secondshift 0.1.0b12__py3-none-any.whl

secondshift/runs/publishing.py

@@ -0,0 +1,162 @@
+"""Publish a finished run's changes as a draft pull request.
+
+Publishing reads only what the run stored: the pinned commit, the collected
+patch and the report. A retry repeats this without the agent or a sandbox.
+
+When the GitHub connection shows attribution, the branch, the description and
+the commit's trailers name SecondShift. When it does not, nothing does: the
+branch is named after the title and the description is the report alone.
+"""
+
+import logging
+import tempfile
+from pathlib import Path
+
+from django.utils.text import slugify
+
+from secondshift.config.constants import MAX_CHANGES_BYTES
+from secondshift.connections.github import shows_attribution
+from secondshift.github.pulls import MAX_BODY_CHARS
+from secondshift.repositories.models import Repository
+from secondshift.repositories.pull_requests import (
+    DraftPullRequest,
+    PublishError,
+    publish_pull_request,
+)
+from secondshift.runs.artifacts import artifact_storage, read_text
+from secondshift.runs.dao import (
+    create_delivery,
+    finish_delivery,
+    get_run,
+    run_delivery,
+)
+from secondshift.runs.models import Run, RunDelivery
+from secondshift.runs.reporting.collection import plural
+
+logger = logging.getLogger(__name__)
+
+SKIP_CI = "[skip ci]"
+BRANCH_PREFIX = "secondshift/run-"
+# Long enough to read, short enough for a branch list.
+BRANCH_SLUG_CHARS = 40
+
+
+def record_pending_pull_request(run: Run) -> None:
+    """Shown as pending from the start, and kept if publishing fails."""
+    plan = run.plan.pull_request
+    if plan:
+        create_delivery(
+            run,
+            RunDelivery.Kind.PULL_REQUEST,
+            f"{run.repository.full_name} into {plan.base}",
+        )
+
+
+def pull_request_delivery(run: Run) -> RunDelivery | None:
+    return run_delivery(run, RunDelivery.Kind.PULL_REQUEST)
+
+
+def skip_reason(run: Run, repository: Repository) -> str:
+    """Why this run opens no pull request, or an empty string if it should."""
+    if repository.source_type != Repository.SourceType.GITHUB:
+        return "Local repositories cannot open pull requests."
+    if not repository.allow_pull_requests:
+        return "An owner has not allowed pull requests for this repository."
+    if run.status != Run.Status.SUCCEEDED:
+        return "The run did not succeed."
+    if run.collected is None:
+        return "The run's changes could not be collected."
+    changes = run.collected.changes
+    if changes.too_large:
+        return (
+            f"The changes were larger than {MAX_CHANGES_BYTES // 2**20} MiB, "
+            "so they were not kept."
+        )
+    if not changes.path:
+        return "The agent made no changes."
+    return ""
+
+
+def draft_for(run: Run) -> DraftPullRequest:
+    if run.finished_at is None:
+        raise PublishError("The run has not finished.")
+    plan = run.plan.pull_request
+    if plan is None:
+        raise PublishError("The run did not ask for a pull request.")
+    title = run.display_name[:200]
+    report = ""
+    if run.output_path:
+        report, _ = read_text(run.output_path, MAX_BODY_CHARS)
+    attribution = shows_attribution(run.repository.github_connection)
+    body = report.strip() or run.summary
+    paragraphs = [title]
+    if not plan.run_ci:
+        # CI waits for a person, because the patch has not been reviewed yet.
+        paragraphs.append(SKIP_CI)
+    if attribution:
+        body = f"{body}\n\n---\n\n{footer(run)}"
+        paragraphs.append(trailers(run))
+    return DraftPullRequest(
+        branch=branch_name(run, attribution),
+        base=plan.base,
+        title=title,
+        body=body,
+        message="\n\n".join(paragraphs),
+        # The same date on every attempt gives the same commit.
+        committed_at=run.finished_at,
+    )
+
+
+def footer(run: Run) -> str:
+    return f"Opened by SecondShift from run #{run.pk} at {run.commit_sha[:12]}."
+
+
+def trailers(run: Run) -> str:
+    """Git trailers, so tools can find the run behind a commit."""
+    lines = [f"SecondShift-Run: {run.pk}"]
+    if run.job is not None:
+        lines.append(f"SecondShift-Job: {run.job.name}")
+    return "\n".join(lines)
+
+
+def branch_name(run: Run, attribution: bool) -> str:
+    """The same name on every attempt, so a retry pushes the same branch."""
+    if attribution:
+        return f"{BRANCH_PREFIX}{run.pk}"
+    slug = slugify(run.display_name)[:BRANCH_SLUG_CHARS].strip("-") or "changes"
+    return f"{slug}-{run.pk}"
+
+
+def publish_run(run_id: int) -> None:
+    run = get_run(run_id, "job", "task__repository__github_connection")
+    delivery = pull_request_delivery(run)
+    if delivery is None or delivery.status == RunDelivery.Status.DELIVERED:
+        return
+    if reason := skip_reason(run, run.repository):
+        finish_delivery(delivery, RunDelivery.Status.SKIPPED, reason)
+        return
+    delivery.attempts += 1
+    try:
+        with tempfile.TemporaryDirectory(prefix="secondshift-patch-") as folder:
+            patch = Path(folder) / "changes.patch"
+            with artifact_storage().open(run.collected.changes.path, "rb") as src:
+                patch.write_bytes(src.read())
+            opened = publish_pull_request(
+                run.repository, run.commit_sha, patch, draft_for(run)
+            )
+    except PublishError as error:
+        finish_delivery(delivery, RunDelivery.Status.FAILED, str(error))
+        return
+    except Exception:
+        logger.exception("publishing run %s failed", run_id)
+        finish_delivery(
+            delivery, RunDelivery.Status.FAILED, "Publishing failed unexpectedly."
+        )
+        return
+    delivery.external_url = opened.url
+    count = run.collected.changes.file_count
+    finish_delivery(
+        delivery,
+        RunDelivery.Status.DELIVERED,
+        f"Opened draft #{opened.number} with changes to {plural(count, 'file')}.",
+    )

secondshift/runs/queue.py

@@ -0,0 +1,26 @@
+"""Changes a person may make to a task that has not started."""
+
+from django.db import transaction
+
+from secondshift.repositories.dao import lock_repository
+from secondshift.runs.dao import add_event, lock_run
+from secondshift.runs.models import Run
+from secondshift.runs.services import RunRefused
+from secondshift.runs.transitions import finish_run
+
+
+@transaction.atomic
+def cancel_queued_task(run: Run) -> Run:
+    if run.job_id is not None:
+        raise RunRefused("Only queued ad hoc tasks can be canceled here.")
+    lock_repository(run.task.repository_id)
+    run = lock_run(run.pk, "task__repository")
+    if run.status == Run.Status.CANCELED:
+        return run
+    if run.status != Run.Status.QUEUED:
+        raise RunRefused("This task has already started or finished.")
+    summary = "Canceled before execution."
+    finish_run(run.pk, Run.Status.CANCELED, summary, only_from={Run.Status.QUEUED})
+    run.refresh_from_db(fields=["status", "summary", "finished_at"])
+    add_event(run.pk, summary)
+    return run

secondshift/runs/reporting/collection.py

@@ -0,0 +1,26 @@
+from secondshift.config.constants import MAX_CHANGES_BYTES
+from secondshift.runs.outputs import RunOutputs
+
+
+def plural(count: int, noun: str) -> str:
+    return f"{count} {noun}" if count == 1 else f"{count} {noun}s"
+
+
+def collection_summary(outputs: RunOutputs) -> str:
+    """One timeline line about what the sandbox left behind, or none."""
+    changes = outputs.changes
+    parts: list[str] = []
+    if changes.path:
+        parts.append(f"changes to {plural(changes.file_count, 'file')}")
+    if outputs.files:
+        parts.append(plural(len(outputs.files), "saved file"))
+    lines = [f"Collected {' and '.join(parts)}."] if parts else []
+    if changes.too_large:
+        limit = MAX_CHANGES_BYTES // (1024 * 1024)
+        lines.append(
+            f"Changes to {plural(changes.file_count, 'file')} were larger than "
+            f"{limit} MiB, so they were not kept."
+        )
+    if outputs.skipped:
+        lines.append(f"Skipped {plural(len(outputs.skipped), 'saved file')}.")
+    return " ".join(lines)

secondshift/runs/reporting/connection_usage.py

@@ -0,0 +1,45 @@
+"""How each connection is used: by which jobs, and for model providers, at what cost."""
+
+from dataclasses import dataclass
+from datetime import datetime, timedelta
+from decimal import Decimal
+
+from django.utils import timezone
+
+from secondshift.gateway.dao import usage_by_connection
+from secondshift.jobs.dao import approved_jobs_per_connection
+from secondshift.workspaces.models import Workspace
+
+WINDOW = timedelta(days=7)
+# The window an agent login's run cap counts over.
+
+
+@dataclass(frozen=True)
+class ConnectionUsage:
+    # Jobs with approved access through this connection.
+    jobs: int = 0
+    runs_7d: int = 0
+    spend_7d_usd: Decimal = Decimal(0)
+    # Some model calls had no known price, so spend is a lower bound.
+    spend_partial: bool = False
+    # Last model call. Services don't record individual calls.
+    last_used_at: datetime | None = None
+
+
+def connection_usage(
+    workspace: Workspace, now: datetime | None = None
+) -> dict[int, ConnectionUsage]:
+    start = (now or timezone.now()) - WINDOW
+    jobs = approved_jobs_per_connection(workspace.pk)
+    models = usage_by_connection(workspace.pk, start)
+    usage: dict[int, ConnectionUsage] = {}
+    for connection_id in jobs.keys() | models.keys():
+        row = models.get(connection_id, {})
+        usage[connection_id] = ConnectionUsage(
+            jobs=jobs.get(connection_id, 0),
+            runs_7d=row.get("runs", 0),
+            spend_7d_usd=row.get("spend") or Decimal(0),
+            spend_partial=row.get("unpriced", 0) > 0,
+            last_used_at=row.get("last"),
+        )
+    return usage

secondshift/runs/reporting/failures.py

@@ -0,0 +1,150 @@
+"""Turn workflow exceptions into run summaries a person can act on."""
+
+from dataclasses import dataclass
+
+from pydantic_ai.exceptions import ModelHTTPError
+
+from secondshift.connections.errors import ExternalRequestError, ExternalToolError
+from secondshift.github.errors import GitHubError
+from secondshift.jobs.tool_rules import ToolRuleViolation
+from secondshift.runner.protocol import RunnerProtocolError
+from secondshift.runs.models import Run, RunFailure
+
+STAGE_FAILURES: dict[str, str] = {
+    RunFailure.STARTING: "The run could not start",
+    RunFailure.CHECKOUT: "Couldn't check out the repository",
+    RunFailure.SANDBOX: "Couldn't start the sandbox",
+    RunFailure.SKILL: "The skill run failed",
+    RunFailure.FINISHING: "The run could not be recorded",
+}
+MAX_DETAIL_CHARS = 300
+TOOL_RULE_NEXT_STEP = (
+    "The model used a tool in a way the job's access review does not allow. "
+    "Change the restriction or the skill, then run again."
+)
+
+# Messages of these types come from SecondShift or Pydantic AI (whose run errors
+# are RuntimeErrors) and never carry credentials, so they are shown. Anything
+# else could echo arbitrary data, so only its type is shown.
+SHOWN_ERROR_TYPES: tuple[type[BaseException], ...] = (
+    GitHubError,
+    RunnerProtocolError,
+    RuntimeError,
+)
+
+
+def root_error(error: BaseException) -> BaseException:
+    """The first underlying error, unwrapping exhausted step retries.
+
+    Later retry attempts often fail for a different, misleading reason (for
+    example, a conflict because the first attempt already ran), so the first
+    attempt is the one that explains the failure.
+    """
+    attempts = getattr(error, "errors", None)
+    if isinstance(attempts, list) and attempts:
+        first = attempts[0]
+        if isinstance(first, BaseException):
+            return first
+    return error
+
+
+def provider_message(body: object) -> str:
+    """The human message from an OpenAI- or Anthropic-shaped error body."""
+    if not isinstance(body, dict):
+        return ""
+    nested = body.get("error")
+    if isinstance(nested, dict) and isinstance(nested.get("message"), str):
+        return nested["message"]
+    message = body.get("message")
+    return message if isinstance(message, str) else ""
+
+
+def one_line(text: str) -> str:
+    line = " ".join(text.split())
+    if len(line) > MAX_DETAIL_CHARS:
+        line = line[: MAX_DETAIL_CHARS - 1] + "…"
+    return line
+
+
+def provider_reply(error: ModelHTTPError, separator: str) -> str:
+    """`HTTP 401: User not found.`, or `HTTP 401.` when the body says nothing."""
+    message = provider_message(error.body)
+    reply = f"HTTP {error.status_code}"
+    return one_line(f"{reply}{separator}{message}" if message else f"{reply}.")
+
+
+def failure_detail(error: BaseException) -> str:
+    if isinstance(error, ModelHTTPError):
+        return one_line(f"The model provider answered {provider_reply(error, ': ')}")
+    if isinstance(error, ToolRuleViolation):
+        # Names the argument and the rule, never the value the model sent.
+        return one_line(f"Blocked by a tool restriction: {error}")
+    if isinstance(error, SHOWN_ERROR_TYPES) and str(error).strip():
+        return one_line(str(error))
+    # SecondShift writes these for people. Request errors may quote the
+    # remote service, so they stay hidden.
+    shown_tool_error = isinstance(error, ExternalToolError) and not isinstance(
+        error, ExternalRequestError
+    )
+    if shown_tool_error and str(error).strip():
+        return one_line(str(error))
+    return f"Unexpected {type(error).__name__}."
+
+
+@dataclass(frozen=True)
+class StageFailure:
+    kind: RunFailure
+    reason: str
+    # One line naming the failed stage and the original cause.
+    summary: str
+
+
+def stage_failure(stage: RunFailure, error: BaseException) -> StageFailure:
+    """What a workflow error at this stage means for the run."""
+    root = root_error(error)
+    detail = failure_detail(root)
+    summary = f"{STAGE_FAILURES[stage]}: {detail}"
+    if isinstance(root, ModelHTTPError):
+        # model_provider_next_step reads the status from the start of this.
+        reason = provider_reply(root, " · ")
+        return StageFailure(RunFailure.MODEL_PROVIDER, reason, summary)
+    if isinstance(root, ToolRuleViolation):
+        return StageFailure(RunFailure.TOOL_RULE, one_line(str(root)), summary)
+    return StageFailure(stage, detail, summary)
+
+
+def failure_metadata(stage: str, error: BaseException) -> dict[str, object]:
+    attempts = getattr(error, "errors", None)
+    return {
+        "stage": stage,
+        "error_type": type(root_error(error)).__name__,
+        "attempts": len(attempts) if isinstance(attempts, list) else 1,
+    }
+
+
+@dataclass(frozen=True)
+class FailureView:
+    """A failure split for compact display: where it happened, and why."""
+
+    label: str
+    reason: str
+
+
+def describe_failure(run: Run) -> FailureView:
+    kind = RunFailure(run.failure or RunFailure.OTHER)
+    reason = " ".join(run.failure_reason.split())
+    return FailureView(kind.label, reason or "No reason was recorded.")
+
+
+def model_provider_next_step(reason: str, connection_name: str) -> str:
+    """What to do about a model provider failure, in plain words."""
+    if reason.startswith(("HTTP 401", "HTTP 403")):
+        return (
+            f"The API key for {connection_name} was refused. "
+            "Update the key, then run again."
+        )
+    if reason.startswith("HTTP 429"):
+        return "The provider is limiting requests. Wait, then run again."
+    if reason.startswith("HTTP 5"):
+        return "The provider had a problem. Run again later."
+    return f"Check {connection_name}, then run again."

secondshift/runs/reporting/health.py

@@ -0,0 +1,158 @@
+"""Workspace health for the overview: what is failing now, and what it costs."""
+
+from dataclasses import dataclass
+from datetime import date, datetime, timedelta
+from decimal import Decimal
+
+from django.db.models import Q
+from django.utils import timezone
+
+from secondshift.gateway.dao import spend_per_job, spend_totals
+from secondshift.jobs.dao import jobs_by_id
+from secondshift.runs.dao import (
+    finished_runs_per_day,
+    jobs_whose_last_run_failed,
+    run_counts,
+    runs_by_id,
+)
+from secondshift.runs.models import Run
+from secondshift.runs.reporting.failures import describe_failure
+from secondshift.workspaces.models import Workspace
+
+WINDOW = timedelta(days=7)
+# Two weeks, so the overview chart shows this week against the one before.
+CHART_DAYS = 14
+
+
+@dataclass(frozen=True)
+class FailingJob:
+    job_id: int
+    job: str
+    repository: str
+    run_id: int
+    failed_at: datetime | None
+    label: str
+    reason: str
+    # Scheduled but switched off, so nothing will run it again on its own.
+    paused: bool
+
+
+@dataclass(frozen=True)
+class WeekSummary:
+    runs: int
+    previous_runs: int
+    finished: int
+    succeeded: int
+    spend_usd: Decimal
+    previous_spend_usd: Decimal
+    # Some model calls had no known price, so spend is a lower bound.
+    spend_partial: bool
+
+
+@dataclass(frozen=True)
+class RunDay:
+    """Finished runs on one local day, by outcome."""
+
+    day: date
+    succeeded: int
+    failed: int
+    canceled: int
+
+
+@dataclass(frozen=True)
+class JobSpend:
+    job_id: int
+    job: str
+    repository: str
+    runs: int
+    spend_usd: Decimal
+    # Some of this job's model calls had no known price.
+    partial: bool
+
+
+def failing_jobs(workspace: Workspace) -> list[FailingJob]:
+    """Jobs whose most recent finished run failed.
+
+    A job that failed last week but has succeeded since is healthy, so this
+    looks only at each job's latest outcome, not at failure history. Paused
+    jobs still count, marked as paused, since their last run is still broken.
+    """
+    jobs = jobs_whose_last_run_failed(workspace.pk)
+    runs = runs_by_id(job.latest_run_id for job in jobs)
+    failing: list[FailingJob] = []
+    for job in jobs:
+        run = runs[job.latest_run_id]
+        view = describe_failure(run)
+        failing.append(
+            FailingJob(
+                job_id=job.pk,
+                job=job.name,
+                repository=job.repository.display_name,
+                run_id=run.pk,
+                failed_at=run.finished_at,
+                label=view.label,
+                reason=view.reason,
+                paused=bool(job.cron) and not job.enabled,
+            )
+        )
+    return failing
+
+
+def week_summary(workspace: Workspace, now: datetime | None = None) -> WeekSummary:
+    """Runs and model spend in the last seven days, with the week before for trend."""
+    now = now or timezone.now()
+    start, previous_start = now - WINDOW, now - 2 * WINDOW
+    runs = run_counts(workspace.pk, start, previous_start)
+    totals = spend_totals(
+        Q(run__task__repository__workspace_id=workspace.pk), start, previous_start
+    )
+    return WeekSummary(
+        runs=runs["runs"],
+        previous_runs=runs["previous"],
+        finished=runs["finished"],
+        succeeded=runs["succeeded"],
+        spend_usd=totals["spend"] or Decimal(0),
+        previous_spend_usd=totals["previous"] or Decimal(0),
+        spend_partial=totals["unpriced"] > 0,
+    )
+
+
+def runs_by_day(
+    workspace: Workspace, now: datetime | None = None, days: int = CHART_DAYS
+) -> list[RunDay]:
+    """Finished runs per local day, oldest first. Days without runs count as zero."""
+    today = timezone.localdate(now or timezone.now())
+    first = today - timedelta(days=days - 1)
+    rows = finished_runs_per_day(workspace.pk, first, today)
+    counts = {(row["day"], row["status"]): row["count"] for row in rows}
+    return [
+        RunDay(
+            day=day,
+            succeeded=counts.get((day, Run.Status.SUCCEEDED), 0),
+            failed=counts.get((day, Run.Status.FAILED), 0),
+            canceled=counts.get((day, Run.Status.CANCELED), 0),
+        )
+        for day in (first + timedelta(days=offset) for offset in range(days))
+    ]
+
+
+def spend_by_job(
+    workspace: Workspace, now: datetime | None = None, limit: int = 5
+) -> list[JobSpend]:
+    """The jobs that spent the most on models in the last seven days."""
+    start = (now or timezone.now()) - WINDOW
+    rows = spend_per_job(workspace.pk, start)
+    ranked = sorted(rows, key=lambda row: row["spend"] or Decimal(0), reverse=True)
+    ranked = ranked[:limit]
+    jobs = jobs_by_id(row["run__job_id"] for row in ranked)
+    return [
+        JobSpend(
+            job_id=row["run__job_id"],
+            job=jobs[row["run__job_id"]].name,
+            repository=jobs[row["run__job_id"]].repository.display_name,
+            runs=row["runs"],
+            spend_usd=row["spend"] or Decimal(0),
+            partial=row["unpriced"] > 0,
+        )
+        for row in ranked
+    ]