chore(scripts): add scripts/ for operational tooling

Moves whats_deployed.py and setup_test_mcp_secrets.py out of scratch/ (which
is gitignored and defined as disposable) into a tracked scripts/ dir. Both are
standing operational tools, not throwaways — whats_deployed.py is meant to run
at the start of every session.

Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>

scripts/setup_test_mcp_secrets.py

@@ -0,0 +1,154 @@
+#!/usr/bin/env python
+"""
+One-off: copy the MCP Space secrets from the local .env into the TEST MCP Space.
+
+    source ./demoprep/bin/activate && python scratch/setup_test_mcp_secrets.py
+
+Reads values straight from .env and pushes them to
+`thoughtspot-demoprep/test-mcp` as Repository Secrets. Secret VALUES are never
+printed — only the key names and whether each was set. HF's API is write-only
+for secrets, so values cannot be read back out of the prod Space; .env is the
+source of truth.
+
+Why a separate MCP test Space exists: on 2026-08-25 a logging change went
+straight to the prod MCP Space and failed every build (PermissionError on
+/app/logs under the Space's non-root user). Deploy to test first.
+
+Flags:
+    --dry-run       show what would be set, touch nothing
+    --new-token     generate a FRESH MCP_ACCESS_TOKEN for test instead of
+                    reusing prod's (recommended — a leaked test token should
+                    not unlock the prod MCP Space). Prints it ONCE so you can
+                    hand it to the calling agent; it is not stored locally.
+"""
+
+import argparse
+import secrets
+import sys
+from pathlib import Path
+
+REPO_ID = "thoughtspot-demoprep/test-mcp"
+ENV_PATH = Path(__file__).resolve().parent.parent / ".env"
+
+# Required by the MCP Space (see README.md "Required secrets").
+REQUIRED = [
+    "SUPABASE_URL",
+    "SUPABASE_ANON_KEY",
+    "OPENAI_API_KEY",
+    "MCP_OWNER_EMAIL",
+    "MCP_TS_ENV_LABEL",
+    "MCP_ACCESS_TOKEN",
+]
+# Optional but commonly set.
+OPTIONAL = ["GOOGLE_API_KEY", "ANTHROPIC_API_KEY", "MCP_SHARE_WITH",
+            "MCP_MAX_CONCURRENT_BUILDS"]
+
+
+def load_env(path: Path) -> dict:
+    if not path.exists():
+        sys.exit(f"ERROR: {path} not found — run from the repo root.")
+    env = {}
+    for raw in path.read_text().splitlines():
+        line = raw.strip()
+        if not line or line.startswith("#") or "=" not in line:
+            continue
+        k, v = line.split("=", 1)
+        env[k.strip()] = v.strip().strip('"').strip("'")
+    return env
+
+
+def main() -> None:
+    ap = argparse.ArgumentParser()
+    ap.add_argument("--dry-run", action="store_true")
+    ap.add_argument("--new-token", action="store_true")
+    args = ap.parse_args()
+
+    env = load_env(ENV_PATH)
+
+    # Collect every TS_ENV_<n>_* triple present, plus resolve the KEY_VAR
+    # indirection: TS_ENV_<n>_KEY_VAR holds the NAME of the var carrying the
+    # actual trusted-auth key, so that var has to be copied too.
+    ts_keys = sorted(k for k in env if k.startswith("TS_ENV_"))
+    indirect = []
+    for k in ts_keys:
+        if k.endswith("_KEY_VAR"):
+            target = env.get(k, "").strip()
+            if target and target in env:
+                indirect.append(target)
+            elif target:
+                print(f"  !! {k} points at '{target}' which is NOT in .env "
+                      f"— trusted auth will fail on test until you set it.")
+
+    to_set = REQUIRED + [k for k in OPTIONAL if k in env] + ts_keys + indirect
+    # de-dupe, preserve order
+    seen, ordered = set(), []
+    for k in to_set:
+        if k not in seen:
+            seen.add(k)
+            ordered.append(k)
+
+    fresh_token = None
+    if args.new_token:
+        fresh_token = secrets.token_urlsafe(32)
+
+    missing = [k for k in ordered
+               if not env.get(k) and not (k == "MCP_ACCESS_TOKEN" and fresh_token)]
+
+    print(f"Target Space: {REPO_ID}")
+    print(f"Reading:      {ENV_PATH}")
+    print(f"\n{len(ordered)} secret(s) to set:")
+    for k in ordered:
+        if k == "MCP_ACCESS_TOKEN" and fresh_token:
+            state = "NEWLY GENERATED"
+        elif env.get(k):
+            state = "ok"
+        else:
+            state = "MISSING from .env"
+        print(f"  {k:<28} {state}")
+
+    if missing:
+        print(f"\nWARNING: {len(missing)} required value(s) missing from .env: "
+              f"{', '.join(missing)}")
+        print("The Space will boot but builds will fail until these are set.")
+
+    if args.dry_run:
+        print("\n--dry-run: nothing was changed.")
+        return
+
+    if input("\nPush these to the test Space? [y/N] ").strip().lower() != "y":
+        sys.exit("Aborted.")
+
+    from huggingface_hub import HfApi
+
+    hf_token = env.get("HF_TOKEN")
+    if not hf_token:
+        sys.exit("ERROR: HF_TOKEN not in .env")
+    api = HfApi(token=hf_token)
+
+    ok, failed = 0, []
+    for k in ordered:
+        value = fresh_token if (k == "MCP_ACCESS_TOKEN" and fresh_token) else env.get(k)
+        if not value:
+            continue
+        try:
+            api.add_space_secret(repo_id=REPO_ID, key=k, value=value)
+            print(f"  set {k}")
+            ok += 1
+        except Exception as exc:
+            print(f"  FAILED {k}: {type(exc).__name__}: {exc}")
+            failed.append(k)
+
+    print(f"\nDone: {ok} set, {len(failed)} failed.")
+    if fresh_token:
+        print("\n" + "=" * 62)
+        print("FRESH TEST MCP_ACCESS_TOKEN (shown once — copy it now):")
+        print(f"  {fresh_token}")
+        print("Give this to the calling agent for TEST. Prod keeps its own token.")
+        print("=" * 62)
+    print("\nNEXT: confirm the TS target. If MCP_TS_ENV_LABEL / MCP_OWNER_EMAIL")
+    print("match prod, test builds will create objects in the PROD ThoughtSpot")
+    print("instance. Point test at a non-prod TS env or a throwaway owner.")
+
+
+if __name__ == "__main__":
+    main()

scripts/whats_deployed.py

@@ -0,0 +1,128 @@
+#!/usr/bin/env python
+"""
+What is actually deployed, right now, on every Space.
+
+    .venv/bin/python scratch/whats_deployed.py
+
+Answers the question that was unanswerable during the 2026-08-25 MCP outage:
+which commit is each Space really running, and does any local branch have it?
+
+For each Space it prints the live commit, the runtime stage, and — the part that
+matters — a DRIFT verdict:
+
+  in sync      the deployed sha is the tip of its source branch
+  behind       source branch has newer commits not deployed yet
+  DRIFT        the deployed sha is on NO local branch. Something was pushed
+               straight to the Space. The next normal deploy will revert it.
+
+DRIFT is the condition that caused the outage's second-order problem: hotfix
+4b87c36 lived only on the prod Space for ~10 hours while every local branch
+still carried the bug.
+
+Exit code is 1 if any Space is in DRIFT or not RUNNING, so this can gate a
+deploy script later.
+"""
+
+import subprocess
+import time
+import sys
+
+# Space -> the branch it is supposed to be deployed from.
+SPACES = [
+    ("thoughtspot-demoprep/mcp",      "deploy/mcp",            "MCP  PROD"),
+    ("thoughtspot-demoprep/test-mcp", "deploy/mcp",            "MCP  test"),
+    ("thoughtspot-dp/demoprep",       "origin/main",           "app  PROD"),
+    ("thoughtspot-dp/test-demoprep",  "spike/portal-template", "app  test"),
+]
+
+
+def git(*args, _tries: int = 5) -> str:
+    """Run git, retrying if the host is temporarily out of process slots.
+
+    macOS fork() raises BlockingIOError when the per-user process table is
+    full (e.g. thousands of zombie browser helpers). That is a host condition,
+    not a git failure — back off and retry rather than crashing the report.
+    """
+    for attempt in range(_tries):
+        try:
+            return subprocess.run(("git",) + args, capture_output=True,
+                                  text=True).stdout.strip()
+        except BlockingIOError:
+            if attempt == _tries - 1:
+                raise
+            time.sleep(0.5 * (attempt + 1))
+    return ""
+
+
+def hf_token() -> str:
+    for line in open(".env"):
+        line = line.strip()
+        if line.startswith("HF_TOKEN="):
+            return line.split("=", 1)[1].strip().strip('"').strip("'")
+    sys.exit("ERROR: HF_TOKEN not found in .env")
+
+
+def main() -> None:
+    from huggingface_hub import HfApi
+
+    api = HfApi(token=hf_token())
+    git("fetch", "--all", "--quiet")
+
+    print(f"{'SPACE':<34} {'TIER':<10} {'DEPLOYED':<9} {'STAGE':<14} SOURCE / DRIFT")
+    print("-" * 104)
+
+    problems = 0
+    for repo_id, source, tier in SPACES:
+        try:
+            info = api.space_info(repo_id)
+        except Exception as exc:
+            print(f"{repo_id:<34} {tier:<10} {'?':<9} {'UNREACHABLE':<14} {type(exc).__name__}")
+            problems += 1
+            continue
+
+        sha = (info.sha or "")[:7]
+        stage = getattr(info.runtime, "stage", "?") or "?"
+
+        # Does any local branch contain the deployed commit?
+        if sha and git("cat-file", "-t", sha) == "commit":
+            holders = [b.strip().lstrip("* +").strip()
+                       for b in git("branch", "--contains", sha).splitlines() if b.strip()]
+            if not holders:
+                verdict = "DRIFT — on no local branch! pushed direct to Space"
+                problems += 1
+            else:
+                tip = git("rev-parse", "--short=7", source)
+                if tip == sha:
+                    verdict = f"in sync with {source}"
+                else:
+                    ahead = git("rev-list", "--count", f"{sha}..{source}")
+                    behind = git("rev-list", "--count", f"{source}..{sha}")
+                    if behind != "0":
+                        verdict = (f"DRIFT — {behind} commit(s) deployed that {source} "
+                                   f"lacks (+{ahead} undeployed)")
+                        problems += 1
+                    else:
+                        verdict = f"behind {source} by {ahead} commit(s)"
+        else:
+            verdict = f"deployed sha {sha} UNKNOWN locally — run git fetch --all"
+            problems += 1
+
+        if stage != "RUNNING":
+            problems += 1
+
+        print(f"{repo_id:<34} {tier:<10} {sha:<9} {stage:<14} {verdict}")
+
+    print()
+    if problems:
+        print(f"{problems} issue(s). A DRIFT verdict means: merge the Space's commit back "
+              f"into its source branch BEFORE the next deploy, or it gets reverted.")
+    else:
+        print("All Spaces running and in sync with their source branches.")
+
+    print("\nNote: 'RUNNING' only means the container booted. It does NOT mean builds "
+          "work — GET / returned ok throughout the 2026-08-25 total build outage.")
+    sys.exit(1 if problems else 0)
+
+
+if __name__ == "__main__":
+    main()