refactor(logs,landscape): unified log targets, injection-safe profile writes

src/codesphere/http_client.py

@@ -1,6 +1,7 @@
 import logging
+from contextlib import AbstractAsyncContextManager
 from types import TracebackType
-from typing import Any
+from typing import Any, cast
 
 import httpx
 from pydantic import SecretStr
@@ -38,6 +39,24 @@ def _get_client(self) -> httpx.AsyncClient:
             )
         return self._client
 
+    @property
+    def timeout(self) -> httpx.Timeout:
+        """The configured request timeouts."""
+        return self._timeout_config
+
+    @property
+    def stream_timeout(self) -> httpx.Timeout:
+        """Timeouts for long-lived streams: configured connect, unbounded read."""
+        # httpx.Timeout attributes are untyped upstream; connect is float | None
+        connect = cast("float | None", self._timeout_config.connect)
+        return httpx.Timeout(connect, read=None)
+
+    def stream(
+        self, method: str, endpoint: str, **kwargs: Any
+    ) -> AbstractAsyncContextManager[httpx.Response]:
+        """Open a streaming request (e.g. SSE) on the underlying client."""
+        return self._get_client().stream(method, endpoint, **kwargs)
+
     async def open(self) -> None:
         if not self._client:
             self._client = httpx.AsyncClient(**self._client_config)

src/codesphere/resources/workspace/landscape/resources.py

@@ -1,6 +1,7 @@
 from __future__ import annotations
 
 import asyncio
+import base64
 import logging
 import re
 from typing import TYPE_CHECKING
@@ -75,16 +76,18 @@ async def save_profile(self, name: str, config: ProfileConfig | str) -> None:
         yaml_content = config.to_yaml() if isinstance(config, ProfileConfig) else config
 
         body = yaml_content if yaml_content.endswith("\n") else yaml_content + "\n"
-        await self._run_command(
-            f"cat > {filename} << 'PROFILE_EOF'\n{body}PROFILE_EOF\n"
-        )
+        # Transport the content base64-encoded: the base64 alphabet is inert
+        # inside single quotes, so arbitrary YAML cannot break out of the
+        # shell command (the filename is regex-validated above).
+        encoded = base64.b64encode(body.encode("utf-8")).decode("ascii")
+        await self._run_command(f"printf '%s' '{encoded}' | base64 -d > '{filename}'")
 
     async def get_profile(self, name: str) -> str:
-        result = await self._run_command(f"cat {_profile_filename(name)}")
+        result = await self._run_command(f"cat '{_profile_filename(name)}'")
         return result.output
 
     async def delete_profile(self, name: str) -> None:
-        await self._run_command(f"rm -f {_profile_filename(name)}")
+        await self._run_command(f"rm -f '{_profile_filename(name)}'")
 
     async def deploy(self, profile: str | None = None) -> None:
         if profile is not None:

src/codesphere/resources/workspace/logs/__init__.py

@@ -1,10 +1,22 @@
-from .resources import LogStream, WorkspaceLogManager
-from .schemas import LogEntry, LogProblem, LogStage
+from .resources import (
+    LogStream,
+    LogTarget,
+    ReplicaTarget,
+    ServerTarget,
+    StageTarget,
+    WorkspaceLogManager,
+)
+from .schemas import LogEntry, LogKind, LogProblem, LogStage
 
 __all__ = [
     "LogEntry",
+    "LogKind",
     "LogProblem",
     "LogStage",
     "LogStream",
+    "LogTarget",
+    "ReplicaTarget",
+    "ServerTarget",
+    "StageTarget",
     "WorkspaceLogManager",
 ]