observal-cli 0.2.0__tar.gz

observal_cli-0.2.0/.dockerignore

@@ -0,0 +1,5 @@
+**/node_modules
+**/.next
+**/.git
+**/__pycache__
+**/.venv

observal_cli-0.2.0/.editorconfig

@@ -0,0 +1,18 @@
+root = true
+
+[*]
+indent_style = space
+indent_size = 4
+end_of_line = lf
+charset = utf-8
+trim_trailing_whitespace = true
+insert_final_newline = true
+
+[*.{ts,tsx,js,jsx,json,css,html,yaml,yml}]
+indent_size = 2
+
+[*.md]
+trim_trailing_whitespace = false
+
+[Makefile]
+indent_style = tab

observal_cli-0.2.0/.env.example

@@ -0,0 +1,62 @@
+# Core settings (have sensible defaults, override for production)
+DATABASE_URL=postgresql+asyncpg://postgres:postgres@observal-db:5432/observal
+# Recommended: generate a unique key for production
+# python3 -c "import secrets; print(secrets.token_urlsafe(32))"
+SECRET_KEY=change-me-to-a-random-string
+CLICKHOUSE_URL=clickhouse://default:clickhouse@observal-clickhouse:8123/observal
+REDIS_URL=redis://observal-redis:6379
+
+# Postgres container credentials
+POSTGRES_USER=postgres
+POSTGRES_PASSWORD=postgres
+
+# Optional: ClickHouse credentials
+CLICKHOUSE_USER=default
+CLICKHOUSE_PASSWORD=clickhouse
+
+# Optional: Eval engine (LLM-as-judge)
+EVAL_MODEL_URL=
+EVAL_MODEL_API_KEY=
+EVAL_MODEL_NAME=
+EVAL_MODEL_PROVIDER=
+
+# Optional: AWS credentials for Bedrock eval engine
+AWS_ACCESS_KEY_ID=
+AWS_SECRET_ACCESS_KEY=
+AWS_SESSION_TOKEN=
+AWS_REGION=us-east-1
+
+# Optional: OAuth / SSO (disabled when unset)
+OAUTH_CLIENT_ID=
+OAUTH_CLIENT_SECRET=
+OAUTH_SERVER_METADATA_URL=
+
+# Deployment mode: "local" (default) or "enterprise"
+# Local mode: self-registration, bootstrap endpoint, built-in account creation
+# Enterprise mode: SSO-only login, SCIM provisioning, no self-registration
+DEPLOYMENT_MODE=local
+
+# ClickHouse data retention (days). Set to 0 to disable TTL.
+DATA_RETENTION_DAYS=90
+
+# Demo accounts — seeded on first startup when no real users exist.
+# Automatically cleaned up when a real super_admin is created.
+# Set all 8 vars to enable, or leave unset to skip demo seeding.
+DEMO_SUPER_ADMIN_EMAIL=super@demo.example
+DEMO_SUPER_ADMIN_PASSWORD=super-changeme
+DEMO_ADMIN_EMAIL=admin@demo.example
+DEMO_ADMIN_PASSWORD=admin-changeme
+DEMO_REVIEWER_EMAIL=reviewer@demo.example
+DEMO_REVIEWER_PASSWORD=reviewer-changeme
+DEMO_USER_EMAIL=user@demo.example
+DEMO_USER_PASSWORD=user-changeme
+
+# Host port mappings (change these if defaults conflict with other services)
+# API_HOST_PORT=8000
+# POSTGRES_HOST_PORT=5432
+# CLICKHOUSE_HOST_PORT=8123
+# REDIS_HOST_PORT=6379
+# WEB_HOST_PORT=3000
+# OTEL_GRPC_HOST_PORT=4317
+# OTEL_HTTP_HOST_PORT=4318
+# GRAFANA_HOST_PORT=3001

observal_cli-0.2.0/.gitattributes

@@ -0,0 +1,2 @@
+# Force LF line endings for shell scripts (prevents CRLF breakage in Docker on Windows)
+*.sh text eol=lf

observal_cli-0.2.0/.github/ISSUE_TEMPLATE/bug_report_form.yml

@@ -0,0 +1,38 @@
+name: 🐞 Bug
+description: File a bug
+type: "Bug"
+labels:  ["Needs Triage"]
+
+body:
+
+  - type: checkboxes
+    id: contact
+    attributes:
+      label: Checked for duplicates?
+      description: Quickly search our [issues](https://github.com/BlazeUp-AI/Observal/issues) to see if a similar issue exists
+      options:
+        - label: This issue is not a duplicate
+          required: true
+
+  - type: textarea
+    id: steps
+    attributes:
+      label: What are the steps to reproduce this bug?
+      description: Briefly explain what you did which caused this bug to occur
+    validations:
+      required: true
+
+  - type: textarea
+    id: expected-behaviour
+    attributes:
+      label: Expected behaviour
+      description: Briefly describe what happened, and what should have happened
+    validations:
+      required: true
+
+  - type: textarea
+    id: extra_info
+    attributes:
+      label: (Optional) Anything else you want to share?
+      placeholder: List any extra information
+

observal_cli-0.2.0/.github/ISSUE_TEMPLATE/config.yml

@@ -0,0 +1,5 @@
+blank_issues_enabled: true
+contact_links:
+  - name: Github Discussions
+    url: https://github.com/BlazeUp-AI/Observal/discussions
+    about: Post on the forums for questions, support and feature requests!

observal_cli-0.2.0/.github/ISSUE_TEMPLATE/feature_request.yml

@@ -0,0 +1,38 @@
+name: 💡 Feature Request
+description: Suggest an idea for this project
+title: "[FEATURE] "
+labels: ["accepted"]
+body:
+  - type: markdown
+    attributes:
+      value: |
+        **Have a quick idea or want to gauge interest first?**
+        Consider starting a conversation in our [GitHub Discussions](https://github.com/BlazeUp-AI/Observal/discussions) before filing a formal feature request.
+
+  - type: textarea
+    id: problem
+    attributes:
+      label: Is your feature request related to a problem? Please describe.
+      description: A clear and concise description of what the problem is. Ex. I'm always frustrated when [...]
+    validations:
+      required: true
+
+  - type: textarea
+    id: solution
+    attributes:
+      label: Describe the solution you'd like
+      description: A clear and concise description of what you want to happen.
+    validations:
+      required: true
+
+  - type: textarea
+    id: alternatives
+    attributes:
+      label: Describe alternatives you've considered
+      description: A clear and concise description of any alternative solutions or features you've considered.
+
+  - type: textarea
+    id: additional_context
+    attributes:
+      label: Additional context
+      description: Add any other context or screenshots about the feature request here.

observal_cli-0.2.0/.github/pull_request_template.md

@@ -0,0 +1,36 @@
+<!--- Please fill the necessary details below -->
+## Purpose / Description
+_Describe the problem or feature and motivation_
+
+## Fixes
+* Fixes #<!-- replace this comment with the issue number e.g. 'Fixes #100'-->
+
+## Approach
+_How does this change address the problem?_
+
+## How Has This Been Tested?
+
+Please describe the tests that you ran to verify your changes. Provide instructions so we can reproduce. Please also list any relevant details for your test configuration
+
+## Learning (optional, can help others)
+_Describe the research stage_
+
+_Links to blog posts, patterns, libraries or addons used to solve this problem_
+
+## Checklist
+_Please, go through these checks before submitting the PR._
+
+- [ ] All commits are signed off (`git commit -s`) per the [DCO](https://developercertificate.org/)
+- [ ] You have a descriptive commit message with a short title (first line, max 50 chars).
+- [ ] You have commented your code, particularly in hard-to-understand areas
+- [ ] You have performed a self-review of your own code
+- [ ] UI changes: include screenshots of all affected screens (in particular showing any new or changed strings)
+
+<!--- Uncomment this section ONLY if this PR introduces new resources (external libraries, icons etc)
+## Licenses
+_For each new external resource, add a row to the table below:_
+
+| Library | Description | License |
+| --- | --- | --- |
+| Sample Icon Library | Sample Description | [The Apache Software License, Version 2.0](http://www.apache.org/licenses/LICENSE-2.0.txt) |
+--->

observal_cli-0.2.0/.github/workflows/ci.yml

@@ -0,0 +1,281 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# Observal CI — runs on every PR targeting main and on pushes to main.
+#
+# Recommended branch-protection rules (Settings → Branches → main):
+#   Required status checks:
+#     • lint
+#     • test (3.11)
+#     • test (3.12)
+#     • test (3.13)
+#     • web-lint
+#     • docker-build
+#     • security-scan
+#   Require a pull request before merging
+#   Require approvals: 1
+#   Do not allow bypassing the above settings
+# ─────────────────────────────────────────────────────────────────────────────
+
+name: CI
+
+on:
+  pull_request:
+    branches: [main]
+  push:
+    branches: [main]
+
+concurrency:
+  group: ci-${{ github.ref }}
+  cancel-in-progress: true
+
+# ── Job 0: Path filtering ─────────────────────────────────────────────────────
+jobs:
+  changes:
+    runs-on: ubuntu-latest
+    permissions:
+      pull-requests: read
+    outputs:
+      python: ${{ steps.filter.outputs.python }}
+      web: ${{ steps.filter.outputs.web }}
+      docker: ${{ steps.filter.outputs.docker }}
+    steps:
+      - uses: actions/checkout@v6
+      - uses: dorny/paths-filter@v4
+        id: filter
+        with:
+          filters: |
+            python:
+              - 'observal_cli/**/*.py'
+              - 'observal-server/**/*.py'
+              - 'tests/**/*.py'
+              - 'pyproject.toml'
+              - 'uv.lock'
+              - 'Makefile'
+              - '.pre-commit-config.yaml'
+              - '.github/workflows/ci.yml'
+            web:
+              - 'web/**'
+              - '.github/workflows/ci.yml'
+            docker:
+              - 'docker/**'
+              - 'observal_cli/**'
+              - 'observal-server/**'
+              - 'web/**'
+              - 'pyproject.toml'
+              - 'uv.lock'
+              - 'web/package.json'
+              - 'web/pnpm-lock.yaml'
+              - '.env.example'
+              - '.github/workflows/ci.yml'
+
+# ── Job 1: Python lint ────────────────────────────────────────────────────────
+  lint:
+    name: lint
+    runs-on: ubuntu-latest
+    needs: changes
+    steps:
+      - name: Skip if no Python changes
+        if: needs.changes.outputs.python != 'true'
+        run: |
+          echo "::notice::No Python changes detected, skipping lint"
+          echo "This job reports success to satisfy branch protection"
+
+      - uses: actions/checkout@v6
+        if: needs.changes.outputs.python == 'true'
+
+      - uses: astral-sh/setup-uv@v7
+        if: needs.changes.outputs.python == 'true'
+        with:
+          enable-cache: true
+
+      - name: Install Python 3.13
+        if: needs.changes.outputs.python == 'true'
+        run: uv python install 3.13
+
+      - name: ruff check
+        if: needs.changes.outputs.python == 'true'
+        run: uv run --with ruff==0.15.10 ruff check .
+
+      - name: ruff format --check
+        if: needs.changes.outputs.python == 'true'
+        run: uv run --with ruff==0.15.10 ruff format --check .
+
+# ── Job 2: Python tests (matrix) ──────────────────────────────────────────────
+  test:
+    name: test (${{ matrix.python-version }})
+    runs-on: ubuntu-latest
+    needs: changes
+    strategy:
+      fail-fast: false
+      matrix:
+        python-version: ["3.11", "3.12", "3.13"]
+
+    steps:
+      - name: Skip if no Python changes
+        if: needs.changes.outputs.python != 'true'
+        run: |
+          echo "::notice::No Python changes detected, skipping test"
+          echo "This job reports success to satisfy branch protection"
+
+      - uses: actions/checkout@v6
+        if: needs.changes.outputs.python == 'true'
+
+      - uses: astral-sh/setup-uv@v7
+        if: needs.changes.outputs.python == 'true'
+        with:
+          enable-cache: true
+
+      - name: Install Python ${{ matrix.python-version }}
+        if: needs.changes.outputs.python == 'true'
+        run: uv python install ${{ matrix.python-version }}
+
+      - name: Install project dependencies
+        if: needs.changes.outputs.python == 'true'
+        run: |
+          cd observal-server
+          uv sync --python ${{ matrix.python-version }} --group dev
+
+      - name: Run pytest
+        if: needs.changes.outputs.python == 'true'
+        run: |
+          cd observal-server
+          uv run \
+            --python ${{ matrix.python-version }} \
+            --with asyncpg \
+            --with hypothesis \
+            pytest ../tests/ -q
+
+# ── Job 3: Next.js lint + typecheck ───────────────────────────────────────────
+  web-lint:
+    name: web-lint
+    runs-on: ubuntu-latest
+    needs: changes
+    defaults:
+      run:
+        working-directory: web
+
+    steps:
+      - name: Skip if no web changes
+        if: needs.changes.outputs.web != 'true'
+        working-directory: .
+        run: |
+          echo "::notice::No web changes detected, skipping web-lint"
+          echo "This job reports success to satisfy branch protection"
+
+      - uses: actions/checkout@v6
+        if: needs.changes.outputs.web == 'true'
+
+      - uses: pnpm/action-setup@v4
+        if: needs.changes.outputs.web == 'true'
+        with:
+          version: 10
+
+      - uses: actions/setup-node@v6
+        if: needs.changes.outputs.web == 'true'
+        with:
+          node-version: 24
+          cache: pnpm
+          cache-dependency-path: web/pnpm-lock.yaml
+
+      - name: Install dependencies
+        if: needs.changes.outputs.web == 'true'
+        run: pnpm install --frozen-lockfile
+
+      - name: ESLint
+        if: needs.changes.outputs.web == 'true'
+        run: pnpm run lint
+
+      - name: TypeScript typecheck
+        if: needs.changes.outputs.web == 'true'
+        run: pnpm run typecheck
+
+# ── Job 4: Import boundary check ─────────────────────────────────────────────
+  import-boundary:
+    name: import-boundary
+    runs-on: ubuntu-latest
+    needs: changes
+    if: needs.changes.outputs.python == 'true'
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Check ee/ import boundary
+        run: |
+          echo "Checking that core does not import from ee/..."
+          VIOLATIONS=$(grep -rn "from ee\b\|import ee\b" observal-server/ observal_cli/ --include="*.py" | grep -v "main.py" || true)
+          if [ -n "$VIOLATIONS" ]; then
+            echo "::error::Import boundary violation — core must not import from ee/"
+            echo "$VIOLATIONS"
+            exit 1
+          fi
+          echo "✓ No import boundary violations found"
+
+# ── Job 5: Docker build ───────────────────────────────────────────────────────
+  docker-build:
+    name: docker-build
+    runs-on: ubuntu-latest
+    needs: changes
+    defaults:
+      run:
+        working-directory: docker
+
+    steps:
+      - name: Skip if no Docker changes
+        if: needs.changes.outputs.docker != 'true'
+        working-directory: .
+        run: |
+          echo "::notice::No Docker changes detected, skipping docker-build"
+          echo "This job reports success to satisfy branch protection"
+
+      - uses: actions/checkout@v6
+        if: needs.changes.outputs.docker == 'true'
+
+      - name: Create stub .env
+        if: needs.changes.outputs.docker == 'true'
+        run: touch ../.env
+
+      - name: Build images
+        if: needs.changes.outputs.docker == 'true'
+        run: docker compose build
+
+# ── Job 5: Python SAST with bandit ──────────────────────────────────────────
+  security-scan:
+    name: security-scan
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+      - uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Install Python 3.12
+        run: uv python install 3.12
+      - name: Run bandit
+        run: uv run --with bandit bandit -r observal-server/ observal_cli/ -c pyproject.toml -f json -o bandit-report.json || true
+      - name: Check bandit results
+        run: uv run --with bandit bandit -r observal-server/ observal_cli/ -c pyproject.toml -ll
+
+# ── Job 6: Dependency audit ─────────────────────────────────────────────────
+  dependency-audit:
+    name: dependency-audit
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v6
+
+      - name: Python dependency audit
+        uses: astral-sh/setup-uv@v7
+        with:
+          enable-cache: true
+      - name: Run pip-audit
+        # TODO: burn down pre-existing advisories then remove || true
+        run: |
+          uv python install 3.12
+          cd observal-server
+          uv run --with pip-audit pip-audit --strict --desc || true
+
+      - name: JS dependency audit
+        uses: pnpm/action-setup@v4
+        with:
+          version: 10
+      - name: Run pnpm audit
+        run: |
+          cd web
+          pnpm install --frozen-lockfile
+          pnpm audit --prod || true

observal_cli-0.2.0/.github/workflows/codeql.yml

@@ -0,0 +1,34 @@
+name: CodeQL
+
+on:
+  push:
+    branches: [main]
+  pull_request:
+    branches: [main]
+  schedule:
+    - cron: '0 6 * * 1'
+
+jobs:
+  analyze:
+    name: Analyze
+    runs-on: ubuntu-latest
+    permissions:
+      security-events: write
+      actions: read
+      contents: read
+    strategy:
+      fail-fast: false
+      matrix:
+        language: [javascript-typescript, python]
+    steps:
+      - uses: actions/checkout@v6
+      - name: Initialize CodeQL
+        uses: github/codeql-action/init@v3
+        with:
+          languages: ${{ matrix.language }}
+      - name: Autobuild
+        uses: github/codeql-action/autobuild@v3
+      - name: Perform CodeQL Analysis
+        uses: github/codeql-action/analyze@v3
+        with:
+          category: "/language:${{ matrix.language }}"

observal_cli-0.2.0/.github/workflows/dco.yml

@@ -0,0 +1,14 @@
+name: DCO Check
+
+on:
+  pull_request:
+    branches: [main]
+
+jobs:
+  dco:
+    runs-on: ubuntu-latest
+    steps:
+      - name: DCO Check
+        uses: christophebedard/dco-check@0.5.0
+        env:
+          GITHUB_TOKEN: ${{ secrets.GITHUB_TOKEN }}

observal_cli-0.2.0/.github/workflows/deploy.yml

@@ -0,0 +1,44 @@
+name: Deploy to EC2
+
+on:
+  push:
+    branches: [main]
+  workflow_dispatch:
+
+concurrency:
+  group: deploy-ec2
+  cancel-in-progress: false
+
+jobs:
+  deploy:
+    runs-on: ubuntu-latest
+    timeout-minutes: 15
+    steps:
+      - name: Deploy to EC2
+        uses: appleboy/ssh-action@v1
+        with:
+          host: ${{ secrets.EC2_HOST }}
+          username: ubuntu
+          key: ${{ secrets.EC2_SSH_KEY }}
+          script_stop: true
+          script: |
+            cd ~/Observal
+            git fetch origin main
+            git reset --hard origin/main
+
+            cd docker
+            docker compose up -d --build --remove-orphans
+
+            # Wait for API health check
+            for i in $(seq 1 30); do
+              if curl -sf http://localhost:8000/health > /dev/null 2>&1; then
+                echo "API is healthy"
+                exit 0
+              fi
+              echo "Waiting for API... ($i/30)"
+              sleep 5
+            done
+
+            echo "API failed health check"
+            docker compose logs observal-api --tail 30
+            exit 1

observal_cli-0.2.0/.github/workflows/publish.yml

@@ -0,0 +1,48 @@
+# ─────────────────────────────────────────────────────────────────────────────
+# Publish observal CLI to PyPI on a v* tag.
+#
+# Uses PyPI Trusted Publishing (OIDC) — no PYPI_API_TOKEN secret required.
+# Configure on PyPI: Project → Publishing → Add a trusted publisher with
+#   owner = BlazeUp-AI, repo = Observal, workflow = publish.yml,
+#   environment = pypi.
+#
+# Tag a release with `git tag -s vX.Y.Z && git push origin vX.Y.Z`.
+# ─────────────────────────────────────────────────────────────────────────────
+
+name: Publish
+
+on:
+  push:
+    tags: ['v*']
+
+jobs:
+  publish:
+    name: Build and publish to PyPI
+    runs-on: ubuntu-latest
+    environment: pypi
+    permissions:
+      id-token: write   # required for PyPI Trusted Publishing
+      contents: read
+
+    steps:
+      - uses: actions/checkout@v4
+
+      - name: Install uv
+        uses: astral-sh/setup-uv@v3
+        with:
+          enable-cache: true
+
+      - name: Verify tag matches pyproject version
+        run: |
+          tag="${GITHUB_REF#refs/tags/v}"
+          pkg=$(uv run --with tomli python -c "import tomli, pathlib; print(tomli.loads(pathlib.Path('pyproject.toml').read_text())['project']['version'])")
+          if [ "$tag" != "$pkg" ]; then
+            echo "::error::Tag v$tag does not match pyproject version $pkg"
+            exit 1
+          fi
+
+      - name: Build sdist and wheel
+        run: uv build
+
+      - name: Publish to PyPI
+        uses: pypa/gh-action-pypi-publish@release/v1

observal_cli-0.2.0/.gitignore

@@ -0,0 +1,41 @@
+__pycache__/
+*.pyc
+*.pyo
+.env
+*.egg-info/
+dist/
+build/
+.eggs/
+
+# IDE
+.vscode/
+.idea/
+*.swp
+*.swo
+*~
+
+# OS
+.DS_Store
+Thumbs.db
+
+# Python
+.mypy_cache/
+.ruff_cache/
+.pytest_cache/
+htmlcov/
+.coverage
+*.cover
+
+# Node
+observal-web/node_modules/
+observal-web/dist/
+
+# Docker
+docker/data/
+
+# Local config
+.kiro/
+.claude/
+CLAUDE.md
+graphify-out/
+observal-web/tsconfig.tsbuildinfo