StandupBot

Generate standup updates from recent git activity with a local Ollama model or Groq's free cloud tier.

What is new (unreleased)

Since 0.2.4: a full security/correctness audit (private-IP redaction, a config-mutation bug that could leak an API key across process calls, a broken Linux systemd unit, and a few other fixes), plus a follow-up fix for missing secret-detection patterns (GitHub tokens, AWS keys, Slack tokens, LLM API keys, credentialed URIs) reported via #2. See CHANGELOG.md for the full list.

Quick Start

# Install dependencies
pip install -e .

# Configure StandupBot
standup --setup

# Generate a standup
standup

For Ollama, install and pull a model first:

ollama pull llama3

Providers

Groq API keys should be supplied through GROQ_API_KEY when possible.

Core Commands

# Standard generation
standup
standup --hours 48
standup --week
standup --provider groq

# Output options
standup --copy
standup --slack
standup --raw
standup --template slack
standup --verbose

# Cache and filtering controls
standup --no-cache
standup --no-filter

# Maintenance
standup doctor
standup usage
standup logs
standup logs --tail 50
standup logs --clear
standup models
standup templates
standup history
standup history --limit 25
standup history --clear
standup history --clear --days 30
standup warm-up
standup warm-up --install-startup
standup warm-up --uninstall-startup
standup --maintenance

Templates

Built-in templates:

• default
• slack
• minimal
• detailed
• jira

You can also define custom templates in config. StandupBot extracts yesterday, today, and blockers from the LLM output, then renders the final format with these variables:

• {yesterday}
• {today}
• {blockers}
• {date}
• {time}
• {commit_count}
• {repos}
• {provider}
• {author_email}

Config

StandupBot reads ~/.standup.json.

{
  "repos": [
    "/path/to/repo1",
    "/path/to/repo2"
  ],
  "author_email": "you@example.com",
  "hours_lookback": 24,
  "tone": "casual",
  "slack_webhook_url": "",
  "provider": {
    "name": "ollama",
    "ollama": {
      "base_url": "http://localhost:11434",
      "model": "llama3"
    },
    "groq": {
      "api_key": "",
      "model": "llama-3.1-8b-instant"
    }
  },
  "rate_limit": {
    "cooldown_minutes": 30,
    "max_calls_per_day": 10,
    "enabled": true
  },
  "quality": {
    "enabled": true,
    "min_score": 0,
    "show_breakdown": false
  },
  "noise_filter_enabled": true,
  "template": "default",
  "custom_templates": {
    "my_format": "Done: {yesterday} | Doing: {today} | Help needed: {blockers}"
  },
  "auto_warm_up": false
}

Caching and History

Every generated standup is stored locally in ~/.standup_history.db.

• Cache keys are based on a SHA256 fingerprint of sorted commit hashes.
• Cache reuse is limited to the same day, tone, and provider.
• The database stores standup text, provider metadata, repo names, lookback hours, and quality score.
• Raw commit messages are not stored in the database.

Quality Scoring

After generation, StandupBot can score the standup from 0-100 and show a colored badge.

• Green: 80+
• Yellow: 60-79
• Red: below 60

When quality.min_score is above zero, StandupBot retries low-quality outputs up to two times with refined guidance.

Warm-Up

Use standup warm-up to pre-load the configured model before your first real run.

• Ollama: sends a minimal warm-up request to keep the selected model ready in memory.
• Groq: runs a lightweight availability ping.
• auto_warm_up can trigger a silent warm-up when the model has not been used recently.

Security

StandupBot treats config, git metadata, templates, provider responses, and local storage as hostile inputs until proven otherwise.

• ~/.standup.json, ~/.standup_usage.json, ~/.standup_history.db, and ~/.standup.log use restricted permissions on Unix/macOS.
• Commit messages are scanned for common secret formats — passwords/tokens/API keys, private IPs, internal hostnames, bearer tokens, GitHub PATs, LLM provider keys, AWS access keys, Slack tokens, and credentialed URIs — and redacted before they reach a prompt, storage, or the terminal.
• Repo paths go through explicit path-safety checks to block traversal tricks, network paths, and unsafe symlinks.
• Commit messages and LLM responses are length-capped before they reach prompts, storage, or terminal rendering.
• Custom templates only substitute a fixed allowlist of variables and reject Python-style format syntax.
• All history database queries are parameterized, and stored standup text is sanitized before persistence.
• User-facing exception messages are sanitized so file paths, emails, and API-key-shaped values are not echoed back to the terminal.
• standup doctor now checks log health, DB size, schema version, WAL mode, file permissions, and full config validity.

Development

python -m pytest tests/ -q

If your environment restricts Python temp directories or __pycache__ writes, set a writable --basetemp or PYTHONDONTWRITEBYTECODE=1 while testing.

License

MIT