secondshift 0.1.0b12__py3-none-any.whl

secondshift/core/management/commands/dev_reset_db.py

@@ -0,0 +1,204 @@
+from datetime import timedelta
+
+import djclick as click
+from django.conf import settings
+from django.core.management import call_command
+from django.utils import timezone
+
+from secondshift.config.constants import RunStart, SandboxRuntime
+from secondshift.connections.dao import create_connection
+from secondshift.connections.models import Connection
+from secondshift.github.identity import clone_url
+from secondshift.jobs.dao import create_job
+from secondshift.jobs.planning import build_execution_plan
+from secondshift.repositories.dao import create_repository
+from secondshift.runs.dao import add_event, create_run_record, create_task
+from secondshift.runs.models import Run
+from secondshift.workspaces.dao import get_workspace_by_slug
+
+DEMO_SKILLS = {
+    "weekly-infra": """# Weekly infrastructure review
+
+Review infrastructure changes merged in the last seven days.
+
+## Steps
+
+1. List commits under `infra/` and `deploy/` since the last report.
+2. For each change, note what it affects and who merged it.
+3. Query the `observability` binding for error rates around each deploy.
+4. Flag drift between Terraform state and the committed configuration.
+
+## Report
+
+- Start with one line: how many changes, how many need attention.
+- List each finding with the commit, the evidence and a suggested owner.
+- Do not suggest changes you cannot point to evidence for.
+""",
+}
+
+
+@click.command()
+@click.option(
+    "--yes",
+    is_flag=True,
+    help="Confirm destroying every record in the development database.",
+)
+def command(yes: bool) -> None:
+    """Reset the development database, migrate it, and load demo data."""
+    if not settings.DEV:
+        raise click.ClickException("dev_reset_db only runs with SECONDSHIFT_ENV=dev.")
+    if not yes:
+        raise click.ClickException(
+            "dev_reset_db destroys the development database. Pass --yes to continue."
+        )
+    click.echo("Resetting the development database...")
+    call_command("reset_db", interactive=False, close_sessions=True, verbosity=0)
+    call_command("migrate", interactive=False, verbosity=0)
+    call_command("bootstrap_dev")
+    seed_demo_data()
+    click.secho("Development demo data is ready.", fg="green")
+
+
+def seed_demo_data() -> None:
+    """Load safe, credential-free records for exploring the development UI."""
+    workspace = get_workspace_by_slug("secondshift")
+    now = timezone.now()
+
+    github = create_connection(
+        workspace=workspace,
+        provider=Connection.Provider.GITHUB,
+        kind=Connection.Kind.SOURCE,
+        display_name="GitHub · demo",
+        external_account_id="demo-github",
+        status=Connection.Status.CONNECTED,
+        auth_strategy=Connection.AuthStrategy.MANAGED,
+        metadata={"demo": True},
+    )
+
+    repositories = {
+        name: create_repository(
+            workspace=workspace,
+            github_connection=github,
+            # GitHub repository ids are numbers.
+            external_id=str(900_000 + index),
+            full_name=name,
+            clone_url=clone_url(name),
+            default_branch=branch,
+            enabled=enabled,
+            config_sha=commit_sha,
+            last_synced_at=now - timedelta(minutes=index * 7),
+        )
+        for index, (name, branch, enabled, commit_sha) in enumerate(
+            (
+                ("wild-edge/wild-edge", "main", True, "8f3c9d2" * 5 + "8f3c9"),
+                ("secondshift/examples", "main", True, "34a0be7" * 5 + "34a0b"),
+                ("acme/platform-infra", "production", False, "c77b103" * 5 + "c77b1"),
+            ),
+            start=1,
+        )
+    }
+
+    jobs = {
+        key: create_job(
+            workspace=workspace,
+            repository=repositories[repository],
+            key=key,
+            name=name,
+            skill_path=skill_path,
+            skill_text=DEMO_SKILLS.get(key, ""),
+            cron=cron,
+            timezone=job_timezone,
+            enabled=False,
+            config_hash=(key.encode().hex() + "0" * 64)[:64],
+        )
+        for key, name, repository, skill_path, cron, job_timezone in (
+            (
+                "weekly-infra",
+                "Weekly infrastructure review",
+                "wild-edge/wild-edge",
+                ".agents/skills/infrastructure-review/SKILL.md",
+                "0 9 * * 1",
+                "Europe/Warsaw",
+            ),
+            (
+                "dependency-sweep",
+                "Dependency freshness sweep",
+                "wild-edge/wild-edge",
+                ".agents/skills/dependency-sweep/SKILL.md",
+                "30 7 * * 2",
+                "UTC",
+            ),
+            (
+                "release-notes",
+                "Release notes digest",
+                "secondshift/examples",
+                ".agents/skills/release-notes/SKILL.md",
+                "0 16 * * 5",
+                "America/New_York",
+            ),
+            (
+                "incident-followup",
+                "Incident follow-up",
+                "acme/platform-infra",
+                ".agents/skills/incident-review/SKILL.md",
+                "0 */6 * * *",
+                "UTC",
+            ),
+        )
+    }
+
+    run_specs = (
+        (
+            "weekly-infra",
+            Run.Status.SUCCEEDED,
+            1,
+            "Reviewed 14 infrastructure changes; no critical drift found.",
+            0,
+        ),
+        (
+            "dependency-sweep",
+            Run.Status.SUCCEEDED,
+            2,
+            "Found two dependency updates ready for review.",
+            0,
+        ),
+        (
+            "weekly-infra",
+            Run.Status.FAILED,
+            3,
+            "The observability capability needs attention.",
+            1,
+        ),
+        (
+            "release-notes",
+            Run.Status.SUCCEEDED,
+            5,
+            "Prepared a release digest for the engineering team.",
+            0,
+        ),
+    )
+    for index, (job_key, status, days_ago, summary, exit_code) in enumerate(
+        run_specs, start=1
+    ):
+        finished_at = now - timedelta(days=days_ago)
+        run = create_run_record(
+            task=create_task(repository=jobs[job_key].repository),
+            started_by=RunStart.SCHEDULE,
+            execution_plan=build_execution_plan(jobs[job_key]).stored(),
+            job=jobs[job_key],
+            status=status,
+            commit_sha=jobs[job_key].repository.config_sha,
+            scheduled_for=finished_at - timedelta(minutes=4),
+            started_at=finished_at - timedelta(minutes=4),
+            finished_at=finished_at,
+            sandbox_runtime=SandboxRuntime.GVISOR,
+            exit_code=exit_code,
+            summary=summary,
+            dbos_workflow_id=f"demo-run-{index}",
+        )
+        add_event(
+            run.pk,
+            summary,
+            level="info" if status == Run.Status.SUCCEEDED else "error",
+            metadata={"demo": True},
+        )

secondshift/core/management/commands/login.py

@@ -0,0 +1,23 @@
+import djclick as click
+from django.conf import settings
+
+from secondshift.core import local_output
+from secondshift.core.signin import SIGN_IN_LINK_SECONDS, sign_in_url
+from secondshift.workspaces.owners import get_owner, has_owner
+
+
+@click.command()
+@click.option(
+    "--url",
+    default=None,
+    help="Where SecondShift is running. Defaults to where secondshift up serves it.",
+)
+def command(url: str | None) -> None:
+    """Print a one-time link that signs you in as the owner."""
+    if not has_owner():
+        raise click.ClickException("There is no owner yet. Run secondshift up first.")
+    state = local_output.load_state()
+    base = url or (state["url"] if state else settings.FRONTEND_URL)
+    minutes = SIGN_IN_LINK_SECONDS // 60
+    click.echo(f"This link works once, within {minutes} minutes:")
+    click.echo(sign_in_url(base, get_owner()))

secondshift/core/management/commands/logs.py

@@ -0,0 +1,58 @@
+"""Inspect local service diagnostics."""
+
+import time
+from collections import deque
+from pathlib import Path
+
+import djclick as click
+
+from secondshift.core.local_output import LOG_NAMES, log_directory
+
+
+@click.command()
+@click.option("--service", type=click.Choice(LOG_NAMES))
+@click.option("--lines", default=50, type=click.IntRange(1, 10000), show_default=True)
+@click.option("--follow", is_flag=True, help="Stream new log entries until Ctrl+C.")
+def command(service: str | None, lines: int, follow: bool) -> None:
+    """Show saved local service logs."""
+    names = [service] if service else LOG_NAMES
+    paths = [log_directory() / f"{name}.log" for name in names]
+    positions = {path: print_tail(path, lines) for path in paths if path.exists()}
+    if not positions and not follow:
+        click.echo("No local logs yet. Run secondshift up first.")
+    try:
+        while follow:
+            for path in paths:
+                position = read_new(path, positions.get(path))
+                if position is not None:
+                    positions[path] = position
+            time.sleep(0.2)
+    except KeyboardInterrupt:
+        pass
+
+
+def print_tail(path: Path, lines: int) -> tuple[int, int]:
+    """Print the last lines of a log and return where reading stopped."""
+    with path.open(errors="replace") as stream:
+        for line in deque(stream, maxlen=lines):
+            click.echo(line, nl=False)
+        return path.stat().st_ino, stream.tell()
+
+
+def read_new(path: Path, position: tuple[int, int] | None) -> tuple[int, int] | None:
+    """Print lines added since position, starting over if the file rotated.
+
+    A position is the file's inode and the offset already printed.
+    """
+    try:
+        with path.open(errors="replace") as stream:
+            stat = path.stat()
+            inode, offset = position or (stat.st_ino, 0)
+            if inode != stat.st_ino or stat.st_size < offset:
+                offset = 0
+            stream.seek(offset)
+            for line in stream:
+                click.echo(line, nl=False)
+            return stat.st_ino, stream.tell()
+    except FileNotFoundError:
+        return position

secondshift/core/management/commands/status.py

@@ -0,0 +1,46 @@
+"""Inspect the local supervisor without starting services."""
+
+import os
+
+import djclick as click
+
+from secondshift.core import launcher, local_output, terminal
+
+
+@click.command()
+def command() -> None:
+    """Show local service status and the dashboard address."""
+    if not local_output.is_running():
+        click.echo("SecondShift is stopped. Start it with secondshift up.")
+        return
+    state = local_output.load_state()
+    if state is None:
+        click.echo("SecondShift is starting.")
+        return
+    click.echo(f"Dashboard: {terminal.link(state['url'])}")
+    all_ready = True
+    for name, service in state["services"].items():
+        ready = is_alive(service["pid"]) and launcher.is_ready(
+            name, service["health_url"]
+        )
+        all_ready &= ready
+        label = (
+            click.style("ready", fg="green")
+            if ready
+            else click.style("starting or unavailable", fg="yellow")
+        )
+        click.echo(f"  {name}: {label}")
+    if not all_ready:
+        terminal.note(local_output.LOGS_HINT)
+        raise SystemExit(1)
+
+
+def is_alive(pid: int) -> bool:
+    try:
+        os.kill(pid, 0)
+    except ProcessLookupError:
+        return False
+    except PermissionError:
+        # The process exists but belongs to another user.
+        return True
+    return True

secondshift/core/management/commands/up.py

@@ -0,0 +1,244 @@
+import ipaddress
+import os
+import socket
+import subprocess
+import sys
+import webbrowser
+from importlib.metadata import version
+
+import djclick as click
+from django.conf import settings
+from django.core.management import call_command
+
+from secondshift.config.constants import AppEnv, Environment, Service
+from secondshift.core import launcher, local_agents, local_output, terminal
+from secondshift.core.signin import SIGN_IN_LINK_SECONDS, sign_in_url
+from secondshift.workspaces.owners import (
+    ensure_owner,
+    get_owner,
+    has_owner,
+    set_owner_credentials,
+)
+
+
+@click.command()
+@click.option(
+    "--host", default=None, help="Web listen host. Overrides SECONDSHIFT_HTTP_BIND."
+)
+@click.option(
+    "--port",
+    default=None,
+    type=int,
+    help="Web listen port. Overrides SECONDSHIFT_HTTP_BIND.",
+)
+@click.option(
+    "--email",
+    envvar="SECONDSHIFT_OWNER_EMAIL",
+    help="Owner email. Needed only to share on the network with --host.",
+)
+@click.option(
+    "--password",
+    envvar="SECONDSHIFT_OWNER_PASSWORD",
+    help="Owner password. Needed only to share on the network with --host.",
+)
+@click.option(
+    "--browser/--no-browser",
+    default=True,
+    show_default=True,
+    help="Open the sign-in link in your browser once started.",
+)
+@click.option(
+    "--agents/--no-agents",
+    default=True,
+    show_default=True,
+    help="Let jobs run through Claude Code or Codex subscriptions.",
+)
+@click.option("--debug", is_flag=True, help="Stream service diagnostics to stderr.")
+def command(
+    host: str | None,
+    port: int | None,
+    email: str | None,
+    password: str | None,
+    browser: bool,
+    agents: bool,
+    debug: bool,
+) -> None:
+    """Start SecondShift on this computer."""
+    if settings.ENVIRONMENT != Environment.LOCAL:
+        raise click.ClickException(
+            "secondshift up runs with SECONDSHIFT_ENV=local. "
+            "In a checkout, use process-compose instead."
+        )
+    try:
+        with local_output.instance_lock():
+            start(host, port, email, password, browser, agents, debug)
+    except local_output.AlreadyRunning as error:
+        raise click.ClickException(
+            "SecondShift is already running or starting. Run secondshift status."
+        ) from error
+
+
+def start(
+    host: str | None,
+    port: int | None,
+    email: str | None,
+    password: str | None,
+    browser: bool,
+    agents: bool,
+    debug: bool,
+) -> None:
+    parent = dict(os.environ)
+    if debug:
+        parent[AppEnv.LOG_LEVEL] = "DEBUG"
+    configured_host, configured_port = launcher.web_address("127.0.0.1", 8000, parent)
+    host, port = host or configured_host, port if port is not None else configured_port
+    parent.pop(AppEnv.HTTP_BIND, None)
+    terminal.heading(f"SecondShift {version('secondshift')}")
+    check_port(host, port)
+    check_service_ports()
+    check_docker()
+    terminal.done("Docker is ready")
+    if not (settings.WEB_DIR / "index.html").exists():
+        raise click.ClickException(
+            "The dashboard isn't built. In a checkout, run "
+            "npm --prefix dashboard run build first."
+        )
+
+    call_command("migrate", interactive=False, verbosity=0)
+    terminal.done("Local data is ready", str(settings.DATA_DIR))
+    agent_host = None
+    if agents:
+        try:
+            local_agents.prepare_agent_image(settings.AGENT_IMAGE, terminal.note)
+            agent_host = local_agents.container_gateway_host()
+            terminal.done("Agent image is ready")
+        except local_agents.AgentSetupError as error:
+            raise click.ClickException(
+                f"{error} Run with --no-agents to start without agent subscriptions."
+            ) from error
+    else:
+        # An empty value overrides the local default, in every process.
+        parent[AppEnv.AGENT_IMAGE] = ""
+    services = launcher.services(host, port, parent, agent_host=agent_host)
+    runner = next(service for service in services if service.name == Service.RUNNER)
+    prepare_runner(runner, debug)
+    prepare_owner(host, email, password)
+
+    url = launcher.public_url(host, port)
+
+    def ready() -> None:
+        link = sign_in_url(url, get_owner())
+        minutes = SIGN_IN_LINK_SECONDS // 60
+        terminal.done("All services are ready")
+        click.echo()
+        click.secho("SecondShift is running at ", fg="green", bold=True, nl=False)
+        click.echo(terminal.link(url))
+        if browser and webbrowser.open(link):
+            click.echo("Opening your dashboard...")
+        else:
+            click.echo(f"Sign in with this link (valid for {minutes} minutes):")
+            click.echo(f"  {terminal.link(link)}")
+        click.echo()
+        terminal.note("Keep this terminal open. Press Ctrl+C to stop.")
+        terminal.note("Logs: secondshift logs --follow")
+
+    terminal.note("Starting the web app, model gateway, runner and worker...")
+    code = launcher.run(services, ready, click.echo, debug=debug, url=url)
+    if code:
+        click.echo(local_output.LOGS_HINT, err=True)
+    sys.exit(code)
+
+
+def is_loopback(host: str) -> bool:
+    if host == "localhost":
+        return True
+    try:
+        return ipaddress.ip_address(host).is_loopback
+    except ValueError:
+        return False
+
+
+def check_docker() -> None:
+    try:
+        result = subprocess.run(
+            ["docker", "info"], capture_output=True, timeout=15, check=False
+        )
+    except (FileNotFoundError, subprocess.TimeoutExpired):
+        result = None
+    if result is None or result.returncode:
+        raise click.ClickException(
+            "Docker isn't running. Skills run in Docker sandboxes. "
+            "Start Docker and try again."
+        )
+
+
+def prepare_runner(runner: launcher.Process, debug: bool) -> None:
+    migration = subprocess.Popen(
+        [sys.executable, "-m", "secondshift", "migrate", "--verbosity", "0"],
+        env=runner.env,
+        stdout=subprocess.PIPE,
+        stderr=subprocess.STDOUT,
+    )
+    assert migration.stdout is not None
+    reader = local_output.capture(migration.stdout, local_output.SETUP_LOG, debug)
+    try:
+        code = migration.wait()
+    except KeyboardInterrupt:
+        migration.terminate()
+        migration.wait()
+        raise
+    finally:
+        reader.join(timeout=2)
+    if code:
+        raise click.ClickException(
+            "Couldn't prepare runner data. Run secondshift logs --service setup."
+        )
+
+
+def prepare_owner(host: str, email: str | None, password: str | None) -> None:
+    if not has_owner():
+        ensure_owner()
+    if not is_loopback(host) and not get_owner().has_usable_password():
+        # Other machines can reach the app, so a password must guard it.
+        click.echo("Sharing on the network needs an owner email and password.")
+        set_owner_credentials(
+            email or click.prompt("Owner email"),
+            password
+            or click.prompt(
+                "Owner password", hide_input=True, confirmation_prompt=True
+            ),
+        )
+
+
+def check_port(
+    host: str,
+    port: int,
+    hint: str = "Try secondshift up --port with an available port.",
+) -> None:
+    try:
+        addresses = socket.getaddrinfo(host, port, type=socket.SOCK_STREAM)
+        family, kind, protocol, _, address = addresses[0]
+        with socket.socket(family, kind, protocol) as listener:
+            # The server binds the same way. Without this, closed connections
+            # from the last run keep the port looking busy for a minute.
+            listener.setsockopt(socket.SOL_SOCKET, socket.SO_REUSEADDR, 1)
+            listener.bind(address)
+    except OSError as error:
+        raise click.ClickException(
+            f"Couldn't listen on {host}:{port}: {error.strerror or error}. {hint}"
+        ) from error
+
+
+def check_service_ports() -> None:
+    """--port moves only the web app. The gateway and runner keep their URLs."""
+    for name, url, variable in (
+        ("model gateway", settings.MODEL_GATEWAY_URL, AppEnv.MODEL_GATEWAY_URL),
+        ("runner", settings.RUNNER_SERVICE_URL, AppEnv.RUNNER_SERVICE_URL),
+    ):
+        check_port(
+            "127.0.0.1",
+            launcher.local_service_port(url),
+            f"The {name} needs this port. Another SecondShift may be running. "
+            f"To use another port, set {variable}, "
+            "for example to http://127.0.0.1:8202.",
+        )

secondshift/core/middleware.py

@@ -0,0 +1,21 @@
+from collections.abc import Callable
+
+from django.http import HttpRequest, HttpResponse
+
+LIVENESS_PATH = "/-/health/up/"
+
+
+class LivenessMiddleware:
+    """Answer the proxy's liveness probe before host validation and SSL redirects.
+
+    Kamal's proxy probes the container directly over HTTP with an internal Host
+    header, so this must run ahead of SecurityMiddleware and ALLOWED_HOSTS.
+    """
+
+    def __init__(self, get_response: Callable[[HttpRequest], HttpResponse]) -> None:
+        self.get_response = get_response
+
+    def __call__(self, request: HttpRequest) -> HttpResponse:
+        if request.path == LIVENESS_PATH:
+            return HttpResponse("ok", content_type="text/plain")
+        return self.get_response(request)

secondshift/core/schemas.py

@@ -0,0 +1,71 @@
+from datetime import date, datetime
+
+from ninja import Schema
+
+from secondshift.connections.schemas import ExecutionStatusSchema
+
+
+class UserSchema(Schema):
+    email: str
+    workspace_name: str | None
+    workspace_slug: str | None
+    # The person's role in the current workspace and what it lets them do.
+    role: str | None
+    permissions: list[str]
+    # Django admin only lets staff in, so links to it are shown only to them.
+    can_use_admin: bool
+    can_create_workspace: bool
+    local_repositories_enabled: bool
+    # The operator set up the GitHub App, so repositories can come from GitHub.
+    github_app_configured: bool = False
+    environment: str = "Production"
+    sandbox: str = "gVisor sandbox"
+
+
+class FailingJobSchema(Schema):
+    job_id: int
+    job: str
+    repository: str
+    run_id: int
+    failed_at: datetime | None
+    label: str
+    reason: str
+    paused: bool = False
+
+
+class JobSpendSchema(Schema):
+    job_id: int
+    job: str
+    repository: str
+    runs: int
+    spend_usd: float
+    partial: bool
+
+
+class RunDaySchema(Schema):
+    day: date
+    succeeded: int
+    failed: int
+    canceled: int
+
+
+class OverviewSchema(Schema):
+    repositories: int
+    local_repositories: int
+    enabled_jobs: int
+    runs_today: int
+    failed_runs: int
+    connected_services: int
+    failing_jobs: list[FailingJobSchema] = []
+    runs_7d: int = 0
+    runs_previous_7d: int = 0
+    finished_7d: int = 0
+    succeeded_7d: int = 0
+    spend_7d_usd: float = 0
+    spend_previous_7d_usd: float = 0
+    spend_partial: bool = False
+    spend_by_job: list[JobSpendSchema] = []
+    run_days: list[RunDaySchema] = []
+    execution: ExecutionStatusSchema | None = None
+    # Whether this person has a usable MCP token in this workspace.
+    has_agent_token: bool = False