nightshift-sdk 0.4.0__tar.gz → 0.4.2__tar.gz

nightshift_sdk-0.4.2/.github/workflows/release.yml

@@ -0,0 +1,79 @@
+name: Release
+
+on:
+  push:
+    tags: ["v*"]
+
+jobs:
+  build-python:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - uses: astral-sh/setup-uv@v4
+
+      - run: uv build
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+  build-rootfs:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install build dependencies
+        run: sudo apt-get update && sudo apt-get install -y squashfs-tools wget
+
+      - name: Build base rootfs
+        run: sudo ./rootfs/build-rootfs.sh rootfs.ext4
+
+      - name: Bake agent runtime
+        run: sudo ./infra/bake-rootfs.sh rootfs.ext4
+
+      - name: Compress rootfs
+        run: gzip rootfs.ext4
+
+      - uses: actions/upload-artifact@v4
+        with:
+          name: rootfs
+          path: rootfs.ext4.gz
+
+  publish-pypi:
+    runs-on: ubuntu-latest
+    needs: [build-python]
+    environment: pypi
+    steps:
+      - uses: astral-sh/setup-uv@v4
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - run: uv publish dist/*
+        env:
+          UV_PUBLISH_TOKEN: ${{ secrets.PYPI_TOKEN }}
+
+  publish-github:
+    runs-on: ubuntu-latest
+    needs: [build-python, build-rootfs]
+    permissions:
+      contents: write
+    steps:
+      - uses: actions/download-artifact@v4
+        with:
+          name: dist
+          path: dist/
+
+      - uses: actions/download-artifact@v4
+        with:
+          name: rootfs
+
+      - uses: softprops/action-gh-release@v2
+        with:
+          files: |
+            dist/*
+            rootfs.ext4.gz

{nightshift_sdk-0.4.0 → nightshift_sdk-0.4.2}/.gitignore

@@ -6,3 +6,4 @@ __pycache__/
 env/
 build/
 dist/
+infra/.deploy-state

{nightshift_sdk-0.4.0 → nightshift_sdk-0.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: nightshift-sdk
-Version: 0.4.0
+Version: 0.4.2
 Summary: Nightshift — autonomous agent orchestrator with Firecracker VMs
 Project-URL: Homepage, https://nightshift.sh
 Project-URL: Documentation, https://docs.nightshift.sh

{nightshift_sdk-0.4.0 → nightshift_sdk-0.4.2}/docs/deployment/provision.mdx

@@ -4,24 +4,40 @@ sidebarTitle: "Provision"
 description: "Set up a c5.metal EC2 instance with Firecracker, KVM, and all dependencies."
 ---
 
+## Operator deploy
 
-## Prerequisites
+If you're an operator deploying Nightshift for your team, use the single-command deploy script. It provisions a c5.metal, pulls everything from PyPI and GitHub Releases, and starts serving — no repo checkout needed.
 
-- AWS CLI configured with credentials (EC2, IAM, Lambda, EventBridge Scheduler permissions)
-- `curl` and `jq` installed locally
-- The `infra/` directory from this repository
+```bash
+./infra/deploy.sh --hostname api.example.com --api-key ns_abc123
+```
+
+Optional flags:
+- `--region <region>` — AWS region (default: us-east-1)
+- `--version <tag>` — pin to a specific release (default: latest)
+- `--port <port>` — backend port (default: 3000)
+
+The script allocates an Elastic IP and prints DNS instructions at the end. Point your hostname's A record at the Elastic IP, and Caddy provisions TLS automatically.
+
+To upgrade an existing deployment:
+
+```bash
+./infra/upgrade.sh ubuntu@<ELASTIC_IP> --key ~/.ssh/nightshift.pem
+./infra/upgrade.sh --version v0.3.0  # reads target from state file
+```
+
+## Dev environment setup
 
-## Run setup
+For development (requires a local repo checkout):
 
 ```bash
-cd infra
-bash setup.sh
+./infra/dev/setup.sh
 ```
 
 For a production deployment with TLS in one step:
 
 ```bash
-bash setup.sh --production --hostname api.example.com
+./infra/dev/setup.sh --production --hostname api.example.com
 ```
 
 This opens ports 80/443, provisions the instance, and runs `production.sh` on the remote machine to install Caddy + systemd services. See [Server](/deployment/server) for details.
@@ -55,7 +71,7 @@ This opens ports 80/443, provisions the instance, and runs `production.sh` on th
     Polls SSH and waits for `/opt/nightshift/.setup-done` marker.
   </Step>
   <Step title="Write connection details">
-    Writes connection details to `infra/.instance`.
+    Writes connection details to `infra/dev/.instance`.
   </Step>
 </Steps>
 
@@ -70,8 +86,7 @@ ssh -i ~/.ssh/nightshift-dev.pem ubuntu@<IP> 'tail -50 /var/log/nightshift-setup
 ## Tear down
 
 ```bash
-cd infra
-bash teardown.sh
+./infra/dev/teardown.sh
 ```
 
-Terminates the instance and removes `infra/.instance`. The SSH keypair and security group are preserved for next time.
+Terminates the instance and removes `infra/dev/.instance`. The SSH keypair and security group are preserved for next time.

nightshift_sdk-0.4.2/examples/oai_agent.py

@@ -0,0 +1,22 @@
+"""OpenAI agent — simple streaming assistant.
+
+Demonstrates Nightshift with the OpenAI Agents SDK.
+Uses forward_env to pass the API key from the server, or --env from the CLI.
+
+Usage:
+    nightshift deploy examples/oai_agent.py
+    nightshift run oai_agent -p "hello" -f --env OPENAI_API_KEY=$OPENAI_API_KEY
+"""
+
+from agents import Agent, Runner
+from nightshift import NightshiftApp, AgentConfig
+
+app = NightshiftApp()
+
+
+@app.agent(AgentConfig(workspace="", forward_env=["OPENAI_API_KEY"], max_concurrent_vms=3))
+async def oai_agent(prompt: str):
+    agent = Agent(name="Assistant", instructions="You are a helpful assistant")
+    result = Runner.run_streamed(agent, prompt)
+    async for event in result.stream_events():
+        yield event

{nightshift_sdk-0.4.0 → nightshift_sdk-0.4.2}/infra/bake-rootfs.sh

@@ -76,53 +76,13 @@ echo "    protocol/      → packaging.py, events.py"
 # Replace systemd with a minimal shell init. Systemd is too heavy for
 # Firecracker microVMs — it can panic or hang during boot. Our init
 # sets up the essentials (filesystems, network, env) and starts the agent.
+#
+# The init script lives in rootfs/init (single source of truth).
 echo "==> Installing init script"
 # /sbin/init is a symlink to ../lib/systemd/systemd — remove it first
 # so we don't overwrite the systemd binary.
 rm -f "$MOUNT_DIR/sbin/init"
-cat > "$MOUNT_DIR/sbin/init" << 'INIT'
-#!/bin/sh
-#
-# Nightshift VM init — PID 1 inside the Firecracker microVM.
-#
-
-# Mount essential filesystems (ignore errors if kernel already mounted them)
-mount -t proc proc /proc 2>/dev/null
-mount -t sysfs sysfs /sys 2>/dev/null
-mount -t devtmpfs devtmpfs /dev 2>/dev/null
-mount -t tmpfs tmpfs /tmp 2>/dev/null
-mount -t tmpfs tmpfs /run 2>/dev/null
-
-# Configure network from kernel command line
-# ip=GUEST::GATEWAY:MASK::eth0:off
-GUEST_IP=$(cat /proc/cmdline | tr ' ' '\n' | grep '^ip=' | cut -d= -f2 | cut -d: -f1)
-GATEWAY=$(cat /proc/cmdline | tr ' ' '\n' | grep '^ip=' | cut -d= -f2 | cut -d: -f3)
-MASK=$(cat /proc/cmdline | tr ' ' '\n' | grep '^ip=' | cut -d= -f2 | cut -d: -f4)
-
-if [ -n "$GUEST_IP" ]; then
-    ip addr add "${GUEST_IP}/${MASK}" dev eth0 2>/dev/null
-    ip link set eth0 up 2>/dev/null
-    ip route add default via "$GATEWAY" 2>/dev/null
-fi
-
-# DNS
-echo "nameserver 8.8.8.8" > /etc/resolv.conf
-echo "nameserver 8.8.4.4" >> /etc/resolv.conf
-
-# Load environment
-if [ -f /etc/nightshift/env ]; then
-    set -a
-    . /etc/nightshift/env
-    set +a
-fi
-
-export PATH="/root/.local/bin:/usr/local/bin:/usr/bin:/bin"
-export PYTHONPATH="/opt"
-
-# Start the agent
-cd /workspace
-exec python3 -m nightshift.agent
-INIT
+cp "$PROJECT_DIR/rootfs/init" "$MOUNT_DIR/sbin/init"
 chmod +x "$MOUNT_DIR/sbin/init"
 
 # ── Required directories ─────────────────────────────────────

nightshift_sdk-0.4.2/infra/deploy.sh

@@ -0,0 +1,362 @@
+#!/bin/bash
+#
+# Deploy Nightshift for operators.
+#
+# Provisions a c5.metal EC2 instance and bootstraps a production-ready
+# Nightshift server. Everything is pulled from PyPI (nightshift-sdk) and
+# GitHub Releases (rootfs.ext4.gz) — no local repo checkout needed.
+#
+# Prerequisites:
+#   - AWS CLI configured with EC2/VPC permissions
+#   - A hostname with DNS pointing to the Elastic IP (printed at the end)
+#
+# Usage:
+#   ./infra/deploy.sh --hostname api.example.com --api-key ns_abc123
+#   ./infra/deploy.sh --hostname api.example.com --api-key ns_abc123 --region us-west-2
+#   ./infra/deploy.sh --hostname api.example.com --api-key ns_abc123 --version v0.2.0
+#
+set -euo pipefail
+
+SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
+STATE_FILE="$SCRIPT_DIR/.deploy-state"
+
+INSTANCE_TYPE="c5.metal"
+KEY_NAME="nightshift"
+SG_NAME="nightshift"
+REGION="${AWS_DEFAULT_REGION:-us-east-1}"
+HOSTNAME=""
+API_KEY=""
+PORT=3000
+VERSION=""
+GITHUB_REPO="nightshiftco/nightshift"
+
+# Parse arguments
+while [[ $# -gt 0 ]]; do
+    case $1 in
+        --hostname) HOSTNAME="$2"; shift 2 ;;
+        --api-key)  API_KEY="$2";  shift 2 ;;
+        --region)   REGION="$2";   shift 2 ;;
+        --version)  VERSION="$2";  shift 2 ;;
+        --port)     PORT="$2";     shift 2 ;;
+        *)
+            echo "Unknown option: $1"
+            echo "Usage: $0 --hostname <FQDN> --api-key <key> [--region <region>] [--version <tag>] [--port <port>]"
+            exit 1
+            ;;
+    esac
+done
+
+if [ -z "$HOSTNAME" ]; then
+    echo "Error: --hostname is required"
+    echo "Usage: $0 --hostname <FQDN> --api-key <key> [--region <region>] [--version <tag>] [--port <port>]"
+    exit 1
+fi
+
+if [ -z "$API_KEY" ]; then
+    echo "Error: --api-key is required"
+    echo "Generate one with: python3 -c \"import secrets; print(f'ns_{secrets.token_hex(16)}')\""
+    exit 1
+fi
+
+# If no version specified, fetch the latest release tag from GitHub.
+if [ -z "$VERSION" ]; then
+    VERSION=$(curl -s "https://api.github.com/repos/${GITHUB_REPO}/releases/latest" | jq -r '.tag_name')
+    if [ -z "$VERSION" ] || [ "$VERSION" = "null" ]; then
+        echo "Error: could not determine latest release from GitHub"
+        exit 1
+    fi
+fi
+
+echo "==> Nightshift operator deploy"
+echo "    Hostname: $HOSTNAME"
+echo "    Version:  $VERSION"
+echo "    Region:   $REGION"
+echo "    Port:     $PORT"
+echo ""
+
+# SSH key pair
+if ! aws ec2 describe-key-pairs --key-names "$KEY_NAME" --region "$REGION" &>/dev/null; then
+    echo "==> Creating key pair: $KEY_NAME"
+    aws ec2 create-key-pair \
+        --key-name "$KEY_NAME" \
+        --region "$REGION" \
+        --query 'KeyMaterial' \
+        --output text > ~/.ssh/${KEY_NAME}.pem
+    chmod 400 ~/.ssh/${KEY_NAME}.pem
+    echo "    Saved to ~/.ssh/${KEY_NAME}.pem"
+else
+    echo "==> Key pair '$KEY_NAME' already exists in AWS"
+    if [ ! -f ~/.ssh/${KEY_NAME}.pem ]; then
+        echo "    ERROR: Private key not found at ~/.ssh/${KEY_NAME}.pem"
+        echo "    The key pair exists in AWS but the local private key is missing."
+        echo "    Fix: delete the key pair in AWS and re-run this script."
+        echo "      aws ec2 delete-key-pair --key-name $KEY_NAME --region $REGION"
+        exit 1
+    fi
+fi
+
+# Security group 
+SG_ID=$(aws ec2 describe-security-groups \
+    --filters "Name=group-name,Values=$SG_NAME" \
+    --region "$REGION" \
+    --query 'SecurityGroups[0].GroupId' \
+    --output text 2>/dev/null || echo "None")
+
+if [ "$SG_ID" = "None" ] || [ -z "$SG_ID" ]; then
+    echo "==> Creating security group: $SG_NAME"
+    SG_ID=$(aws ec2 create-security-group \
+        --group-name "$SG_NAME" \
+        --description "Nightshift production - SSH, HTTP, HTTPS" \
+        --region "$REGION" \
+        --query 'GroupId' \
+        --output text)
+fi
+
+MY_IP=$(curl -s https://checkip.amazonaws.com)
+echo "==> Updating security group rules"
+
+# Remove stale SSH rules
+OLD_RULES=$(aws ec2 describe-security-groups \
+    --group-ids "$SG_ID" \
+    --region "$REGION" \
+    --query 'SecurityGroups[0].IpPermissions[?FromPort==`22`].IpRanges[].CidrIp' \
+    --output text 2>/dev/null || echo "")
+for cidr in $OLD_RULES; do
+    aws ec2 revoke-security-group-ingress \
+        --group-id "$SG_ID" \
+        --protocol tcp --port 22 --cidr "$cidr" \
+        --region "$REGION" &>/dev/null || true
+done
+
+# SSH from operator IP + HTTP/HTTPS from anywhere
+aws ec2 authorize-security-group-ingress \
+    --group-id "$SG_ID" \
+    --protocol tcp --port 22 --cidr "${MY_IP}/32" \
+    --region "$REGION" &>/dev/null || true
+aws ec2 authorize-security-group-ingress \
+    --group-id "$SG_ID" \
+    --protocol tcp --port 80 --cidr "0.0.0.0/0" \
+    --region "$REGION" &>/dev/null || true
+aws ec2 authorize-security-group-ingress \
+    --group-id "$SG_ID" \
+    --protocol tcp --port 443 --cidr "0.0.0.0/0" \
+    --region "$REGION" &>/dev/null || true
+echo "    Security group: $SG_ID (SSH: ${MY_IP}/32, HTTP/HTTPS: 0.0.0.0/0)"
+
+# Find latest Ubuntu 22.04 AMI
+AMI_ID=$(aws ec2 describe-images \
+    --owners 099720109477 \
+    --filters "Name=name,Values=ubuntu/images/hvm-ssd/ubuntu-jammy-22.04-amd64-server-*" \
+              "Name=state,Values=available" \
+    --region "$REGION" \
+    --query 'sort_by(Images, &CreationDate)[-1].ImageId' \
+    --output text)
+echo "==> AMI: $AMI_ID (Ubuntu 22.04 latest)"
+
+# Build user-data bootstrap script
+# Variable substitution: VERSION, PORT, API_KEY, HOSTNAME, GITHUB_REPO
+# are injected into the heredoc. The rest of the script runs as root on
+# first boot.
+
+USERDATA=$(cat << USERDATA_EOF
+#!/bin/bash
+set -euxo pipefail
+exec > >(tee /var/log/nightshift-setup.log) 2>&1
+
+# ── System packages ──────────────────────────────────────────────────
+apt-get update
+apt-get upgrade -y
+apt-get install -y curl wget jq acl iptables iproute2 rsync nodejs npm
+
+# We install claude code for convenience on the server
+echo "==> Installing claude CLI..."
+npm install -g @anthropic-ai/claude-code
+
+# ── KVM access ───────────────────────────────────────────────────────
+modprobe kvm
+modprobe kvm_intel 2>/dev/null || modprobe kvm_amd 2>/dev/null || true
+chmod 666 /dev/kvm
+echo 'KERNEL=="kvm", GROUP="kvm", MODE="0666"' > /etc/udev/rules.d/99-kvm.rules
+
+# ── IP forwarding ────────────────────────────────────────────────────
+echo 'net.ipv4.ip_forward = 1' > /etc/sysctl.d/99-firecracker.conf
+sysctl -p /etc/sysctl.d/99-firecracker.conf
+
+# ── uv (system-wide to /root/.local/bin) ─────────────────────────────
+curl -LsSf https://astral.sh/uv/install.sh | bash
+export PATH="/root/.local/bin:\$PATH"
+
+# ── Firecracker + jailer ─────────────────────────────────────────────
+ARCH=\$(uname -m)
+FC_VERSION=\$(curl -s https://api.github.com/repos/firecracker-microvm/firecracker/releases/latest | jq -r '.tag_name')
+cd /tmp
+curl -LO "https://github.com/firecracker-microvm/firecracker/releases/download/\${FC_VERSION}/firecracker-\${FC_VERSION}-\${ARCH}.tgz"
+tar xzf "firecracker-\${FC_VERSION}-\${ARCH}.tgz"
+mv "release-\${FC_VERSION}-\${ARCH}/firecracker-\${FC_VERSION}-\${ARCH}" /usr/local/bin/firecracker
+mv "release-\${FC_VERSION}-\${ARCH}/jailer-\${FC_VERSION}-\${ARCH}" /usr/local/bin/jailer
+chmod +x /usr/local/bin/firecracker /usr/local/bin/jailer
+
+# ── Kernel (vmlinux) from Firecracker CI S3 bucket ───────────────────
+mkdir -p /opt/nightshift
+cd /opt/nightshift
+
+CI_VERSION=\$(echo "\$FC_VERSION" | sed 's/\.[0-9]*\$//')
+latest_kernel_key=\$(curl -s "http://spec.ccfc.min.s3.amazonaws.com/?prefix=firecracker-ci/\${CI_VERSION}/\${ARCH}/vmlinux-&list-type=2" \
+    | grep -oP "(?<=<Key>)(firecracker-ci/\${CI_VERSION}/\${ARCH}/vmlinux-[0-9]+\.[0-9]+\.[0-9]{1,3})(?=</Key>)" \
+    | sort -V | tail -1)
+wget -q -O vmlinux "https://s3.amazonaws.com/spec.ccfc.min/\${latest_kernel_key}"
+
+# ── rootfs from GitHub Release ───────────────────────────────────────
+curl -L -o rootfs.ext4.gz "https://github.com/${GITHUB_REPO}/releases/download/${VERSION}/rootfs.ext4.gz"
+gunzip rootfs.ext4.gz
+
+# ── Install nightshift from PyPI via uvx ─────────────────────────────
+# uvx installs and runs CLI tools from PyPI in isolated environments.
+# Pin to the release version so operator knows exactly what's running.
+SDK_VERSION=\$(echo "${VERSION}" | sed 's/^v//')
+uvx --from "nightshift-sdk==\${SDK_VERSION}" nightshift --help
+
+# ── Caddy (auto-TLS reverse proxy) ──────────────────────────────────
+apt-get install -y debian-keyring debian-archive-keyring apt-transport-https
+curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
+    | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
+curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
+    | tee /etc/apt/sources.list.d/caddy-stable.list
+apt-get update -y
+apt-get install -y caddy
+
+cat > /etc/caddy/Caddyfile << 'CADDY'
+${HOSTNAME} {
+    reverse_proxy localhost:${PORT}
+}
+CADDY
+
+# ── systemd service for nightshift serve ─────────────────────────────
+cat > /etc/systemd/system/nightshift-serve.service << 'SYSTEMD'
+[Unit]
+Description=Nightshift Platform Server
+After=network.target
+
+[Service]
+Type=simple
+User=root
+ExecStart=/root/.local/bin/uvx --from nightshift-sdk nightshift serve --port ${PORT}
+Restart=on-failure
+RestartSec=5
+Environment=NIGHTSHIFT_API_KEY=${API_KEY}
+
+[Install]
+WantedBy=multi-user.target
+SYSTEMD
+
+# ── Enable and start services ────────────────────────────────────────
+systemctl daemon-reload
+systemctl enable --now nightshift-serve
+systemctl enable caddy
+systemctl reload caddy
+
+# ── Done marker ──────────────────────────────────────────────────────
+echo "setup_complete \$(date -u +%Y-%m-%dT%H:%M:%SZ)" > /opt/nightshift/.setup-done
+USERDATA_EOF
+)
+
+# Launch instance
+echo "==> Launching $INSTANCE_TYPE instance..."
+INSTANCE_ID=$(aws ec2 run-instances \
+    --image-id "$AMI_ID" \
+    --instance-type "$INSTANCE_TYPE" \
+    --key-name "$KEY_NAME" \
+    --security-group-ids "$SG_ID" \
+    --region "$REGION" \
+    --block-device-mappings '[{"DeviceName":"/dev/sda1","Ebs":{"VolumeSize":100,"VolumeType":"gp3","DeleteOnTermination":true}}]' \
+    --user-data "$USERDATA" \
+    --tag-specifications "ResourceType=instance,Tags=[{Key=Name,Value=nightshift},{Key=Project,Value=nightshift},{Key=Version,Value=$VERSION}]" \
+    --query 'Instances[0].InstanceId' \
+    --output text)
+echo "    Instance ID: $INSTANCE_ID"
+
+echo "==> Waiting for instance to enter 'running' state..."
+aws ec2 wait instance-running --instance-ids "$INSTANCE_ID" --region "$REGION"
+
+# Allocate and associate Elastic IP
+echo "==> Allocating Elastic IP..."
+ALLOC_ID=$(aws ec2 allocate-address \
+    --domain vpc \
+    --region "$REGION" \
+    --tag-specifications "ResourceType=elastic-ip,Tags=[{Key=Name,Value=nightshift},{Key=Project,Value=nightshift}]" \
+    --query 'AllocationId' \
+    --output text)
+
+ELASTIC_IP=$(aws ec2 describe-addresses \
+    --allocation-ids "$ALLOC_ID" \
+    --region "$REGION" \
+    --query 'Addresses[0].PublicIp' \
+    --output text)
+
+aws ec2 associate-address \
+    --instance-id "$INSTANCE_ID" \
+    --allocation-id "$ALLOC_ID" \
+    --region "$REGION" \
+    --output text > /dev/null
+echo "    Elastic IP: $ELASTIC_IP"
+
+# state
+cat > "$STATE_FILE" << EOF
+INSTANCE_ID=$INSTANCE_ID
+ELASTIC_IP=$ELASTIC_IP
+ALLOC_ID=$ALLOC_ID
+KEY_PATH=~/.ssh/${KEY_NAME}.pem
+REGION=$REGION
+HOSTNAME=$HOSTNAME
+VERSION=$VERSION
+EOF
+echo "    State saved to $STATE_FILE"
+
+# Wait for SSH
+echo "==> Waiting for SSH..."
+for i in $(seq 1 60); do
+    if ssh -o ConnectTimeout=5 -o StrictHostKeyChecking=no -o BatchMode=yes \
+        -i ~/.ssh/${KEY_NAME}.pem ubuntu@${ELASTIC_IP} "echo ok" &>/dev/null; then
+        echo "    SSH is up"
+        break
+    fi
+    if [ "$i" -eq 60 ]; then
+        echo "    ERROR: SSH did not come up after 10 minutes"
+        exit 1
+    fi
+    sleep 10
+done
+
+# Wait for user-data setup to complete
+echo "==> Waiting for instance setup to complete..."
+echo "    (installing firecracker, kernel, rootfs, nightshift, caddy)"
+for i in $(seq 1 90); do
+    DONE=$(ssh -o StrictHostKeyChecking=no -i ~/.ssh/${KEY_NAME}.pem \
+        ubuntu@${ELASTIC_IP} "cat /opt/nightshift/.setup-done 2>/dev/null" 2>/dev/null || echo "")
+    if [ -n "$DONE" ]; then
+        echo "    $DONE"
+        break
+    fi
+    if [ "$i" -eq 90 ]; then
+        echo "    ERROR: Setup did not complete after 15 minutes"
+        echo "    Debug: ssh -i ~/.ssh/${KEY_NAME}.pem ubuntu@${ELASTIC_IP} 'tail -50 /var/log/nightshift-setup.log'"
+        exit 1
+    fi
+    sleep 10
+done
+
+# Print connection info
+echo ""
+echo "=== Nightshift deployment complete ==="
+echo ""
+echo "  Elastic IP: $ELASTIC_IP"
+echo "  Server:     https://$HOSTNAME"
+echo "  Health:     https://$HOSTNAME/health"
+echo "  SSH:        ssh -i ~/.ssh/${KEY_NAME}.pem ubuntu@${ELASTIC_IP}"
+echo "  Version:    $VERSION"
+echo ""
+echo "  DNS: Create an A record pointing $HOSTNAME to $ELASTIC_IP"
+echo "       Caddy will automatically provision TLS once DNS propagates."
+echo ""
+echo "  Logs:    ssh -i ~/.ssh/${KEY_NAME}.pem ubuntu@${ELASTIC_IP} 'sudo journalctl -u nightshift-serve -f'"
+echo "  Upgrade: ./infra/upgrade.sh ubuntu@${ELASTIC_IP} --key ~/.ssh/${KEY_NAME}.pem"

{nightshift_sdk-0.4.0/infra → nightshift_sdk-0.4.2/infra/dev}/cron.sh

@@ -10,10 +10,10 @@
 #   - EventBridge Schedules: start 8am ET Mon-Fri, stop midnight ET Tue-Sat
 #
 # Prerequisites:
-#   - infra/.instance must exist (run setup.sh first)
+#   - infra/dev/.instance must exist (run setup.sh first)
 #   - AWS CLI configured with appropriate permissions
 #
-# Usage: ./infra/cron.sh
+# Usage: ./infra/dev/cron.sh
 #
 set -euo pipefail
 

{nightshift_sdk-0.4.0/infra → nightshift_sdk-0.4.2/infra/dev}/deploy.sh

@@ -7,14 +7,14 @@
 # next run cold-starts with the new code.
 #
 # Usage:
-#   ./infra/deploy.sh                          # uses IP from .instance
-#   ./infra/deploy.sh ubuntu@100.49.58.14      # explicit host
-#   ./infra/deploy.sh --key ~/.ssh/my.pem ubuntu@host
+#   ./infra/dev/deploy.sh                          # uses IP from .instance
+#   ./infra/dev/deploy.sh ubuntu@100.49.58.14      # explicit host
+#   ./infra/dev/deploy.sh --key ~/.ssh/my.pem ubuntu@host
 #
 set -euo pipefail
 
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-PROJECT_DIR="$(dirname "$SCRIPT_DIR")"
+PROJECT_DIR="$(dirname "$(dirname "$SCRIPT_DIR")")"
 STATE_FILE="$SCRIPT_DIR/.instance"
 
 SSH_KEY=""

{nightshift_sdk-0.4.0/infra → nightshift_sdk-0.4.2/infra/dev}/production.sh

@@ -7,9 +7,9 @@
 # It does NOT handle DNS; point your hostname at this machine first.
 #
 # Usage:
-#   ./infra/production.sh --hostname api.nightshift.sh
-#   ./infra/production.sh --hostname api.nightshift.sh --port 8080
-#   ./infra/production.sh --hostname api.nightshift.sh --api-key my-secret-key
+#   ./infra/dev/production.sh --hostname api.nightshift.sh
+#   ./infra/dev/production.sh --hostname api.nightshift.sh --port 8080
+#   ./infra/dev/production.sh --hostname api.nightshift.sh --api-key my-secret-key
 #
 set -euo pipefail
 
@@ -75,7 +75,7 @@ fi
 # Default to the directory containing this script's parent, but allow
 # override via NIGHTSHIFT_PROJECT_DIR.
 SCRIPT_DIR="$(cd "$(dirname "$0")" && pwd)"
-PROJECT_DIR="${NIGHTSHIFT_PROJECT_DIR:-$(dirname "$SCRIPT_DIR")}"
+PROJECT_DIR="${NIGHTSHIFT_PROJECT_DIR:-$(dirname "$(dirname "$SCRIPT_DIR")")}"
 
 # Verify uv is available
 UV_PATH="$(command -v uv 2>/dev/null || echo "$HOME/.local/bin/uv")"
@@ -129,7 +129,7 @@ echo "    Created /etc/caddy/Caddyfile"
 # 5. Bake agent runtime into rootfs
 # -------------------------------------------------------------------
 echo "==> Baking agent runtime into rootfs"
-sudo "$SCRIPT_DIR/bake-rootfs.sh"
+sudo "$SCRIPT_DIR/../bake-rootfs.sh"
 
 # -------------------------------------------------------------------
 # 6. Enable and start services