Release 1.6.1: Three bug fixes #patch (#180)

* perf: optimize test scheduling with --dist loadfile for 25% faster test runs

* feat: add support for Cortex Secrets API (#161)

* chore: update HISTORY.md for main

* perf: optimize test scheduling with --dist loadfile for 25% faster test runs (#157)

* refactor: separate trigger-evaluation test to avoid scorecard evaluation race conditions

- Create dedicated cli-test-evaluation-scorecard for trigger-evaluation testing
- Remove retry logic complexity from test_scorecards() and test_scorecards_drafts()
- Add new test_scorecard_trigger_evaluation() that creates/deletes its own scorecard
- Eliminates race condition where import triggers evaluation conflicting with tests

* refactor: remove unnecessary mock decorator from _get_rule helper function

The helper function doesn't need its own environment patching since it's called
from fixtures that already have their own @mock.patch.dict decorators.

* Revert "perf: optimize test scheduling with --dist loadfile for 25% faster test runs (#157)"

This reverts commit 8879fcf.

The --dist loadfile optimization caused race conditions between tests that
share resources (e.g., test_custom_events_uuid and test_custom_events_list
both operate on custom events and can interfere with each other when run in
parallel by file).

Reliability > speed. Better to have tests take 40s with no race conditions
than 30s with intermittent failures.

* perf: rename test_deploys.py to test_000_deploys.py for early scheduling

Pytest collects tests alphabetically by filename. With pytest-xdist --dist load,
tests collected earlier are more likely to be scheduled first. Since test_deploys
is the longest-running test (~19s), scheduling it early maximizes parallel
efficiency with 12 workers.

This is our general strategy: prefix slow tests with numbers (000, 001, etc.) to
control scheduling order without introducing race conditions like --dist loadfile.

* feat: add support for Cortex Secrets API

Add complete CLI support for managing secrets via the Cortex Secrets API:
- cortex secrets list: List secrets (with optional entity tag filter)
- cortex secrets get: Get secret by alias
- cortex secrets create: Create new secret
- cortex secrets update: Update existing secret
- cortex secrets delete: Delete secret

All commands support entity tags as required by the API.
Tests skip gracefully if API key lacks secrets permissions.

Also fixes HISTORY.md generation by using Angular convention in git-changelog,
which properly recognizes feat:, fix:, and perf: commit types instead of only
recognizing the basic convention (add:, fix:, change:, remove:).

Closes #158

* fix: update secret test to use valid tag format

Change test secret tag from 'cli-test-secret' to 'cli_test_secret' to comply
with API validation that only allows alphanumeric and underscore characters.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: GitHub Actions <actions@github.com>
Co-authored-by: Claude <noreply@anthropic.com>

* feat: add entity relationships API support with optimized backup/restore (#160)

* chore: update HISTORY.md for main

* perf: optimize test scheduling with --dist loadfile for 25% faster test runs (#157)

* refactor: separate trigger-evaluation test to avoid scorecard evaluation race conditions

- Create dedicated cli-test-evaluation-scorecard for trigger-evaluation testing
- Remove retry logic complexity from test_scorecards() and test_scorecards_drafts()
- Add new test_scorecard_trigger_evaluation() that creates/deletes its own scorecard
- Eliminates race condition where import triggers evaluation conflicting with tests

* refactor: remove unnecessary mock decorator from _get_rule helper function

The helper function doesn't need its own environment patching since it's called
from fixtures that already have their own @mock.patch.dict decorators.

* Revert "perf: optimize test scheduling with --dist loadfile for 25% faster test runs (#157)"

This reverts commit 8879fcf.

The --dist loadfile optimization caused race conditions between tests that
share resources (e.g., test_custom_events_uuid and test_custom_events_list
both operate on custom events and can interfere with each other when run in
parallel by file).

Reliability > speed. Better to have tests take 40s with no race conditions
than 30s with intermittent failures.

* perf: rename test_deploys.py to test_000_deploys.py for early scheduling

Pytest collects tests alphabetically by filename. With pytest-xdist --dist load,
tests collected earlier are more likely to be scheduled first. Since test_deploys
is the longest-running test (~19s), scheduling it early maximizes parallel
efficiency with 12 workers.

This is our general strategy: prefix slow tests with numbers (000, 001, etc.) to
control scheduling order without introducing race conditions like --dist loadfile.

* feat: add entity relationships API support and fix backup export bug

- Fix double-encoding bug in backup export for entity-types and ip-allowlist
  - entity-types and ip-allowlist were being converted to strings before json.dump
  - This caused import failures with "TypeError: string indices must be integers"

- Add entity-relationship-types commands:
  - list: List all relationship types
  - get: Get relationship type by tag
  - create: Create new relationship type
  - update: Update existing relationship type
  - delete: Delete relationship type

- Add entity-relationships commands:
  - list: List all relationships for a type
  - list-destinations: Get destinations for source entity
  - list-sources: Get sources for destination entity
  - add-destinations: Add destinations to source
  - add-sources: Add sources to destination
  - update-destinations: Replace all destinations for source
  - update-sources: Replace all sources for destination
  - add-bulk: Add multiple relationships
  - update-bulk: Replace all relationships for type

- Integrate entity relationships into backup/restore:
  - Export entity-relationship-types and entity-relationships
  - Import with proper ordering (types before catalog, relationships after)
  - Transform export format to bulk update format for import

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: clean up entity relationships import output and fix bugs

- Add _print parameter to entity_relationship_types.create() and entity_relationships.update_bulk()
- Use _print=False when importing to suppress JSON output
- Fix import to use correct keys: sourceEntity.tag and destinationEntity.tag instead of source.tag
- Replace typer.unstable.TempFile with standard tempfile.NamedTemporaryFile
- Improve output: show only tag names instead of full JSON when importing
- Add missing tempfile import

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: support re-importing existing entity relationship types

- Check if relationship type already exists before importing
- Use update instead of create for existing relationship types
- Add _print parameter to entity_relationship_types.update()
- Matches pattern used by entity_types import

This allows backup imports to be idempotent and run multiple times
without encountering "already exists" errors.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* feat: improve error handling in backup import

- Add detailed error reporting for catalog imports
  - Show filename, error type, and error message for failures
  - Add total failure count at end of catalog import

- Add error handling for entity relationship type imports
  - Wrap create/update in try/except blocks
  - Show which relationship type failed and why
  - Add total failure count

- Add error handling for entity relationship imports
  - Wrap import operations in try/except blocks
  - Show which relationship type failed and why
  - Add total failure count

This makes it much easier to diagnose import failures by showing
exactly which files are failing and what the error is.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: improve catalog import error handling and make sequential

- Change catalog import from parallel to sequential execution
  - This allows errors to be correlated with specific files
  - HTTP errors from cortex_client are now shown with filenames

- Catch typer.Exit exceptions in catalog import
  - The HTTP client raises typer.Exit on errors
  - Now catches and reports which file caused the error

- Remove unused imports added for parallel error capture
- Simplify catalog import logic

Note: The plugin import failures with "string indices must be integers"
are due to exports created before the double-encoding bug fix. Re-export
with the current code to fix these.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* perf: parallelize entity relationships and catalog imports

- Restore parallel execution for catalog import (30 workers)
  - Previously made sequential for error debugging
  - Now handles typer.Exit exceptions properly
  - Maintains good error reporting with filenames

- Parallelize entity relationship type imports (30 workers)
  - Check existing types once, then import in parallel
  - Properly handles create vs update decision

- Parallelize entity relationship imports (30 workers)
  - Each relationship type is independent
  - Can safely import in parallel

All imports now use ThreadPoolExecutor with 30 workers for
maximum performance while maintaining error reporting.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* feat: add comprehensive import summary and retry commands

- All import functions now return statistics (type, imported count, failures)
- Import summary section shows:
  - Per-type import counts and failures
  - Total imported and failed counts

- Failed imports section lists:
  - Full file paths for all failures
  - Error type and message for each

- Retry commands section provides:
  - Ready-to-run cortex commands for each failed file
  - Can copy/paste directly from terminal
  - Commands use proper quoting for file paths with spaces

- Updated all import functions to track file paths in parallel execution
- Added typer.Exit exception handling to plugins, scorecards, workflows
- Consistent error reporting across all import types

Example output:
  IMPORT SUMMARY
  catalog: 250 imported, 5 failed
  TOTAL: 500 imported, 5 failed

  FAILED IMPORTS
  /path/to/file.yaml
    Error: HTTP - Validation or HTTP error

  RETRY COMMANDS
  cortex catalog create -f "/path/to/file.yaml"

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: show catalog filename before import attempt

- Print "Importing: filename" before attempting catalog import
- HTTP errors now appear immediately after the filename
- Remove duplicate success messages at end
- Only show failure count summary

This makes it immediately clear which file is causing each HTTP 400 error:

Before:
  Processing: .../catalog
  HTTP Error 400: Unknown error
  HTTP Error 400: Unknown error

After:
  Processing: .../catalog
     Importing: docs.yaml
  HTTP Error 400: Unknown error
     Importing: another.yaml
  HTTP Error 400: Unknown error

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: improve test isolation for custom events list test

Delete all event types (not just VALIDATE_SERVICE) at test start to prevent
interference from parallel tests. The connection pooling performance improvements
made tests run much faster, increasing temporal overlap between parallel tests
and exposing this existing test isolation issue.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: initialize variables before conditional to prevent NameError

When entity-relationship-types or entity-relationships directories don't exist
(like in test data), the import functions would reference undefined `results` and
`failed_count` variables, causing a NameError and preventing subsequent imports
from running (including catalog import, breaking tests).

This bug was causing test_catalog_delete_entity and test_custom_events_list to
fail because the import would crash before importing catalog entities.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: GitHub Actions <actions@github.com>
Co-authored-by: Claude <noreply@anthropic.com>

* fix: add client-side rate limiting and make tests idempotent (#165) #minor

* chore: update HISTORY.md for main

* perf: optimize test scheduling with --dist loadfile for 25% faster test runs (#157)

* refactor: separate trigger-evaluation test to avoid scorecard evaluation race conditions

- Create dedicated cli-test-evaluation-scorecard for trigger-evaluation testing
- Remove retry logic complexity from test_scorecards() and test_scorecards_drafts()
- Add new test_scorecard_trigger_evaluation() that creates/deletes its own scorecard
- Eliminates race condition where import triggers evaluation conflicting with tests

* refactor: remove unnecessary mock decorator from _get_rule helper function

The helper function doesn't need its own environment patching since it's called
from fixtures that already have their own @mock.patch.dict decorators.

* Revert "perf: optimize test scheduling with --dist loadfile for 25% faster test runs (#157)"

This reverts commit 8879fcf.

The --dist loadfile optimization caused race conditions between tests that
share resources (e.g., test_custom_events_uuid and test_custom_events_list
both operate on custom events and can interfere with each other when run in
parallel by file).

Reliability > speed. Better to have tests take 40s with no race conditions
than 30s with intermittent failures.

* perf: rename test_deploys.py to test_000_deploys.py for early scheduling

Pytest collects tests alphabetically by filename. With pytest-xdist --dist load,
tests collected earlier are more likely to be scheduled first. Since test_deploys
is the longest-running test (~19s), scheduling it early maximizes parallel
efficiency with 12 workers.

This is our general strategy: prefix slow tests with numbers (000, 001, etc.) to
control scheduling order without introducing race conditions like --dist loadfile.

* feat: add entity relationships API support and fix backup export bug

- Fix double-encoding bug in backup export for entity-types and ip-allowlist
  - entity-types and ip-allowlist were being converted to strings before json.dump
  - This caused import failures with "TypeError: string indices must be integers"

- Add entity-relationship-types commands:
  - list: List all relationship types
  - get: Get relationship type by tag
  - create: Create new relationship type
  - update: Update existing relationship type
  - delete: Delete relationship type

- Add entity-relationships commands:
  - list: List all relationships for a type
  - list-destinations: Get destinations for source entity
  - list-sources: Get sources for destination entity
  - add-destinations: Add destinations to source
  - add-sources: Add sources to destination
  - update-destinations: Replace all destinations for source
  - update-sources: Replace all sources for destination
  - add-bulk: Add multiple relationships
  - update-bulk: Replace all relationships for type

- Integrate entity relationships into backup/restore:
  - Export entity-relationship-types and entity-relationships
  - Import with proper ordering (types before catalog, relationships after)
  - Transform export format to bulk update format for import

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: clean up entity relationships import output and fix bugs

- Add _print parameter to entity_relationship_types.create() and entity_relationships.update_bulk()
- Use _print=False when importing to suppress JSON output
- Fix import to use correct keys: sourceEntity.tag and destinationEntity.tag instead of source.tag
- Replace typer.unstable.TempFile with standard tempfile.NamedTemporaryFile
- Improve output: show only tag names instead of full JSON when importing
- Add missing tempfile import

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: support re-importing existing entity relationship types

- Check if relationship type already exists before importing
- Use update instead of create for existing relationship types
- Add _print parameter to entity_relationship_types.update()
- Matches pattern used by entity_types import

This allows backup imports to be idempotent and run multiple times
without encountering "already exists" errors.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* feat: improve error handling in backup import

- Add detailed error reporting for catalog imports
  - Show filename, error type, and error message for failures
  - Add total failure count at end of catalog import

- Add error handling for entity relationship type imports
  - Wrap create/update in try/except blocks
  - Show which relationship type failed and why
  - Add total failure count

- Add error handling for entity relationship imports
  - Wrap import operations in try/except blocks
  - Show which relationship type failed and why
  - Add total failure count

This makes it much easier to diagnose import failures by showing
exactly which files are failing and what the error is.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: improve catalog import error handling and make sequential

- Change catalog import from parallel to sequential execution
  - This allows errors to be correlated with specific files
  - HTTP errors from cortex_client are now shown with filenames

- Catch typer.Exit exceptions in catalog import
  - The HTTP client raises typer.Exit on errors
  - Now catches and reports which file caused the error

- Remove unused imports added for parallel error capture
- Simplify catalog import logic

Note: The plugin import failures with "string indices must be integers"
are due to exports created before the double-encoding bug fix. Re-export
with the current code to fix these.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* perf: parallelize entity relationships and catalog imports

- Restore parallel execution for catalog import (30 workers)
  - Previously made sequential for error debugging
  - Now handles typer.Exit exceptions properly
  - Maintains good error reporting with filenames

- Parallelize entity relationship type imports (30 workers)
  - Check existing types once, then import in parallel
  - Properly handles create vs update decision

- Parallelize entity relationship imports (30 workers)
  - Each relationship type is independent
  - Can safely import in parallel

All imports now use ThreadPoolExecutor with 30 workers for
maximum performance while maintaining error reporting.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* feat: add comprehensive import summary and retry commands

- All import functions now return statistics (type, imported count, failures)
- Import summary section shows:
  - Per-type import counts and failures
  - Total imported and failed counts

- Failed imports section lists:
  - Full file paths for all failures
  - Error type and message for each

- Retry commands section provides:
  - Ready-to-run cortex commands for each failed file
  - Can copy/paste directly from terminal
  - Commands use proper quoting for file paths with spaces

- Updated all import functions to track file paths in parallel execution
- Added typer.Exit exception handling to plugins, scorecards, workflows
- Consistent error reporting across all import types

Example output:
  IMPORT SUMMARY
  catalog: 250 imported, 5 failed
  TOTAL: 500 imported, 5 failed

  FAILED IMPORTS
  /path/to/file.yaml
    Error: HTTP - Validation or HTTP error

  RETRY COMMANDS
  cortex catalog create -f "/path/to/file.yaml"

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: show catalog filename before import attempt

- Print "Importing: filename" before attempting catalog import
- HTTP errors now appear immediately after the filename
- Remove duplicate success messages at end
- Only show failure count summary

This makes it immediately clear which file is causing each HTTP 400 error:

Before:
  Processing: .../catalog
  HTTP Error 400: Unknown error
  HTTP Error 400: Unknown error

After:
  Processing: .../catalog
     Importing: docs.yaml
  HTTP Error 400: Unknown error
     Importing: another.yaml
  HTTP Error 400: Unknown error

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: improve test isolation for custom events list test

Delete all event types (not just VALIDATE_SERVICE) at test start to prevent
interference from parallel tests. The connection pooling performance improvements
made tests run much faster, increasing temporal overlap between parallel tests
and exposing this existing test isolation issue.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: initialize variables before conditional to prevent NameError

When entity-relationship-types or entity-relationships directories don't exist
(like in test data), the import functions would reference undefined `results` and
`failed_count` variables, causing a NameError and preventing subsequent imports
from running (including catalog import, breaking tests).

This bug was causing test_catalog_delete_entity and test_custom_events_list to
fail because the import would crash before importing catalog entities.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* chore: merge staging to main #minor (#162)

* perf: optimize test scheduling with --dist loadfile for 25% faster test runs

* feat: add support for Cortex Secrets API (#161)

* chore: update HISTORY.md for main

* perf: optimize test scheduling with --dist loadfile for 25% faster test runs (#157)

* refactor: separate trigger-evaluation test to avoid scorecard evaluation race conditions

- Create dedicated cli-test-evaluation-scorecard for trigger-evaluation testing
- Remove retry logic complexity from test_scorecards() and test_scorecards_drafts()
- Add new test_scorecard_trigger_evaluation() that creates/deletes its own scorecard
- Eliminates race condition where import triggers evaluation conflicting with tests

* refactor: remove unnecessary mock decorator from _get_rule helper function

The helper function doesn't need its own environment patching since it's called
from fixtures that already have their own @mock.patch.dict decorators.

* Revert "perf: optimize test scheduling with --dist loadfile for 25% faster test runs (#157)"

This reverts commit 8879fcf.

The --dist loadfile optimization caused race conditions between tests that
share resources (e.g., test_custom_events_uuid and test_custom_events_list
both operate on custom events and can interfere with each other when run in
parallel by file).

Reliability > speed. Better to have tests take 40s with no race conditions
than 30s with intermittent failures.

* perf: rename test_deploys.py to test_000_deploys.py for early scheduling

Pytest collects tests alphabetically by filename. With pytest-xdist --dist load,
tests collected earlier are more likely to be scheduled first. Since test_deploys
is the longest-running test (~19s), scheduling it early maximizes parallel
efficiency with 12 workers.

This is our general strategy: prefix slow tests with numbers (000, 001, etc.) to
control scheduling order without introducing race conditions like --dist loadfile.

* feat: add support for Cortex Secrets API

Add complete CLI support for managing secrets via the Cortex Secrets API:
- cortex secrets list: List secrets (with optional entity tag filter)
- cortex secrets get: Get secret by alias
- cortex secrets create: Create new secret
- cortex secrets update: Update existing secret
- cortex secrets delete: Delete secret

All commands support entity tags as required by the API.
Tests skip gracefully if API key lacks secrets permissions.

Also fixes HISTORY.md generation by using Angular convention in git-changelog,
which properly recognizes feat:, fix:, and perf: commit types instead of only
recognizing the basic convention (add:, fix:, change:, remove:).

Closes #158

* fix: update secret test to use valid tag format

Change test secret tag from 'cli-test-secret' to 'cli_test_secret' to comply
with API validation that only allows alphanumeric and underscore characters.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: GitHub Actions <actions@github.com>
Co-authored-by: Claude <noreply@anthropic.com>

* feat: add entity relationships API support with optimized backup/restore (#160)

* chore: update HISTORY.md for main

* perf: optimize test scheduling with --dist loadfile for 25% faster test runs (#157)

* refactor: separate trigger-evaluation test to avoid scorecard evaluation race conditions

- Create dedicated cli-test-evaluation-scorecard for trigger-evaluation testing
- Remove retry logic complexity from test_scorecards() and test_scorecards_drafts()
- Add new test_scorecard_trigger_evaluation() that creates/deletes its own scorecard
- Eliminates race condition where import triggers evaluation conflicting with tests

* refactor: remove unnecessary mock decorator from _get_rule helper function

The helper function doesn't need its own environment patching since it's called
from fixtures that already have their own @mock.patch.dict decorators.

* Revert "perf: optimize test scheduling with --dist loadfile for 25% faster test runs (#157)"

This reverts commit 8879fcf.

The --dist loadfile optimization caused race conditions between tests that
share resources (e.g., test_custom_events_uuid and test_custom_events_list
both operate on custom events and can interfere with each other when run in
parallel by file).

Reliability > speed. Better to have tests take 40s with no race conditions
than 30s with intermittent failures.

* perf: rename test_deploys.py to test_000_deploys.py for early scheduling

Pytest collects tests alphabetically by filename. With pytest-xdist --dist load,
tests collected earlier are more likely to be scheduled first. Since test_deploys
is the longest-running test (~19s), scheduling it early maximizes parallel
efficiency with 12 workers.

This is our general strategy: prefix slow tests with numbers (000, 001, etc.) to
control scheduling order without introducing race conditions like --dist loadfile.

* feat: add entity relationships API support and fix backup export bug

- Fix double-encoding bug in backup export for entity-types and ip-allowlist
  - entity-types and ip-allowlist were being converted to strings before json.dump
  - This caused import failures with "TypeError: string indices must be integers"

- Add entity-relationship-types commands:
  - list: List all relationship types
  - get: Get relationship type by tag
  - create: Create new relationship type
  - update: Update existing relationship type
  - delete: Delete relationship type

- Add entity-relationships commands:
  - list: List all relationships for a type
  - list-destinations: Get destinations for source entity
  - list-sources: Get sources for destination entity
  - add-destinations: Add destinations to source
  - add-sources: Add sources to destination
  - update-destinations: Replace all destinations for source
  - update-sources: Replace all sources for destination
  - add-bulk: Add multiple relationships
  - update-bulk: Replace all relationships for type

- Integrate entity relationships into backup/restore:
  - Export entity-relationship-types and entity-relationships
  - Import with proper ordering (types before catalog, relationships after)
  - Transform export format to bulk update format for import

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: clean up entity relationships import output and fix bugs

- Add _print parameter to entity_relationship_types.create() and entity_relationships.update_bulk()
- Use _print=False when importing to suppress JSON output
- Fix import to use correct keys: sourceEntity.tag and destinationEntity.tag instead of source.tag
- Replace typer.unstable.TempFile with standard tempfile.NamedTemporaryFile
- Improve output: show only tag names instead of full JSON when importing
- Add missing tempfile import

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: support re-importing existing entity relationship types

- Check if relationship type already exists before importing
- Use update instead of create for existing relationship types
- Add _print parameter to entity_relationship_types.update()
- Matches pattern used by entity_types import

This allows backup imports to be idempotent and run multiple times
without encountering "already exists" errors.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* feat: improve error handling in backup import

- Add detailed error reporting for catalog imports
  - Show filename, error type, and error message for failures
  - Add total failure count at end of catalog import

- Add error handling for entity relationship type imports
  - Wrap create/update in try/except blocks
  - Show which relationship type failed and why
  - Add total failure count

- Add error handling for entity relationship imports
  - Wrap import operations in try/except blocks
  - Show which relationship type failed and why
  - Add total failure count

This makes it much easier to diagnose import failures by showing
exactly which files are failing and what the error is.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: improve catalog import error handling and make sequential

- Change catalog import from parallel to sequential execution
  - This allows errors to be correlated with specific files
  - HTTP errors from cortex_client are now shown with filenames

- Catch typer.Exit exceptions in catalog import
  - The HTTP client raises typer.Exit on errors
  - Now catches and reports which file caused the error

- Remove unused imports added for parallel error capture
- Simplify catalog import logic

Note: The plugin import failures with "string indices must be integers"
are due to exports created before the double-encoding bug fix. Re-export
with the current code to fix these.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* perf: parallelize entity relationships and catalog imports

- Restore parallel execution for catalog import (30 workers)
  - Previously made sequential for error debugging
  - Now handles typer.Exit exceptions properly
  - Maintains good error reporting with filenames

- Parallelize entity relationship type imports (30 workers)
  - Check existing types once, then import in parallel
  - Properly handles create vs update decision

- Parallelize entity relationship imports (30 workers)
  - Each relationship type is independent
  - Can safely import in parallel

All imports now use ThreadPoolExecutor with 30 workers for
maximum performance while maintaining error reporting.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* feat: add comprehensive import summary and retry commands

- All import functions now return statistics (type, imported count, failures)
- Import summary section shows:
  - Per-type import counts and failures
  - Total imported and failed counts

- Failed imports section lists:
  - Full file paths for all failures
  - Error type and message for each

- Retry commands section provides:
  - Ready-to-run cortex commands for each failed file
  - Can copy/paste directly from terminal
  - Commands use proper quoting for file paths with spaces

- Updated all import functions to track file paths in parallel execution
- Added typer.Exit exception handling to plugins, scorecards, workflows
- Consistent error reporting across all import types

Example output:
  IMPORT SUMMARY
  catalog: 250 imported, 5 failed
  TOTAL: 500 imported, 5 failed

  FAILED IMPORTS
  /path/to/file.yaml
    Error: HTTP - Validation or HTTP error

  RETRY COMMANDS
  cortex catalog create -f "/path/to/file.yaml"

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: show catalog filename before import attempt

- Print "Importing: filename" before attempting catalog import
- HTTP errors now appear immediately after the filename
- Remove duplicate success messages at end
- Only show failure count summary

This makes it immediately clear which file is causing each HTTP 400 error:

Before:
  Processing: .../catalog
  HTTP Error 400: Unknown error
  HTTP Error 400: Unknown error

After:
  Processing: .../catalog
     Importing: docs.yaml
  HTTP Error 400: Unknown error
     Importing: another.yaml
  HTTP Error 400: Unknown error

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: improve test isolation for custom events list test

Delete all event types (not just VALIDATE_SERVICE) at test start to prevent
interference from parallel tests. The connection pooling performance improvements
made tests run much faster, increasing temporal overlap between parallel tests
and exposing this existing test isolation issue.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: initialize variables before conditional to prevent NameError

When entity-relationship-types or entity-relationships directories don't exist
(like in test data), the import functions would reference undefined `results` and
`failed_count` variables, causing a NameError and preventing subsequent imports
from running (including catalog import, breaking tests).

This bug was causing test_catalog_delete_entity and test_custom_events_list to
fail because the import would crash before importing catalog entities.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: GitHub Actions <actions@github.com>
Co-authored-by: Claude <noreply@anthropic.com>

---------

Co-authored-by: GitHub Actions <actions@github.com>
Co-authored-by: Claude <noreply@anthropic.com>

* chore: update HISTORY.md for main

* add: pytest configuration with perf marker

Add pytest.ini to configure test markers:
- perf: for performance tests excluded from regular runs
- setup: for setup tests that run before other tests

The perf marker is excluded by default via addopts, ensuring
performance tests only run via 'just test-perf'.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: exclude perf tests from test-all command

Update Justfile to exclude both 'setup' and 'perf' markers from
test-all and _test-all-individual recipes. Previously only excluded
'setup', which caused performance tests to run and slow down the
regular test suite.

Also add test-perf recipe to explicitly run performance tests.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: allow 'just test' to run perf tests

Override pytest.ini's default marker exclusion in the 'test' recipe
by passing -m "" (empty marker filter). This allows users to run
individual test files including perf tests via 'just test <file>'.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* add: client-side rate limiting with TokenBucket algorithm

Implements proactive rate limiting to avoid 429 errors rather than
reactively retrying them.

Key changes:
- Add TokenBucket class for thread-safe rate limiting (1000 req/min)
- Configure 50-token burst capacity for initial request batches
- Remove 429 from retry status_forcelist (now prevented by rate limiter)
- Add performance test validating rate limiter with 250 parallel workers
- Test confirms 100% success rate at ~1049 req/min with no 429 errors

This approach is more efficient than retry-based rate limiting as it
prevents rate limit errors proactively, reducing overall request latency
and eliminating wasted retry attempts.

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* add: configurable rate limit via CORTEX_RATE_LIMIT env var

Allows testing higher rate limits to determine if actual API limit
is higher than documented 1000 req/min.

Changes:
- Read rate limit from CORTEX_RATE_LIMIT environment variable
- Default to 1000 req/min if not set
- Allows runtime testing of different rate limits without code changes

Usage:
  export CORTEX_RATE_LIMIT=1500
  cortex backup catalog --export-dir ./test

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* add: --rate-limit CLI flag for configurable rate limiting

Adds global CLI flag to configure API rate limit alongside existing
CORTEX_RATE_LIMIT environment variable.

Changes:
- Add --rate-limit/-r flag to global options
- Pass rate_limit to CortexClient initialization
- Help text shows environment variable and default (1000 req/min)

Usage:
  cortex --rate-limit 1500 backup catalog --export-dir ./test

Or via environment variable:
  export CORTEX_RATE_LIMIT=1500
  cortex backup catalog --export-dir ./test

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

* fix: make scorecard exemption tests idempotent

- Moved CORTEX_API_KEY_VIEWER patch from decorator to context manager
- Added cleanup logic to revoke existing exemptions before creating new ones
- Cleanup runs with admin key (has revoke permission) while request uses viewer key (creates PENDING exemptions)
- Tests now pass even when exemptions exist from previous runs

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-Authored-By: Claude <noreply@anthropic.com>

---------

Co-authored-by: GitHub Actions <actions@github.com>
Co-authored-by: Claude <noreply@anthropic.com>

* fix: remove rate limiter initialization log message (#168) 

Removed INFO log message that appears on every CLI invocation which could
impact applications parsing CLI output.

Fixes #167

🤖 Generated with [Claude Code](https://claude.com/claude-code)

Co-authored-by: Claude <noreply@anthropic.com>

* fix: change default logging level from INFO to WARNING

- Users no longer see INFO log messages by default
- Still shows WARNING (slow requests) and ERROR/CRITICAL if they occur
- CLI output is cleaner and more suitable for parsing by other tools
- Users can enable full diagnostics with -l DEBUG or -l INFO

Fixes #170

* fix: initialize results and failed_count before directory check in import functions

All _import_* functions now initialize results=[] and failed_count=0 before
checking if directory exists. This prevents UnboundLocalError when importing
partial exports that don't include all resource types.

Fixed functions:
- _import_catalog: Added results=[] and failed_count=0
- _import_plugins: Added results=[] and failed_count=0
- _import_scorecards: Added results=[] and failed_count=0
- _import_workflows: Added results=[] and failed_count=0

Fixes #171

* fix: only retry on 429 rate limit errors, not 5xx server errors

Changed status_forcelist from [500, 502, 503, 504] to [429] to avoid
wasting time retrying requests that are unlikely to succeed. Client errors
(4xx) and server errors (5xx) typically won't succeed on retry, while rate
limit errors (429) benefit from retry with backoff.

Fixes #172

* Revert: Undo direct merges to staging (#176)

* Revert "Merge branch '172-retry-only-429' into staging"

This reverts commit 052796e, reversing
changes made to 5be1748.

* Revert "Merge branch '171-import-partial-export' into staging"

This reverts commit 5be1748, reversing
changes made to b095f88.

* Revert "Merge branch '170-default-logging-none' into staging"

This reverts commit b095f88, reversing
changes made to 7b20357.

* fix: change default logging level from INFO to WARNING (#177)

- Users no longer see INFO log messages by default
- Still shows WARNING (slow requests) and ERROR/CRITICAL if they occur
- CLI output is cleaner and more suitable for parsing by other tools
- Users can enable full diagnostics with -l DEBUG or -l INFO

Fixes #170

* fix: initialize results and failed_count before directory check in import functions (#178)

All _import_* functions now initialize results=[] and failed_count=0 before
checking if directory exists. This prevents UnboundLocalError when importing
partial exports that don't include all resource types.

Fixed functions:
- _import_catalog: Added results=[] and failed_count=0
- _import_plugins: Added results=[] and failed_count=0
- _import_scorecards: Added results=[] and failed_count=0
- _import_workflows: Added results=[] and failed_count=0

Fixes #171

* fix: only retry on 429 rate limit errors, not 5xx server errors (#179)

Changed status_forcelist from [500, 502, 503, 504] to [429] to avoid
wasting time retrying requests that are unlikely to succeed. Client errors
(4xx) and server errors (5xx) typically won't succeed on retry, while rate
limit errors (429) benefit from retry with backoff.

Fixes #172

---------

Co-authored-by: GitHub Actions <actions@github.com>
Co-authored-by: Claude <noreply@anthropic.com>

Author: 3 people

HISTORY.md

@@ -6,14 +6,6 @@ The format is based on [Keep a Changelog](http://keepachangelog.com/en/1.0.0/)
 and this project adheres to [Semantic Versioning](http://semver.org/spec/v2.0.0.html).
 
 <!-- insertion marker -->
-## [1.6.0](https://github.com/cortexapps/cli/releases/tag/1.6.0) - 2025-11-14
-
-<small>[Compare with 1.5.0](https://github.com/cortexapps/cli/compare/1.5.0...1.6.0)</small>
-
-### Bug Fixes
-
-- remove rate limiter initialization log message (#169) #patch ([015107a](https://github.com/cortexapps/cli/commit/015107aca15d5a4cf4eb746834bcbb7dac607e1d) by Jeff Schnitter).
-
 ## [1.5.0](https://github.com/cortexapps/cli/releases/tag/1.5.0) - 2025-11-13
 
 <small>[Compare with 1.4.0](https://github.com/cortexapps/cli/compare/1.4.0...1.5.0)</small>

cortexapps_cli/cli.py

@@ -87,7 +87,7 @@ def global_callback(
     url: str = typer.Option(None, "--url", "-u", help="Base URL for the API", envvar="CORTEX_BASE_URL"),
     config_file: str = typer.Option(os.path.join(os.path.expanduser('~'), '.cortex', 'config'), "--config", "-c", help="Config file path", envvar="CORTEX_CONFIG"),
     tenant: str = typer.Option("default", "--tenant", "-t", help="Tenant alias", envvar="CORTEX_TENANT_ALIAS"),
-    log_level: Annotated[str, typer.Option("--log-level", "-l", help="Set the logging level")] = "INFO",
+    log_level: Annotated[str, typer.Option("--log-level", "-l", help="Set the logging level")] = "WARNING",
     rate_limit: int = typer.Option(None, "--rate-limit", "-r", help="API rate limit in requests per minute (default: 1000)", envvar="CORTEX_RATE_LIMIT")
 ):
     if not ctx.obj:

cortexapps_cli/commands/backup.py

@@ -472,6 +472,8 @@ def import_relationships_file(file_info):
     return ("entity-relationships", len(results) - failed_count, [(fp, et, em) for rt, fp, et, em in results if et])
 
 def _import_catalog(ctx, directory):
+    results = []
+    failed_count = 0
     if os.path.isdir(directory):
         print("Processing: " + directory)
         files = [(filename, os.path.join(directory, filename))
@@ -507,6 +509,8 @@ def import_catalog_file(file_info):
     return ("catalog", len(results) - failed_count, [(fp, et, em) for fn, fp, et, em in results if et])
 
 def _import_plugins(ctx, directory):
+    results = []
+    failed_count = 0
     if os.path.isdir(directory):
         print("Processing: " + directory)
         files = [(filename, os.path.join(directory, filename))
@@ -543,6 +547,8 @@ def import_plugin_file(file_info):
     return ("plugins", len(results) - failed_count, [(fp, et, em) for fn, fp, et, em in results if et])
 
 def _import_scorecards(ctx, directory):
+    results = []
+    failed_count = 0
     if os.path.isdir(directory):
         print("Processing: " + directory)
         files = [(filename, os.path.join(directory, filename))
@@ -579,6 +585,8 @@ def import_scorecard_file(file_info):
     return ("scorecards", len(results) - failed_count, [(fp, et, em) for fn, fp, et, em in results if et])
 
 def _import_workflows(ctx, directory):
+    results = []
+    failed_count = 0
     if os.path.isdir(directory):
         print("Processing: " + directory)
         files = [(filename, os.path.join(directory, filename))

cortexapps_cli/cortex_client.py

@@ -98,7 +98,7 @@ def __init__(self, api_key, tenant, numeric_level, base_url='https://api.getcort
             max_retries=Retry(
                 total=3,
                 backoff_factor=0.3,
-                status_forcelist=[500, 502, 503, 504],  # Removed 429 - we avoid it with rate limiting
+                status_forcelist=[429],  # Only retry on rate limit errors
                 allowed_methods=["GET", "POST", "PUT", "PATCH", "DELETE", "HEAD", "OPTIONS"],
                 respect_retry_after_header=True
             )