terradev-cli 5.3.1__tar.gz → 5.3.2__tar.gz

{terradev_cli-5.3.1 → terradev_cli-5.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: terradev-cli
-Version: 5.3.1
+Version: 5.3.2
 Summary: An imperative command-line-interface for AI workload orchestration.
 Author-email: Terradev Team <team@terradev.com>
 Maintainer-email: Terradev Team <team@terradev.com>
@@ -93,7 +93,7 @@ Requires-Dist: redis>=5.0.0; extra == "enterprise"
 Requires-Dist: PyJWT>=2.8.0; extra == "enterprise"
 Dynamic: license-file
 
-# Terradev CLI v5.3.1
+# Terradev CLI v5.3.2
 
 **An imperative command-line-interface for AI workload orchestration.**
 

{terradev_cli-5.3.1/terradev_cli → terradev_cli-5.3.2}/README.md

@@ -1,4 +1,4 @@
-# Terradev CLI v5.3.0
+# Terradev CLI v5.3.2
 
 **An imperative command-line-interface for AI workload orchestration.**
 

{terradev_cli-5.3.1 → terradev_cli-5.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "setuptools.build_meta"
 
 [project]
 name = "terradev-cli"
-version = "5.3.1"
+version = "5.3.2"
 description = "An imperative command-line-interface for AI workload orchestration."
 readme = "README.md"
 license = {text = "Apache-2.0"}

{terradev_cli-5.3.1 → terradev_cli-5.3.2/terradev_cli}/README.md

@@ -1,4 +1,4 @@
-# Terradev CLI v5.3.1
+# Terradev CLI v5.3.2
 
 **An imperative command-line-interface for AI workload orchestration.**
 

{terradev_cli-5.3.1 → terradev_cli-5.3.2}/terradev_cli/__init__.py

@@ -3,6 +3,6 @@ Terradev CLI - Cross-Cloud Compute Optimization Platform
 Parallel provisioning and orchestration for optimized compute costs
 """
 
-__version__ = "5.0.1"
+__version__ = "5.3.2"
 __author__ = "Terradev Team"
 __description__ = "Open Source BYOAPI Multi-Cloud GPU Infrastructure Platform"

{terradev_cli-5.3.1 → terradev_cli-5.3.2}/terradev_cli/core/inference_router.py

@@ -813,6 +813,9 @@ class InferenceRouter:
     ) -> Optional[float]:
         """Measure latency to a target via async ping (ms)"""
         try:
+            # R3-B: Defense-in-depth — refuse targets that look like flags.
+            if not target or target.startswith("-"):
+                return None
             proc = await asyncio.create_subprocess_exec(
                 "ping",
                 "-c",

{terradev_cli-5.3.1 → terradev_cli-5.3.2}/terradev_cli/ml_services/ollama_service.py

@@ -5,11 +5,24 @@ Local LLM deployment and management
 """
 
 import json
+import re
 import aiohttp
 import subprocess
 from typing import Dict, List, Any, Optional
 from dataclasses import dataclass
 
+# R3-A: Allowlist for model names that get interpolated into shell scripts.
+# Matches HuggingFace IDs ("org/model-name"), Ollama tags ("llama3.2:13b"),
+# and version suffixes. Rejects shell metacharacters and newlines.
+_MODEL_NAME_RE = re.compile(r'^[A-Za-z0-9_.:/\-]{1,256}$')
+
+
+def _validate_model_name(name: str) -> None:
+    if not isinstance(name, str) or not _MODEL_NAME_RE.match(name):
+        raise ValueError(
+            f"Unsafe model name {name!r}: only [A-Za-z0-9_.:/-] (max 256) allowed."
+        )
+
 
 @dataclass
 class OllamaConfig:
@@ -130,6 +143,7 @@ ollama --version
     ) -> Dict[str, Any]:
         """Pull a model on remote instance"""
         try:
+            _validate_model_name(model_name)
             pull_script = f"""
 #!/bin/bash
 # Pull model: {model_name}
@@ -360,6 +374,7 @@ ollama list | grep {model_name}
     ) -> Dict[str, Any]:
         """Delete a model on remote instance"""
         try:
+            _validate_model_name(model)
             delete_script = f"""
 #!/bin/bash
 # Delete model: {model}
@@ -443,6 +458,7 @@ ollama list
         ssh_key: Optional[str] = None,
     ) -> str:
         """Generate deployment script for Ollama"""
+        _validate_model_name(model)
         script = f"""
 #!/bin/bash
 # Ollama Deployment Script for Terradev

{terradev_cli-5.3.1 → terradev_cli-5.3.2}/terradev_cli/ml_services/sglang_service.py

@@ -988,6 +988,13 @@ python3 -c "import sglang; print('SGLang', sglang.__version__, 'installed')"
     ) -> Dict[str, Any]:
         """Start SGLang server on a remote instance via systemd"""
         try:
+            # R3-A: Reject model names that could escape the heredoc / inject shell.
+            import re as _re
+            if not _re.match(r'^[A-Za-z0-9_.:/\-]{1,256}$', self.config.model_name or ""):
+                return {
+                    "status": "failed",
+                    "error": f"Unsafe model_name {self.config.model_name!r}: only [A-Za-z0-9_.:/-] allowed.",
+                }
             server_cmd = [
                 "python3",
                 "-m",

{terradev_cli-5.3.1 → terradev_cli-5.3.2}/terradev_cli/ml_services/vllm_service.py

@@ -500,6 +500,13 @@ python3 -c "import vllm; print('vLLM installed successfully')"
     ) -> Dict[str, Any]:
         """Start vLLM server on remote instance"""
         try:
+            # R3-A: Reject model names that could escape the heredoc / inject shell.
+            import re as _re
+            if not _re.match(r'^[A-Za-z0-9_.:/\-]{1,256}$', self.config.model_name or ""):
+                return {
+                    "status": "failed",
+                    "error": f"Unsafe model_name {self.config.model_name!r}: only [A-Za-z0-9_.:/-] allowed.",
+                }
             # Build vLLM server command
             server_cmd = [
                 "vllm",

{terradev_cli-5.3.1 → terradev_cli-5.3.2}/terradev_cli/providers/crusoe_provider.py

@@ -5,9 +5,15 @@ BYOAPI: Uses the end-client's Crusoe API access key + secret key
 API: https://api.crusoecloud.com/v1alpha5
 """
 
+import base64
+import hashlib
+import hmac
 import os
+from datetime import datetime, timezone
 from typing import Dict, List, Any, Optional
-from datetime import datetime
+from urllib.parse import urlparse
+
+import aiohttp
 
 from .base_provider import BaseProvider
 
@@ -76,24 +82,73 @@ class CrusoeProvider(BaseProvider):
     # ── Authentication ────────────────────────────────────────────────
 
     async def _ensure_auth(self):
-        """Obtain a bearer token from Crusoe using access_key + secret_key.
-
-        Crusoe authenticates via an Authorization header built from the
-        access key and secret key.  The simplest approach is HTTP Basic
-        auth (access_key:secret_key) exchanged for a short-lived bearer
-        token, but the v1alpha5 API also accepts the key-pair directly
-        as a Bearer header in the format ``Bearer <access_key>:<secret_key>``.
-        We use the direct header approach to avoid an extra token-exchange
-        round-trip.
-        """
-        if self.access_key and self.secret_key:
-            self._bearer_token = f"{self.access_key}:{self.secret_key}"
+        """No-op: Crusoe uses per-request HMAC-SHA256 signing (see _make_request)."""
+        pass
 
     def _get_auth_headers(self) -> Dict[str, str]:
-        if self.access_key and self.secret_key:
-            return {"Authorization": f"Bearer {self.access_key}:{self.secret_key}"}
+        # Auth is injected per-request via _make_request override (HMAC-SHA256 signed).
         return {}
 
+    # ── Per-request HMAC-SHA256 signing ──────────────────────────────
+
+    async def _make_request(self, method: str, url: str, **kwargs) -> Dict[str, Any]:
+        """Override base _make_request to inject Crusoe HMAC-SHA256 signed headers.
+
+        Signature scheme (v1.0):
+          payload = path + "\n" + canonicalized_query + "\n" + METHOD + "\n" + timestamp + "\n"
+          sig     = base64url(hex(hmac_sha256(payload, urlsafe_b64decode(secret_key))))
+          header  = "Bearer 1.0:{access_key_id}:{sig}"
+        See: https://docs.crusoecloud.com/reference/api/
+        """
+        if not self.session or self.session.closed:
+            self.session = aiohttp.ClientSession()
+            self._owns_session = True
+
+        headers = kwargs.pop("headers", {})
+        headers.update(self._build_signed_headers(method, url))
+        headers.setdefault("Content-Type", "application/json")
+
+        async with self.session.request(method, url, headers=headers, **kwargs) as response:
+            if response.status >= 400:
+                error_text = await response.text()
+                raise Exception(f"HTTP {response.status}: {error_text}")
+            return await response.json()
+
+    def _build_signed_headers(self, method: str, url: str) -> Dict[str, str]:
+        """Build X-Crusoe-Timestamp and Authorization headers for a single request."""
+        if not self.access_key or not self.secret_key:
+            return {}
+
+        parsed = urlparse(url)
+        path = parsed.path
+        timestamp = datetime.now(timezone.utc).strftime("%Y-%m-%dT%H:%M:%S+00:00")
+
+        # Canonicalize query params: sort lexicographically, join with &
+        if parsed.query:
+            pairs = sorted(
+                part for part in parsed.query.split("&") if part
+            )
+            query_str = "&".join(pairs)
+        else:
+            query_str = ""
+
+        payload = f"{path}\n{query_str}\n{method.upper()}\n{timestamp}\n"
+
+        # Decode URL-safe base64 secret key (add padding if needed)
+        sk = self.secret_key
+        padding = (4 - len(sk) % 4) % 4
+        secret_bytes = base64.urlsafe_b64decode(sk + "=" * padding)
+
+        # HMAC-SHA256 → hex-encode → URL-safe base64 (no padding)
+        mac = hmac.new(secret_bytes, payload.encode("utf-8"), hashlib.sha256)
+        hex_digest = mac.hexdigest()
+        sig_b64 = base64.urlsafe_b64encode(hex_digest.encode("utf-8")).rstrip(b"=").decode()
+
+        return {
+            "X-Crusoe-Timestamp": timestamp,
+            "Authorization": f"Bearer 1.0:{self.access_key}:{sig_b64}",
+        }
+
     # ── Capacity / Quotes ─────────────────────────────────────────────
 
     async def get_instance_quotes(

{terradev_cli-5.3.1 → terradev_cli-5.3.2}/terradev_cli/providers/e2e_networks_provider.py

@@ -76,11 +76,13 @@ class E2ENetworksProvider(BaseProvider):
     # ── URL helpers ───────────────────────────────────────────────────
 
     def _nodes_url(self, path: str = "") -> str:
-        """Build a nodes endpoint URL, optionally scoped to project."""
-        if self.project_id:
-            return f"{self.API_BASE}/projects/{self.project_id}/nodes{path}"
+        """Build a nodes endpoint URL. Project scoping is done via ?project_id= query param."""
         return f"{self.API_BASE}/nodes{path}"
 
+    def _project_params(self) -> Dict[str, str]:
+        """Return project_id as a query-param dict if configured."""
+        return {"project_id": self.project_id} if self.project_id else {}
+
     # ── Capacity / Quotes ─────────────────────────────────────────────
 
     async def get_instance_quotes(
@@ -240,24 +242,31 @@ class E2ENetworksProvider(BaseProvider):
             "india_based": True,
         }
 
-    async def _node_action(self, instance_id: str, action: str) -> Dict[str, Any]:
-        """Send a lifecycle action to a node (start/stop/reboot)."""
-        body = {"action": action}
+    async def _node_action(self, instance_id: str, action_type: str) -> Dict[str, Any]:
+        """Send a lifecycle action to a node.
+
+        Endpoint: PUT /api/v1/nodes/{node_id}/actions/
+        Body: {"type": <action_type>}
+        Supported types: power_off, power_on, reboot, reinstall, rename, ...
+        See: https://docs.e2enetworks.com/api/myaccount/compute/nodes/actions/node-action/
+        """
+        body = {"type": action_type}
         data = await self._make_request(
-            "POST", self._nodes_url(f"/{instance_id}/action/"), json=body
+            "PUT", self._nodes_url(f"/{instance_id}/actions/"),
+            json=body, params=self._project_params()
         )
         return data if isinstance(data, dict) else {}
 
     async def stop_instance(self, instance_id: str) -> Dict[str, Any]:
         if not self.api_key:
             raise Exception("E2E Networks API key not configured")
-        await self._node_action(instance_id, "stop")
+        await self._node_action(instance_id, "power_off")
         return {"instance_id": instance_id, "action": "stop", "status": "stopping"}
 
     async def start_instance(self, instance_id: str) -> Dict[str, Any]:
         if not self.api_key:
             raise Exception("E2E Networks API key not configured")
-        await self._node_action(instance_id, "start")
+        await self._node_action(instance_id, "power_on")
         return {"instance_id": instance_id, "action": "start", "status": "starting"}
 
     async def terminate_instance(self, instance_id: str) -> Dict[str, Any]:
@@ -368,3 +377,4 @@ class E2ENetworksProvider(BaseProvider):
             raise Exception("E2E Networks API key not configured")
         await self._node_action(instance_id, "reboot")
         return {"instance_id": instance_id, "action": "reboot", "status": "rebooting"}
+

{terradev_cli-5.3.1 → terradev_cli-5.3.2}/terradev_cli/providers/lambda_labs_provider.py

@@ -9,6 +9,7 @@ CRITICAL FIXES v4.0.0:
 - Container image pinning strategy
 """
 
+import base64
 import os
 from typing import Dict, List, Any, Optional
 from datetime import datetime
@@ -363,7 +364,12 @@ class LambdaLabsProvider(BaseProvider):
             }
 
     def _get_auth_headers(self) -> Dict[str, str]:
-        return {"Authorization": f"Bearer {self.api_key}"} if self.api_key else {}
+        # Lambda Labs uses HTTP Basic auth: api_key as username, empty password
+        # Per official docs: curl -u $LAMBDA_API_KEY: https://cloud.lambdalabs.com/api/v1/...
+        if self.api_key:
+            token = base64.b64encode(f"{self.api_key}:".encode()).decode()
+            return {"Authorization": f"Basic {token}"}
+        return {}
 
     async def _check_capacity_availability(self, instance_type: str) -> Dict[str, Any]:
         """CRITICAL: Check real-time capacity availability for Lambda instances"""

{terradev_cli-5.3.1 → terradev_cli-5.3.2}/terradev_cli/providers/oracle_provider.py

@@ -271,9 +271,11 @@ class OracleProvider(BaseProvider):
             }
 
     def _get_auth_headers(self) -> Dict[str, str]:
-        # OCI uses request signing, not simple bearer tokens
-        # For full implementation, use oci-python-sdk's Signer
-        # This provides basic API key auth for compatible endpoints
-        if self.api_key:
-            return {"Authorization": f"Bearer {self.api_key}"}
+        # KNOWN LIMITATION: Oracle Cloud Infrastructure requires RSA HTTP request
+        # signing (OCI Signature v1), NOT a simple Bearer token. Live API calls
+        # (provision, status, stop, terminate) will return HTTP 401 without a
+        # proper RSA-signed request. For production use, replace this provider
+        # with one that uses oci-python-sdk's oci.auth.signers.Signer.
+        # get_instance_quotes() falls back to static pricing, so quoting works.
+        # See: https://docs.oracle.com/en-us/iaas/Content/API/Concepts/usingapi.htm
         return {}

{terradev_cli-5.3.1 → terradev_cli-5.3.2}/terradev_cli/providers/yottalabs_provider.py

@@ -29,37 +29,55 @@ class YottaLabsProvider(BaseProvider):
     DEFAULT_IMAGE = "yottalabsai/pytorch:2.9.0-py3.11-cuda12.8.1-cudnn-devel-ubuntu22.04"
 
     # Map Terradev canonical GPU names → Yotta Labs gpuType strings
+    # Source: https://docs.yottalabs.ai/api-and-sdk/api-guides (GPU Types Reference)
     GPU_TYPE_MAP = {
-        "H100":        "NVIDIA_H100_SXM5_80G",
-        "H100-80GB":   "NVIDIA_H100_SXM5_80G",
-        "H100-SXM":    "NVIDIA_H100_SXM5_80G",
+        "H100":        "NVIDIA_H100_80G",
+        "H100-80GB":   "NVIDIA_H100_80G",
+        "H100-SXM":    "NVIDIA_H100_80G",
+        "H100-PCIe":   "NVIDIA_H100_PCIe_80G",
         "H200":        "NVIDIA_H200_141G",
-        "A100":        "NVIDIA_A100_SXM4_80G",
-        "A100-80GB":   "NVIDIA_A100_SXM4_80G",
-        "A100-40GB":   "NVIDIA_A100_PCIE_40G",
+        "B200":        "NVIDIA_B200_180G",
+        "B300":        "NVIDIA_B300_262G",
+        "A100":        "NVIDIA_A100_80G",
+        "A100-80GB":   "NVIDIA_A100_80G",
+        "A100-PCIe":   "NVIDIA_A100_PCIe_80G",
+        "A100-40GB":   "NVIDIA_A100_PCIe_40G",
         "RTX4090":     "NVIDIA_RTX_4090_24G",
+        "RTX5090":     "NVIDIA_RTX_5090_32G",
         "RTX3090":     "NVIDIA_RTX_3090_24G",
-        "RTX3080":     "NVIDIA_RTX_3080_10G",
         "L40S":        "NVIDIA_L40S_48G",
         "L40":         "NVIDIA_L40_48G",
         "A6000":       "NVIDIA_RTX_A6000_48G",
+        "RTX6000Ada":  "NVIDIA_RTX_6000_Ada_48G",
+        "RTXPro6000":  "NVIDIA_RTX_PRO_6000_96G",
+        "MI300X":      "AMD_MI300X_192G",
         "T4":          "NVIDIA_T4_16G",
         "V100":        "NVIDIA_V100_16G",
     }
 
     # Reference pricing (USD/hr per GPU) — live API takes precedence
+    # Keys must exactly match the gpuType strings from GPU_TYPE_MAP / Yotta API reference
     GPU_PRICING = {
-        "NVIDIA_H100_SXM5_80G":    {"price": 2.99, "mem_gb": 80,  "vcpus": 16, "ram_gb": 64},
+        "NVIDIA_H100_80G":          {"price": 2.99, "mem_gb": 80,  "vcpus": 16, "ram_gb": 64},
+        "NVIDIA_H100_PCIe_80G":     {"price": 2.49, "mem_gb": 80,  "vcpus": 16, "ram_gb": 64},
         "NVIDIA_H200_141G":         {"price": 4.49, "mem_gb": 141, "vcpus": 16, "ram_gb": 64},
-        "NVIDIA_A100_SXM4_80G":    {"price": 1.89, "mem_gb": 80,  "vcpus": 16, "ram_gb": 64},
-        "NVIDIA_A100_PCIE_40G":    {"price": 1.29, "mem_gb": 40,  "vcpus": 12, "ram_gb": 48},
-        "NVIDIA_RTX_4090_24G":     {"price": 0.69, "mem_gb": 24,  "vcpus": 8,  "ram_gb": 32},
-        "NVIDIA_RTX_3090_24G":     {"price": 0.29, "mem_gb": 24,  "vcpus": 8,  "ram_gb": 32},
-        "NVIDIA_L40S_48G":         {"price": 1.19, "mem_gb": 48,  "vcpus": 16, "ram_gb": 64},
-        "NVIDIA_L40_48G":          {"price": 0.99, "mem_gb": 48,  "vcpus": 12, "ram_gb": 48},
-        "NVIDIA_RTX_A6000_48G":    {"price": 0.79, "mem_gb": 48,  "vcpus": 12, "ram_gb": 48},
-        "NVIDIA_T4_16G":           {"price": 0.35, "mem_gb": 16,  "vcpus": 4,  "ram_gb": 16},
-        "NVIDIA_V100_16G":         {"price": 0.55, "mem_gb": 16,  "vcpus": 8,  "ram_gb": 32},
+        "NVIDIA_B200_180G":         {"price": 6.99, "mem_gb": 180, "vcpus": 24, "ram_gb": 128},
+        "NVIDIA_B300_262G":         {"price": 8.99, "mem_gb": 262, "vcpus": 32, "ram_gb": 192},
+        "NVIDIA_A100_80G":          {"price": 1.89, "mem_gb": 80,  "vcpus": 16, "ram_gb": 64},
+        "NVIDIA_A100_PCIe_80G":     {"price": 1.79, "mem_gb": 80,  "vcpus": 16, "ram_gb": 64},
+        "NVIDIA_A100_PCIe_40G":     {"price": 1.29, "mem_gb": 40,  "vcpus": 12, "ram_gb": 48},
+        "NVIDIA_A100_40G":          {"price": 1.29, "mem_gb": 40,  "vcpus": 12, "ram_gb": 48},
+        "NVIDIA_RTX_4090_24G":      {"price": 0.69, "mem_gb": 24,  "vcpus": 8,  "ram_gb": 32},
+        "NVIDIA_RTX_5090_32G":      {"price": 0.99, "mem_gb": 32,  "vcpus": 8,  "ram_gb": 32},
+        "NVIDIA_RTX_3090_24G":      {"price": 0.29, "mem_gb": 24,  "vcpus": 8,  "ram_gb": 32},
+        "NVIDIA_L40S_48G":          {"price": 1.19, "mem_gb": 48,  "vcpus": 16, "ram_gb": 64},
+        "NVIDIA_L40_48G":           {"price": 0.99, "mem_gb": 48,  "vcpus": 12, "ram_gb": 48},
+        "NVIDIA_RTX_A6000_48G":     {"price": 0.79, "mem_gb": 48,  "vcpus": 12, "ram_gb": 48},
+        "NVIDIA_RTX_6000_Ada_48G":  {"price": 0.89, "mem_gb": 48,  "vcpus": 12, "ram_gb": 48},
+        "NVIDIA_RTX_PRO_6000_96G":  {"price": 1.49, "mem_gb": 96,  "vcpus": 16, "ram_gb": 64},
+        "AMD_MI300X_192G":          {"price": 3.49, "mem_gb": 192, "vcpus": 24, "ram_gb": 128},
+        "NVIDIA_T4_16G":            {"price": 0.35, "mem_gb": 16,  "vcpus": 4,  "ram_gb": 16},
+        "NVIDIA_V100_16G":          {"price": 0.55, "mem_gb": 16,  "vcpus": 8,  "ram_gb": 32},
     }
 
     def __init__(self, credentials: Dict[str, str]):

{terradev_cli-5.3.1 → terradev_cli-5.3.2}/terradev_cli.egg-info/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: terradev-cli
-Version: 5.3.1
+Version: 5.3.2
 Summary: An imperative command-line-interface for AI workload orchestration.
 Author-email: Terradev Team <team@terradev.com>
 Maintainer-email: Terradev Team <team@terradev.com>
@@ -93,7 +93,7 @@ Requires-Dist: redis>=5.0.0; extra == "enterprise"
 Requires-Dist: PyJWT>=2.8.0; extra == "enterprise"
 Dynamic: license-file
 
-# Terradev CLI v5.3.1
+# Terradev CLI v5.3.2
 
 **An imperative command-line-interface for AI workload orchestration.**