], "children": []}
 
@@ -378,6 +390,7 @@ class EnvironmentManager:
         self.lineage_service = lineage_service
         self.event_bus = event_bus
         self.promotions: Dict[str, Promotion] = {}
+        self._lock = threading.Lock()
         self.logger = logging.getLogger(__name__)
 
     def request_promotion(
@@ -395,7 +408,8 @@ class EnvironmentManager:
             requested_by=requested_by,
         )
 
-        self.promotions[promotion.id] = promotion
+        with self._lock:
+            self.promotions[promotion.id] = promotion
         self.logger.info(
             f"Promotion requested: {from_env.value} -> {to_env.value} for artifact {artifact_id}"
         )
@@ -464,7 +478,8 @@ class EnvironmentManager:
         self, artifact_id: Optional[str] = None
     ) -> List[Promotion]:
         """Get promotion history"""
-        promotions = list(self.promotions.values())
+        with self._lock:
+            promotions = list(self.promotions.values())
 
         if artifact_id:
             promotions = [p for p in promotions if p.artifact_id == artifact_id]

{terradev_cli-5.3.0 → terradev_cli-5.3.2}/terradev_cli/core/gitops_manager.py

@@ -12,6 +12,7 @@ Implements GitOps patterns for Kubernetes infrastructure management:
 Based on production lessons: "GitOps isn't optional, it's survival"
 """
 
+import re
 import yaml
 import subprocess
 import logging
@@ -20,6 +21,8 @@ from typing import Dict, List, Optional, Any
 from dataclasses import dataclass, field
 from enum import Enum
 
+_SAFE_REPO_NAME_RE = re.compile(r'^[a-zA-Z0-9_\-\.]{1,128}$')
+
 logger = logging.getLogger(__name__)
 
 
@@ -80,6 +83,14 @@ class GitOpsManager:
     def __init__(self, config: GitOpsConfig):
         self.config = config
         self.repo_structure = GitRepoStructure()
+        # H-B: Sanitize repository name — reject anything that could escape the
+        # ~/.terradev/gitops/ directory via path traversal (e.g. "../../.ssh").
+        if not _SAFE_REPO_NAME_RE.match(config.repository):
+            raise ValueError(
+                f"GitOps repository name {config.repository!r} is invalid. "
+                "Only alphanumerics, hyphens, underscores, and dots are allowed "
+                "(max 128 chars)."
+            )
         self.work_dir = Path.home() / ".terradev" / "gitops" / config.repository
 
     async def init_repository(self) -> bool:
@@ -222,7 +233,12 @@ class GitOpsManager:
                             },
                             {
                                 "name": "configs.credentialTemplates.git-creds.password",
-                                "value": self.config.git_token or "",
+                                # H-A: Do NOT embed the literal token in the YAML — it would
+                                # be committed to git.  Reference a Kubernetes Secret instead;
+                                # the caller must create the secret out-of-band:
+                                #   kubectl create secret generic argocd-git-creds \
+                                #     --from-literal=password=<TOKEN> -n <namespace>
+                                "value": "<from-secret:argocd-git-creds:password>",
                             },
                         ]
                     },

{terradev_cli-5.3.0 → terradev_cli-5.3.2}/terradev_cli/core/gpu_topology.py

@@ -696,11 +696,12 @@ class RDMAConfigurator:
             "NCCL_NET_GDR_READ": "1",
         }
         if pair.locality == PCIeLocality.PIX:
+            import os
             import tempfile
 
-            env["NCCL_TOPO_DUMP_FILE"] = tempfile.mktemp(
-                prefix="nccl_topo_", suffix=".xml"
-            )
+            _nccl_fd, _nccl_path = tempfile.mkstemp(prefix="nccl_topo_", suffix=".xml")
+            os.close(_nccl_fd)
+            env["NCCL_TOPO_DUMP_FILE"] = _nccl_path
 
         # XCD-aware env vars for intra-GPU NUMA
         if gpu:

{terradev_cli-5.3.0 → terradev_cli-5.3.2}/terradev_cli/core/inference_router.py

@@ -813,6 +813,9 @@ class InferenceRouter:
     ) -> Optional[float]:
         """Measure latency to a target via async ping (ms)"""
         try:
+            # R3-B: Defense-in-depth — refuse targets that look like flags.
+            if not target or target.startswith("-"):
+                return None
             proc = await asyncio.create_subprocess_exec(
                 "ping",
                 "-c",