Upload 11 files

core/admin.py

@@ -0,0 +1,3 @@
+from django.contrib import admin
+
+# Register your models here.

core/apps.py

@@ -0,0 +1,59 @@
+from django.apps import AppConfig
+from django.utils import timezone
+
+# Module-level variable to store app start time
+APP_START_TIME = None
+
+
+class CoreConfig(AppConfig):
+    name = "core"
+
+    def ready(self):
+        global APP_START_TIME
+        APP_START_TIME = timezone.now()
+
+        # Register signal handlers for worker heartbeat
+        self._register_worker_signals()
+
+        # Use post_migrate signal to ensure heartbeat schedule exists after migrations
+        # This avoids database access during app initialization
+        from django.db.models.signals import post_migrate
+
+        post_migrate.connect(self._on_post_migrate, sender=self)
+
+    def _on_post_migrate(self, sender, **kwargs):
+        """Run after migrations are complete to set up heartbeat schedule."""
+        self._ensure_heartbeat_schedule()
+
+    def _register_worker_signals(self):
+        """Register django-q2 signals for worker heartbeat."""
+        try:
+            from django_q.signals import post_execute
+
+            def update_heartbeat(sender, task, **kwargs):
+                """Update heartbeat timestamp after each task execution."""
+                try:
+                    from core.models import GlobalSettings
+
+                    settings = GlobalSettings.get_settings()
+                    settings.worker_heartbeat_at = timezone.now()
+                    settings.save(update_fields=["worker_heartbeat_at"])
+                except Exception:
+                    pass  # Fail silently - don't break task execution
+
+            post_execute.connect(update_heartbeat, dispatch_uid="worker_heartbeat")
+        except Exception:
+            pass  # django-q signals not available
+
+    def _ensure_heartbeat_schedule(self):
+        """Ensure the worker heartbeat schedule exists in database."""
+        try:
+            # Only run if database tables exist (not during migrations)
+            from django.db import connection
+
+            if "django_q_schedule" in connection.introspection.table_names():
+                from core.services.schedule_service import ScheduleService
+
+                ScheduleService.ensure_heartbeat_schedule()
+        except Exception:
+            pass  # Database not ready yet

core/context_processors.py

@@ -0,0 +1,12 @@
+"""
+Context processors for PyRunner templates.
+"""
+
+from pyrunner.version import __version__
+
+
+def pyrunner_version(request):
+    """Add PyRunner version to template context."""
+    return {
+        "pyrunner_version": __version__,
+    }

core/email.py

@@ -0,0 +1,278 @@
+"""
+Email sending abstraction for magic link authentication.
+Supports multiple backends: Console (dev), Resend API (production).
+"""
+import logging
+from django.conf import settings
+from django.core.mail import EmailMultiAlternatives, send_mail
+from django.urls import reverse
+
+logger = logging.getLogger(__name__)
+
+
+def send_magic_link_email(request, magic_token) -> bool:
+    """
+    Send magic link email using configured backend.
+
+    Args:
+        request: HttpRequest object (for building absolute URL)
+        magic_token: MagicToken instance
+
+    Returns:
+        bool: True if email sent successfully
+    """
+    verify_path = reverse("auth:verify", kwargs={"token": magic_token.token})
+    verify_url = request.build_absolute_uri(verify_path)
+
+    # Print URL directly to console in development (bypasses MIME encoding)
+    if settings.DEBUG:
+        print("\n" + "=" * 60)
+        print("MAGIC LINK (click or copy):")
+        print(verify_url)
+        print("=" * 60 + "\n")
+
+    subject = "Your PyRunner Login Link"
+
+    text_message = f"""Hi there!
+
+Click the link below to sign in to PyRunner:
+
+========================================
+{verify_url}
+========================================
+
+This link will expire in 15 minutes and can only be used once.
+
+If you didn't request this link, you can safely ignore this email.
+
+---
+PyRunner - Python Script Automation
+"""
+
+    html_message = f"""<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <style>
+        body {{ font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }}
+        .container {{ max-width: 600px; margin: 0 auto; padding: 40px 20px; }}
+        .button {{ display: inline-block; background: #2563eb; color: #ffffff !important; padding: 14px 28px; text-decoration: none; border-radius: 6px; font-weight: 600; }}
+        .footer {{ margin-top: 40px; padding-top: 20px; border-top: 1px solid #e5e7eb; color: #6b7280; font-size: 14px; }}
+    </style>
+</head>
+<body>
+    <div class="container">
+        <h2>Sign in to PyRunner</h2>
+        <p>Click the button below to sign in:</p>
+        <p style="margin: 30px 0;">
+            <a href="{verify_url}" class="button">Sign In to PyRunner</a>
+        </p>
+        <p style="color: #6b7280; font-size: 14px;">
+            This link expires in 15 minutes and can only be used once.
+        </p>
+        <p style="color: #6b7280; font-size: 14px;">
+            Or copy and paste this URL into your browser:<br>
+            <code style="background: #f3f4f6; padding: 2px 6px; border-radius: 4px;">{verify_url}</code>
+        </p>
+        <div class="footer">
+            <p>If you didn't request this link, you can safely ignore this email.</p>
+            <p><strong>PyRunner</strong> - Python Script Automation</p>
+        </div>
+    </div>
+</body>
+</html>"""
+
+    return _send_email(magic_token.email, subject, text_message, html_message)
+
+
+def send_password_reset_email(request, user, reset_token) -> bool:
+    """
+    Send password reset email.
+
+    Args:
+        request: HttpRequest object (for building absolute URL)
+        user: User instance
+        reset_token: PasswordResetToken instance
+
+    Returns:
+        bool: True if email sent successfully
+    """
+    reset_path = reverse("auth:reset_password", kwargs={"token": reset_token.token})
+    reset_url = request.build_absolute_uri(reset_path)
+
+    # Print URL directly to console in development
+    if settings.DEBUG:
+        print("\n" + "=" * 60)
+        print("PASSWORD RESET LINK (click or copy):")
+        print(reset_url)
+        print("=" * 60 + "\n")
+
+    subject = "Reset Your PyRunner Password"
+
+    text_message = f"""Hi there!
+
+You requested a password reset for your PyRunner account.
+
+Click the link below to reset your password:
+
+========================================
+{reset_url}
+========================================
+
+This link will expire in 24 hours and can only be used once.
+
+If you didn't request this, you can safely ignore this email.
+
+---
+PyRunner - Python Script Automation
+"""
+
+    html_message = f"""<!DOCTYPE html>
+<html>
+<head>
+    <meta charset="utf-8">
+    <style>
+        body {{ font-family: -apple-system, BlinkMacSystemFont, 'Segoe UI', Roboto, sans-serif; line-height: 1.6; color: #333; }}
+        .container {{ max-width: 600px; margin: 0 auto; padding: 40px 20px; }}
+        .button {{ display: inline-block; background: #2563eb; color: #ffffff !important; padding: 14px 28px; text-decoration: none; border-radius: 6px; font-weight: 600; }}
+        .footer {{ margin-top: 40px; padding-top: 20px; border-top: 1px solid #e5e7eb; color: #6b7280; font-size: 14px; }}
+    </style>
+</head>
+<body>
+    <div class="container">
+        <h2>Reset Your Password</h2>
+        <p>You requested a password reset for your PyRunner account ({user.email}).</p>
+        <p style="margin: 30px 0;">
+            <a href="{reset_url}" class="button">Reset Password</a>
+        </p>
+        <p style="color: #6b7280; font-size: 14px;">
+            This link expires in 24 hours and can only be used once.
+        </p>
+        <p style="color: #6b7280; font-size: 14px;">
+            Or copy and paste this URL into your browser:<br>
+            <code style="background: #f3f4f6; padding: 2px 6px; border-radius: 4px;">{reset_url}</code>
+        </p>
+        <div class="footer">
+            <p>If you didn't request this, you can safely ignore this email.</p>
+            <p><strong>PyRunner</strong> - Python Script Automation</p>
+        </div>
+    </div>
+</body>
+</html>"""
+
+    return _send_email(user.email, subject, text_message, html_message)
+
+
+def _get_db_backend_and_from_email():
+    """
+    Returns (backend, from_email) if GlobalSettings has a non-DISABLED email
+    backend configured, else (None, None). Local imports avoid a circular
+    import with core.services.notification_service.
+    """
+    from core.models import GlobalSettings
+    from core.services.notification_service import NotificationService
+
+    gs = GlobalSettings.get_settings()
+    if gs.email_backend == GlobalSettings.EmailBackend.DISABLED:
+        return None, None
+
+    backend = NotificationService._get_email_backend(gs)
+    if backend is None:
+        return None, None
+
+    from_email = (
+        gs.smtp_from_email
+        if gs.email_backend == GlobalSettings.EmailBackend.SMTP
+        else gs.resend_from_email
+    )
+    return backend, from_email
+
+
+def _send_email(to_email: str, subject: str, text_content: str, html_content: str) -> bool:
+    """
+    Unified sender for auth emails.
+    Resolution order: DB-configured backend → env Resend API → Django send_mail().
+    A DB backend failure is NOT retried via env — it is surfaced as False.
+    """
+    backend, from_email = _get_db_backend_and_from_email()
+    if backend is not None:
+        if not from_email:
+            logger.error(
+                f"DB email backend configured but from_email is empty; cannot send to {to_email}"
+            )
+            return False
+        try:
+            msg = EmailMultiAlternatives(
+                subject=subject,
+                body=text_content,
+                from_email=from_email,
+                to=[to_email],
+                connection=backend,
+            )
+            msg.attach_alternative(html_content, "text/html")
+            msg.send()
+            logger.info(f"Auth email sent to {to_email} via DB backend")
+            return True
+        except Exception as e:
+            logger.error(f"DB backend failed to send auth email to {to_email}: {e}")
+            return False
+
+    if _should_use_resend():
+        return _send_via_resend(to_email, subject, text_content, html_content)
+
+    try:
+        send_mail(
+            subject=subject,
+            message=text_content,
+            from_email=getattr(settings, "DEFAULT_FROM_EMAIL", "noreply@localhost"),
+            recipient_list=[to_email],
+            html_message=html_content,
+            fail_silently=False,
+        )
+        logger.info(f"Auth email sent to {to_email} via env backend")
+        return True
+    except Exception as e:
+        logger.error(f"Env backend failed to send auth email to {to_email}: {e}")
+        return False
+
+
+def _should_use_resend() -> bool:
+    """Check if Resend API should be used."""
+    return (
+        hasattr(settings, "RESEND_API_KEY") and
+        settings.RESEND_API_KEY and
+        getattr(settings, "USE_RESEND", False)
+    )
+
+
+def _send_via_resend(to_email: str, subject: str, text_content: str, html_content: str) -> bool:
+    """
+    Send email via Resend API.
+
+    Requires:
+        - RESEND_API_KEY in settings
+        - USE_RESEND = True in settings
+        - resend package installed
+    """
+    try:
+        import resend
+        resend.api_key = settings.RESEND_API_KEY
+
+        params = {
+            "from": getattr(settings, "DEFAULT_FROM_EMAIL", "noreply@localhost"),
+            "to": [to_email],
+            "subject": subject,
+            "text": text_content,
+            "html": html_content,
+        }
+
+        response = resend.Emails.send(params)
+        logger.info(f"Resend email sent to {to_email}, id: {response.get('id')}")
+        return True
+
+    except ImportError:
+        logger.error("resend package not installed. Run: pip install resend")
+        return False
+    except Exception as e:
+        logger.error(f"Resend API error: {e}")
+        return False

core/executor.py

@@ -0,0 +1,358 @@
+"""
+Script executor module for PyRunner.
+
+This module handles the execution of Python scripts in isolated environments.
+It is designed to be called from django-q2 async tasks.
+"""
+
+import json
+import logging
+import os
+import subprocess
+import tempfile
+import traceback
+from pathlib import Path
+
+from django.conf import settings
+from django.utils import timezone
+
+from core.models import Run, Secret
+from core.services import EncryptionService
+
+logger = logging.getLogger(__name__)
+
+# Maximum output size (1MB) to prevent database bloat
+MAX_OUTPUT_BYTES = 1_000_000
+
+
+def _get_secrets_env() -> dict:
+    """
+    Get all secrets as environment variables.
+
+    Returns:
+        Dict of {key: decrypted_value} for all secrets
+    """
+    secrets_env = {}
+
+    # Only try to get secrets if encryption is configured
+    if not EncryptionService.is_configured():
+        logger.debug("Encryption not configured - secrets will not be injected")
+        return secrets_env
+
+    try:
+        for secret in Secret.objects.all():
+            try:
+                secrets_env[secret.key] = secret.get_decrypted_value()
+            except Exception as e:
+                logger.error(f"Failed to decrypt secret {secret.key}: {e}")
+    except Exception as e:
+        logger.error(f"Failed to load secrets: {e}")
+
+    return secrets_env
+
+
+def _build_script_environment(webhook_data: dict | None = None) -> dict:
+    """
+    Build the environment dict for script execution.
+
+    Combines system environment with secrets, webhook data, and DataStore access.
+    Secrets override any same-named system variables.
+    Webhook data is added with WEBHOOK_ prefix.
+
+    Args:
+        webhook_data: Optional webhook data from HTTP request
+
+    Returns:
+        Environment dict to pass to subprocess
+    """
+    # Start with system environment
+    env = os.environ.copy()
+
+    # Add secrets (overriding any existing vars with same name)
+    secrets = _get_secrets_env()
+    env.update(secrets)
+
+    # Add webhook data if present
+    if webhook_data:
+        env["WEBHOOK_METHOD"] = webhook_data.get("method", "")
+        env["WEBHOOK_QUERY"] = json.dumps(webhook_data.get("query", {}))
+        env["WEBHOOK_CONTENT_TYPE"] = webhook_data.get("content_type", "")
+
+        if "body" in webhook_data:
+            env["WEBHOOK_BODY"] = webhook_data["body"]
+
+        if "body_json" in webhook_data:
+            env["WEBHOOK_BODY_JSON"] = json.dumps(webhook_data["body_json"])
+
+    # Add DataStore support
+    # Set the database path for the pyrunner_datastore module
+    env["PYRUNNER_DB_PATH"] = str(settings.DATABASES["default"]["NAME"])
+
+    # Add script_helpers to PYTHONPATH so scripts can import pyrunner_datastore
+    helpers_path = str(Path(settings.BASE_DIR) / "core" / "script_helpers")
+    existing_pythonpath = env.get("PYTHONPATH", "")
+    if existing_pythonpath:
+        env["PYTHONPATH"] = f"{helpers_path}{os.pathsep}{existing_pythonpath}"
+    else:
+        env["PYTHONPATH"] = helpers_path
+
+    return env
+
+
+def _mask_secrets_in_output(output: str, secrets: dict) -> str:
+    """
+    Mask secret values in output to prevent accidental exposure.
+
+    Args:
+        output: The script output
+        secrets: Dict of {key: value} secrets
+
+    Returns:
+        Output with secret values replaced with [KEY:MASKED]
+    """
+    if not output or not secrets:
+        return output
+
+    masked = output
+    for key, value in secrets.items():
+        if value and len(value) >= 4:  # Only mask non-trivial values
+            masked = masked.replace(value, f"[{key}:MASKED]")
+
+    return masked
+
+
+class ExecutorError(Exception):
+    """Base exception for executor errors."""
+
+    pass
+
+
+class EnvironmentNotFoundError(ExecutorError):
+    """Raised when the environment directory does not exist."""
+
+    pass
+
+
+class PythonNotFoundError(ExecutorError):
+    """Raised when the Python executable is not found."""
+
+    pass
+
+
+def _truncate_output(output: str, max_bytes: int = MAX_OUTPUT_BYTES) -> str:
+    """
+    Truncate output if it exceeds max_bytes.
+
+    Args:
+        output: The output string to potentially truncate
+        max_bytes: Maximum size in bytes (default 1MB)
+
+    Returns:
+        The original or truncated output with notice
+    """
+    if not output:
+        return output
+
+    encoded = output.encode("utf-8", errors="replace")
+    if len(encoded) <= max_bytes:
+        return output
+
+    # Truncate and decode back, keeping a buffer for the notice
+    notice = "\n\n[OUTPUT TRUNCATED - exceeded maximum size]"
+    truncated = encoded[: max_bytes - len(notice.encode())].decode(
+        "utf-8", errors="replace"
+    )
+    return truncated + notice
+
+
+def _validate_environment(run: Run) -> str:
+    """
+    Validate the environment and return the Python executable path.
+
+    Args:
+        run: The Run instance containing the script and environment
+
+    Returns:
+        The absolute path to the Python executable
+
+    Raises:
+        EnvironmentNotFoundError: If environment directory doesn't exist
+        PythonNotFoundError: If Python executable doesn't exist
+    """
+    environment = run.script.environment
+
+    if not environment.exists():
+        raise EnvironmentNotFoundError(
+            f"Environment directory not found: {environment.get_full_path()}"
+        )
+
+    python_path = environment.get_python_executable()
+    if not os.path.isfile(python_path):
+        raise PythonNotFoundError(f"Python executable not found: {python_path}")
+
+    return python_path
+
+
+def execute_run(run: Run, webhook_data: dict | None = None) -> None:
+    """
+    Execute a script run and update the Run record with results.
+
+    This function is designed to be called from a django-q2 async task.
+    It handles all aspects of script execution including:
+    - Writing script code to a temporary file
+    - Running the script with the appropriate Python executable
+    - Capturing stdout/stderr
+    - Handling timeouts
+    - Updating the Run record with results
+
+    Args:
+        run: The Run model instance to execute
+        webhook_data: Optional webhook data to inject as environment variables
+
+    Note:
+        This function always saves the Run state, even on errors.
+        The Run status will be updated to one of:
+        SUCCESS, FAILED, TIMEOUT, or remain FAILED on errors.
+    """
+    script_file_path = None
+
+    try:
+        # Phase 1: Pre-execution validation
+        if run.status != Run.Status.PENDING:
+            logger.warning(
+                f"Run {run.id} is not in PENDING status (current: {run.status}). "
+                "Skipping execution."
+            )
+            return
+
+        # Update to RUNNING status
+        run.status = Run.Status.RUNNING
+        run.started_at = timezone.now()
+        run.save(update_fields=["status", "started_at"])
+
+        # Validate environment
+        try:
+            python_path = _validate_environment(run)
+        except EnvironmentNotFoundError as e:
+            run.status = Run.Status.FAILED
+            run.stderr = str(e)
+            run.ended_at = timezone.now()
+            run.save()
+            logger.error(f"Run {run.id} failed: {e}")
+            return
+        except PythonNotFoundError as e:
+            run.status = Run.Status.FAILED
+            run.stderr = str(e)
+            run.ended_at = timezone.now()
+            run.save()
+            logger.error(f"Run {run.id} failed: {e}")
+            return
+
+        # Ensure working directory exists
+        workdir = Path(settings.SCRIPTS_WORKDIR)
+        workdir.mkdir(parents=True, exist_ok=True)
+
+        # Phase 2: Create temporary script file
+        # Use delete=False for Windows compatibility (must close before subprocess reads)
+        with tempfile.NamedTemporaryFile(
+            mode="w",
+            suffix=".py",
+            delete=False,
+            encoding="utf-8",
+            dir=str(workdir),
+        ) as script_file:
+            # Use code_snapshot if available (preserves code at queue time)
+            code = run.code_snapshot if run.code_snapshot else run.script.code
+            script_file.write(code)
+            script_file_path = script_file.name
+
+        # Phase 3: Execute script
+        try:
+            # Build subprocess arguments
+            cmd = [python_path, script_file_path]
+
+            # Build environment with secrets and webhook data injected
+            script_env = _build_script_environment(webhook_data)
+            secrets = _get_secrets_env()
+
+            # Subprocess kwargs
+            kwargs = {
+                "capture_output": True,
+                "timeout": run.script.timeout_seconds,
+                "cwd": str(workdir),
+                "text": True,
+                "encoding": "utf-8",
+                "errors": "replace",
+                "env": script_env,
+            }
+
+            # Windows-specific: prevent console window popup
+            if os.name == "nt":
+                kwargs["creationflags"] = subprocess.CREATE_NO_WINDOW
+
+            result = subprocess.run(cmd, **kwargs)
+
+            # Process results - mask secrets in output
+            run.stdout = _truncate_output(_mask_secrets_in_output(result.stdout, secrets))
+            run.stderr = _truncate_output(_mask_secrets_in_output(result.stderr, secrets))
+            run.exit_code = result.returncode
+            run.status = (
+                Run.Status.SUCCESS if result.returncode == 0 else Run.Status.FAILED
+            )
+
+        except subprocess.TimeoutExpired as e:
+            # Handle timeout - process is automatically killed
+            run.status = Run.Status.TIMEOUT
+            # TimeoutExpired provides stdout/stderr as bytes even with text=True
+            # Decode them to strings for consistent processing
+            stdout_raw = ""
+            if e.stdout:
+                stdout_raw = e.stdout.decode("utf-8", errors="replace") if isinstance(e.stdout, bytes) else e.stdout
+            stderr_raw = ""
+            if e.stderr:
+                stderr_raw = e.stderr.decode("utf-8", errors="replace") if isinstance(e.stderr, bytes) else e.stderr
+            run.stdout = _truncate_output(_mask_secrets_in_output(stdout_raw, secrets))
+            run.stderr = _truncate_output(_mask_secrets_in_output(stderr_raw, secrets))
+            if run.stderr:
+                run.stderr += "\n\n[TIMEOUT: Script exceeded maximum execution time]"
+            else:
+                run.stderr = (
+                    f"[TIMEOUT: Script exceeded {run.script.timeout_seconds} seconds]"
+                )
+            run.exit_code = -1
+            logger.warning(f"Run {run.id} timed out after {run.script.timeout_seconds}s")
+
+        except subprocess.SubprocessError as e:
+            # Handle other subprocess errors
+            run.status = Run.Status.FAILED
+            run.stderr = f"Subprocess error: {str(e)}"
+            run.exit_code = -1
+            logger.error(f"Run {run.id} subprocess error: {e}")
+
+    except Exception as e:
+        # Catch-all for unexpected errors
+        run.status = Run.Status.FAILED
+        run.stderr = f"Unexpected executor error: {str(e)}\n\n{traceback.format_exc()}"
+        run.exit_code = -1
+        logger.exception(f"Run {run.id} unexpected error")
+
+    finally:
+        # Phase 4: Cleanup and save
+        # Always set end time if not already set
+        if not run.ended_at:
+            run.ended_at = timezone.now()
+
+        # Always save the run state
+        run.save()
+
+        # Cleanup temporary file
+        if script_file_path is not None:
+            try:
+                os.unlink(script_file_path)
+            except OSError as e:
+                logger.warning(f"Failed to delete temp script file: {e}")
+
+        logger.info(
+            f"Run {run.id} completed with status {run.status} "
+            f"(exit_code={run.exit_code})"
+        )

core/forms.py

@@ -0,0 +1,1973 @@
+"""
+Forms for the core app.
+"""
+import re
+from zoneinfo import available_timezones
+
+from django import forms
+from django.utils.text import slugify
+
+from core.models import Script, Environment, ScriptSchedule, Tag, DataStore, DataStoreEntry, DataStoreAPIToken
+from core.services import EnvironmentService
+
+
+# Regex pattern for secret key validation (uppercase, numbers, underscores, must start with letter)
+SECRET_KEY_PATTERN = re.compile(r"^[A-Z][A-Z0-9_]*$")
+
+
+# Common timezone choices (sorted, common ones first)
+COMMON_TIMEZONES = [
+    "UTC",
+    "America/New_York",
+    "America/Chicago",
+    "America/Denver",
+    "America/Los_Angeles",
+    "Europe/London",
+    "Europe/Paris",
+    "Europe/Berlin",
+    "Asia/Tokyo",
+    "Asia/Shanghai",
+    "Asia/Singapore",
+    "Australia/Sydney",
+]
+
+
+def get_timezone_choices():
+    """Generate timezone choices with common ones first."""
+    all_tz = sorted(available_timezones())
+    common = [(tz, tz) for tz in COMMON_TIMEZONES if tz in all_tz]
+    others = [(tz, tz) for tz in all_tz if tz not in COMMON_TIMEZONES]
+    return [("", "---")] + common + [("---", "─" * 20)] + others
+
+
+class ScriptForm(forms.ModelForm):
+    """Form for creating and editing scripts."""
+
+    class Meta:
+        model = Script
+        fields = [
+            "name",
+            "description",
+            "code",
+            "environment",
+            "tags",
+            "timeout_seconds",
+            "is_enabled",
+            "notify_on",
+            "notify_email",
+            "notify_webhook_url",
+            "notify_webhook_enabled",
+        ]
+        widgets = {
+            "name": forms.TextInput(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "placeholder": "My Script Name",
+                }
+            ),
+            "description": forms.Textarea(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "rows": 2,
+                    "placeholder": "What does this script do?",
+                }
+            ),
+            "code": forms.Textarea(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text font-mono text-sm placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "rows": 15,
+                    "placeholder": '# Your Python code here\nprint("Hello, World!")',
+                }
+            ),
+            "environment": forms.Select(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                }
+            ),
+            "tags": forms.CheckboxSelectMultiple(
+                attrs={
+                    "class": "tag-checkbox",
+                }
+            ),
+            "timeout_seconds": forms.NumberInput(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "min": 1,
+                    "max": 86400,
+                }
+            ),
+            "is_enabled": forms.CheckboxInput(
+                attrs={
+                    "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+                }
+            ),
+            "notify_on": forms.Select(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                }
+            ),
+            "notify_email": forms.EmailInput(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "placeholder": "Override default email (optional)",
+                }
+            ),
+            "notify_webhook_url": forms.URLInput(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "placeholder": "https://your-service.com/webhook",
+                }
+            ),
+            "notify_webhook_enabled": forms.CheckboxInput(
+                attrs={
+                    "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+                }
+            ),
+        }
+        labels = {
+            "name": "Script Name",
+            "description": "Description",
+            "code": "Python Code",
+            "environment": "Environment",
+            "tags": "Tags",
+            "timeout_seconds": "Timeout (seconds)",
+            "is_enabled": "Enabled",
+            "notify_on": "Notify On",
+            "notify_email": "Notification Email",
+            "notify_webhook_url": "Webhook URL",
+            "notify_webhook_enabled": "Enable Webhook",
+        }
+        help_texts = {
+            "timeout_seconds": "Maximum execution time (1 second to 24 hours)",
+            "notify_email": "Leave empty to use global default",
+            "notify_webhook_url": "URL to POST notifications to when script completes",
+        }
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        # Only show active environments
+        self.fields["environment"].queryset = Environment.objects.filter(is_active=True)
+
+    def clean_code(self):
+        code = self.cleaned_data.get("code", "").strip()
+        if not code:
+            raise forms.ValidationError("Script code cannot be empty.")
+        return code
+
+    def clean_timeout_seconds(self):
+        timeout = self.cleaned_data.get("timeout_seconds")
+        if timeout is not None and (timeout < 1 or timeout > 86400):
+            raise forms.ValidationError("Timeout must be between 1 and 86400 seconds (24 hours).")
+        return timeout
+
+
+class TagForm(forms.ModelForm):
+    """Form for creating and editing tags."""
+
+    class Meta:
+        model = Tag
+        fields = ["name", "color"]
+        widgets = {
+            "name": forms.TextInput(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "placeholder": "Tag name",
+                }
+            ),
+            "color": forms.Select(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                }
+            ),
+        }
+        labels = {
+            "name": "Tag Name",
+            "color": "Color",
+        }
+
+    def clean_name(self):
+        name = self.cleaned_data.get("name", "").strip()
+        if not name:
+            raise forms.ValidationError("Tag name is required.")
+        # Check uniqueness (excluding current instance for edits)
+        qs = Tag.objects.filter(name__iexact=name)
+        if self.instance.pk:
+            qs = qs.exclude(pk=self.instance.pk)
+        if qs.exists():
+            raise forms.ValidationError("A tag with this name already exists.")
+        return name
+
+
+class ScheduleForm(forms.ModelForm):
+    """Form for configuring script schedules."""
+
+    WEEKDAY_CHOICES = [
+        (0, "Monday"),
+        (1, "Tuesday"),
+        (2, "Wednesday"),
+        (3, "Thursday"),
+        (4, "Friday"),
+        (5, "Saturday"),
+        (6, "Sunday"),
+    ]
+
+    MONTHDAY_CHOICES = [(i, str(i)) for i in range(1, 32)]
+
+    # Custom field for daily times (comma-separated input)
+    daily_times_input = forms.CharField(
+        required=False,
+        widget=forms.TextInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50",
+                "placeholder": "09:00, 18:00",
+            }
+        ),
+        label="Run Times",
+        help_text="Comma-separated times in HH:MM format (24-hour)",
+    )
+
+    # Weekly mode fields
+    weekly_days_input = forms.MultipleChoiceField(
+        required=False,
+        choices=WEEKDAY_CHOICES,
+        widget=forms.CheckboxSelectMultiple(
+            attrs={
+                "class": "sr-only peer",
+            }
+        ),
+        label="Days of Week",
+    )
+
+    weekly_times_input = forms.CharField(
+        required=False,
+        widget=forms.TextInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50",
+                "placeholder": "09:00, 18:00",
+            }
+        ),
+        label="Run Times",
+        help_text="Comma-separated times in HH:MM format (24-hour)",
+    )
+
+    # Monthly mode fields
+    monthly_days_input = forms.MultipleChoiceField(
+        required=False,
+        choices=MONTHDAY_CHOICES,
+        widget=forms.CheckboxSelectMultiple(
+            attrs={
+                "class": "sr-only peer",
+            }
+        ),
+        label="Days of Month",
+    )
+
+    monthly_times_input = forms.CharField(
+        required=False,
+        widget=forms.TextInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50",
+                "placeholder": "09:00, 18:00",
+            }
+        ),
+        label="Run Times",
+        help_text="Comma-separated times in HH:MM format (24-hour)",
+    )
+
+    timezone = forms.ChoiceField(
+        choices=get_timezone_choices,
+        initial="UTC",
+        widget=forms.Select(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50",
+            }
+        ),
+    )
+
+    class Meta:
+        model = ScriptSchedule
+        fields = ["run_mode", "interval_minutes", "timezone", "is_active"]
+        widgets = {
+            "run_mode": forms.RadioSelect(
+                attrs={
+                    "class": "sr-only peer",
+                }
+            ),
+            "interval_minutes": forms.Select(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50",
+                }
+            ),
+            "is_active": forms.CheckboxInput(
+                attrs={
+                    "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+                }
+            ),
+        }
+        labels = {
+            "run_mode": "Run Mode",
+            "interval_minutes": "Interval",
+            "is_active": "Schedule Active",
+        }
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+
+        # Populate daily_times_input from instance
+        if self.instance and self.instance.pk and self.instance.daily_times:
+            self.fields["daily_times_input"].initial = ", ".join(
+                self.instance.daily_times
+            )
+
+        # Populate weekly fields from instance
+        if self.instance and self.instance.pk:
+            if self.instance.weekly_days:
+                self.fields["weekly_days_input"].initial = [
+                    str(d) for d in self.instance.weekly_days
+                ]
+            if self.instance.weekly_times:
+                self.fields["weekly_times_input"].initial = ", ".join(
+                    self.instance.weekly_times
+                )
+
+        # Populate monthly fields from instance
+        if self.instance and self.instance.pk:
+            if self.instance.monthly_days:
+                self.fields["monthly_days_input"].initial = [
+                    str(d) for d in self.instance.monthly_days
+                ]
+            if self.instance.monthly_times:
+                self.fields["monthly_times_input"].initial = ", ".join(
+                    self.instance.monthly_times
+                )
+
+    def _parse_times(self, value):
+        """Parse and validate comma-separated times input."""
+        if not value:
+            return []
+
+        value = value.strip()
+        if not value:
+            return []
+
+        times = []
+        for time_str in value.split(","):
+            time_str = time_str.strip()
+            if not time_str:
+                continue
+
+            # Validate HH:MM format
+            try:
+                parts = time_str.split(":")
+                if len(parts) != 2:
+                    raise ValueError
+                hour, minute = int(parts[0]), int(parts[1])
+                if not (0 <= hour <= 23 and 0 <= minute <= 59):
+                    raise ValueError
+                times.append(f"{hour:02d}:{minute:02d}")
+            except ValueError:
+                raise forms.ValidationError(
+                    f"Invalid time format: '{time_str}'. Use HH:MM (e.g., 09:00)"
+                )
+
+        return times
+
+    def clean_daily_times_input(self):
+        """Parse and validate daily times input."""
+        return self._parse_times(self.cleaned_data.get("daily_times_input", ""))
+
+    def clean_weekly_times_input(self):
+        """Parse and validate weekly times input."""
+        return self._parse_times(self.cleaned_data.get("weekly_times_input", ""))
+
+    def clean_monthly_times_input(self):
+        """Parse and validate monthly times input."""
+        return self._parse_times(self.cleaned_data.get("monthly_times_input", ""))
+
+    def clean(self):
+        cleaned_data = super().clean()
+        run_mode = cleaned_data.get("run_mode")
+
+        if run_mode == ScriptSchedule.RunMode.INTERVAL:
+            if not cleaned_data.get("interval_minutes"):
+                self.add_error(
+                    "interval_minutes", "Interval is required for interval mode."
+                )
+
+        elif run_mode == ScriptSchedule.RunMode.DAILY:
+            daily_times = cleaned_data.get("daily_times_input", [])
+            if not daily_times:
+                self.add_error(
+                    "daily_times_input",
+                    "At least one time is required for daily mode.",
+                )
+
+        elif run_mode == ScriptSchedule.RunMode.WEEKLY:
+            weekly_days = cleaned_data.get("weekly_days_input", [])
+            weekly_times = cleaned_data.get("weekly_times_input", [])
+            if not weekly_days:
+                self.add_error(
+                    "weekly_days_input",
+                    "At least one day is required for weekly mode.",
+                )
+            if not weekly_times:
+                self.add_error(
+                    "weekly_times_input",
+                    "At least one time is required for weekly mode.",
+                )
+
+        elif run_mode == ScriptSchedule.RunMode.MONTHLY:
+            monthly_days = cleaned_data.get("monthly_days_input", [])
+            monthly_times = cleaned_data.get("monthly_times_input", [])
+            if not monthly_days:
+                self.add_error(
+                    "monthly_days_input",
+                    "At least one day is required for monthly mode.",
+                )
+            if not monthly_times:
+                self.add_error(
+                    "monthly_times_input",
+                    "At least one time is required for monthly mode.",
+                )
+
+        return cleaned_data
+
+    def save(self, commit=True):
+        instance = super().save(commit=False)
+
+        # Set daily_times from parsed input
+        instance.daily_times = self.cleaned_data.get("daily_times_input", [])
+
+        # Set weekly fields from parsed input
+        weekly_days = self.cleaned_data.get("weekly_days_input", [])
+        instance.weekly_days = [int(d) for d in weekly_days] if weekly_days else []
+        instance.weekly_times = self.cleaned_data.get("weekly_times_input", [])
+
+        # Set monthly fields from parsed input
+        monthly_days = self.cleaned_data.get("monthly_days_input", [])
+        instance.monthly_days = [int(d) for d in monthly_days] if monthly_days else []
+        instance.monthly_times = self.cleaned_data.get("monthly_times_input", [])
+
+        if commit:
+            instance.save()
+
+        return instance
+
+
+class EnvironmentCreateForm(forms.ModelForm):
+    """Form for creating a new environment."""
+
+    python_path = forms.ChoiceField(
+        choices=[],
+        widget=forms.Select(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+            }
+        ),
+        label="Python Version",
+        help_text="Select Python installation to use for this environment",
+    )
+
+    class Meta:
+        model = Environment
+        fields = ["name", "description"]
+        widgets = {
+            "name": forms.TextInput(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "placeholder": "My Environment",
+                }
+            ),
+            "description": forms.Textarea(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "rows": 2,
+                    "placeholder": "Environment description (optional)",
+                }
+            ),
+        }
+        labels = {
+            "name": "Environment Name",
+            "description": "Description",
+        }
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        # Populate python_path choices from discovered Python installations
+        pythons = EnvironmentService.discover_python_versions()
+        choices = [(p["path"], p["display"]) for p in pythons]
+        if not choices:
+            choices = [("", "No Python installations found")]
+        self.fields["python_path"].choices = choices
+
+    def clean_name(self):
+        """Validate name and check for path uniqueness."""
+        name = self.cleaned_data.get("name", "").strip()
+        if not name:
+            raise forms.ValidationError("Environment name is required.")
+
+        # Generate path from slugified name
+        base_path = slugify(name)
+        if not base_path:
+            base_path = "environment"
+
+        # Ensure path is unique
+        path = base_path
+        counter = 1
+        while Environment.objects.filter(path=path).exists():
+            path = f"{base_path}-{counter}"
+            counter += 1
+
+        # Store generated path for use in view
+        self._generated_path = path
+        return name
+
+    def get_generated_path(self) -> str:
+        """Return the generated path after validation."""
+        return getattr(self, "_generated_path", slugify(self.cleaned_data.get("name", "env")))
+
+
+class EnvironmentEditForm(forms.ModelForm):
+    """Form for editing environment details (name/description only)."""
+
+    class Meta:
+        model = Environment
+        fields = ["name", "description"]
+        widgets = {
+            "name": forms.TextInput(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "placeholder": "My Environment",
+                }
+            ),
+            "description": forms.Textarea(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "rows": 2,
+                    "placeholder": "Environment description (optional)",
+                }
+            ),
+        }
+        labels = {
+            "name": "Environment Name",
+            "description": "Description",
+        }
+
+
+class PackageInstallForm(forms.Form):
+    """Form for installing a single package."""
+
+    package_spec = forms.CharField(
+        max_length=200,
+        widget=forms.TextInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text font-mono placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "placeholder": "requests==2.31.0",
+            }
+        ),
+        label="Package",
+        help_text="Package name with optional version (e.g., requests, django>=4.0)",
+    )
+
+    def clean_package_spec(self):
+        spec = self.cleaned_data.get("package_spec", "").strip()
+        if not spec:
+            raise forms.ValidationError("Package specification is required.")
+        if not EnvironmentService.validate_package_spec(spec):
+            raise forms.ValidationError(
+                "Invalid package specification. Use format: package or package==version"
+            )
+        return spec
+
+
+class BulkInstallForm(forms.Form):
+    """Form for bulk package installation from requirements."""
+
+    requirements = forms.CharField(
+        widget=forms.Textarea(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text font-mono text-sm placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "rows": 10,
+                "placeholder": "requests==2.31.0\ndjango>=4.0\nnumpy",
+            }
+        ),
+        label="Requirements",
+        help_text="Paste requirements.txt content (one package per line)",
+        required=False,
+    )
+
+    requirements_file = forms.FileField(
+        required=False,
+        widget=forms.FileInput(
+            attrs={
+                "class": "block w-full text-sm text-code-muted file:mr-4 file:py-2 file:px-4 file:rounded-lg file:border-0 file:text-sm file:font-semibold file:bg-code-accent file:text-white hover:file:bg-code-accent/90 cursor-pointer",
+                "accept": ".txt",
+            }
+        ),
+        label="Or upload requirements.txt",
+    )
+
+    def clean(self):
+        cleaned_data = super().clean()
+        text = cleaned_data.get("requirements", "").strip()
+        file = cleaned_data.get("requirements_file")
+
+        if not text and not file:
+            raise forms.ValidationError(
+                "Provide requirements text or upload a file."
+            )
+
+        # If file provided, read its content
+        if file:
+            try:
+                content = file.read().decode("utf-8")
+                cleaned_data["requirements"] = content
+            except UnicodeDecodeError:
+                raise forms.ValidationError(
+                    "Could not read file. Ensure it's a valid text file."
+                )
+
+        # Validate each line
+        requirements_text = cleaned_data.get("requirements", "")
+        for line in requirements_text.splitlines():
+            line = line.strip()
+            # Skip empty lines and comments
+            if not line or line.startswith("#") or line.startswith("-"):
+                continue
+            # Extract package spec (first word before any whitespace)
+            pkg_spec = line.split()[0] if line.split() else ""
+            if pkg_spec and not EnvironmentService.validate_package_spec(pkg_spec):
+                raise forms.ValidationError(f"Invalid package specification: {line}")
+
+        return cleaned_data
+
+
+class SecretCreateForm(forms.Form):
+    """Form for creating a new secret."""
+
+    key = forms.CharField(
+        max_length=100,
+        widget=forms.TextInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text font-mono placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent uppercase",
+                "placeholder": "API_KEY",
+                "autocomplete": "off",
+            }
+        ),
+        label="Key Name",
+        help_text="Uppercase letters, numbers, and underscores only. Must start with a letter.",
+    )
+
+    value = forms.CharField(
+        widget=forms.Textarea(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text font-mono placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "rows": 3,
+                "placeholder": "sk-your-secret-value-here",
+                "autocomplete": "off",
+            }
+        ),
+        label="Secret Value",
+        help_text="The secret value (will be encrypted at rest)",
+    )
+
+    description = forms.CharField(
+        required=False,
+        widget=forms.Textarea(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "rows": 2,
+                "placeholder": "What is this secret used for?",
+            }
+        ),
+        label="Description",
+        help_text="Optional description to help remember what this secret is for",
+    )
+
+    def clean_key(self):
+        """Validate and normalize the key."""
+        key = self.cleaned_data.get("key", "").strip().upper()
+
+        if not key:
+            raise forms.ValidationError("Key name is required.")
+
+        if not SECRET_KEY_PATTERN.match(key):
+            raise forms.ValidationError(
+                "Key must start with a letter and contain only uppercase letters, numbers, and underscores."
+            )
+
+        # Check for reserved environment variable names
+        reserved = {
+            "PATH",
+            "HOME",
+            "USER",
+            "SHELL",
+            "PWD",
+            "PYTHONPATH",
+            "VIRTUAL_ENV",
+            "PYTHONHOME",
+            "PYTHONDONTWRITEBYTECODE",
+            "PYTHONUNBUFFERED",
+        }
+        if key in reserved:
+            raise forms.ValidationError(
+                f"'{key}' is a reserved environment variable name."
+            )
+
+        # Check if key already exists
+        from core.models import Secret
+
+        if Secret.objects.filter(key=key).exists():
+            raise forms.ValidationError(f"A secret with key '{key}' already exists.")
+
+        return key
+
+    def clean_value(self):
+        """Validate the secret value."""
+        value = self.cleaned_data.get("value", "")
+
+        if not value:
+            raise forms.ValidationError("Secret value is required.")
+
+        # Reasonable max length for secrets
+        if len(value) > 10000:
+            raise forms.ValidationError(
+                "Secret value is too long (max 10,000 characters)."
+            )
+
+        return value
+
+
+class SecretEditForm(forms.Form):
+    """Form for editing an existing secret (value and description only)."""
+
+    value = forms.CharField(
+        required=False,
+        widget=forms.Textarea(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text font-mono placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "rows": 3,
+                "placeholder": "Leave blank to keep current value",
+                "autocomplete": "off",
+            }
+        ),
+        label="New Secret Value",
+        help_text="Leave blank to keep the current value",
+    )
+
+    description = forms.CharField(
+        required=False,
+        widget=forms.Textarea(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "rows": 2,
+                "placeholder": "What is this secret used for?",
+            }
+        ),
+        label="Description",
+    )
+
+    def clean_value(self):
+        """Validate the secret value if provided."""
+        value = self.cleaned_data.get("value", "")
+
+        if value and len(value) > 10000:
+            raise forms.ValidationError(
+                "Secret value is too long (max 10,000 characters)."
+            )
+
+        return value
+
+
+class NotificationSettingsForm(forms.Form):
+    """Form for global notification settings."""
+
+    from core.models import GlobalSettings
+
+    EMAIL_BACKEND_CHOICES = [
+        (GlobalSettings.EmailBackend.DISABLED, "Disabled"),
+        (GlobalSettings.EmailBackend.SMTP, "SMTP"),
+        (GlobalSettings.EmailBackend.RESEND, "Resend API"),
+    ]
+
+    email_backend = forms.ChoiceField(
+        choices=EMAIL_BACKEND_CHOICES,
+        initial=GlobalSettings.EmailBackend.DISABLED,
+        widget=forms.RadioSelect(
+            attrs={
+                "class": "sr-only peer",
+            }
+        ),
+        label="Email Backend",
+    )
+
+    # SMTP Configuration
+    smtp_host = forms.CharField(
+        required=False,
+        max_length=255,
+        widget=forms.TextInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "placeholder": "smtp.example.com",
+            }
+        ),
+        label="SMTP Host",
+    )
+
+    smtp_port = forms.IntegerField(
+        required=False,
+        initial=587,
+        widget=forms.NumberInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "min": 1,
+                "max": 65535,
+            }
+        ),
+        label="SMTP Port",
+    )
+
+    smtp_username = forms.CharField(
+        required=False,
+        max_length=255,
+        widget=forms.TextInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "placeholder": "username@example.com",
+            }
+        ),
+        label="SMTP Username",
+    )
+
+    smtp_password = forms.CharField(
+        required=False,
+        widget=forms.PasswordInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "placeholder": "Leave blank to keep current",
+                "autocomplete": "new-password",
+            }
+        ),
+        label="SMTP Password",
+    )
+
+    smtp_use_tls = forms.BooleanField(
+        required=False,
+        initial=True,
+        widget=forms.CheckboxInput(
+            attrs={
+                "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+            }
+        ),
+        label="Use TLS",
+    )
+
+    smtp_from_email = forms.EmailField(
+        required=False,
+        widget=forms.EmailInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "placeholder": "noreply@example.com",
+            }
+        ),
+        label="From Email",
+    )
+
+    # Resend Configuration
+    resend_api_key = forms.CharField(
+        required=False,
+        widget=forms.PasswordInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "placeholder": "Leave blank to keep current",
+                "autocomplete": "new-password",
+            }
+        ),
+        label="Resend API Key",
+    )
+
+    resend_from_email = forms.EmailField(
+        required=False,
+        widget=forms.EmailInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "placeholder": "noreply@yourdomain.com",
+            }
+        ),
+        label="From Email",
+    )
+
+    # Default notification email
+    default_notification_email = forms.EmailField(
+        required=False,
+        widget=forms.EmailInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "placeholder": "notifications@example.com",
+            }
+        ),
+        label="Default Notification Email",
+        help_text="All script notifications will be sent here unless overridden per-script.",
+    )
+
+    def __init__(self, *args, instance=None, **kwargs):
+        """Initialize form with existing settings."""
+        super().__init__(*args, **kwargs)
+        if instance:
+            self.fields["email_backend"].initial = instance.email_backend
+            self.fields["smtp_host"].initial = instance.smtp_host
+            self.fields["smtp_port"].initial = instance.smtp_port
+            self.fields["smtp_username"].initial = instance.smtp_username
+            self.fields["smtp_use_tls"].initial = instance.smtp_use_tls
+            self.fields["smtp_from_email"].initial = instance.smtp_from_email
+            self.fields["resend_from_email"].initial = instance.resend_from_email
+            self.fields["default_notification_email"].initial = instance.default_notification_email
+
+    def clean(self):
+        """Validate configuration based on selected backend."""
+        cleaned_data = super().clean()
+        backend = cleaned_data.get("email_backend")
+
+        from core.models import GlobalSettings
+
+        if backend == GlobalSettings.EmailBackend.SMTP:
+            if not cleaned_data.get("smtp_host"):
+                self.add_error("smtp_host", "SMTP host is required for SMTP backend.")
+            if not cleaned_data.get("smtp_from_email"):
+                self.add_error("smtp_from_email", "From email is required for SMTP backend.")
+
+        elif backend == GlobalSettings.EmailBackend.RESEND:
+            if not cleaned_data.get("resend_from_email"):
+                self.add_error("resend_from_email", "From email is required for Resend backend.")
+
+        return cleaned_data
+
+    def save(self, instance):
+        """Save the notification settings to the GlobalSettings instance."""
+        from core.services import EncryptionService
+
+        instance.email_backend = self.cleaned_data["email_backend"]
+        instance.smtp_host = self.cleaned_data.get("smtp_host") or ""
+        instance.smtp_port = self.cleaned_data.get("smtp_port") or 587
+        instance.smtp_username = self.cleaned_data.get("smtp_username") or ""
+        instance.smtp_use_tls = self.cleaned_data.get("smtp_use_tls", True)
+        instance.smtp_from_email = self.cleaned_data.get("smtp_from_email") or ""
+        instance.resend_from_email = self.cleaned_data.get("resend_from_email") or ""
+        instance.default_notification_email = self.cleaned_data.get("default_notification_email") or ""
+
+        # Encrypt and save SMTP password if provided
+        smtp_password = self.cleaned_data.get("smtp_password")
+        if smtp_password:
+            instance.smtp_password_encrypted = EncryptionService.encrypt(smtp_password)
+
+        # Encrypt and save Resend API key if provided
+        resend_api_key = self.cleaned_data.get("resend_api_key")
+        if resend_api_key:
+            instance.resend_api_key_encrypted = EncryptionService.encrypt(resend_api_key)
+
+        instance.save()
+        return instance
+
+
+class GeneralSettingsForm(forms.Form):
+    """Form for general instance settings."""
+
+    from core.models import GlobalSettings
+
+    DATE_FORMAT_CHOICES = [
+        (GlobalSettings.DateFormat.ISO, "YYYY-MM-DD (ISO)"),
+        (GlobalSettings.DateFormat.US, "MM/DD/YYYY (US)"),
+        (GlobalSettings.DateFormat.EU, "DD/MM/YYYY (EU)"),
+        (GlobalSettings.DateFormat.DOT, "DD.MM.YYYY"),
+    ]
+
+    TIME_FORMAT_CHOICES = [
+        (GlobalSettings.TimeFormat.H24, "24-hour (14:30)"),
+        (GlobalSettings.TimeFormat.H12, "12-hour (2:30 PM)"),
+    ]
+
+    instance_name = forms.CharField(
+        max_length=100,
+        required=False,
+        widget=forms.TextInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "placeholder": "PyRunner",
+            }
+        ),
+        label="Instance Name",
+        help_text="Displayed in the header and email notifications",
+    )
+
+    timezone = forms.ChoiceField(
+        choices=get_timezone_choices,
+        initial="UTC",
+        widget=forms.Select(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+            }
+        ),
+        label="Timezone",
+        help_text="Default timezone for displaying dates and times",
+    )
+
+    date_format = forms.ChoiceField(
+        choices=DATE_FORMAT_CHOICES,
+        widget=forms.Select(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+            }
+        ),
+        label="Date Format",
+    )
+
+    time_format = forms.ChoiceField(
+        choices=TIME_FORMAT_CHOICES,
+        widget=forms.Select(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+            }
+        ),
+        label="Time Format",
+    )
+
+    admin_url_slug = forms.CharField(
+        max_length=100,
+        required=False,
+        widget=forms.TextInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "placeholder": "django-admin",
+            }
+        ),
+        label="Django Admin URL",
+        help_text="URL path for Django admin (e.g., 'django-admin' → /django-admin/). Requires app restart.",
+    )
+
+    def clean_admin_url_slug(self):
+        """Validate admin URL slug format."""
+        import re
+        slug = self.cleaned_data.get("admin_url_slug", "django-admin").strip().lower()
+        if not slug:
+            slug = "django-admin"
+        # Remove leading/trailing slashes
+        slug = slug.strip("/")
+        # Validate: alphanumeric, hyphens, underscores only
+        if not re.match(r"^[a-z0-9_-]+$", slug):
+            raise forms.ValidationError(
+                "Admin URL can only contain lowercase letters, numbers, hyphens, and underscores."
+            )
+        # Prevent conflicts with existing routes
+        reserved = ["setup", "auth", "cpanel", "webhook", "static", "media"]
+        if slug in reserved:
+            raise forms.ValidationError(
+                f"'{slug}' is a reserved URL path. Please choose a different name."
+            )
+        return slug
+
+    def __init__(self, *args, instance=None, **kwargs):
+        """Initialize form with existing settings."""
+        super().__init__(*args, **kwargs)
+        if instance:
+            self.fields["instance_name"].initial = instance.instance_name
+            self.fields["timezone"].initial = instance.timezone
+            self.fields["date_format"].initial = instance.date_format
+            self.fields["time_format"].initial = instance.time_format
+            self.fields["admin_url_slug"].initial = instance.admin_url_slug
+
+    def save(self, instance):
+        """Save the general settings to the GlobalSettings instance."""
+        instance.instance_name = self.cleaned_data.get("instance_name") or "PyRunner"
+        instance.timezone = self.cleaned_data.get("timezone") or "UTC"
+        instance.date_format = self.cleaned_data.get("date_format")
+        instance.time_format = self.cleaned_data.get("time_format")
+        instance.admin_url_slug = self.cleaned_data.get("admin_url_slug") or "django-admin"
+        instance.save(update_fields=[
+            "instance_name", "timezone", "date_format", "time_format", "admin_url_slug", "updated_at"
+        ])
+        return instance
+
+
+class LogRetentionForm(forms.Form):
+    """Form for log retention settings."""
+
+    retention_days = forms.IntegerField(
+        min_value=0,
+        initial=0,
+        widget=forms.NumberInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "min": 0,
+            }
+        ),
+        label="Retention Days",
+        help_text="Delete runs older than this many days (0 = keep forever)",
+    )
+
+    retention_count = forms.IntegerField(
+        min_value=0,
+        initial=0,
+        widget=forms.NumberInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "min": 0,
+            }
+        ),
+        label="Retention Count",
+        help_text="Keep only the last N runs per script (0 = unlimited)",
+    )
+
+    auto_cleanup_enabled = forms.BooleanField(
+        required=False,
+        initial=False,
+        widget=forms.CheckboxInput(
+            attrs={
+                "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+            }
+        ),
+        label="Auto Cleanup",
+        help_text="Automatically clean up old runs daily at 2 AM",
+    )
+
+    def __init__(self, *args, instance=None, **kwargs):
+        """Initialize form with existing settings."""
+        super().__init__(*args, **kwargs)
+        if instance:
+            self.fields["retention_days"].initial = instance.retention_days
+            self.fields["retention_count"].initial = instance.retention_count
+            self.fields["auto_cleanup_enabled"].initial = instance.auto_cleanup_enabled
+
+    def save(self, instance):
+        """Save the retention settings to the GlobalSettings instance."""
+        from core.services import RetentionService
+
+        instance.retention_days = self.cleaned_data.get("retention_days") or 0
+        instance.retention_count = self.cleaned_data.get("retention_count") or 0
+
+        # Handle auto cleanup schedule
+        new_auto_cleanup = self.cleaned_data.get("auto_cleanup_enabled", False)
+        old_auto_cleanup = instance.auto_cleanup_enabled
+
+        instance.auto_cleanup_enabled = new_auto_cleanup
+        instance.save(update_fields=[
+            "retention_days", "retention_count", "auto_cleanup_enabled", "updated_at"
+        ])
+
+        # Manage the django-q2 schedule
+        if new_auto_cleanup and not old_auto_cleanup:
+            RetentionService.enable_auto_cleanup()
+        elif not new_auto_cleanup and old_auto_cleanup:
+            RetentionService.disable_auto_cleanup()
+
+        return instance
+
+
+class WorkerSettingsForm(forms.Form):
+    """Form for Django-Q2 worker configuration."""
+
+    q_workers = forms.IntegerField(
+        min_value=1,
+        max_value=16,
+        initial=2,
+        widget=forms.NumberInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "min": 1,
+                "max": 16,
+            }
+        ),
+        label="Worker Count",
+        help_text="Number of worker processes (1-16). More workers can process more tasks simultaneously.",
+    )
+
+    q_timeout = forms.IntegerField(
+        min_value=0,
+        max_value=86400,
+        initial=600,
+        widget=forms.NumberInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "min": 0,
+                "max": 86400,
+            }
+        ),
+        label="Task Timeout (seconds)",
+        help_text="Maximum time a task can run before worker timeout. Use 0 for no timeout (required on Windows). For long-running scripts, also increase the script's own timeout.",
+    )
+
+    q_retry = forms.IntegerField(
+        min_value=60,
+        max_value=86400,
+        initial=660,
+        widget=forms.NumberInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "min": 60,
+                "max": 86400,
+            }
+        ),
+        label="Retry Delay (seconds)",
+        help_text="Time before retrying a failed/timed-out task. Should be greater than timeout.",
+    )
+
+    q_queue_limit = forms.IntegerField(
+        min_value=5,
+        max_value=100,
+        initial=20,
+        widget=forms.NumberInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "min": 5,
+                "max": 100,
+            }
+        ),
+        label="Queue Limit",
+        help_text="Maximum number of tasks that can be queued at once.",
+    )
+
+    def __init__(self, *args, instance=None, **kwargs):
+        """Initialize form with existing settings."""
+        super().__init__(*args, **kwargs)
+        if instance:
+            self.fields["q_workers"].initial = instance.q_workers
+            self.fields["q_timeout"].initial = instance.q_timeout
+            self.fields["q_retry"].initial = instance.q_retry
+            self.fields["q_queue_limit"].initial = instance.q_queue_limit
+
+    def clean(self):
+        """Validate that retry > timeout."""
+        cleaned_data = super().clean()
+        timeout = cleaned_data.get("q_timeout", 0)
+        retry = cleaned_data.get("q_retry", 660)
+
+        if timeout > 0 and retry <= timeout:
+            self.add_error(
+                "q_retry",
+                f"Retry delay ({retry}s) must be greater than timeout ({timeout}s).",
+            )
+
+        return cleaned_data
+
+    def save(self, instance):
+        """Save the worker settings to the GlobalSettings instance."""
+        from django.utils import timezone
+
+        # Check if any values actually changed
+        changed = (
+            instance.q_workers != self.cleaned_data["q_workers"]
+            or instance.q_timeout != self.cleaned_data["q_timeout"]
+            or instance.q_retry != self.cleaned_data["q_retry"]
+            or instance.q_queue_limit != self.cleaned_data["q_queue_limit"]
+        )
+
+        instance.q_workers = self.cleaned_data["q_workers"]
+        instance.q_timeout = self.cleaned_data["q_timeout"]
+        instance.q_retry = self.cleaned_data["q_retry"]
+        instance.q_queue_limit = self.cleaned_data["q_queue_limit"]
+
+        if changed:
+            instance.worker_settings_updated_at = timezone.now()
+
+        instance.save(
+            update_fields=[
+                "q_workers",
+                "q_timeout",
+                "q_retry",
+                "q_queue_limit",
+                "worker_settings_updated_at",
+                "updated_at",
+            ]
+        )
+        return instance
+
+
+class BackupCreateForm(forms.Form):
+    """Form for configuring backup creation."""
+
+    backup_format = forms.ChoiceField(
+        choices=[
+            ("gzip", "Compressed (recommended) - .json.gz"),
+            ("json", "Plain JSON - .json"),
+        ],
+        initial="gzip",
+        widget=forms.RadioSelect(
+            attrs={
+                "class": "w-4 h-4 text-code-accent bg-code-bg border-code-border focus:ring-code-accent",
+            }
+        ),
+        label="Backup format",
+        help_text="Compressed backups are 80-95% smaller",
+    )
+
+    include_datastores = forms.BooleanField(
+        required=False,
+        initial=True,
+        widget=forms.CheckboxInput(
+            attrs={
+                "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+            }
+        ),
+        label="Include DataStores",
+        help_text="Include all DataStores and their key-value entries",
+    )
+
+    include_runs = forms.BooleanField(
+        required=False,
+        initial=True,
+        widget=forms.CheckboxInput(
+            attrs={
+                "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+            }
+        ),
+        label="Include run history",
+        help_text="Include execution history (stdout/stderr)",
+    )
+
+    max_runs = forms.IntegerField(
+        initial=1000,
+        min_value=0,
+        max_value=10000,
+        widget=forms.NumberInput(
+            attrs={
+                "class": "w-full px-4 py-2 bg-code-bg text-code-text border border-code-border rounded-lg focus:ring-2 focus:ring-code-accent focus:border-transparent",
+                "placeholder": "1000",
+            }
+        ),
+        label="Maximum runs to include",
+        help_text="Limit run history to most recent N runs (0 = all runs)",
+    )
+
+    include_package_operations = forms.BooleanField(
+        required=False,
+        initial=False,
+        widget=forms.CheckboxInput(
+            attrs={
+                "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+            }
+        ),
+        label="Include package operations",
+        help_text="Include pip installation history",
+    )
+
+
+class BackupRestoreForm(forms.Form):
+    """Form for restoring from backup."""
+
+    backup_file = forms.FileField(
+        widget=forms.FileInput(
+            attrs={
+                "class": "block w-full text-sm text-code-text file:mr-4 file:py-2 file:px-4 file:rounded-lg file:border-0 file:text-sm file:font-semibold file:bg-code-accent file:text-white hover:file:bg-opacity-90",
+                "accept": ".json,.json.gz,.gz",
+            }
+        ),
+        label="Backup file",
+        help_text="JSON or compressed backup file (.json or .json.gz)",
+    )
+
+    restore_runs = forms.BooleanField(
+        required=False,
+        initial=True,
+        widget=forms.CheckboxInput(
+            attrs={
+                "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+            }
+        ),
+        label="Restore run history",
+        help_text="Import execution history from backup",
+    )
+
+    confirm_delete = forms.BooleanField(
+        required=True,
+        widget=forms.CheckboxInput(
+            attrs={
+                "class": "w-5 h-5 text-red-500 bg-code-bg border-code-border rounded focus:ring-red-500 focus:ring-2",
+            }
+        ),
+        label="I understand all existing data will be deleted",
+        help_text="This action cannot be undone without the automatic backup",
+    )
+
+
+# =============================================================================
+# Data Store Forms
+# =============================================================================
+
+
+class DataStoreForm(forms.ModelForm):
+    """Form for creating and editing data stores."""
+
+    class Meta:
+        model = DataStore
+        fields = ["name", "description"]
+        widgets = {
+            "name": forms.TextInput(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "placeholder": "my_data_store",
+                }
+            ),
+            "description": forms.Textarea(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "rows": 2,
+                    "placeholder": "What is this data store used for?",
+                }
+            ),
+        }
+        labels = {
+            "name": "Store Name",
+            "description": "Description",
+        }
+        help_texts = {
+            "name": "Used in scripts as: DataStore(\"name\")",
+        }
+
+    def clean_name(self):
+        name = self.cleaned_data.get("name", "").strip()
+        if not name:
+            raise forms.ValidationError("Store name is required.")
+        # Check for valid identifier-like name
+        if not name.replace("_", "").replace("-", "").isalnum():
+            raise forms.ValidationError(
+                "Name can only contain letters, numbers, underscores, and hyphens."
+            )
+        # Check uniqueness (excluding current instance for edits)
+        qs = DataStore.objects.filter(name__iexact=name)
+        if self.instance.pk:
+            qs = qs.exclude(pk=self.instance.pk)
+        if qs.exists():
+            raise forms.ValidationError("A data store with this name already exists.")
+        return name
+
+
+class DataStoreEntryForm(forms.Form):
+    """Form for creating and editing data store entries."""
+
+    key = forms.CharField(
+        max_length=255,
+        widget=forms.TextInput(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text font-mono placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "placeholder": "my_key",
+            }
+        ),
+        label="Key",
+        help_text="Unique identifier for this entry",
+    )
+
+    value = forms.CharField(
+        widget=forms.Textarea(
+            attrs={
+                "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text font-mono text-sm placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                "rows": 6,
+                "placeholder": '{"example": "value"}\nor just a string\nor a number like 42',
+            }
+        ),
+        label="Value (JSON)",
+        help_text="JSON value: string, number, boolean, array, or object",
+    )
+
+    def __init__(self, *args, datastore=None, instance=None, **kwargs):
+        super().__init__(*args, **kwargs)
+        self.datastore = datastore
+        self.instance = instance
+
+        # Pre-populate for editing
+        if instance:
+            self.fields["key"].initial = instance.key
+            self.fields["value"].initial = instance.value_json
+
+    def clean_key(self):
+        key = self.cleaned_data.get("key", "").strip()
+        if not key:
+            raise forms.ValidationError("Key is required.")
+        if len(key) > 255:
+            raise forms.ValidationError("Key cannot exceed 255 characters.")
+
+        # Check uniqueness within the data store
+        if self.datastore:
+            qs = DataStoreEntry.objects.filter(datastore=self.datastore, key=key)
+            if self.instance:
+                qs = qs.exclude(pk=self.instance.pk)
+            if qs.exists():
+                raise forms.ValidationError(
+                    f"Key '{key}' already exists in this data store."
+                )
+        return key
+
+    def clean_value(self):
+        import json
+
+        value = self.cleaned_data.get("value", "").strip()
+        if not value:
+            raise forms.ValidationError("Value is required.")
+
+        try:
+            # Validate it's valid JSON
+            json.loads(value)
+        except json.JSONDecodeError as e:
+            raise forms.ValidationError(f"Invalid JSON: {e}")
+
+        return value
+
+
+# =============================================================================
+# API Token Forms
+# =============================================================================
+
+
+class DataStoreAPITokenForm(forms.ModelForm):
+    """Form for creating API tokens."""
+
+    class Meta:
+        model = DataStoreAPIToken
+        fields = ["name", "datastore", "expires_at"]
+        widgets = {
+            "name": forms.TextInput(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "placeholder": "My Dashboard Token",
+                }
+            ),
+            "datastore": forms.Select(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                }
+            ),
+            "expires_at": forms.DateTimeInput(
+                attrs={
+                    "class": "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent",
+                    "type": "datetime-local",
+                },
+                format="%Y-%m-%dT%H:%M",
+            ),
+        }
+        labels = {
+            "name": "Token Name",
+            "datastore": "Scope",
+            "expires_at": "Expires At",
+        }
+        help_texts = {
+            "name": "A friendly name to identify this token",
+            "datastore": "Leave empty for access to all datastores, or select a specific datastore",
+            "expires_at": "Optional. Leave empty for no expiration.",
+        }
+
+    def __init__(self, *args, **kwargs):
+        super().__init__(*args, **kwargs)
+        # Make datastore optional with a clear empty choice
+        self.fields["datastore"].required = False
+        self.fields["datastore"].empty_label = "All Datastores (Global Access)"
+        self.fields["expires_at"].required = False
+
+
+# =============================================================================
+# Authentication Forms
+# =============================================================================
+
+INPUT_CLASS = "w-full px-4 py-3 bg-code-bg border border-code-border rounded-lg text-code-text placeholder-code-muted/50 focus:outline-none focus:ring-2 focus:ring-code-accent/50 focus:border-code-accent"
+
+
+class PasswordLoginForm(forms.Form):
+    """Form for password-based login."""
+
+    email = forms.EmailField(
+        widget=forms.EmailInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "placeholder": "you@example.com",
+                "autocomplete": "email",
+            }
+        ),
+        label="Email address",
+    )
+    password = forms.CharField(
+        widget=forms.PasswordInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "placeholder": "Your password",
+                "autocomplete": "current-password",
+            }
+        ),
+        label="Password",
+    )
+
+
+class SetPasswordForm(forms.Form):
+    """Form for setting or changing password."""
+
+    password = forms.CharField(
+        min_length=8,
+        widget=forms.PasswordInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "placeholder": "New password",
+                "autocomplete": "new-password",
+            }
+        ),
+        label="New Password",
+        help_text="Minimum 8 characters",
+    )
+    password_confirm = forms.CharField(
+        widget=forms.PasswordInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "placeholder": "Confirm new password",
+                "autocomplete": "new-password",
+            }
+        ),
+        label="Confirm Password",
+    )
+
+    def clean(self):
+        cleaned_data = super().clean()
+        password = cleaned_data.get("password")
+        confirm = cleaned_data.get("password_confirm")
+        if password and confirm and password != confirm:
+            raise forms.ValidationError("Passwords do not match.")
+        return cleaned_data
+
+
+class AdminSetupForm(forms.Form):
+    """Form for initial admin setup with password."""
+
+    email = forms.EmailField(
+        widget=forms.EmailInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "placeholder": "admin@example.com",
+                "autocomplete": "email",
+            }
+        ),
+        label="Admin Email",
+    )
+    password = forms.CharField(
+        min_length=8,
+        widget=forms.PasswordInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "placeholder": "Create a strong password",
+                "autocomplete": "new-password",
+            }
+        ),
+        label="Password",
+        help_text="Minimum 8 characters",
+    )
+    password_confirm = forms.CharField(
+        widget=forms.PasswordInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "placeholder": "Confirm password",
+                "autocomplete": "new-password",
+            }
+        ),
+        label="Confirm Password",
+    )
+
+    def clean(self):
+        cleaned_data = super().clean()
+        password = cleaned_data.get("password")
+        confirm = cleaned_data.get("password_confirm")
+        if password and confirm and password != confirm:
+            raise forms.ValidationError("Passwords do not match.")
+        return cleaned_data
+
+
+# =============================================================================
+# Services Forms
+# =============================================================================
+
+
+class S3SettingsForm(forms.Form):
+    """Form for S3 storage configuration."""
+
+    s3_enabled = forms.BooleanField(
+        required=False,
+        initial=False,
+        widget=forms.CheckboxInput(
+            attrs={
+                "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+            }
+        ),
+        label="Enable S3 Storage",
+    )
+
+    s3_endpoint_url = forms.CharField(
+        required=False,
+        max_length=500,
+        widget=forms.TextInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "placeholder": "https://s3.amazonaws.com or https://minio.example.com:9000",
+            }
+        ),
+        label="Endpoint URL",
+        help_text="Leave empty for AWS S3. Required for MinIO, DigitalOcean Spaces, etc.",
+    )
+
+    s3_region = forms.CharField(
+        required=False,
+        max_length=50,
+        initial="us-east-1",
+        widget=forms.TextInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "placeholder": "us-east-1",
+            }
+        ),
+        label="Region",
+    )
+
+    s3_bucket_name = forms.CharField(
+        required=False,
+        max_length=255,
+        widget=forms.TextInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "placeholder": "my-backup-bucket",
+            }
+        ),
+        label="Bucket Name",
+    )
+
+    s3_access_key = forms.CharField(
+        required=False,
+        widget=forms.PasswordInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "placeholder": "Leave blank to keep current",
+                "autocomplete": "new-password",
+            }
+        ),
+        label="Access Key",
+    )
+
+    s3_secret_key = forms.CharField(
+        required=False,
+        widget=forms.PasswordInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "placeholder": "Leave blank to keep current",
+                "autocomplete": "new-password",
+            }
+        ),
+        label="Secret Key",
+    )
+
+    s3_use_ssl = forms.BooleanField(
+        required=False,
+        initial=True,
+        widget=forms.CheckboxInput(
+            attrs={
+                "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+            }
+        ),
+        label="Use SSL/TLS",
+        help_text="Recommended for security. Disable only for local development.",
+    )
+
+    s3_path_style = forms.BooleanField(
+        required=False,
+        initial=False,
+        widget=forms.CheckboxInput(
+            attrs={
+                "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+            }
+        ),
+        label="Path-style addressing",
+        help_text="Required for MinIO and some S3-compatible providers.",
+    )
+
+    def __init__(self, *args, instance=None, **kwargs):
+        """Initialize form with existing settings."""
+        super().__init__(*args, **kwargs)
+        if instance:
+            self.fields["s3_enabled"].initial = instance.s3_enabled
+            self.fields["s3_endpoint_url"].initial = instance.s3_endpoint_url
+            self.fields["s3_region"].initial = instance.s3_region or "us-east-1"
+            self.fields["s3_bucket_name"].initial = instance.s3_bucket_name
+            self.fields["s3_use_ssl"].initial = instance.s3_use_ssl
+            self.fields["s3_path_style"].initial = instance.s3_path_style
+
+    def save(self, instance):
+        """Save the S3 settings to the GlobalSettings instance."""
+        from core.services.encryption_service import EncryptionService
+
+        instance.s3_enabled = self.cleaned_data.get("s3_enabled", False)
+        instance.s3_endpoint_url = self.cleaned_data.get("s3_endpoint_url") or ""
+        instance.s3_region = self.cleaned_data.get("s3_region") or "us-east-1"
+        instance.s3_bucket_name = self.cleaned_data.get("s3_bucket_name") or ""
+        instance.s3_use_ssl = self.cleaned_data.get("s3_use_ssl", True)
+        instance.s3_path_style = self.cleaned_data.get("s3_path_style", False)
+
+        # Encrypt and save access key if provided
+        access_key = self.cleaned_data.get("s3_access_key")
+        if access_key:
+            instance.s3_access_key_encrypted = EncryptionService.encrypt(access_key)
+
+        # Encrypt and save secret key if provided
+        secret_key = self.cleaned_data.get("s3_secret_key")
+        if secret_key:
+            instance.s3_secret_key_encrypted = EncryptionService.encrypt(secret_key)
+
+        instance.save()
+        return instance
+
+
+class S3BackupScheduleForm(forms.Form):
+    """Form for S3 scheduled backup configuration."""
+
+    from core.models import GlobalSettings
+
+    WEEKDAY_CHOICES = [
+        (0, "Monday"),
+        (1, "Tuesday"),
+        (2, "Wednesday"),
+        (3, "Thursday"),
+        (4, "Friday"),
+        (5, "Saturday"),
+        (6, "Sunday"),
+    ]
+
+    s3_backup_enabled = forms.BooleanField(
+        required=False,
+        initial=False,
+        widget=forms.CheckboxInput(
+            attrs={
+                "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+            }
+        ),
+        label="Enable Scheduled Backups",
+    )
+
+    s3_backup_schedule = forms.ChoiceField(
+        choices=GlobalSettings.S3BackupSchedule.choices,
+        initial=GlobalSettings.S3BackupSchedule.DISABLED,
+        widget=forms.Select(
+            attrs={
+                "class": INPUT_CLASS,
+            }
+        ),
+        label="Schedule Frequency",
+    )
+
+    s3_backup_time = forms.TimeField(
+        initial="02:00",
+        widget=forms.TimeInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "type": "time",
+            }
+        ),
+        label="Backup Time",
+        help_text="Time to run backups (in instance timezone)",
+    )
+
+    s3_backup_day = forms.ChoiceField(
+        choices=WEEKDAY_CHOICES,
+        initial=0,
+        widget=forms.Select(
+            attrs={
+                "class": INPUT_CLASS,
+            }
+        ),
+        label="Day of Week",
+        help_text="For weekly backups",
+    )
+
+    s3_backup_prefix = forms.CharField(
+        required=False,
+        max_length=255,
+        initial="pyrunner-backups/",
+        widget=forms.TextInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "placeholder": "pyrunner-backups/",
+            }
+        ),
+        label="S3 Path Prefix",
+        help_text="Path prefix for backup files in the bucket",
+    )
+
+    s3_backup_retention_count = forms.IntegerField(
+        min_value=0,
+        initial=7,
+        widget=forms.NumberInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "min": "0",
+            }
+        ),
+        label="Retention Count",
+        help_text="Keep the last N backups (0 = keep all)",
+    )
+
+    s3_backup_include_runs = forms.BooleanField(
+        required=False,
+        initial=False,
+        widget=forms.CheckboxInput(
+            attrs={
+                "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+            }
+        ),
+        label="Include Run History",
+    )
+
+    s3_backup_max_runs = forms.IntegerField(
+        min_value=0,
+        initial=1000,
+        widget=forms.NumberInput(
+            attrs={
+                "class": INPUT_CLASS,
+                "min": "0",
+            }
+        ),
+        label="Max Runs",
+        help_text="Maximum runs to include (0 = all)",
+    )
+
+    s3_backup_include_datastores = forms.BooleanField(
+        required=False,
+        initial=True,
+        widget=forms.CheckboxInput(
+            attrs={
+                "class": "w-5 h-5 text-code-accent bg-code-bg border-code-border rounded focus:ring-code-accent focus:ring-2",
+            }
+        ),
+        label="Include DataStores",
+    )
+
+    def __init__(self, *args, instance=None, **kwargs):
+        """Initialize form with existing settings."""
+        super().__init__(*args, **kwargs)
+        if instance:
+            self.fields["s3_backup_enabled"].initial = instance.s3_backup_enabled
+            self.fields["s3_backup_schedule"].initial = instance.s3_backup_schedule
+            self.fields["s3_backup_time"].initial = instance.s3_backup_time
+            self.fields["s3_backup_day"].initial = instance.s3_backup_day
+            self.fields["s3_backup_prefix"].initial = instance.s3_backup_prefix or "pyrunner-backups/"
+            self.fields["s3_backup_retention_count"].initial = instance.s3_backup_retention_count
+            self.fields["s3_backup_include_runs"].initial = instance.s3_backup_include_runs
+            self.fields["s3_backup_max_runs"].initial = instance.s3_backup_max_runs
+            self.fields["s3_backup_include_datastores"].initial = instance.s3_backup_include_datastores
+
+    def save(self, instance):
+        """Save the backup schedule settings."""
+        from core.services.backup_schedule_service import BackupScheduleService
+
+        instance.s3_backup_enabled = self.cleaned_data.get("s3_backup_enabled", False)
+        instance.s3_backup_schedule = self.cleaned_data.get("s3_backup_schedule")
+        instance.s3_backup_time = self.cleaned_data.get("s3_backup_time")
+        instance.s3_backup_day = int(self.cleaned_data.get("s3_backup_day", 0))
+        instance.s3_backup_prefix = self.cleaned_data.get("s3_backup_prefix") or "pyrunner-backups/"
+        instance.s3_backup_retention_count = self.cleaned_data.get("s3_backup_retention_count", 7)
+        instance.s3_backup_include_runs = self.cleaned_data.get("s3_backup_include_runs", False)
+        instance.s3_backup_max_runs = self.cleaned_data.get("s3_backup_max_runs", 1000)
+        instance.s3_backup_include_datastores = self.cleaned_data.get("s3_backup_include_datastores", True)
+
+        instance.save()
+
+        # Sync the django-q2 schedule
+        BackupScheduleService.sync_schedule()
+
+        return instance

core/logging.py

@@ -0,0 +1,29 @@
+"""
+Custom logging formatters for PyRunner.
+"""
+import json
+import logging
+from datetime import datetime
+
+
+class JsonFormatter(logging.Formatter):
+    """
+    Format log records as JSON for easier parsing.
+    """
+
+    def format(self, record: logging.LogRecord) -> str:
+        log_entry = {
+            "timestamp": datetime.fromtimestamp(record.created).isoformat(),
+            "level": record.levelname,
+            "logger": record.name,
+            "message": record.getMessage(),
+            "module": record.module,
+            "function": record.funcName,
+            "line": record.lineno,
+        }
+
+        # Add exception info if present
+        if record.exc_info:
+            log_entry["exception"] = self.formatException(record.exc_info)
+
+        return json.dumps(log_entry)

core/middleware.py

@@ -0,0 +1,87 @@
+"""
+Custom middleware for PyRunner.
+"""
+
+import logging
+
+from django.shortcuts import redirect
+from django.urls import reverse
+
+logger = logging.getLogger(__name__)
+
+
+class SetupWizardMiddleware:
+    """
+    Middleware that redirects to setup wizard if initial setup is not completed.
+
+    Allows access to:
+    - /setup/* (the setup wizard itself)
+    - /static/* (static assets)
+    - /<admin_url>/* (emergency access, configurable)
+    """
+
+    # Static allowed paths (always allowed)
+    STATIC_ALLOWED_PREFIXES = [
+        "/setup/",
+        "/static/",
+    ]
+
+    def __init__(self, get_response):
+        self.get_response = get_response
+        self._admin_prefix = None
+
+    def _get_admin_prefix(self):
+        """Get the admin URL prefix (cached after first call)."""
+        if self._admin_prefix is None:
+            try:
+                from core.models import GlobalSettings
+                slug = GlobalSettings.get_settings().admin_url_slug or "django-admin"
+                self._admin_prefix = f"/{slug}/"
+            except Exception:
+                self._admin_prefix = "/django-admin/"
+        return self._admin_prefix
+
+    def _get_allowed_prefixes(self):
+        """Get all allowed path prefixes including dynamic admin URL."""
+        return self.STATIC_ALLOWED_PREFIXES + [self._get_admin_prefix()]
+
+    def __call__(self, request):
+        # Skip for allowed paths
+        if any(
+            request.path.startswith(prefix)
+            for prefix in self._get_allowed_prefixes()
+        ):
+            return self.get_response(request)
+
+        # Check if setup is needed
+        if self._is_setup_needed():
+            setup_url = reverse("setup:setup")
+            if request.path != setup_url:
+                return redirect(setup_url)
+
+        # Check if admin setup is needed (setup complete but no admin user)
+        elif self._is_admin_setup_needed():
+            admin_setup_url = reverse("setup:admin_setup")
+            if request.path != admin_setup_url:
+                return redirect(admin_setup_url)
+
+        return self.get_response(request)
+
+    def _is_setup_needed(self) -> bool:
+        """Check if initial setup has been completed."""
+        try:
+            from core.services.setup_service import SetupService
+            return SetupService.is_setup_needed()
+        except Exception as e:
+            # If we can't check, assume setup is needed
+            logger.debug(f"Setup check failed in middleware: {e}")
+            return True
+
+    def _is_admin_setup_needed(self) -> bool:
+        """Check if admin user needs to be created."""
+        try:
+            from core.services.setup_service import SetupService
+            return SetupService.needs_admin_setup()
+        except Exception as e:
+            logger.debug(f"Admin setup check failed in middleware: {e}")
+            return False

core/tasks.py

@@ -0,0 +1,413 @@
+"""
+Async tasks for PyRunner using django-q2.
+
+This module contains task functions that are executed asynchronously
+by django-q2 workers.
+"""
+
+import logging
+from uuid import UUID
+
+from django.utils import timezone
+from django_q.tasks import async_task
+
+from core.models import Run, Script, ScriptSchedule, GlobalSettings, PackageOperation
+
+logger = logging.getLogger(__name__)
+
+
+def execute_run_task(run_id: str, webhook_data: dict | None = None) -> dict:
+    """
+    Execute a script run asynchronously.
+
+    This is the task function called by django-q2 workers.
+    It fetches the Run by ID and delegates to the executor.
+
+    Args:
+        run_id: The UUID of the Run record (as string)
+        webhook_data: Optional webhook data to inject as environment variables
+
+    Returns:
+        dict: Execution result summary for logging/monitoring
+    """
+    from core.executor import execute_run  # Import here to avoid circular imports
+    from core.services.notification_service import NotificationService
+
+    try:
+        run = Run.objects.select_related("script", "script__environment").get(
+            id=UUID(run_id)
+        )
+    except Run.DoesNotExist:
+        logger.error(f"Run {run_id} not found - task cannot execute")
+        return {
+            "success": False,
+            "run_id": run_id,
+            "error": "Run not found",
+        }
+    except ValueError as e:
+        logger.error(f"Invalid run_id format: {run_id} - {e}")
+        return {
+            "success": False,
+            "run_id": run_id,
+            "error": f"Invalid UUID format: {e}",
+        }
+
+    execute_run(run, webhook_data=webhook_data)
+    run.refresh_from_db()
+
+    # Send notifications after run completion
+    try:
+        notification_results = NotificationService.send_notification(run)
+        if notification_results.get("email_sent") or notification_results.get("webhook_sent"):
+            logger.info(f"Notifications sent for run {run_id}: {notification_results}")
+    except Exception as e:
+        logger.error(f"Failed to send notifications for run {run_id}: {e}")
+
+    logger.info(f"Task completed for Run {run_id} with status {run.status}")
+
+    return {
+        "success": run.status == Run.Status.SUCCESS,
+        "run_id": run_id,
+        "status": run.status,
+        "exit_code": run.exit_code,
+    }
+
+
+def queue_script_run(run: Run, webhook_data: dict | None = None) -> str:
+    """
+    Queue a Run for async execution.
+
+    This is the main entry point for queuing script runs.
+    It handles setting up the async task and storing the task_id.
+
+    Args:
+        run: The Run model instance to execute
+        webhook_data: Optional webhook data to inject as environment variables
+
+    Returns:
+        str: The django-q2 task ID
+
+    Raises:
+        ValueError: If the run is not in PENDING status
+    """
+    if run.status != Run.Status.PENDING:
+        raise ValueError(
+            f"Cannot queue run {run.id}: status is {run.status}, expected PENDING"
+        )
+
+    task_id = async_task(
+        "core.tasks.execute_run_task",
+        str(run.id),
+        webhook_data,
+        task_name=f"run-{run.id}",
+        timeout=run.script.timeout_seconds + 60,
+    )
+
+    run.task_id = task_id
+    run.save(update_fields=["task_id"])
+
+    logger.info(f"Queued Run {run.id} as task {task_id}")
+
+    return task_id
+
+
+def execute_scheduled_run(script_id: str) -> dict:
+    """
+    Execute a scheduled script run.
+    Called by django-q2 scheduler.
+
+    Args:
+        script_id: The UUID of the Script (as string)
+
+    Returns:
+        dict: Execution result summary
+    """
+    from core.services.schedule_service import ScheduleService
+
+    # Check global pause
+    settings = GlobalSettings.get_settings()
+    if settings.schedules_paused:
+        logger.info(f"Scheduled run for script {script_id} skipped - schedules paused")
+        return {"success": False, "error": "Schedules globally paused"}
+
+    try:
+        script = Script.objects.get(id=UUID(script_id))
+    except Script.DoesNotExist:
+        logger.error(f"Script {script_id} not found for scheduled run")
+        return {"success": False, "error": "Script not found"}
+    except ValueError as e:
+        logger.error(f"Invalid script_id format: {script_id} - {e}")
+        return {"success": False, "error": f"Invalid UUID format: {e}"}
+
+    # Check if script can run (enabled and not archived)
+    if not script.can_run:
+        reason = "archived" if script.is_archived else "disabled"
+        logger.info(f"Scheduled run for script {script.name} skipped - script {reason}")
+        return {"success": False, "error": f"Script {reason}"}
+
+    # Check if schedule is active
+    try:
+        schedule = script.schedule
+        if not schedule.is_active:
+            logger.info(
+                f"Scheduled run for script {script.name} skipped - schedule inactive"
+            )
+            return {"success": False, "error": "Schedule inactive"}
+    except ScriptSchedule.DoesNotExist:
+        logger.error(f"No schedule found for script {script.name}")
+        return {"success": False, "error": "No schedule"}
+
+    # Create the run
+    run = Run.objects.create(
+        script=script,
+        status=Run.Status.PENDING,
+        triggered_by=None,  # System-triggered
+        trigger_type=Run.TriggerType.SCHEDULED,
+        code_snapshot=script.code,
+    )
+
+    # Update schedule tracking
+    schedule.last_scheduled_run = timezone.now()
+    schedule.save(update_fields=["last_scheduled_run"])
+
+    # Queue for execution
+    queue_script_run(run)
+
+    # Update next_run cache
+    schedule.next_run = ScheduleService._calculate_next_run(schedule)
+    schedule.save(update_fields=["next_run"])
+
+    logger.info(f"Scheduled run {run.id} created for script {script.name}")
+
+    return {
+        "success": True,
+        "run_id": str(run.id),
+        "script_id": script_id,
+    }
+
+
+def execute_package_operation(operation_id: str) -> dict:
+    """
+    Execute a package operation (install/uninstall) asynchronously.
+    Called by django-q2 workers.
+
+    Args:
+        operation_id: The UUID of the PackageOperation record (as string)
+
+    Returns:
+        dict: Operation result summary
+    """
+    from core.services.environment_service import EnvironmentService
+
+    try:
+        operation = PackageOperation.objects.select_related("environment").get(
+            id=UUID(operation_id)
+        )
+    except PackageOperation.DoesNotExist:
+        logger.error(f"PackageOperation {operation_id} not found")
+        return {"success": False, "error": "Operation not found"}
+    except ValueError as e:
+        logger.error(f"Invalid operation_id format: {operation_id} - {e}")
+        return {"success": False, "error": f"Invalid UUID format: {e}"}
+
+    # Update to running
+    operation.status = PackageOperation.Status.RUNNING
+    operation.started_at = timezone.now()
+    operation.save(update_fields=["status", "started_at"])
+
+    environment = operation.environment
+
+    try:
+        if operation.operation == PackageOperation.Operation.INSTALL:
+            success, stdout, stderr = EnvironmentService.install_package(
+                environment, operation.package_spec
+            )
+        elif operation.operation == PackageOperation.Operation.UNINSTALL:
+            success, stdout, stderr = EnvironmentService.uninstall_package(
+                environment, operation.package_spec
+            )
+        elif operation.operation == PackageOperation.Operation.BULK_INSTALL:
+            success, stdout, stderr = EnvironmentService.install_requirements(
+                environment, operation.package_spec
+            )
+        else:
+            success, stdout, stderr = False, "", "Unknown operation type"
+
+        operation.output = stdout
+        operation.error = stderr
+        operation.status = (
+            PackageOperation.Status.SUCCESS
+            if success
+            else PackageOperation.Status.FAILED
+        )
+
+        # Update environment requirements cache on success
+        if success:
+            environment.requirements = EnvironmentService.pip_freeze(environment)
+            environment.save(update_fields=["requirements", "updated_at"])
+
+    except Exception as e:
+        operation.status = PackageOperation.Status.FAILED
+        operation.error = str(e)
+        logger.exception(f"Package operation {operation_id} failed with exception")
+
+    operation.completed_at = timezone.now()
+    operation.save()
+
+    logger.info(
+        f"Package operation {operation_id} completed with status {operation.status}"
+    )
+
+    return {
+        "success": operation.status == PackageOperation.Status.SUCCESS,
+        "operation_id": operation_id,
+        "status": operation.status,
+    }
+
+
+def cleanup_old_runs_task() -> dict:
+    """
+    Clean up old runs based on retention settings.
+    Called by django-q2 scheduler or manually.
+
+    Returns:
+        dict: Cleanup result summary with count of deleted runs
+    """
+    from core.services.retention_service import RetentionService
+
+    try:
+        deleted_count = RetentionService.cleanup_all_runs()
+
+        # Update last_cleanup_at timestamp
+        settings = GlobalSettings.get_settings()
+        settings.last_cleanup_at = timezone.now()
+        settings.save(update_fields=["last_cleanup_at"])
+
+        logger.info(f"Cleanup task completed: {deleted_count} runs deleted")
+        return {"success": True, "deleted_count": deleted_count}
+    except Exception as e:
+        logger.exception("Cleanup task failed")
+        return {"success": False, "error": str(e)}
+
+
+def worker_heartbeat_task() -> dict:
+    """
+    Heartbeat task that runs periodically to indicate workers are alive.
+    Updates the worker_heartbeat_at timestamp in GlobalSettings.
+
+    This task is scheduled to run every minute when qcluster starts.
+    It allows the system to detect when workers have stopped.
+
+    Returns:
+        dict: Result with timestamp of heartbeat
+    """
+    try:
+        settings = GlobalSettings.get_settings()
+        settings.worker_heartbeat_at = timezone.now()
+        settings.save(update_fields=["worker_heartbeat_at"])
+
+        logger.debug("Worker heartbeat updated")
+        return {"success": True, "heartbeat_at": str(settings.worker_heartbeat_at)}
+    except Exception as e:
+        logger.exception("Worker heartbeat failed")
+        return {"success": False, "error": str(e)}
+
+
+def scheduled_backup_task() -> dict:
+    """
+    Execute a scheduled backup to S3.
+    Called by django-q2 scheduler.
+
+    Creates a backup, uploads to S3, and applies retention policy.
+
+    Returns:
+        dict: Backup result summary
+    """
+    from core.services.backup_service import BackupService
+    from core.services.s3_service import S3Service
+    from core.services.backup_schedule_service import BackupScheduleService
+
+    settings = GlobalSettings.get_settings()
+
+    # Validate S3 is configured
+    if not settings.s3_enabled:
+        logger.warning("Scheduled backup skipped - S3 not enabled")
+        return {"success": False, "error": "S3 not enabled"}
+
+    if not S3Service.is_configured():
+        logger.warning("Scheduled backup skipped - S3 not configured")
+        return {"success": False, "error": "S3 not configured"}
+
+    try:
+        # Create backup
+        backup_data = BackupService.create_backup(
+            include_runs=settings.s3_backup_include_runs,
+            max_runs=settings.s3_backup_max_runs,
+            include_package_operations=False,
+            include_datastores=settings.s3_backup_include_datastores,
+            created_by_user=None,  # System backup
+        )
+
+        # Serialize to gzip
+        file_bytes, _ = BackupService.serialize_backup(
+            backup_data,
+            format=BackupService.FORMAT_GZIP,
+        )
+
+        # Generate S3 key
+        key = S3Service.generate_backup_key()
+
+        # Upload to S3
+        result = S3Service.upload_file(file_bytes, key)
+
+        if result["success"]:
+            # Update tracking
+            settings.s3_backup_last_run_at = timezone.now()
+            settings.s3_backup_last_status = "success"
+            settings.s3_backup_last_error = ""
+            settings.s3_backup_last_size = result["size"]
+            settings.save(update_fields=[
+                "s3_backup_last_run_at",
+                "s3_backup_last_status",
+                "s3_backup_last_error",
+                "s3_backup_last_size",
+            ])
+
+            # Apply retention cleanup
+            deleted = BackupScheduleService.apply_retention()
+
+            logger.info(f"Scheduled backup completed: {key} ({result['size']} bytes)")
+
+            return {
+                "success": True,
+                "key": key,
+                "size": result["size"],
+                "retention_deleted": deleted,
+            }
+        else:
+            # Update tracking with error
+            settings.s3_backup_last_run_at = timezone.now()
+            settings.s3_backup_last_status = "failed"
+            settings.s3_backup_last_error = result.get("error", "Unknown error")
+            settings.save(update_fields=[
+                "s3_backup_last_run_at",
+                "s3_backup_last_status",
+                "s3_backup_last_error",
+            ])
+
+            logger.error(f"Scheduled backup failed: {result.get('error')}")
+            return {"success": False, "error": result.get("error")}
+
+    except Exception as e:
+        # Update tracking with error
+        settings.s3_backup_last_run_at = timezone.now()
+        settings.s3_backup_last_status = "failed"
+        settings.s3_backup_last_error = str(e)
+        settings.save(update_fields=[
+            "s3_backup_last_run_at",
+            "s3_backup_last_status",
+            "s3_backup_last_error",
+        ])
+
+        logger.exception("Scheduled backup task failed")
+        return {"success": False, "error": str(e)}

core/tests.py

@@ -0,0 +1,3 @@
+from django.test import TestCase
+
+# Create your tests here.