From ed0f4f9dbbde6f6e44f5a567b5f4e08bbb2cd48c Mon Sep 17 00:00:00 2001
From: Greyson Lalonde <greyson.r.lalonde@gmail.com>
Date: Tue, 5 May 2026 21:38:45 +0800
Subject: [PATCH] fix(cli): atomic trace-consent updates and drop unused
 re-exports
MIME-Version: 1.0
Content-Type: text/plain; charset=UTF-8
Content-Transfer-Encoding: 8bit

- traces enable/disable now use update_user_data (file-locked atomic
  read-modify-write) instead of bare _load_user_data + _save_user_data —
  prevents data loss under concurrent CLI invocations.
- Drop unused _get_nested_value / _get_project_attribute re-exports from
  crewai_cli.utils and crewai.utilities.project_utils — no callers.
- Mark crewai.events.listeners.tracing.utils re-exports via __all__ so
  CodeQL recognizes _save_user_data, is_tracing_enabled, update_user_data
  (and the other tracing helpers defined in the file) as public API.
---
 lib/cli/src/crewai_cli/cli.py                 | 14 +++-------
 lib/cli/src/crewai_cli/utils.py               |  2 --
 .../crewai/events/listeners/tracing/utils.py  | 26 +++++++++++++++++++
 .../src/crewai/utilities/project_utils.py     |  2 --
 4 files changed, 29 insertions(+), 15 deletions(-)

diff --git a/lib/cli/src/crewai_cli/cli.py b/lib/cli/src/crewai_cli/cli.py
index f482e2b9a..a258d917d 100644
--- a/lib/cli/src/crewai_cli/cli.py
+++ b/lib/cli/src/crewai_cli/cli.py
@@ -33,8 +33,8 @@ from crewai_cli.triggers.main import TriggersCommand
 from crewai_cli.update_crew import update_crew
 from crewai_cli.user_data import (
     _load_user_data,
-    _save_user_data,
     is_tracing_enabled,
+    update_user_data,
 )
 from crewai_cli.utils import build_env_with_all_tool_credentials, read_toml
 
@@ -794,11 +794,7 @@ def traces_enable() -> None:
 
     console = Console()
 
-    # Update user data to enable traces
-    user_data = _load_user_data()
-    user_data["trace_consent"] = True
-    user_data["first_execution_done"] = True
-    _save_user_data(user_data)
+    update_user_data({"trace_consent": True, "first_execution_done": True})
 
     panel = Panel(
         "✅ Trace consent recorded.\n\n"
@@ -820,11 +816,7 @@ def traces_disable() -> None:
 
     console = Console()
 
-    # Update user data to disable traces
-    user_data = _load_user_data()
-    user_data["trace_consent"] = False
-    user_data["first_execution_done"] = True
-    _save_user_data(user_data)
+    update_user_data({"trace_consent": False, "first_execution_done": True})
 
     panel = Panel(
         "❌ Trace collection has been disabled!\n\n"
diff --git a/lib/cli/src/crewai_cli/utils.py b/lib/cli/src/crewai_cli/utils.py
index e72e5a6ab..063c6d14e 100644
--- a/lib/cli/src/crewai_cli/utils.py
+++ b/lib/cli/src/crewai_cli/utils.py
@@ -7,8 +7,6 @@ from typing import Any
 
 import click
 from crewai_core.project import (
-    _get_nested_value as _get_nested_value,
-    _get_project_attribute as _get_project_attribute,
     get_project_description as get_project_description,
     get_project_name as get_project_name,
     get_project_version as get_project_version,
diff --git a/lib/crewai/src/crewai/events/listeners/tracing/utils.py b/lib/crewai/src/crewai/events/listeners/tracing/utils.py
index 5db1570d6..b02ab6d4e 100644
--- a/lib/crewai/src/crewai/events/listeners/tracing/utils.py
+++ b/lib/crewai/src/crewai/events/listeners/tracing/utils.py
@@ -32,6 +32,32 @@ from rich.text import Text
 from crewai.utilities.serialization import to_serializable
 
 
+__all__ = [
+    "_load_user_data",
+    "_save_user_data",
+    "_user_data_file",
+    "_user_data_lock_name",
+    "get_user_id",
+    "has_user_declined_tracing",
+    "is_first_execution",
+    "is_tracing_enabled",
+    "is_tracing_enabled_in_context",
+    "mark_first_execution_completed",
+    "mark_first_execution_done",
+    "on_first_execution_tracing_confirmation",
+    "prompt_user_for_trace_viewing",
+    "reset_tracing_enabled",
+    "safe_serialize_to_dict",
+    "set_suppress_tracing_messages",
+    "set_tracing_enabled",
+    "should_auto_collect_first_time_traces",
+    "should_enable_tracing",
+    "should_suppress_tracing_messages",
+    "truncate_messages",
+    "update_user_data",
+]
+
+
 logger = logging.getLogger(__name__)
 
 
diff --git a/lib/crewai/src/crewai/utilities/project_utils.py b/lib/crewai/src/crewai/utilities/project_utils.py
index 5bee9dd9f..c22b85a3c 100644
--- a/lib/crewai/src/crewai/utilities/project_utils.py
+++ b/lib/crewai/src/crewai/utilities/project_utils.py
@@ -14,8 +14,6 @@ import types
 from typing import Any, cast, get_type_hints
 
 from crewai_core.project import (
-    _get_nested_value as _get_nested_value,
-    _get_project_attribute as _get_project_attribute,
     get_project_description as get_project_description,
     get_project_name as get_project_name,
     get_project_version as get_project_version,