Auto-generated changes

.emergent/cron/dispatch_webhook.sh

@@ -0,0 +1,74 @@
+#!/bin/sh
+# Pod-local webhook-cron dispatcher: one crontab line per enabled cron, run by
+# crond inside the preview/env pod. The full endpoint URL is substituted at
+# render time; this fires a single request with the .env secret and exits 0.
+set -eu
+
+: "${CRON_NAME:?}" "${METHOD:?}" "${ENDPOINT_URL_B64:?}"
+JOB_ID="${JOB_ID:-}"
+WEBHOOK_ENV_FILE="${WEBHOOK_ENV_FILE:-/app/backend/.env}"
+AT_DATE="${AT_DATE:-}"
+END_DATE="${END_DATE:-}"
+
+# AT_DATE (one-time trigger): crond can't express the year, so the "M H D Mo *"
+# line re-fires this minute every year. Fire only when the current UTC minute
+# (first 16 chars of RFC3339) matches AT_DATE's minute.
+if [ -n "$AT_DATE" ]; then
+	now_min="$(date -u +%Y-%m-%dT%H:%M)"
+	at_min="$(printf '%s' "$AT_DATE" | cut -c1-16)"
+	[ "$now_min" = "$at_min" ] || exit 0
+fi
+
+# END_DATE (recurring cutoff): both sides use the same fixed %Y-%m-%dT%H:%M:%SZ
+# layout, so comparing their digit-only forms numerically preserves chronological
+# order. Stop firing once now is strictly past END_DATE.
+if [ -n "$END_DATE" ]; then
+	now_num="$(date -u +%Y%m%d%H%M%S)"
+	end_num="$(printf '%s' "$END_DATE" | tr -cd '0-9')"
+	[ "$now_num" -le "$end_num" ] || exit 0
+fi
+
+ENDPOINT="$(printf '%s' "$ENDPOINT_URL_B64" | base64 -d)"
+
+strip_quotes() {
+	# Strip a single matching pair of surrounding quotes.
+	v="$1"
+	case "$v" in
+		\"*\") v="${v#\"}"; v="${v%\"}" ;;
+		\'*\') v="${v#\'}"; v="${v%\'}" ;;
+	esac
+	printf '%s' "$v"
+}
+
+# Read the per-app secret from the dotenv at dispatch time (never from cron env).
+read_secret() {
+	[ -f "$WEBHOOK_ENV_FILE" ] || return 0
+	line="$(grep -E '^WEBHOOK_CRON_SECRET=' "$WEBHOOK_ENV_FILE" | tail -n 1 || true)"
+	value="$(strip_quotes "${line#WEBHOOK_CRON_SECRET=}")"
+	printf '%s' "$value"
+}
+WEBHOOK_CRON_SECRET="$(read_secret)"
+
+# RUN_ID is the idempotency key: cron name + fire time (minute granularity
+# matches the schedule floor).
+RUN_ID="${CRON_NAME}-$(date -u +%Y%m%dT%H%M)"
+DISPATCH_TIME="$(date -u +%Y-%m-%dT%H:%M:%SZ)"
+ENVELOPE="{\"event\":\"schedule.triggered\",\"schedule_id\":\"$CRON_NAME\",\"run_id\":\"$RUN_ID\",\"dispatch_time\":\"$DISPATCH_TIME\",\"job_id\":\"$JOB_ID\",\"data\":null}"
+
+# Fire-and-forget: one request, no retries, no run reporting. `|| true` keeps
+# `set -e` happy on a curl transport failure (000, non-zero exit).
+# --location-trusted: internal-cluster pods get a cross-host 307 to the
+# internal.<preview-host>; the Bearer must survive that same-platform redirect.
+HTTP_STATUS="$(curl -sS -o /dev/null -w '%{http_code}' \
+	--max-time 10 \
+	--location-trusted --max-redirs 2 \
+	-X "$METHOD" \
+	-H "Authorization: Bearer $WEBHOOK_CRON_SECRET" \
+	-H "Content-Type: application/json" \
+	-H "X-Webhook-Id: $RUN_ID" \
+	-H "X-Webhook-Timestamp: $DISPATCH_TIME" \
+	-d "$ENVELOPE" \
+	"$ENDPOINT" 2>/dev/null || true)"
+
+echo "dispatch complete (cron=$CRON_NAME http=${HTTP_STATUS:-000})"
+exit 0

.emergent/cron/watch_crons.sh

@@ -0,0 +1,37 @@
+#!/bin/sh
+# Pod-local crons.yml change watcher: runs every minute from the same crontab.
+# When the live .emergent/crons.yml hash differs from the last-applied hash it
+# asks agent-service to reconcile PREVIEW crons (scope=preview keeps prod/AWS
+# untouched). It never writes applied.hash (the install does, so a failed
+# reconcile retries next minute) and never exits non-zero.
+set -u
+
+YAML="${CRONS_YAML_FILE:-/app/.emergent/crons.yml}"
+APPLIED="${APPLIED_HASH_FILE:-/app/.emergent/cron/applied.hash}"
+JOB_ID="${JOB_ID:-}"
+CRON_API_URL="${CRON_API_URL:-}"
+
+# sha256 of $1, or empty when the file is absent (matches the install writer).
+hash_file() {
+	if [ -f "$1" ]; then
+		sha256sum "$1" 2>/dev/null | cut -d' ' -f1
+	else
+		printf ''
+	fi
+}
+
+current="$(hash_file "$YAML")"
+applied="$(cat "$APPLIED" 2>/dev/null || printf '')"
+
+# Converged: nothing to do.
+[ "$current" = "$applied" ] && exit 0
+# No API URL baked (older pod) — can't reconcile; retry once one is present.
+[ -n "$CRON_API_URL" ] || exit 0
+
+# Fire-and-forget preview reconcile; silent on any transport failure.
+curl -sS -o /dev/null --max-time 15 \
+	-X POST \
+	-H "Content-Type: application/json" \
+	-d "{\"job_id\":\"$JOB_ID\",\"scope\":\"preview\"}" \
+	"$CRON_API_URL/internal/crons/reconcile" >/dev/null 2>&1 || true
+exit 0

.emergent/cron/webhook-crons

@@ -0,0 +1,8 @@
+# Managed by Emergent webhook-cron (pod-local syscron). DO NOT EDIT.
+SHELL=/bin/sh
+PATH=/usr/local/sbin:/usr/local/bin:/usr/sbin:/usr/bin:/sbin:/bin
+JOB_ID=e8fe6d4b-1b47-4757-a9f4-54ebb4753164
+WEBHOOK_ENV_FILE=/app/backend/.env
+CRON_API_URL=https://ea.int.apis.emergentagent.com
+
+* * * * * root JOB_ID=e8fe6d4b-1b47-4757-a9f4-54ebb4753164 CRON_API_URL=https://ea.int.apis.emergentagent.com /bin/sh /app/.emergent/cron/watch_crons.sh >> /var/log/webhook-cron.log 2>&1

.emergent/cron/webhook_crond.sh

@@ -0,0 +1,46 @@
+#!/bin/sh
+# supervisord program entrypoint for the pod-local webhook-cron daemon.
+#
+# Runs in the FOREGROUND so supervisord supervises it; declared autostart=true
+# so it comes back automatically on every pod resume. Before exec'ing the cron
+# daemon it self-heals the live crontab from the persistent workspace copy
+# (/app is a PVC, /etc/cron.d is not) so a freshly resumed pod schedules the
+# last-rendered crons even before agent-service reconciles.
+set -eu
+
+CRON_DIR=/app/.emergent/cron
+PERSIST="$CRON_DIR/webhook-crons"
+CRON_D=/etc/cron.d/webhook-crons
+DISPATCH="$CRON_DIR/dispatch_webhook.sh"
+LOG=/var/log/webhook-cron.log
+
+# Restore the live /etc/cron.d entry from the persistent copy when present.
+if [ -f "$PERSIST" ]; then
+	mkdir -p "$(dirname "$CRON_D")" 2>/dev/null || true
+	cp "$PERSIST" "$CRON_D" 2>/dev/null || true
+	chmod 0644 "$CRON_D" 2>/dev/null || true
+fi
+[ -f "$DISPATCH" ] && chmod 0755 "$DISPATCH" 2>/dev/null || true
+touch "$LOG" 2>/dev/null || true
+
+# If the base image predates the `cron` package, install it at runtime
+# (best-effort; a failure falls through to the error below). Debian base + sudo.
+if ! command -v cron >/dev/null 2>&1 && ! command -v crond >/dev/null 2>&1; then
+	echo "webhook_crond: no cron daemon found, attempting runtime install" >&2
+	if command -v apt-get >/dev/null 2>&1; then
+		SUDO=""
+		[ "$(id -u)" -eq 0 ] || SUDO="sudo"
+		$SUDO apt-get update >/dev/null 2>&1 &&
+			$SUDO apt-get install -y --no-install-recommends cron >/dev/null 2>&1 ||
+			echo "webhook_crond: runtime cron install failed" >&2
+	fi
+fi
+
+# Prefer Debian/cronie `cron` (-f foreground), fall back to busybox `crond`.
+if command -v cron >/dev/null 2>&1; then
+	exec cron -f -L 15
+elif command -v crond >/dev/null 2>&1; then
+	exec crond -f -l 8
+fi
+echo "webhook_crond: no cron daemon (cron/crond) installed in image" >&2
+exit 127

.emergent/emergent.yml

@@ -1,4 +1,4 @@
 {
-  "job_id": "86e4729b-4931-4e3b-a723-419f52bba5fb",
-  "created_at": "2026-07-08T12:24:43.560533+00:00Z"
+  "job_id": "e8fe6d4b-1b47-4757-a9f4-54ebb4753164",
+  "created_at": "2026-07-19T19:07:11.326316+00:00Z"
 }

.gitignore

@@ -40,49 +40,25 @@ logs/
 !index.html
 !static/
 !.nojekyll
--e 
-# Environment files
-*.env
-*.env.*
--e 
-# Environment files
-*.env
-*.env.*
-frontend/node_modules/.cache/default-development/1.pack
-frontend/node_modules/.cache/default-development/3.pack
--e 
-# Environment files
-*.env
-*.env.*
-frontend/node_modules/.cache/default-development/4.pack
--e 
-# Environment files
-*.env
-*.env.*
-frontend/node_modules/.cache/default-development/5.pack
-frontend/node_modules/.cache/default-development/6.pack
--e 
-# Environment files
-*.env
-*.env.*
--e 
--e 
-*.env.*
--e 
-# Environment files
-*.env
-*.env.*
--e 
-# Environment files
-*.env
-*.env.*
--e 
+
 # Environment files
-*.env
-*.env.*
 .env
 .env.*
 credentials.json
 *.pem
 *.key
 .credentials
+
+# Backend (Python / SQLite)
+__pycache__/
+*.pyc
+backend/data/
+*.db
+*.db-journal
+*.sqlite3
+
+# Keep committed env templates
+!.env.example
+!backend/.env.example
+!backend/.env.docker.example
+*.env

backend/.dockerignore

@@ -0,0 +1,9 @@
+__pycache__
+*.pyc
+data
+.env
+.env.*
+*.db
+*.db-journal
+*.sqlite3
+.git

backend/Dockerfile

@@ -0,0 +1,14 @@
+FROM python:3.11-slim
+
+WORKDIR /app
+
+COPY requirements.txt .
+RUN pip install --no-cache-dir -r requirements.txt
+
+COPY . .
+
+RUN mkdir -p /data
+
+EXPOSE 8000
+
+CMD ["sh", "-c", "alembic upgrade head && uvicorn server:app --host 0.0.0.0 --port 8000"]