Hotovo. Přidal jsem podporu bootstrap-v2.sh do stránky Migration Readiness.

Co se změnilo:
migration_readiness.py (line 9) nově zná BOOTSTRAP_SCRIPT = "bootstrap-v2.sh".
Helper umí najít poslední job pro bootstrap a připravit status, return code, started_at, finished_at, raw stdout/stderr z DB.
routes/migration_readiness.py (line 111) přidává tlačítko Run Bootstrap v2, které pouze vytvoří run_script job s script_name=bootstrap-v2.sh.
Přidal jsem výrazné varování k bootstrapu a blok “Poslední výsledek Bootstrap v2”.
Zobrazení logů redaktuje env-like citlivé hodnoty typu TOKEN, PASSWORD, SECRET, API_KEY, PRIVATE, CREDENTIAL.

app/db/migration_readiness.py

@@ -6,10 +6,15 @@ from app.db.database import get_connection
 from app.db.migrations import run_migrations
 
 PREFLIGHT_SCRIPT = "preflight-check.sh"
+BOOTSTRAP_SCRIPT = "bootstrap-v2.sh"
+SENSITIVE_KEY_RE = re.compile(
+    r"(SECRET|TOKEN|PASSWORD|PASS|KEY|CREDENTIAL|AUTH|API_KEY|PRIVATE)",
+    re.IGNORECASE,
+)
 
 
-def _job_matches_script(row: dict[str, Any]) -> bool:
+def _job_matches_script(row: dict[str, Any], script_name: str) -> bool:
-    if row.get("target_id") == PREFLIGHT_SCRIPT:
+    if row.get("target_id") == script_name:
         return True
 
     try:
@@ -17,10 +22,10 @@ def _job_matches_script(row: dict[str, Any]) -> bool:
     except (TypeError, ValueError):
         return False
 
-    return payload.get("script_name") == PREFLIGHT_SCRIPT
+    return payload.get("script_name") == script_name
 
 
-def get_latest_preflight_job():
+def get_latest_script_job(script_name: str):
     run_migrations()
     con = get_connection()
 
@@ -36,18 +41,26 @@ def get_latest_preflight_job():
         ORDER BY id DESC
         LIMIT 20
         """,
-        (PREFLIGHT_SCRIPT, f'%"{PREFLIGHT_SCRIPT}"%'),
+        (script_name, f'%"{script_name}"%'),
     ).fetchall()
 
     con.close()
     for row in rows:
         job = dict(row)
-        if _job_matches_script(job):
+        if _job_matches_script(job, script_name):
             return job
     return None
 
 
-def get_job_log_output(job_id: int) -> str:
+def get_latest_preflight_job():
+    return get_latest_script_job(PREFLIGHT_SCRIPT)
+
+
+def get_latest_bootstrap_job():
+    return get_latest_script_job(BOOTSTRAP_SCRIPT)
+
+
+def get_job_log_entries(job_id: int) -> list[dict[str, Any]]:
     run_migrations()
     con = get_connection()
 
@@ -62,7 +75,34 @@ def get_job_log_output(job_id: int) -> str:
     ).fetchall()
 
     con.close()
-    return "\n".join(f"[{row['stream'] or 'log'}] {row['message'] or ''}" for row in rows)
+    return [dict(row) for row in rows]
+
+
+def _redact_sensitive_text(value: str) -> str:
+    redacted_lines = []
+    for line in value.splitlines():
+        env_match = re.match(r"^(\s*(?:export\s+)?([A-Z_][A-Z0-9_]*)\s*=\s*)(.*)$", line)
+        if env_match and SENSITIVE_KEY_RE.search(env_match.group(2)):
+            redacted_lines.append(f"{env_match.group(1)}[redacted]")
+            continue
+        json_match = re.match(r'^(\s*["\']?([^"\':=]+)["\']?\s*[:=]\s*)(.*)$', line)
+        if json_match and SENSITIVE_KEY_RE.search(json_match.group(2)):
+            redacted_lines.append(f"{json_match.group(1)}[redacted]")
+            continue
+        redacted_lines.append(line)
+    return "\n".join(redacted_lines)
+
+
+def get_job_log_output(job_id: int, stream: str | None = None, include_stream: bool = True) -> str:
+    rows = get_job_log_entries(job_id)
+    lines = []
+    for row in rows:
+        row_stream = row.get("stream") or "log"
+        if stream and row_stream != stream:
+            continue
+        message = _redact_sensitive_text(row.get("message") or "")
+        lines.append(f"[{row_stream}] {message}" if include_stream else message)
+    return "\n".join(lines)
 
 
 def _count_token(text: str, token: str) -> int:
@@ -77,6 +117,14 @@ def _result_data(job: dict[str, Any]) -> dict[str, Any]:
     return value if isinstance(value, dict) else {}
 
 
+def _result_value(job: dict[str, Any], keys: tuple[str, ...]) -> Any:
+    data = _result_data(job)
+    for key in keys:
+        if key in data:
+            return data.get(key)
+    return None
+
+
 def _first_int(data: dict[str, Any], keys: tuple[str, ...]) -> int | None:
     for key in keys:
         value = data.get(key)
@@ -157,3 +205,33 @@ def summarize_readiness(job: dict[str, Any] | None) -> dict[str, Any]:
         "raw_output": raw_output,
         "job": job,
     }
+
+
+def summarize_script_run(job: dict[str, Any] | None) -> dict[str, Any]:
+    if not job:
+        return {
+            "job": None,
+            "return_code": None,
+            "stdout": "",
+            "stderr": "",
+        }
+
+    return_code = _result_value(job, ("returncode", "return_code", "exit_code", "exitCode"))
+    stdout = _result_value(job, ("stdout", "out"))
+    stderr = _result_value(job, ("stderr", "err"))
+
+    if stdout is None:
+        stdout = get_job_log_output(int(job["id"]), stream="stdout", include_stream=False)
+    if stderr is None:
+        stderr = get_job_log_output(int(job["id"]), stream="stderr", include_stream=False)
+
+    error_text = job.get("error_text") or ""
+    if error_text:
+        stderr = f"{stderr}\n{error_text}" if stderr else error_text
+
+    return {
+        "job": job,
+        "return_code": return_code,
+        "stdout": _redact_sensitive_text(str(stdout or "")),
+        "stderr": _redact_sensitive_text(str(stderr or "")),
+    }

app/routes/migration_readiness.py

@@ -6,7 +6,14 @@ from fastapi.responses import HTMLResponse, RedirectResponse
 from app.auth import require_user
 from app.db.audit import log_audit_event
 from app.db.jobs import create_job
-from app.db.migration_readiness import PREFLIGHT_SCRIPT, get_latest_preflight_job, summarize_readiness
+from app.db.migration_readiness import (
+    BOOTSTRAP_SCRIPT,
+    PREFLIGHT_SCRIPT,
+    get_latest_bootstrap_job,
+    get_latest_preflight_job,
+    summarize_readiness,
+    summarize_script_run,
+)
 from app.routes.jobs import render_job_status
 from app.templates.layout import page
 
@@ -19,10 +26,51 @@ def render_readiness_pill(ready: bool) -> str:
     return '<span class="pill pill-danger">NOT READY</span>'
 
 
+def render_script_result(title: str, script_name: str, summary: dict) -> str:
+    job = summary.get("job")
+    job_rows = f'<tr><td colspan="2">Zatím není uložený žádný výsledek skriptu {html.escape(script_name)}.</td></tr>'
+    if job:
+        job_id = html.escape(str(job.get("id", "")))
+        return_code = summary.get("return_code")
+        return_code_label = "" if return_code is None else html.escape(str(return_code))
+        job_rows = f"""
+            <tr><th>Úloha</th><td><a href="/portal/jobs/{job_id}">#{job_id}</a></td></tr>
+            <tr><th>Status</th><td>{render_job_status(job.get("status"))}</td></tr>
+            <tr><th>Return code</th><td>{return_code_label}</td></tr>
+            <tr><th>Started at</th><td>{html.escape(job.get("started_at", "") or "")}</td></tr>
+            <tr><th>Finished at</th><td>{html.escape(job.get("finished_at", "") or "")}</td></tr>
+        """
+
+    stdout = html.escape(summary.get("stdout") or "Zatím není uložený žádný stdout log.")
+    stderr = html.escape(summary.get("stderr") or "Zatím není uložený žádný stderr log.")
+
+    return f"""
+        <div class="card">
+            <h2>{html.escape(title)}</h2>
+            <p class="muted">Poslední výsledek maintenance skriptu {html.escape(script_name)} uložený v databázi.</p>
+            <table>
+                {job_rows}
+            </table>
+        </div>
+
+        <div class="grid">
+            <div class="card">
+                <h2>Raw stdout log</h2>
+                <pre class="log-viewer log-stdout">{stdout}</pre>
+            </div>
+            <div class="card">
+                <h2>Raw stderr log</h2>
+                <pre class="log-viewer log-stderr">{stderr}</pre>
+            </div>
+        </div>
+    """
+
+
 @router.get("/migration-readiness", response_class=HTMLResponse)
 def migration_readiness_page(request: Request, user=Depends(require_user)):
     latest_job = get_latest_preflight_job()
     summary = summarize_readiness(latest_job)
+    bootstrap_summary = summarize_script_run(get_latest_bootstrap_job())
     job = summary["job"]
 
     log_audit_event(
@@ -55,9 +103,25 @@ def migration_readiness_page(request: Request, user=Depends(require_user)):
         <div class="card">
             <h2>Migration Readiness</h2>
             <p class="muted">Poslední výsledek maintenance skriptu {html.escape(PREFLIGHT_SCRIPT)} uložený v databázi. Stav vychází pouze z výstupu skriptu.</p>
+            <div class="inline-form">
                 <form method="post" action="/portal/migration-readiness/run">
                     <button type="submit">Spustit preflight kontrolu</button>
                 </form>
+                <form method="post" action="/portal/migration-readiness/bootstrap" onsubmit="return confirm('Spustit Bootstrap v2? Tato akce upravuje server přes maintenance job.');">
+                    <button type="submit" class="danger">Run Bootstrap v2</button>
+                </form>
+            </div>
+        </div>
+
+        <div class="alert alert-danger">
+            <strong>Bootstrap v2 provádí zásahy do systému.</strong>
+            <ul>
+                <li>Opravuje ownership /opt/appfactory.</li>
+                <li>Nastavuje executable práva pro maintenance a alert skripty.</li>
+                <li>Deployuje core services.</li>
+                <li>Spouští preflight-check.sh.</li>
+            </ul>
+            <p>Portál bootstrap nespouští přímo přes shell. Pouze založí maintenance job pro {html.escape(BOOTSTRAP_SCRIPT)}.</p>
         </div>
 
         <div class="stats-grid">
@@ -68,16 +132,18 @@ def migration_readiness_page(request: Request, user=Depends(require_user)):
         </div>
 
         <div class="card">
-            <h2>Poslední úloha</h2>
+            <h2>Poslední preflight úloha</h2>
             <table>
                 {job_rows}
             </table>
         </div>
 
         <div class="card">
-            <h2>Raw log výstup</h2>
+            <h2>Raw preflight log výstup</h2>
             <pre class="log-viewer log-stdout">{raw_output}</pre>
         </div>
+
+        {render_script_result("Poslední výsledek Bootstrap v2", BOOTSTRAP_SCRIPT, bootstrap_summary)}
         """,
         user=user,
     )
@@ -94,3 +160,16 @@ def run_migration_readiness(user=Depends(require_user)):
         source="portal_manual",
     )
     return RedirectResponse(url=f"/portal/jobs/{job_id}", status_code=303)
+
+
+@router.post("/migration-readiness/bootstrap")
+def run_bootstrap_v2(user=Depends(require_user)):
+    job_id = create_job(
+        job_type="run_script",
+        target_type="maintenance_script",
+        target_id=BOOTSTRAP_SCRIPT,
+        payload={"script_name": BOOTSTRAP_SCRIPT},
+        user=user,
+        source="portal_manual",
+    )
+    return RedirectResponse(url=f"/portal/jobs/{job_id}", status_code=303)