Coding
250 prompts in this category · Page 3 of 21
Android targetSdk 35 Upgrade Planner: Stepwise 33 to 34 to 35 Hops, Edge to Edge Enforcement and WindowInsets Fixes, Foreground Service Types and the dataSync Timeout, Exported Receiver Flags, and a Play Target API Deadline Checklist
Move an Android app to targetSdk 35 without surprise crashes or broken layouts: the behavior changes you inherit at each API level, a code search list for each one, edge to edge and insets fixes for Views or Compose, foreground service declarations and timeout handling, a test matrix, and a staged Play rollout before the target API deadline.
Act as a senior Android engineer who has raised targetSdk on production apps every year, upgrades one API level at a time, and turns each platform behavior change into a code search and a test. Inputs: - Current compileSdk, targetSdk, minSdk, Android Gradle Plugin, Kotlin, and Gradle versions: [BuildVersions] - UI stack: Views with AppCompat or Material, Jetpack Compose, or mixed; any custom toolbars, bottom bars, or full screen screens: [UiStack] - Background work: foreground services and what they do, WorkManager jobs, alarms, broadcast receivers registered in code, BOOT_COMPLETED usage: [BackgroundWork] - Dependencies that touch the platform: push, maps, media, camera, payments, analytics SDKs with versions: [PlatformDeps] - Release process: tracks used, rollout percentages, crash and ANR monitoring: [ReleaseProcess] - Output format: [Format] Generate: 1. A hop plan: if targetSdk is below 34, ship 34 first, then 35. Set compileSdk 35 first with no target change and fix build errors alone. 2. Toolchain floors: AGP, Gradle, and Kotlin versions that support compileSdk 35, with a note to check the AGP release notes for exact minimums. 3. API 34 changes to check if hopping from 33: runtime registered receivers must pass RECEIVER_EXPORTED or RECEIVER_NOT_EXPORTED, foreground services must declare a foregroundServiceType and its matching permission, exact alarms are not granted by default to new installs, and implicit intents to non exported components are blocked. For each: a grep pattern and the fix. 4. API 35 changes: edge to edge is enforced, so content draws behind the status and navigation bars. Give the insets fix for UiStack (ViewCompat.setOnApplyWindowInsetsListener and padding for Views, Scaffold or windowInsetsPadding for Compose), and a list of screens to inspect. Also cover the dataSync foreground service time limit with an onTimeout handler or a move to WorkManager, and restrictions on starting certain foreground service types from BOOT_COMPLETED. 5. A table mapping BackgroundWork items to the change that affects them and the fix. 6. A dependency matrix from PlatformDeps: current version, first version tested on API 35 if documented, and blocker yes or no. 7. A test matrix: devices or emulators on API 34 and 35, gesture and three button navigation, light and dark, large font, and a foldable or tablet if supported. 8. Rollout from ReleaseProcess: internal track, closed testing, then staged production percentages with crash and ANR thresholds to pause, and the Play target API deadline to confirm in Play Console. Constraints: - Show exact Gradle and manifest snippets. Mark anything not confirmed in the official behavior changes pages as "check Android 15 behavior changes". No em dashes.
Django 4.2 LTS to 5.2 LTS Upgrade Planner: Python 3.10+ Floor, Stepwise 5.0 and 5.1 Hops, python -Wa Deprecation Sweep, django-upgrade Codemods, STORAGES Setting, index_together and pytz Removals, and a Third Party Package Matrix
Plan a Django upgrade from 4.2 LTS to 5.2 LTS as a series of safe hops: environment floors, a deprecation sweep with warnings turned on, django-upgrade codemods, the removals that actually break 4.2 code, a package compatibility matrix, migration checks, and a deploy and rollback plan for each step.
Act as a senior Django engineer who has moved several production apps from one LTS release to the next, upgrades one minor version at a time, and lets the deprecation warnings drive the work list. Inputs: - Current versions: Django, Python, database engine and version, OS image: [CurrentStack] - requirements or pyproject dependency list with pinned versions: [Dependencies] - Settings excerpts and code patterns you know you use (storage settings, timezone handling, custom auth, model Meta options, test helpers): [SettingsAndPatterns] - Test suite size, CI setup, and how long a full run takes: [TestSuite] - Deploy method and tolerance for downtime: [DeployContext] - Output format: [Format] Generate: 1. Floors table: Django 5.x needs Python 3.10 or newer, and each release raises database minimums (for PostgreSQL, 5.2 expects 14 or newer). Compare against CurrentStack and list what must move first. 2. Hop plan: 4.2 to 5.0, then 5.1, then 5.2, each its own branch and deploy. Never jump straight to 5.2. 3. Warning sweep for each hop: run the suite with python -Wa manage.py test (or PYTHONWARNINGS=always with pytest), collect RemovedInDjango warnings, and fix all of them before bumping the version. 4. Codemods: run django-upgrade with --target-version for the hop, and pyupgrade for the Python floor, then review the diff by hand. 5. Breaking removals mapped to SettingsAndPatterns, for example: DEFAULT_FILE_STORAGE and STATICFILES_STORAGE replaced by STORAGES, index_together replaced by Meta.indexes with a migration, pytz support and USE_DEPRECATED_PYTZ removed in favor of zoneinfo, USE_L10N removed, logout over GET removed, assertQuerysetEqual renamed to assertQuerySetEqual, CheckConstraint check renamed to condition. For each: file, fix, test. 6. Package matrix from Dependencies: package, current pin, first version that supports the target Django, blocker yes or no, and an alternative if abandoned. 7. Migration safety: makemigrations --check after each hop, review any generated migration, and run migrations against a production sized copy. 8. Deploy and rollback for each hop from DeployContext, including what to watch in logs for the first day. 9. Mark anything you cannot confirm from the official release notes as "check the 5.x release notes". Constraints: - Ordered, checkable steps. Show commands exactly. No em dashes.
Spring Boot 2.7 to 3.x Migration Planner: Java 17 Baseline, javax to jakarta Imports, Spring Security 6 SecurityFilterChain and requestMatchers, Hibernate 6 Sequence Naming, Trailing Slash Matching, properties-migrator, and OpenRewrite
Upgrade a Spring Boot 2.7 service to 3.x in safe steps: move to Java 17, swap javax imports for jakarta without touching Java SE packages, replace WebSecurityConfigurerAdapter with a SecurityFilterChain bean, handle Hibernate 6 sequence and query changes, decide what to do about trailing slash URLs, find renamed properties, and let OpenRewrite do the mechanical edits.
Act as a senior Java backend engineer who has migrated dozens of Spring Boot 2.7 services to 3.x, runs OpenRewrite recipes before touching code by hand, and has seen a release fail because Hibernate 6 started looking for a different sequence name. Inputs: - Build file with Spring Boot, Java, and third party dependency versions (pom.xml or build.gradle): [BuildFile] - Current Spring Security configuration code: [SecurityConfig] - JPA usage: ID generation strategies, database, native queries, custom types: [JpaUsage] - Web endpoints and clients that call them, including any that use trailing slashes: [WebEndpoints] - Integrations: tracing, API docs, caching, messaging libraries: [Integrations] - Target Boot version and test setup: [TargetAndTests] - Output format: [Format] Generate: 1. A phased plan: upgrade to the latest 2.7.x and clear deprecation warnings first, then Java 17 on 2.7, then Boot 3.x. Mark the target from TargetAndTests and note that later 3.x lines and Boot 4 may change more; check your version notes. 2. An OpenRewrite step: the rewrite-spring recipe for Boot 3 (for example org.openrewrite.java.spring.boot3.UpgradeSpringBoot_3_0 or a later 3.x recipe) run with the Maven or Gradle plugin on a branch, then a review of the diff. 3. A javax to jakarta map: javax.persistence, javax.servlet, javax.validation, javax.annotation (where Jakarta), and javax.transaction move to jakarta.*; Java SE packages such as javax.sql and javax.crypto stay as they are. 4. A dependency table from BuildFile and Integrations: each library, its Jakarta compatible version or replacement (for example springfox to springdoc-openapi 2.x, Spring Cloud Sleuth to Micrometer Tracing), and a blocker column. 5. Spring Security 6 rewrite of SecurityConfig: WebSecurityConfigurerAdapter is gone, so expose a SecurityFilterChain bean; authorizeRequests becomes authorizeHttpRequests; antMatchers and mvcMatchers become requestMatchers; @EnableGlobalMethodSecurity becomes @EnableMethodSecurity. Show before and after code. 6. Hibernate 6 checks from JpaUsage: the default sequence naming change for GenerationType.AUTO or SEQUENCE (per entity sequences instead of one shared hibernate_sequence), the legacy naming setting to keep the old behavior during migration, query syntax issues in HQL, and custom @Type mappings. 7. Trailing slash matching: Spring Framework 6 no longer matches /orders/ to /orders by default. From WebEndpoints, list affected clients and pick a fix: update clients, map both paths, or use a URL handler filter where your Framework version provides it. 8. Properties: add spring-boot-properties-migrator at runtime during the migration to log renamed keys (for example spring.redis.* to spring.data.redis.*), then remove it. 9. A test and release checklist: compile, unit and integration tests, security tests for each protected path, a database migration test against a copy of production schema, and a canary release. Constraints: - Base every change on the Inputs; never claim a library version exists without telling the user to confirm it on Maven Central. - Show code in Java. No em dashes.
Express 4 to 5 Migration Planner for Node.js APIs: path-to-regexp 8 Route Syntax for Named Wildcards and Optional Braces, Removed Methods, req.query Getter and Simple Parser, Async Error Handling, Middleware Compatibility, and a Test Plan
Upgrade an Express 4 app to Express 5 route by route: rewrite wildcard, optional, and regex routes for the new path syntax, replace removed methods like app.del, req.param, and res.json with a status argument, handle the read only req.query and the simple query parser, drop try and catch wrappers that async error handling makes redundant, check middleware, and test before release.
Act as a Node.js backend engineer who has upgraded production Express 4 APIs to Express 5, reviews route files for a living, and has shipped the bug where a wildcard route silently stopped matching after the path syntax changed. Inputs: - Current Express version, Node.js version, and package.json dependencies that touch Express: [Stack] - Route definitions and router files (paste the app.get, router.use, and similar lines): [Routes] - Code that uses request and response helpers, especially req.param, req.query writes, res.json with two arguments, res.send with a number, res.redirect, and res.sendfile: [HandlerCode] - Middleware list in order, including third party packages and any that modify req.query: [Middleware] - Test setup and how the API is deployed: [Tests] - Output format: [Format] Generate: 1. A readiness check: Express 5 needs Node.js 18 or newer, so confirm Stack first; list each dependency in Stack and Middleware with a note on whether its docs state Express 5 support or need checking. 2. A route syntax table for every line in Routes using path-to-regexp 8 rules: wildcards must be named (/files/*splat, and /{*splat} to also match the root), optional parts use braces (/users{/:id}) instead of a trailing question mark, inline regex such as /:id(\d+) is removed and becomes validation in the handler or a router.param check, and reserved characters must be escaped. Note that wildcard params arrive as arrays of segments. 3. A removed and changed API list from HandlerCode, each with before and after code: app.del to app.delete, req.param(name) to req.params, req.body, or req.query, res.json(obj, status) to res.status(status).json(obj), res.send(number) to res.sendStatus, res.sendfile to res.sendFile, res.redirect('back') to the Referrer header with a fallback, and the pluralized req.acceptsCharsets, acceptsEncodings, and acceptsLanguages. 4. Query and body changes: req.query is a getter and cannot be reassigned, the default query parser is now simple, how to opt back in with app.set('query parser', 'extended') if nested objects are used, express.urlencoded defaults to extended false, and req.body is undefined when no body parser ran. 5. Async error handling: rejected promises and thrown errors in async handlers now reach next(err), so list which try and catch wrappers or express-async-errors style packages can be removed, and confirm the error handler still has four arguments. 6. Other behavior changes to check: res.status accepts only integers from 100 to 999, express.static ignores dotfiles by default, and any code that depended on old behavior. 7. A migration order: run the official codemods if available (check the Express migration guide), fix routes, fix handlers, update middleware, then tests. 8. A test plan: one request per changed route including root, nested, optional, and invalid id cases, query parsing tests for nested parameters, and an error path test for an async handler. Constraints: - Only rewrite code shown in the Inputs. Never invent routes, packages, or versions. - Flag anything you cannot confirm as "check the Express 5 migration guide". No em dashes.
Apache Airflow 2 to 3 DAG Migration Planner: Ruff AIR301 and AIR302 Scans, airflow.sdk Imports, schedule and logical_date Renames, Standard Provider Operators, No Direct Metadata DB Access, and a Staging Cutover Checklist
Plan an Airflow 2.x to 3.0 upgrade DAG by DAG: run Ruff's AIR rules to find removed and moved names, switch imports to airflow.sdk and the standard provider, replace schedule_interval, execution_date, days_ago, and SubDAGs, move task code off direct metadata database sessions to the REST API, and finish with a config update and staging cutover checklist.
Act as a data platform engineer who has upgraded production Apache Airflow deployments from 2.x to 3.0, maintains a few hundred DAGs, and has been paged for DAGs that vanished from the UI after an import error, for templates still using execution_date, and for tasks that opened ORM sessions against the metadata database. Inputs: - Current Airflow version, Python version, and how it is installed (pip constraints file, official Docker image, Helm chart, managed service): [CurrentVersion] - DAG inventory: file names with the imports, DAG arguments, operators, and Jinja templates they use (paste code or excerpts): [DagInventory] - Installed provider packages and versions: [Providers] - Executor and deployment layout (scheduler, webserver, workers, triggerer): [Deployment] - Any task code that touches the metadata database, airflow.settings.Session, or internal models: [DbAccessInTasks] - Output format: [Format] Generate: 1. A readiness gate: move to the latest 2.x release first (2.10 or the 2.11 bridge release), clear every deprecation warning in the scheduler and DAG processor logs, back up the metadata database, and confirm every provider in Providers has a release that supports Airflow 3. 2. A Ruff scan plan: the exact commands to run the AIR301 (removed in Airflow 3) and AIR302 (moved to a provider) rules over the dags folder with preview mode, how to review autofixes before accepting them, and how to read each rule code in the output. 3. A rename table built from DagInventory: from airflow.decorators and airflow.models.DAG to airflow.sdk (dag, task, DAG, Variable, TaskGroup), Dataset to Asset, schedule_interval and timetable to schedule, airflow.utils.dates.days_ago to a fixed pendulum start_date, and BashOperator, PythonOperator, and the core sensors to apache-airflow-providers-standard import paths. 4. A template and context fix list: execution_date, next_ds, prev_ds, tomorrow_ds, and yesterday_ds replaced with logical_date or data_interval_start and data_interval_end, with each changed template line shown before and after. 5. Behavior changes to decide per DAG: catchup now defaults to False, SubDAGs are removed so each one becomes a TaskGroup, SLA callbacks are removed, and the REST API moves from v1 to v2. 6. A DbAccessInTasks rewrite: task code may no longer open metadata database sessions, so each case moves to the Airflow REST API through the Python client, an Airflow Variable or Connection read through the SDK, or an external table you own. 7. A Deployment change list: the webserver is replaced by airflow api-server, the DAG processor runs as its own component, run airflow config update to review renamed options and add --fix only after review, then airflow db migrate. 8. A staging cutover checklist: parse every DAG with zero import errors, trigger one run per DAG, compare task counts and durations with the 2.x baseline, then a rollback note that names the database backup. Constraints: - Only rewrite code that appears in DagInventory; never invent DAG names, tasks, or connection IDs. - Mark any provider version you cannot confirm as "check the provider changelog". No em dashes.
Pydantic v1 to v2 Migration Planner for FastAPI and Python Services: bump-pydantic First Pass, validator to field_validator, root_validator to model_validator, Config to ConfigDict, BaseSettings Move, and Behavior Changes
Migrate a codebase from Pydantic v1 to v2 without silent behavior changes: run bump-pydantic first, convert validators and root validators, move Config to model_config with renamed keys, replace dict, json, parse_obj, and from_orm calls, move BaseSettings to pydantic-settings, and catch Optional default and strict coercion changes with targeted tests.
Act as a Python backend engineer who has migrated several FastAPI and worker services from Pydantic v1 to v2, uses bump-pydantic for the mechanical pass, and knows which changes it cannot make for you: validator signatures, Optional defaults, and coercion that v1 did quietly. Inputs: - Current versions: Python, pydantic, FastAPI or other frameworks that depend on pydantic, and the target versions: [Versions] - Pasted model code: the models, validators, Config classes, and settings classes to migrate: [ModelCode] - Call sites: where the code uses .dict(), .json(), parse_obj, parse_raw, from_orm, schema(), copy(), or __fields__: [CallSites] - Test coverage and CI notes: what tests exist around these models and which payloads are known in production: [TestNotes] - Rollout constraints: big bang or gradual, other services that import these models, a deadline: [Rollout] - Output format: [Format] Generate: 1. A plan header: dependency changes from Versions (pydantic 2, pydantic-settings if BaseSettings is used, a FastAPI release that supports v2), and whether to use the pydantic.v1 namespace for a gradual path given Rollout. 2. bump-pydantic first pass: the command to run on the package and a list of what it will and will not rewrite in ModelCode. 3. Validator conversions: each @validator to @field_validator with @classmethod, each pre=True to mode='before', each always=True to validate_default, each values argument to info.data via ValidationInfo, and each @root_validator to @model_validator with the right mode. 4. Config conversions: class Config to model_config = ConfigDict(...) with renamed keys (orm_mode to from_attributes, allow_population_by_field_name to populate_by_name, anystr_strip_whitespace to str_strip_whitespace, schema_extra to json_schema_extra), and json_encoders replaced by field_serializer where needed. 5. Field changes: regex to pattern, const removed, __root__ models to RootModel, and Optional fields with no default that become required. 6. Call site replacements from CallSites: dict to model_dump, json to model_dump_json, parse_obj to model_validate, parse_raw to model_validate_json, from_orm to model_validate with from_attributes, schema to model_json_schema, copy to model_copy, __fields__ to model_fields. 7. Behavior change tests from TestNotes: payloads that v1 coerced (an int into a str field), Optional without default, validator order, and serialized output shape, each as a pytest case. 8. A rollout checklist: order of services, the diff to review, and what to watch in logs after deploy. Constraints: - Show before and after code for every model in ModelCode. Do not invent fields or call sites; mark anything unclear as CHECK. - Mark API names that changed between minor v2 releases as CHECK against the installed version. No em dashes.
OpenTelemetry Collector Config Writer for otelcol-contrib: OTLP, Host Metrics, and Filelog Receivers, memory_limiter First, Batch, PII Redaction, Tail Sampling, Agent vs Gateway Pipelines, and otelcol validate
Generate an OpenTelemetry Collector (contrib distribution) YAML config you can validate before deploying: OTLP gRPC and HTTP, hostmetrics, and filelog receivers, processors in a safe order with memory_limiter first, attribute based PII redaction, tail sampling policies on the gateway tier, exporters, health_check and zpages extensions, and separate service.pipelines for traces, metrics, and logs.
Act as a site reliability engineer who runs the OpenTelemetry Collector contrib distribution (otelcol-contrib) in production as both a per host agent and a central gateway, and who has debugged dropped spans, memory kills, and leaked user emails in log bodies. Inputs: - Deployment shape: agent only, gateway only, or agent plus gateway; platform (VM, Kubernetes DaemonSet and Deployment, Docker); Collector version: [Deployment] - Signals and sources: which apps send OTLP over gRPC or HTTP, which hosts need host metrics, which log files to tail and their format: [Signals] - Backend exporters: vendor or self hosted endpoints per signal, auth header names (never values), TLS needs: [Backends] - Sensitive attributes to remove or hash, such as user.email, http.request.header.authorization, client IPs: [PiiFields] - Sampling goals: keep all errors, keep slow traces above a threshold, a baseline percentage for the rest: [SamplingPolicy] - Container or host memory limit for each Collector: [MemoryBudget] - Output format: [Format] Generate: 1. A topology note: what runs on the agent and what runs on the gateway. Tail sampling must run where all spans of a trace arrive, so if there is more than one gateway replica, route traces by trace ID with the loadbalancing exporter on the agent tier. 2. Receivers: otlp with grpc and http endpoints set explicitly (bind to 0.0.0.0 only where the network requires it), hostmetrics with an interval and only the scrapers needed, filelog with include paths, start_at, and a parser operator matching the log format in Signals. 3. Processors in order: memory_limiter first with check_interval and limits derived from MemoryBudget, then resource or attributes processors that delete or hash every PiiFields key, then tail_sampling on the gateway only, then batch last before export. 4. tail_sampling policies from SamplingPolicy: status_code for errors, latency with threshold_ms, probabilistic for the baseline, plus decision_wait and num_traces with a short reason for each value. 5. Exporters per signal from Backends, with auth read from environment variables using the env syntax, retry and sending queue left on. 6. Extensions: health_check and zpages, listed under service.extensions, with ports noted for probes. 7. service.pipelines: separate traces, metrics, and logs pipelines; every component referenced exists and every defined component is used. 8. Validation steps: otelcol-contrib validate --config with the file path, then a smoke test that sends one span and checks zpages or the debug exporter. 9. A risk list: what fails first if MemoryBudget is too small, and how to spot dropped data in the Collector's own metrics. Constraints: - Only use components that exist in otelcol-contrib; if a field name may differ by version, mark it CHECK against the Deployment version. - Never put secrets in YAML. No em dashes. Keep comments short and inside the YAML.
PostgreSQL Row Level Security Policy Writer for Multi Tenant SaaS: Tenant Context with set_config, USING vs WITH CHECK, FORCE ROW LEVEL SECURITY, Roles Without BYPASSRLS, Pooler Safety, and Isolation Tests
Add tenant isolation to a shared schema Postgres database: a safe tenant context function, ENABLE and FORCE row level security, USING and WITH CHECK policies per table, an application role that cannot bypass them, transaction scoped settings that survive PgBouncer, composite foreign keys, view settings, and SQL tests that prove one tenant cannot see another.
Act as a PostgreSQL database engineer who retrofits row level security onto multi tenant SaaS schemas, and who has seen every leak: the app connecting as the table owner, a session setting that survives into the next pooled request, and views that run as their owner. Inputs: - Table definitions (CREATE TABLE statements) and which column identifies the tenant on each: [SchemaDDL] - Roles today: which role owns the tables, which role the app connects as, and their attributes: [CurrentRoles] - How the app connects (driver, ORM, PgBouncer or another pooler and its pool mode): [ConnectionSetup] - Access rules beyond tenant isolation (admins, read only support staff, cross tenant reporting jobs): [AccessRules] - PostgreSQL major version: [PgVersion] - Views and functions that read tenant tables: [ViewsAndFunctions] - Output format: [Format] Generate: 1. A role plan: a migration or owner role, an application role that is not the owner, not superuser, and NOBYPASSRLS, and a separate role for any cross tenant job in AccessRules. Include the GRANT statements. 2. A tenant context function that reads current_setting with missing_ok true and turns an empty string into NULL, so an unset context returns no rows instead of an error or every row. 3. For each tenant table: ALTER TABLE ... ENABLE ROW LEVEL SECURITY and FORCE ROW LEVEL SECURITY, then CREATE POLICY statements. Explain USING (which existing rows are visible or changeable) versus WITH CHECK (which new or updated rows are allowed), and write both. 4. Child tables: composite foreign keys on (parent_id, tenant_id) so a child row cannot point at another tenant's parent, plus the indexes that make policies fast. 5. Application code for ConnectionSetup: set the tenant per transaction with set_config(name, value, true) or SET LOCAL, never a session level SET under transaction pooling, with a short example in the user's driver. 6. Views and functions: security_invoker on views for PgVersion 15 and later, or the workaround for older versions, and review of SECURITY DEFINER functions. 7. Isolation tests in plain SQL inside transactions that roll back: visible row counts per tenant, a blocked cross tenant insert, a blocked update that moves a row to another tenant, and no rows with no context set. 8. A verification query on pg_class and pg_roles showing RLS enabled and forced, and that the app role cannot bypass it. Constraints: - Use only tables and columns from SchemaDDL; flag any table without a tenant column. - Note that foreign key checks and unique constraints are not filtered by RLS and can reveal that a value exists. - No destructive statements; wrap changes in a migration the user can review. No em dashes.
Crontab to systemd Timer Converter: OnCalendar Expressions, Oneshot Service Units with User and EnvironmentFile, Persistent Catch Up, Sandboxing Options, OnFailure Alerts, and journalctl Checks
Move a server's cron jobs to systemd timers without breaking them: translate each crontab line to an OnCalendar expression you can verify, write the matching oneshot service with the right user, working directory, and environment, add catch up for missed runs, sandbox the job, replace MAILTO with an OnFailure alert, and check runs with systemctl and journalctl.
Act as a Linux systems engineer who migrates legacy cron jobs to systemd timers on Debian, Ubuntu, and RHEL servers, and who knows the usual breakages: scripts that relied on cron's environment, overlapping runs, and timers that were written but never enabled. Inputs: - The crontab lines exactly as they are, including which user's crontab or /etc/cron.d file they came from: [CrontabLines] - What each script does, what it writes to, and how long it usually runs: [JobBehavior] - Environment the scripts need (PATH additions, variables, secrets files, working directory): [JobEnv] - Distro and systemd version from systemctl --version: [SystemdVersion] - How failures are reported today (MAILTO, a log file, nothing): [Alerting] - Server timezone and whether jobs must run in a different zone: [TimeZone] - Output format: [Format] Generate: 1. A translation table: each line in CrontabLines next to its OnCalendar expression, plus the systemd-analyze calendar command to verify the next run times. Handle @reboot with OnBootSec or a service enabled at boot, and @daily style shortcuts explicitly. 2. For each job, a .service unit with Type=oneshot, User and Group matching the original crontab owner, WorkingDirectory, Environment or EnvironmentFile from JobEnv, and ExecStart with absolute paths. 3. A matching .timer unit with OnCalendar, Persistent=true for jobs that must catch up after downtime, RandomizedDelaySec where many servers would otherwise run at once, and AccuracySec when exact timing matters. Explain that a oneshot service will not start a second copy while one is still running, which replaces flock wrappers for overlap. 4. Sandboxing options sized to JobBehavior: NoNewPrivileges, PrivateTmp, ProtectSystem=strict with ReadWritePaths for the directories the job writes, ProtectHome, and a note to test each one because a too strict setting fails the job. 5. Alerting: replace MAILTO with OnFailure pointing to a templated notify unit, with a simple example that sends mail or posts to a webhook. 6. A cutover plan: install units under /etc/systemd/system, systemd-analyze verify, daemon-reload, enable --now the timers only, comment out the crontab lines the same minute, then confirm with systemctl list-timers and journalctl -u. 7. TimeZone handling: if SystemdVersion supports a timezone in OnCalendar, show it; otherwise explain the job follows the server zone. Constraints: - Never put secret values in unit files; use an EnvironmentFile readable only by root or the service user. - Do not remove the crontab entries until the timer has run once successfully. No em dashes.
Terraform Config Driven Refactor Planner: moved, import, and removed Blocks for Module Extraction, count to for_each Conversion, and Adopting Unmanaged Resources Without state mv
Plan a Terraform refactor that ends in a zero change plan: an address map from old to new resource addresses, moved blocks for module extraction and count to for_each keys, import blocks with generated config for resources created by hand, removed blocks with destroy set to false for resources you are handing off, the plan output you should expect, and a cleanup schedule for module consumers.
Act as a Terraform platform engineer who refactors live state with config driven blocks instead of terraform state mv, so every change is reviewed in a pull request and proven by a plan that shows moves and imports with nothing to destroy. Inputs: - Terraform CLI version and provider versions from the lock file: [TerraformVersion] - Current resource addresses from terraform state list: [StateList] - The target layout (new modules, new resource names, new for_each keys): [TargetLayout] - Resources that exist in the cloud account but not in state, with their real IDs: [UnmanagedResources] - Resources to stop managing here without deleting them (handed to another team or stack): [HandOffResources] - Who consumes these modules (only this root, or other teams pinning versions): [ModuleConsumers] - Output format: [Format] Generate: 1. A version check: moved blocks need 1.1 or later, import blocks 1.5 or later, removed blocks and for_each inside import 1.7 or later. If TerraformVersion is older, say which steps must wait or fall back to state commands. 2. An address map table: every StateList address, its new address from TargetLayout, and the block that handles it (moved, removed, or none). 3. moved blocks for module extraction (from = aws_x.name to = module.child.aws_x.name) and for count to for_each conversion with explicit index to key pairs. Never guess which index maps to which key; derive it from the attributes in StateList or ask. 4. import blocks for UnmanagedResources with to and id, plus the command terraform plan -generate-config-out=generated.tf and a note to review and trim the generated config before merging. 5. removed blocks for HandOffResources with lifecycle { destroy = false }, and a reminder to delete the matching resource blocks. 6. The expected plan summary: each move listed as has moved to, each import as will be imported, and 0 to add, 0 to change, 0 to destroy. List any line that would mean stop and fix before apply. 7. A cleanup schedule: when each block can be deleted, based on ModuleConsumers. Blocks in the root can go after a clean apply; moved blocks inside a shared module stay for at least one released module version when other teams pin it. Constraints: - Do not use moved to change a resource type unless the provider documents support for it. - Do not invent resource IDs, ARNs, or attribute values. Mark unknowns as FILL FROM CONSOLE. - Assume remote state with locking; never suggest editing the state file by hand. No em dashes.
Alembic Autogenerate Migration Reviewer: SQLAlchemy 2.0 Revision Fixes, Batch Mode for SQLite, Data Migrations, Downgrades, and Zero Downtime Postgres Steps
Review an Alembic revision that autogenerate produced before it reaches production: catch the renames it sees as drop and add, missing server defaults, enum and constraint naming problems, SQLite batch mode needs, and unsafe locking operations on Postgres, then get a corrected revision file, a working downgrade, a separate data migration, and an expand and contract rollout plan.
Act as a Python backend engineer who owns database migrations for SQLAlchemy 2.0 applications and reviews every Alembic revision before it ships. You treat autogenerate output as a first draft that is wrong in predictable ways. Inputs: - The generated revision file, including revision, down_revision, upgrade, and downgrade: [RevisionFile] - The model diff that caused it (old and new SQLAlchemy model classes or a description): [ModelChange] - Database engine and version for each environment (Postgres, MySQL, SQLite in tests): [DatabaseTargets] - Approximate row counts and write traffic for affected tables: [TableSize] - env.py settings that matter (target_metadata, compare_type, compare_server_default, render_as_batch, naming_convention): [EnvConfig] - Deployment style (single deploy, rolling deploy with old and new app versions live together): [DeployStyle] - Output format: [Format] Generate: 1. A findings list comparing RevisionFile with ModelChange: renamed columns or tables that autogenerate wrote as drop_column plus add_column (data loss), type changes it missed because compare_type is off, server defaults, nullable changes on populated tables, unnamed constraints, and enum types it will not create or drop on Postgres. 2. A corrected upgrade() using op.alter_column with new_column_name for renames, explicit constraint names that follow EnvConfig naming_convention, and op.batch_alter_table blocks wherever SQLite is in DatabaseTargets. 3. A downgrade() that truly reverses upgrade() in reverse order, or an explicit raise with the reason when the change cannot be undone without data loss. 4. Data migration: if rows must be backfilled or transformed, a separate revision using op.get_bind() and a lightweight sa.table definition, never imported ORM models, batched when TableSize is large. 5. Locking review for Postgres: flag ADD COLUMN with a volatile default, SET NOT NULL on a large table, new foreign keys, and plain CREATE INDEX. Show the safer pattern (add nullable, backfill, add a NOT VALID check then VALIDATE, CREATE INDEX CONCURRENTLY inside op.get_context().autocommit_block()). 6. If DeployStyle is rolling, an expand and contract sequence split into numbered revisions and app releases so old code never reads a missing column. 7. Commands to verify: alembic upgrade head and downgrade -1 against a copy, alembic check, and alembic upgrade --sql for DBA review. Constraints: - Keep the original revision id and down_revision unless a split is required, and show any new ids as placeholders. - Do not claim lock durations or timings you were not given. No em dashes.
ESLint v9 Flat Config Migration: .eslintrc and .eslintignore to eslint.config.js with typescript-eslint, React Plugins, and FlatCompat Fallbacks
Move a real project from legacy .eslintrc and .eslintignore files to an ESLint v9 eslint.config.js: overrides become file scoped objects, env becomes languageOptions.globals, plugins move to flat configs, typescript-eslint uses the project service, legacy shareable configs go through FlatCompat, and you get a package.json diff, CI command changes, and a parity check so no rule silently disappears.
Act as a JavaScript tooling engineer who has migrated monorepos and single apps from ESLint 8 eslintrc files to ESLint 9 flat config and knows which plugins ship flat configs and which still need the compatibility layer. Inputs: - Current .eslintrc file contents (json, js, or yaml) including overrides: [LegacyConfig] - Current .eslintignore contents and any ignorePatterns: [IgnoreFile] - package.json devDependencies with versions for eslint and every plugin or shared config: [LintDeps] - Module type (package.json type field) and TypeScript tsconfig layout: [ModuleSetup] - Lint scripts and CI commands that call eslint today: [LintScripts] - Inline eslint-env or eslint comments used in source files, if any: [InlineDirectives] - Output format: [Format] Generate: 1. Translation table: every key in LegacyConfig (root, env, parser, parserOptions, plugins, extends, settings, rules, overrides, ignorePatterns) with its flat config equivalent, for example env to languageOptions.globals using the globals package, overrides to separate objects with files and ignores, parser to languageOptions.parser. 2. Plugin readiness list from LintDeps: which packages export flat configs at the listed versions, which need a version bump, and which must be wrapped with FlatCompat from @eslint/eslintrc. Mark anything you are not sure of as VERIFY with the command to check. 3. A complete eslint.config.js (or eslint.config.mjs if ModuleSetup is CommonJS) in the right order: global ignores object first, js.configs.recommended, typescript-eslint configs, React and hooks, FlatCompat entries, file scoped overrides, then eslint-config-prettier last if Prettier is used. Use projectService for type aware rules when typescript-eslint is v8. 4. IgnoreFile converted into the ignores array with directory patterns ending in a slash, plus a note that ESLint 9 no longer reads .eslintignore. 5. package.json diff: packages to add, bump, and remove, and LintScripts rewritten without the removed --ext flag. 6. InlineDirectives fixes: replace eslint-env comments with file scoped globals and list the files to edit. 7. Parity check: run npx eslint --print-config on two representative files before and after, diff the rules, and list rules that changed severity or vanished, with the reason. Constraints: - Do not drop a rule silently. Every rule in LegacyConfig appears in the new file or in a REMOVED list with a reason. - Do not invent plugin export names. Unknown exports are VERIFY items. - No em dashes.