@ai-support-agent/cli 0.3.0-beta.1 → 0.3.1-beta.0

package/dist/types/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,WAAW,CAAA;AACzB,cAAc,UAAU,CAAA;AACxB,cAAc,WAAW,CAAA;AACzB,cAAc,QAAQ,CAAA;AACtB,cAAc,SAAS,CAAA;AACvB,cAAc,eAAe,CAAA;AAC7B,cAAc,OAAO,CAAA"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":"AAAA,cAAc,aAAa,CAAA;AAC3B,cAAc,UAAU,CAAA;AACxB,cAAc,WAAW,CAAA;AACzB,cAAc,UAAU,CAAA;AACxB,cAAc,WAAW,CAAA;AACzB,cAAc,QAAQ,CAAA;AACtB,cAAc,SAAS,CAAA;AACvB,cAAc,eAAe,CAAA;AAC7B,cAAc,OAAO,CAAA;AACrB,cAAc,gBAAgB,CAAA"}

package/dist/types/index.js

@@ -23,4 +23,5 @@ __exportStar(require("./chat"), exports);
 __exportStar(require("./alert"), exports);
 __exportStar(require("./tool-output"), exports);
 __exportStar(require("./ecs"), exports);
+__exportStar(require("./server-setup"), exports);
 //# sourceMappingURL=index.js.map

package/dist/types/index.js.map

@@ -1 +1 @@
-{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA2B;AAC3B,2CAAwB;AACxB,4CAAyB;AACzB,2CAAwB;AACxB,4CAAyB;AACzB,yCAAsB;AACtB,0CAAuB;AACvB,gDAA6B;AAC7B,wCAAqB"}
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../src/types/index.ts"],"names":[],"mappings":";;;;;;;;;;;;;;;;AAAA,8CAA2B;AAC3B,2CAAwB;AACxB,4CAAyB;AACzB,2CAAwB;AACxB,4CAAyB;AACzB,yCAAsB;AACtB,0CAAuB;AACvB,gDAA6B;AAC7B,wCAAqB;AACrB,iDAA8B"}

package/dist/types/server-setup.d.ts

@@ -0,0 +1,30 @@
+/**
+ * Server setup execution types (Ansible-driven server provisioning).
+ *
+ * A `server_setup_exec` command runs a fixed set of Ansible roles (bundled
+ * with the agent CLI under `ansible/`) against a single target host, using
+ * an SSH private key fetched Just-In-Time from the API (never persisted
+ * beyond the lifetime of the command). See admin-docs
+ * `docs/features/server-setup.md` for the full design.
+ */
+/** stepType supported by the bundled `ansible/playbook.yml` roles (MVP scope). */
+export type ServerSetupStepType = 'os_init' | 'docker' | 'web_server' | 'database' | 'dns_tls';
+/** One step of a server setup execution: an Ansible role selected by tag, with its variables. */
+export interface ServerSetupStep {
+    stepType: ServerSetupStepType;
+    params: Record<string, string>;
+}
+/** Payload of the `server_setup_exec` command. */
+export interface ServerSetupExecPayload {
+    executionId: string;
+    sshHostId: string;
+    steps: ServerSetupStep[];
+}
+/** Result of a single step, parsed from the `ansible-playbook` JSON callback output. */
+export interface ServerSetupStepResult {
+    stepType: string;
+    status: 'ok' | 'failed' | 'skipped';
+    changed: boolean;
+    message: string;
+}
+//# sourceMappingURL=server-setup.d.ts.map

package/dist/types/server-setup.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-setup.d.ts","sourceRoot":"","sources":["../../src/types/server-setup.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,kFAAkF;AAClF,MAAM,MAAM,mBAAmB,GAAG,SAAS,GAAG,QAAQ,GAAG,YAAY,GAAG,UAAU,GAAG,SAAS,CAAA;AAE9F,iGAAiG;AACjG,MAAM,WAAW,eAAe;IAC9B,QAAQ,EAAE,mBAAmB,CAAA;IAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;CAC/B;AAED,kDAAkD;AAClD,MAAM,WAAW,sBAAsB;IACrC,WAAW,EAAE,MAAM,CAAA;IACnB,SAAS,EAAE,MAAM,CAAA;IACjB,KAAK,EAAE,eAAe,EAAE,CAAA;CACzB;AAED,wFAAwF;AACxF,MAAM,WAAW,qBAAqB;IACpC,QAAQ,EAAE,MAAM,CAAA;IAChB,MAAM,EAAE,IAAI,GAAG,QAAQ,GAAG,SAAS,CAAA;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,OAAO,EAAE,MAAM,CAAA;CAChB"}

package/dist/types/server-setup.js

@@ -0,0 +1,12 @@
+"use strict";
+/**
+ * Server setup execution types (Ansible-driven server provisioning).
+ *
+ * A `server_setup_exec` command runs a fixed set of Ansible roles (bundled
+ * with the agent CLI under `ansible/`) against a single target host, using
+ * an SSH private key fetched Just-In-Time from the API (never persisted
+ * beyond the lifetime of the command). See admin-docs
+ * `docs/features/server-setup.md` for the full design.
+ */
+Object.defineProperty(exports, "__esModule", { value: true });
+//# sourceMappingURL=server-setup.js.map

package/dist/types/server-setup.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"server-setup.js","sourceRoot":"","sources":["../../src/types/server-setup.ts"],"names":[],"mappings":";AAAA;;;;;;;;GAQG"}

package/dist/types/tool-output.d.ts

@@ -59,4 +59,66 @@ export interface TriggerE2eTestResult {
     };
     error?: ToolOutputError;
 }
+/**
+ * `update_system_knowledge` Agent MCP ツールが `POST /api/{tenantCode}/agent/knowledge` に
+ * 送るリクエストボディ。
+ *
+ * `canPublishHint`/`requesterUserId`/`projectCode` を生のリクエストフィールドとしてそのまま
+ * 信用する旧設計には、有効なagentサービストークンさえあればリクエストボディに
+ * `canPublishHint: true` を直接指定して承認ワークフローを完全にバイパスできてしまう
+ * CRITICALな権限バイパス脆弱性があった。api側はこれを修正し、信頼の起点を
+ * 「クライアント自己申告のcanPublishHint」から「サーバー側で発行済みのチャットコマンド
+ * レコードの参照」に変更した。
+ *
+ * `commandId`/`agentId` はツールのスキーマ（LLMが指定できるパラメータ）には含まれない。
+ * agent側が config-writer.ts 経由でMCPサブプロセスの環境変数
+ * （`AI_SUPPORT_AGENT_KNOWLEDGE_COMMAND_ID`/`AI_SUPPORT_AGENT_KNOWLEDGE_AGENT_ID`）へ伝搬し、
+ * ツール実装（`update-system-knowledge.ts`）がそこから読み取ってここに詰める。api側はこの
+ * `commandId`/`agentId` で `AgentCommandQueueService.getCommand(commandId, agentId,
+ * tenantCode)` を引き、コマンド生成時に刻印された本物の `knowledgeCanPublish`/
+ * `knowledgeRequesterUserId` を引き当てる。省略時、またはレコードが見つからない場合は
+ * 安全側のdraftになる。`projectCode` はもはやリクエストボディで受け付けず、常にトークン
+ * 自体のスコープ（`AgentAuthInfo.projectCode`）が使われる。
+ */
+export interface UpdateSystemKnowledgeRequest {
+    /** 指定時は改訂、未指定時は新規作成 */
+    id?: string;
+    title: string;
+    content: string;
+    category: string;
+    tags?: string[];
+    sourceIssue?: string;
+    /**
+     * このナレッジ登録依頼の元になったチャットコマンドのID。api側の
+     * `AgentCommandQueueService.getCommand` によるコマンドレコード引き当てに使う。
+     */
+    commandId?: string;
+    /** 上記コマンドレコード引き当て用のエージェント自身のagentId */
+    agentId?: string;
+    /** 冪等性キー。新規作成時、同一callIdでのリトライは同一のナレッジIDとして扱われる */
+    callId?: string;
+}
+/**
+ * `update_system_knowledge` Agent MCP ツールの結果（`POST /api/{tenantCode}/agent/knowledge` の
+ * レスポンスをそのまま返す）。他の `agent/tools/*` エンドポイントと異なり
+ * `{success, data, error}` ではなく、201でナレッジ詳細オブジェクトを直接返す。
+ */
+export interface UpdateSystemKnowledgeResult {
+    id: string;
+    tenantCode?: string;
+    projectCode?: string;
+    category?: string;
+    title?: string;
+    content?: string;
+    tags?: string[];
+    sourceIssue?: string;
+    /**
+     * サーバー側で `commandId`/`agentId` から引き当てた実際の knowledgeCanPublish が
+     * trueの場合は即時公開(published)、それ以外（省略時・コマンドレコード未検出を含む）は
+     * 承認待ちのdraft
+     */
+    status?: 'published' | 'draft';
+    createdAt?: string;
+    updatedAt?: string;
+}
 //# sourceMappingURL=tool-output.d.ts.map

package/dist/types/tool-output.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"tool-output.d.ts","sourceRoot":"","sources":["../../src/types/tool-output.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACjD,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAClE,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;KAAE,CAAA;IAC5E,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACvB,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACrD,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB"}
+{"version":3,"file":"tool-output.d.ts","sourceRoot":"","sources":["../../src/types/tool-output.ts"],"names":[],"mappings":"AAAA;;;GAGG;AACH,MAAM,WAAW,eAAe;IAC9B,IAAI,EAAE,MAAM,CAAA;IACZ,OAAO,EAAE,MAAM,CAAA;CAChB;AAED,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IACjD,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED,MAAM,WAAW,mBAAmB;IAClC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QAAE,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,SAAS,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,MAAM,CAAA;KAAE,CAAA;IAClE,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED,MAAM,WAAW,kBAAkB;IACjC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,MAAM,CAAC,EAAE,SAAS,GAAG,WAAW,GAAG,QAAQ,CAAA;KAAE,CAAA;IAC5E,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;;;;;GAMG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QAAE,IAAI,EAAE,MAAM,CAAA;KAAE,CAAA;IACvB,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;;;;GAKG;AACH,MAAM,WAAW,oBAAoB;IACnC,OAAO,EAAE,OAAO,CAAA;IAChB,IAAI,CAAC,EAAE;QAAE,WAAW,CAAC,EAAE,MAAM,CAAC;QAAC,UAAU,CAAC,EAAE,OAAO,CAAA;KAAE,CAAA;IACrD,KAAK,CAAC,EAAE,eAAe,CAAA;CACxB;AAED;;;;;;;;;;;;;;;;;;;;GAoBG;AACH,MAAM,WAAW,4BAA4B;IAC3C,uBAAuB;IACvB,EAAE,CAAC,EAAE,MAAM,CAAA;IACX,KAAK,EAAE,MAAM,CAAA;IACb,OAAO,EAAE,MAAM,CAAA;IACf,QAAQ,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;OAGG;IACH,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,uCAAuC;IACvC,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,kDAAkD;IAClD,MAAM,CAAC,EAAE,MAAM,CAAA;CAChB;AAED;;;;GAIG;AACH,MAAM,WAAW,2BAA2B;IAC1C,EAAE,EAAE,MAAM,CAAA;IACV,UAAU,CAAC,EAAE,MAAM,CAAA;IACnB,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB,QAAQ,CAAC,EAAE,MAAM,CAAA;IACjB,KAAK,CAAC,EAAE,MAAM,CAAA;IACd,OAAO,CAAC,EAAE,MAAM,CAAA;IAChB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAA;IACf,WAAW,CAAC,EAAE,MAAM,CAAA;IACpB;;;;OAIG;IACH,MAAM,CAAC,EAAE,WAAW,GAAG,OAAO,CAAA;IAC9B,SAAS,CAAC,EAAE,MAAM,CAAA;IAClB,SAAS,CAAC,EAAE,MAAM,CAAA;CACnB"}

package/docker/Dockerfile

@@ -53,7 +53,36 @@ RUN pip3 install --no-cache-dir --break-system-packages \
     # HTML/XML parsing (for document content extraction)
     beautifulsoup4==4.* lxml==5.* \
     # Character encoding detection (for legacy files)
-    chardet==5.*
+    chardet==5.* \
+    # Server setup execution: runs agent/ansible/playbook.yml against target hosts.
+    # Pinned to a range validated against ansible/callback_plugins/json.py and
+    # ansible/roles/database (CallbackBase's v2_runner_on_*/v2_playbook_on_stats
+    # hooks and module result shapes are internal APIs, not covered by ansible-core's
+    # semver-ish compatibility promise) rather than the previous unbounded `2.*`,
+    # which could silently pick up a future major ansible-core release with
+    # changed callback internals.
+    'ansible-core>=2.16,<2.18'
+
+# Ansible collections used by ansible/roles/database/tasks/main.yml to set the
+# MySQL root / PostgreSQL postgres admin password via a proper module
+# parameter (ansible.mysql.mysql_user / community.postgresql.postgresql_user)
+# instead of interpolating the password into a raw SQL string, which would be
+# vulnerable to SQL injection via a password containing a single quote.
+# `ansible.mysql` is used rather than the now-deprecated
+# `community.mysql.mysql_user` (removal planned for community.mysql 6.0.0).
+# Version ranges pinned for the same reproducibility reason as ansible-core
+# above — an unbounded install could silently pick up a future major release
+# with a changed module interface (e.g. mysql_user/postgresql_user parameter
+# shape) that ansible/roles/database/tasks/main.yml wasn't validated against.
+# Installed to /usr/share/ansible/collections — one of ansible-core's default
+# collection search paths regardless of the runtime user's $HOME — so the
+# collections are found no matter which UID the container ultimately runs as
+# (see docker/entrypoint.sh's dynamic passwd-entry handling for --user).
+RUN ansible-galaxy collection install \
+    'ansible.mysql:>=5.0.0,<6.0.0' \
+    'community.postgresql:>=4.0.0,<5.0.0' \
+    -p /usr/share/ansible/collections \
+    && chmod -R a+rX /usr/share/ansible/collections
 
 # =============================================================================
 # Layer 3: System CLIs — external binary downloads (stable, rarely changes)

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@ai-support-agent/cli",
-  "version": "0.3.0-beta.1",
+  "version": "0.3.1-beta.0",
   "description": "AI Support Agent CLI client",
   "main": "dist/index.js",
   "bin": {
@@ -24,6 +24,7 @@
   "files": [
     "dist",
     "docker",
+    "ansible",
     "playwright.subprocess.config.js",
     "LICENSE",
     "README.md",