queue-aiops 0.1.0__py3-none-any.whl

queue_aiops/cli/init.py

@@ -0,0 +1,176 @@
+"""``queue-aiops init`` — a friendly, interactive onboarding wizard.
+
+Walks a new user through connecting their first broker target: collects the
+non-secret connection details into ``config.yaml`` and the secret into the
+*encrypted* store (never plaintext on disk). For a redis target the password is
+optional — an auth-less lab instance is a legitimate setup — while a rabbitmq
+target always needs the management user's password. Designed to be run on a
+terminal; everything it needs is prompted with sensible defaults.
+"""
+
+from __future__ import annotations
+
+import getpass
+
+import typer
+import yaml
+
+from queue_aiops.cli._common import cli_errors, console
+from queue_aiops.config import CONFIG_DIR, CONFIG_FILE
+from queue_aiops.governance.paths import ops_path
+from queue_aiops.platform import RABBITMQ, REDIS, get_platform
+
+# Starter policy: keeps the secure-by-default gate (high/critical writes need a
+# named approver) explicit and editable, and shows the other rule kinds.
+DEFAULT_RULES_YAML = """\
+# queue-aiops policy rules — hot-reloaded on change (no restart needed).
+# Kinds: deny rules, maintenance_window, risk_tiers (graduated autonomy).
+
+risk_tiers:
+  - name: high-risk-requires-approver
+    tier: dual
+    min_risk_level: high
+    reason: >-
+      High/critical writes need a named human approver — set
+      QUEUE_AUDIT_APPROVED_BY (and QUEUE_AUDIT_RATIONALE) before the call.
+
+# deny:
+#   - name: no-prod-purges
+#     operations: ["purge_queue", "delete_queue"]
+#     environments: ["production"]
+#     reason: "Destroying queued messages in production goes through change management."
+
+# maintenance_window:
+#   start: "22:00"
+#   end: "06:00"
+"""
+
+
+def _write_default_rules() -> None:
+    """Seed a starter rules.yaml (only when none exists) so the policy layer
+    is explicit from day one; never overwrites an operator-authored file."""
+    rules_path = ops_path("rules.yaml")
+    if rules_path.exists():
+        return
+    rules_path.parent.mkdir(parents=True, exist_ok=True)
+    rules_path.write_text(DEFAULT_RULES_YAML, "utf-8")
+    console.print(f"[green]✓ Wrote default policy rules:[/] {rules_path}")
+
+
+def _load_existing_targets() -> list[dict]:
+    if not CONFIG_FILE.exists():
+        return []
+    raw = yaml.safe_load(CONFIG_FILE.read_text("utf-8")) or {}
+    return list(raw.get("targets", []))
+
+
+def _write_targets(targets: list[dict]) -> None:
+    CONFIG_DIR.mkdir(parents=True, exist_ok=True)
+    try:
+        CONFIG_DIR.chmod(0o700)
+    except OSError:
+        pass
+    CONFIG_FILE.write_text(yaml.safe_dump({"targets": targets}, sort_keys=False), "utf-8")
+
+
+@cli_errors
+def init_cmd() -> None:
+    """Interactively set up your first broker connection."""
+    from queue_aiops.secretstore import SecretStore, resolve_master_password
+
+    console.print("[bold cyan]Queue AIops — setup wizard[/]")
+    console.print(
+        "This collects redis or rabbitmq connection details (saved to "
+        "config.yaml) and your secret (saved [bold]encrypted[/] to "
+        "secrets.enc).\n"
+    )
+
+    console.print("[bold]Step 1 — master password[/]")
+    console.print(
+        "[dim]Encrypts secrets.enc. You'll set it via the "
+        "QUEUE_AIOPS_MASTER_PASSWORD env var for non-interactive/MCP use.[/]"
+    )
+    password = resolve_master_password(confirm_if_new=True)
+    store = SecretStore.unlock(password)
+
+    targets = _load_existing_targets()
+    existing_names = {t.get("name") for t in targets}
+
+    while True:
+        console.print("\n[bold]Step 2 — add a target[/]")
+        name = typer.prompt("Target name (e.g. cache1 or broker1)").strip()
+        if name in existing_names:
+            if not typer.confirm(f"'{name}' already exists — overwrite?", default=False):
+                continue
+            targets = [t for t in targets if t.get("name") != name]
+
+        platform = typer.prompt(
+            f"Platform ({REDIS} / {RABBITMQ})", default=REDIS
+        ).strip().lower()
+        if platform not in (REDIS, RABBITMQ):
+            console.print("[red]Platform must be 'redis' or 'rabbitmq'.[/]")
+            continue
+
+        host = typer.prompt("Host (IP or FQDN)").strip()
+        port = typer.prompt("Port", default=get_platform(platform).default_port, type=int)
+        db = 0
+        if platform == REDIS:
+            db = typer.prompt("Redis logical db index", default=0, type=int)
+            use_tls = typer.confirm("Use TLS (rediss://)?", default=False)
+        else:
+            use_tls = typer.confirm("Use HTTPS for the management API?", default=False)
+        verify_ssl = True
+        if use_tls:
+            console.print("[dim]Lab/self-signed setups can answer No here.[/]")
+            verify_ssl = typer.confirm(
+                "Verify TLS certificate? (No for self-signed lab certs)", default=True
+            )
+
+        username = ""
+        if platform == RABBITMQ:
+            username = typer.prompt("Management user (needs 'monitoring'/'management' tag)")
+            username = username.strip()
+            secret = getpass.getpass(f"Password for '{username}' on '{name}' (hidden): ")
+            if not secret:
+                console.print("[red]rabbitmq needs the management user's password.[/]")
+                continue
+            store = store.set(name, secret)
+            secret_note = "secret encrypted"  # nosec B105 — a UI label, not a secret
+        else:
+            secret = getpass.getpass(
+                f"Redis password for '{name}' (hidden; empty for no AUTH): "
+            )
+            if secret:
+                store = store.set(name, secret)
+                secret_note = "secret encrypted"  # nosec B105 — a UI label, not a secret
+            else:
+                secret_note = "no AUTH — lab mode"  # nosec B105 — a UI label, not a secret
+
+        entry = {
+            "name": name,
+            "platform": platform,
+            "host": host,
+            "port": port,
+            "username": username,
+            "db": db,
+            "use_tls": use_tls,
+            "verify_ssl": verify_ssl,
+        }
+        targets.append(entry)
+        existing_names.add(name)
+        _write_targets(targets)
+        console.print(f"[green]✓ Saved target '{name}' ({platform}, {secret_note}).[/]")
+
+        if not typer.confirm("\nAdd another target?", default=False):
+            break
+
+    _write_default_rules()
+    console.print(f"\n[green]✓ Setup complete.[/] Config: {CONFIG_FILE}")
+    console.print(
+        "[dim]Tip: export QUEUE_AIOPS_MASTER_PASSWORD=... in your shell profile "
+        "so the MCP server and CLI can unlock secrets non-interactively.[/]"
+    )
+    if typer.confirm("Run a connectivity check now (queue-aiops doctor)?", default=True):
+        from queue_aiops.doctor import run_doctor
+
+        raise typer.Exit(run_doctor())

queue_aiops/cli/overview.py

@@ -0,0 +1,16 @@
+"""``queue-aiops overview`` — one-shot broker health."""
+
+from __future__ import annotations
+
+import json
+
+from queue_aiops.cli._common import TargetOption, cli_errors, console, get_connection
+
+
+@cli_errors
+def overview_cmd(target: TargetOption = None) -> None:
+    """One-shot summary: platform + version + backlog/memory/client health."""
+    from queue_aiops.ops import overview as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.queue_overview(conn)))

queue_aiops/cli/rabbit_cmds.py

@@ -0,0 +1,234 @@
+"""``queue-aiops rabbitmq`` — rabbitmq reads + governed writes."""
+
+from __future__ import annotations
+
+import json
+from typing import Annotated
+
+import typer
+
+from queue_aiops.cli._common import (
+    DryRunOption,
+    TargetOption,
+    cli_errors,
+    console,
+    double_confirm,
+    dry_run_print,
+    get_connection,
+)
+
+rabbitmq_app = typer.Typer(
+    name="rabbitmq",
+    help="rabbitmq: overview/queues/connections/channels/policies/nodes reads, "
+    "plus governed purge/delete/declare queue and set/delete policy.",
+    no_args_is_help=True,
+)
+
+VhostOption = Annotated[
+    str, typer.Option("--vhost", help="Vhost (the default vhost is '/')")
+]
+
+
+@rabbitmq_app.command("overview")
+@cli_errors
+def rabbit_overview(target: TargetOption = None) -> None:
+    """Broker identity + totals (queues, messages, connections, rates)."""
+    from queue_aiops.ops import rabbit_reads as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.broker_overview(conn)))
+
+
+@rabbitmq_app.command("queues")
+@cli_errors
+def rabbit_queues(
+    vhost: Annotated[
+        str | None, typer.Option("--vhost", help="Restrict to one vhost")
+    ] = None,
+    target: TargetOption = None,
+) -> None:
+    """Queues, deepest backlog first."""
+    from queue_aiops.ops import rabbit_reads as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.list_queues(conn, vhost)))
+
+
+@rabbitmq_app.command("queue")
+@cli_errors
+def rabbit_queue(
+    name: Annotated[str, typer.Argument(help="Queue name (from 'queues')")],
+    vhost: VhostOption = "/",
+    target: TargetOption = None,
+) -> None:
+    """One queue's full detail."""
+    from queue_aiops.ops import rabbit_reads as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.queue_detail(conn, vhost, name)))
+
+
+@rabbitmq_app.command("connections")
+@cli_errors
+def rabbit_connections(target: TargetOption = None) -> None:
+    """Client connections grouped by peer host."""
+    from queue_aiops.ops import rabbit_reads as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.list_connections(conn)))
+
+
+@rabbitmq_app.command("channels")
+@cli_errors
+def rabbit_channels(target: TargetOption = None) -> None:
+    """Channels with unacked/prefetch pressure."""
+    from queue_aiops.ops import rabbit_reads as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.list_channels(conn)))
+
+
+@rabbitmq_app.command("policies")
+@cli_errors
+def rabbit_policies(
+    vhost: Annotated[
+        str | None, typer.Option("--vhost", help="Restrict to one vhost")
+    ] = None,
+    target: TargetOption = None,
+) -> None:
+    """Policies with pattern, priority, definition."""
+    from queue_aiops.ops import rabbit_reads as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.list_policies(conn, vhost)))
+
+
+@rabbitmq_app.command("nodes")
+@cli_errors
+def rabbit_nodes(target: TargetOption = None) -> None:
+    """Node memory/disk/fd posture + watermark alarms."""
+    from queue_aiops.ops import rabbit_reads as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.node_health(conn)))
+
+
+@rabbitmq_app.command("purge")
+@cli_errors
+def rabbit_purge(
+    name: Annotated[str, typer.Argument(help="Queue name to purge")],
+    vhost: VhostOption = "/",
+    target: TargetOption = None,
+    dry_run: DryRunOption = False,
+) -> None:
+    """Purge all ready messages from a queue (IRREVERSIBLE, risk=high)."""
+    from mcp_server.tools import writes as gov
+
+    if dry_run:
+        dry_run_print(operation="purge_queue", api_call="DELETE queue contents",
+                      parameters={"vhost": vhost, "name": name})
+        return
+    double_confirm("purge queue", name)
+    console.print_json(json.dumps(gov.purge_queue(vhost=vhost, name=name, target=target)))
+
+
+@rabbitmq_app.command("delete-queue")
+@cli_errors
+def rabbit_delete_queue(
+    name: Annotated[str, typer.Argument(help="Queue name to delete")],
+    vhost: VhostOption = "/",
+    target: TargetOption = None,
+    dry_run: DryRunOption = False,
+) -> None:
+    """Delete a queue (risk=high; undo re-declares the captured definition)."""
+    from mcp_server.tools import writes as gov
+
+    if dry_run:
+        dry_run_print(operation="delete_queue", api_call="DELETE queue",
+                      parameters={"vhost": vhost, "name": name})
+        return
+    double_confirm("delete queue", name)
+    console.print_json(json.dumps(gov.delete_queue(vhost=vhost, name=name, target=target)))
+
+
+@rabbitmq_app.command("declare-queue")
+@cli_errors
+def rabbit_declare_queue(
+    name: Annotated[str, typer.Argument(help="Queue name to declare")],
+    vhost: VhostOption = "/",
+    durable: Annotated[
+        bool, typer.Option("--durable/--transient", help="Survive broker restarts")
+    ] = True,
+    auto_delete: Annotated[
+        bool, typer.Option("--auto-delete", help="Delete when the last consumer leaves")
+    ] = False,
+    target: TargetOption = None,
+    dry_run: DryRunOption = False,
+) -> None:
+    """Declare (create) a queue (undo deletes it when newly created)."""
+    from mcp_server.tools import writes as gov
+
+    if dry_run:
+        dry_run_print(operation="declare_queue", api_call="PUT queue",
+                      parameters={"vhost": vhost, "name": name, "durable": durable,
+                                  "auto_delete": auto_delete})
+        return
+    double_confirm("declare queue", name)
+    console.print_json(json.dumps(gov.declare_queue(
+        vhost=vhost, name=name, durable=durable, auto_delete=auto_delete, target=target
+    )))
+
+
+@rabbitmq_app.command("set-policy")
+@cli_errors
+def rabbit_set_policy(
+    name: Annotated[str, typer.Argument(help="Policy name")],
+    pattern: Annotated[str, typer.Argument(help="Regex the policy matches names against")],
+    definition: Annotated[
+        str, typer.Argument(help="Definition as JSON, e.g. '{\"max-length\": 100000}'")
+    ],
+    vhost: VhostOption = "/",
+    priority: Annotated[int, typer.Option("--priority", help="Higher wins")] = 0,
+    apply_to: Annotated[
+        str, typer.Option("--apply-to", help="queues / exchanges / all")
+    ] = "all",
+    target: TargetOption = None,
+    dry_run: DryRunOption = False,
+) -> None:
+    """Create/update a policy (reversible — prior policy captured for undo)."""
+    from mcp_server.tools import writes as gov
+
+    try:
+        definition_obj = json.loads(definition)
+    except json.JSONDecodeError as exc:
+        raise ValueError(f"'definition' must be valid JSON: {exc}") from exc
+    if dry_run:
+        dry_run_print(operation="set_policy", api_call="PUT policy",
+                      parameters={"vhost": vhost, "name": name, "pattern": pattern,
+                                  "definition": definition_obj, "priority": priority,
+                                  "apply_to": apply_to})
+        return
+    double_confirm("set policy", name)
+    console.print_json(json.dumps(gov.set_policy(
+        vhost=vhost, name=name, pattern=pattern, definition=definition_obj,
+        priority=priority, apply_to=apply_to, target=target,
+    )))
+
+
+@rabbitmq_app.command("delete-policy")
+@cli_errors
+def rabbit_delete_policy(
+    name: Annotated[str, typer.Argument(help="Policy name to delete")],
+    vhost: VhostOption = "/",
+    target: TargetOption = None,
+    dry_run: DryRunOption = False,
+) -> None:
+    """Delete a policy (reversible — its definition is captured for undo)."""
+    from mcp_server.tools import writes as gov
+
+    if dry_run:
+        dry_run_print(operation="delete_policy", api_call="DELETE policy",
+                      parameters={"vhost": vhost, "name": name})
+        return
+    double_confirm("delete policy", name)
+    console.print_json(json.dumps(gov.delete_policy(vhost=vhost, name=name, target=target)))

queue_aiops/cli/redis_cmds.py

@@ -0,0 +1,147 @@
+"""``queue-aiops redis`` — redis reads + governed writes."""
+
+from __future__ import annotations
+
+import json
+from typing import Annotated
+
+import typer
+
+from queue_aiops.cli._common import (
+    DryRunOption,
+    TargetOption,
+    cli_errors,
+    console,
+    double_confirm,
+    dry_run_print,
+    get_connection,
+)
+
+redis_app = typer.Typer(
+    name="redis",
+    help="redis: server/memory/clients/slowlog/config/keyspace/big-key reads, "
+    "plus governed config-set and kill-client.",
+    no_args_is_help=True,
+)
+
+
+@redis_app.command("info")
+@cli_errors
+def redis_info(target: TargetOption = None) -> None:
+    """Server identity + health basics (version, role, clients, ops/sec)."""
+    from queue_aiops.ops import redis_reads as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.server_info(conn)))
+
+
+@redis_app.command("memory")
+@cli_errors
+def redis_memory(target: TargetOption = None) -> None:
+    """Memory posture: used vs maxmemory, policy, fragmentation."""
+    from queue_aiops.ops import redis_reads as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.memory_stats(conn)))
+
+
+@redis_app.command("clients")
+@cli_errors
+def redis_clients(target: TargetOption = None) -> None:
+    """Connected clients grouped by source address."""
+    from queue_aiops.ops import redis_reads as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.list_clients(conn)))
+
+
+@redis_app.command("slowlog")
+@cli_errors
+def redis_slowlog(
+    count: Annotated[int, typer.Option("--count", "-n", help="Max entries")] = 128,
+    target: TargetOption = None,
+) -> None:
+    """Recent SLOWLOG entries, slowest first."""
+    from queue_aiops.ops import redis_reads as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.slowlog(conn, count)))
+
+
+@redis_app.command("config-get")
+@cli_errors
+def redis_config_get(
+    pattern: Annotated[str, typer.Argument(help="Config-name glob, e.g. 'maxmemory*'")] = "*",
+    target: TargetOption = None,
+) -> None:
+    """CONFIG GET for a glob pattern."""
+    from queue_aiops.ops import redis_reads as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.config_get(conn, pattern)))
+
+
+@redis_app.command("keyspace")
+@cli_errors
+def redis_keyspace(target: TargetOption = None) -> None:
+    """Per-db key counts and expiry coverage."""
+    from queue_aiops.ops import redis_reads as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.keyspace(conn)))
+
+
+@redis_app.command("bigkeys")
+@cli_errors
+def redis_bigkeys(
+    top: Annotated[int, typer.Option("--top", help="Rows to return, largest first")] = 20,
+    target: TargetOption = None,
+) -> None:
+    """SCAN-budgeted big-key sample (never KEYS *)."""
+    from queue_aiops.ops import redis_reads as ops
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.big_key_sample(conn, top)))
+
+
+@redis_app.command("config-set")
+@cli_errors
+def redis_config_set(
+    parameter: Annotated[str, typer.Argument(help="Config parameter, e.g. maxmemory-policy")],
+    value: Annotated[str, typer.Argument(help="New value")],
+    target: TargetOption = None,
+    dry_run: DryRunOption = False,
+) -> None:
+    """Set one config parameter (reversible — prior value captured for undo)."""
+    from mcp_server.tools import writes as gov
+
+    if dry_run:
+        dry_run_print(operation="redis_config_set", api_call="CONFIG SET",
+                      parameters={"parameter": parameter, "value": value})
+        return
+    double_confirm("set config parameter", parameter)
+    console.print_json(
+        json.dumps(gov.redis_config_set(parameter=parameter, value=value, target=target))
+    )
+
+
+@redis_app.command("kill-client")
+@cli_errors
+def redis_kill_client(
+    client_id: Annotated[int, typer.Option("--id", help="Client id (from 'clients')")] = 0,
+    addr: Annotated[str, typer.Option("--addr", help="Or the client's ip:port")] = "",
+    target: TargetOption = None,
+    dry_run: DryRunOption = False,
+) -> None:
+    """Disconnect one client (irreversible; its info is captured as priorState)."""
+    from mcp_server.tools import writes as gov
+
+    who = str(client_id) if client_id else addr
+    if dry_run:
+        dry_run_print(operation="redis_kill_client", api_call="CLIENT KILL",
+                      parameters={"client_id": client_id, "addr": addr})
+        return
+    double_confirm("kill client", who or "(unspecified)")
+    console.print_json(
+        json.dumps(gov.redis_kill_client(client_id=client_id, addr=addr, target=target))
+    )

queue_aiops/cli/secret.py

@@ -0,0 +1,105 @@
+"""``queue-aiops secret`` — manage the encrypted credential store.
+
+Secrets (Monitoring API keys) are stored in ``~/.queue-aiops/secrets.enc``
+(Fernet, key derived from a master password via scrypt). Nothing here ever
+prints a secret value.
+"""
+
+from __future__ import annotations
+
+import getpass
+from typing import Annotated
+
+import typer
+
+from queue_aiops.cli._common import cli_errors, console
+from queue_aiops.config import SECRET_ENV_PREFIX, SECRET_ENV_SUFFIX
+from queue_aiops.secretstore import (
+    SECRETS_FILE,
+    SecretStore,
+    check_permissions,
+    migrate_legacy_env,
+    resolve_master_password,
+)
+
+secret_app = typer.Typer(
+    name="secret",
+    help="Manage the encrypted credential store (secrets.enc).",
+    no_args_is_help=True,
+)
+
+NameArg = Annotated[str, typer.Argument(help="Target name the API key belongs to")]
+
+
+@secret_app.command("set")
+@cli_errors
+def secret_set(
+    name: NameArg,
+    value: Annotated[
+        str | None,
+        typer.Option("--value", help="API key value (omit to be prompted, hidden)"),
+    ] = None,
+) -> None:
+    """Store (or replace) the API key for a target — value is read hidden."""
+    password = resolve_master_password(confirm_if_new=True)
+    if value is None:
+        value = getpass.getpass(f"API key for '{name}' (hidden): ")
+    store = SecretStore.unlock(password)
+    store.set(name, value)
+    console.print(f"[green]✓ Stored encrypted API key for '{name}' in {SECRETS_FILE}[/]")
+
+
+@secret_app.command("list")
+@cli_errors
+def secret_list() -> None:
+    """List target names that have a stored API key (values never shown)."""
+    store = SecretStore.unlock()
+    names = store.names()
+    if not names:
+        console.print(
+            "[yellow]No secrets stored yet. Add one: queue-aiops secret set <name>[/]"
+        )
+        return
+    console.print("[bold]Stored secrets:[/]")
+    for n in names:
+        console.print(f"  • {n}")
+    warning = check_permissions()
+    if warning:
+        console.print(f"[yellow]! {warning}[/]")
+
+
+@secret_app.command("rm")
+@cli_errors
+def secret_rm(name: NameArg) -> None:
+    """Delete a stored API key."""
+    store = SecretStore.unlock()
+    store.delete(name)
+    console.print(f"[green]✓ Deleted API key for '{name}'[/]")
+
+
+@secret_app.command("migrate")
+@cli_errors
+def secret_migrate() -> None:
+    """Import API keys from a legacy plaintext .env into the encrypted store."""
+    password = resolve_master_password(confirm_if_new=True)
+    imported = migrate_legacy_env(SECRET_ENV_PREFIX, SECRET_ENV_SUFFIX, password)
+    if not imported:
+        console.print("[yellow]Nothing to migrate (no legacy .env secrets found).[/]")
+        return
+    console.print(f"[green]✓ Imported {len(imported)} secret(s): {', '.join(imported)}[/]")
+    console.print("[dim]The old .env was renamed to .env.migrated — delete it once verified.[/]")
+
+
+@secret_app.command("rotate-password")
+@cli_errors
+def secret_rotate_password() -> None:
+    """Re-encrypt the whole store under a new master password."""
+    console.print("[bold]Unlock with the current master password:[/]")
+    store = SecretStore.unlock()
+    new_pw = getpass.getpass("New master password: ")
+    confirm = getpass.getpass("Confirm new master password: ")
+    if new_pw != confirm:
+        console.print("[red]Passwords did not match. Aborted.[/]")
+        raise typer.Exit(1)
+    store.with_password(new_pw)
+    console.print("[green]✓ Master password rotated. Update QUEUE_AIOPS_MASTER_PASSWORD.[/]")