@calltelemetry/ct-lab-mcp 0.1.5 → 0.3.0

package/dist/src/canonical/bridge.d.ts

@@ -0,0 +1,28 @@
+import { CanonicalCommandResult, LabPreflightInput, LabPreflightResult } from "./types.js";
+export interface CanonicalLabBridgeOptions {
+    cliPath?: string;
+    inventoryFile?: string;
+    args?: string[];
+    timeoutMs?: number;
+    required?: boolean;
+    runner?: (args: string[]) => Promise<Pick<CanonicalCommandResult, "exitCode" | "stdout" | "stderr">>;
+}
+export declare class CanonicalBridgeError extends Error {
+    readonly code = "CANONICAL_INVENTORY_UNAVAILABLE";
+    constructor(message: string);
+}
+export declare class CanonicalLabBridge {
+    private readonly cliPath?;
+    private readonly inventoryFile?;
+    private readonly prefixArgs;
+    private readonly timeoutMs;
+    private readonly required;
+    private readonly runner?;
+    constructor(options?: CanonicalLabBridgeOptions);
+    get isConfigured(): boolean;
+    /** The canonical CLI owns identity and lease policy in this mode. */
+    get isRequired(): boolean;
+    run(args: string[]): Promise<CanonicalCommandResult>;
+    preflight(input: LabPreflightInput): Promise<LabPreflightResult>;
+}
+//# sourceMappingURL=bridge.d.ts.map

package/dist/src/canonical/bridge.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.d.ts","sourceRoot":"","sources":["../../../src/canonical/bridge.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,sBAAsB,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAK3F,MAAM,WAAW,yBAAyB;IACxC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,IAAI,CAAC,EAAE,MAAM,EAAE,CAAC;IAChB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,MAAM,CAAC,EAAE,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,OAAO,CAAC,IAAI,CAAC,sBAAsB,EAAE,UAAU,GAAG,QAAQ,GAAG,QAAQ,CAAC,CAAC,CAAC;CACtG;AAED,qBAAa,oBAAqB,SAAQ,KAAK;IAC7C,QAAQ,CAAC,IAAI,qCAAqC;gBAEtC,OAAO,EAAE,MAAM;CAI5B;AAiBD,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAC,CAAS;IAClC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAC,CAAS;IACxC,OAAO,CAAC,QAAQ,CAAC,UAAU,CAAW;IACtC,OAAO,CAAC,QAAQ,CAAC,SAAS,CAAS;IACnC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAU;IACnC,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAC,CAAsC;gBAElD,OAAO,GAAE,yBAA8B;IASnD,IAAI,YAAY,IAAI,OAAO,CAE1B;IAED,qEAAqE;IACrE,IAAI,UAAU,IAAI,OAAO,CAExB;IAEK,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,GAAG,OAAO,CAAC,sBAAsB,CAAC;IA6CpD,SAAS,CAAC,KAAK,EAAE,iBAAiB,GAAG,OAAO,CAAC,kBAAkB,CAAC;CA8FvE"}

package/dist/src/canonical/bridge.js

@@ -0,0 +1,179 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { defaultRedactor } from "../utils/redactor.js";
+const execFileAsync = promisify(execFile);
+export class CanonicalBridgeError extends Error {
+    code = "CANONICAL_INVENTORY_UNAVAILABLE";
+    constructor(message) {
+        super(message);
+        this.name = "CanonicalBridgeError";
+    }
+}
+function redact(text) {
+    let result = defaultRedactor.redactString(text);
+    // Preserve machine-readable evidence while redacting JSON object keys
+    // recursively (plain string regexes cannot safely cover escaped values).
+    try {
+        const parsed = JSON.parse(text);
+        result = JSON.stringify(defaultRedactor.redactObject(parsed));
+    }
+    catch {
+        // Non-JSON CLI output is already covered by the string redactor above.
+    }
+    return result
+        .replace(/(["']?(?:DOPPLER_TOKEN|LAB_[A-Z0-9_]*(?:TOKEN|SECRET|PASSWORD)|password|passwd|token|secret|private_key|privateKey)["']?)\s*([:=])\s*(["']?)[^\s,"'}]+\3/gi, "$1$2[REDACTED]")
+        .replace(/(authorization\s*:\s*bearer\s+)["']?[^\s"']+["']?/gi, "$1[REDACTED]");
+}
+export class CanonicalLabBridge {
+    cliPath;
+    inventoryFile;
+    prefixArgs;
+    timeoutMs;
+    required;
+    runner;
+    constructor(options = {}) {
+        this.cliPath = options.cliPath || process.env.CT_LAB_CANONICAL_CLI;
+        this.inventoryFile = options.inventoryFile || process.env.LAB_INVENTORY_FILE;
+        this.prefixArgs = options.args || [];
+        this.timeoutMs = options.timeoutMs ?? Number(process.env.CT_LAB_CANONICAL_TIMEOUT_MS || 30_000);
+        this.required = options.required ?? process.env.CT_LAB_CANONICAL_REQUIRED === "1";
+        this.runner = options.runner;
+    }
+    get isConfigured() {
+        return Boolean(this.runner || this.cliPath);
+    }
+    /** The canonical CLI owns identity and lease policy in this mode. */
+    get isRequired() {
+        return this.required;
+    }
+    async run(args) {
+        if (!this.isConfigured) {
+            throw new CanonicalBridgeError("canonical lab CLI is not configured");
+        }
+        const command = [
+            ...(this.inventoryFile ? ["--file", this.inventoryFile] : []),
+            ...args,
+        ];
+        if (this.runner) {
+            const result = await this.runner(command);
+            return {
+                command,
+                exitCode: result.exitCode,
+                stdout: redact(result.stdout),
+                stderr: redact(result.stderr),
+            };
+        }
+        try {
+            const result = await execFileAsync(this.cliPath, [...this.prefixArgs, ...command], {
+                env: process.env,
+                timeout: this.timeoutMs,
+                maxBuffer: 4 * 1024 * 1024,
+                encoding: "utf8",
+            });
+            return {
+                command,
+                exitCode: 0,
+                stdout: redact(result.stdout),
+                stderr: redact(result.stderr),
+            };
+        }
+        catch (error) {
+            const exitCode = typeof error?.code === "number" ? error.code : 1;
+            return {
+                command,
+                exitCode,
+                stdout: redact(String(error?.stdout || "")),
+                stderr: redact(String(error?.stderr || error?.message || "")),
+                timedOut: Boolean(error?.killed),
+            };
+        }
+    }
+    async preflight(input) {
+        const base = {
+            assetId: input.assetId,
+            linearIssue: input.linearIssue,
+            evidence: {},
+        };
+        if (!this.isConfigured) {
+            if (this.required) {
+                return {
+                    ...base,
+                    status: "blocked",
+                    blockedAt: "configuration",
+                    checks: { inventory: "blocked", identity: "not_run", ownership: "not_run", releaseLine: "not_run" },
+                    message: "canonical lab CLI is not configured",
+                };
+            }
+            throw new CanonicalBridgeError("canonical lab CLI is not configured");
+        }
+        const inventory = await this.run(["validate"]);
+        base.evidence.inventory = inventory;
+        if (inventory.exitCode !== 0) {
+            return {
+                ...base,
+                status: "blocked",
+                blockedAt: "inventory",
+                checks: { inventory: "blocked", identity: "not_run", ownership: "not_run", releaseLine: "not_run" },
+                message: inventory.stderr || inventory.stdout || "canonical inventory validation failed",
+                command: inventory.command,
+            };
+        }
+        const identity = await this.run(["vm", "status", "--asset-id", input.assetId]);
+        base.evidence.identity = identity;
+        if (identity.exitCode !== 0) {
+            return {
+                ...base,
+                status: "blocked",
+                blockedAt: "identity",
+                checks: { inventory: "passed", identity: "blocked", ownership: "not_run", releaseLine: "not_run" },
+                message: identity.stderr || identity.stdout || "canonical VM identity validation failed",
+                command: identity.command,
+            };
+        }
+        const ownership = await this.run(["context", "--asset-id", input.assetId]);
+        base.evidence.ownership = ownership;
+        let ownsIssue = false;
+        try {
+            const payload = JSON.parse(ownership.stdout);
+            ownsIssue = (payload.linear_context || []).some((entry) => entry.key?.toUpperCase() === input.linearIssue.toUpperCase() && entry.status === "available");
+        }
+        catch {
+            ownsIssue = false;
+        }
+        if (ownership.exitCode !== 0 || !ownsIssue) {
+            return {
+                ...base,
+                status: "blocked",
+                blockedAt: "ownership",
+                checks: { inventory: "passed", identity: "passed", ownership: "blocked", releaseLine: "not_run" },
+                message: ownership.stderr || "canonical asset is not provably owned by the supplied Linear issue",
+                command: ownership.command,
+            };
+        }
+        const releaseLine = await this.run([
+            "fleet",
+            "versions",
+            "--asset-id",
+            input.assetId,
+            "--format",
+            "json",
+        ]);
+        base.evidence.releaseLine = releaseLine;
+        if (releaseLine.exitCode !== 0) {
+            return {
+                ...base,
+                status: "blocked",
+                blockedAt: "releaseLine",
+                checks: { inventory: "passed", identity: "passed", ownership: "passed", releaseLine: "blocked" },
+                message: releaseLine.stderr || releaseLine.stdout || "release-line qualification failed",
+                command: releaseLine.command,
+            };
+        }
+        return {
+            ...base,
+            status: "passed",
+            checks: { inventory: "passed", identity: "passed", ownership: "passed", releaseLine: "passed" },
+        };
+    }
+}
+//# sourceMappingURL=bridge.js.map

package/dist/src/canonical/bridge.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"bridge.js","sourceRoot":"","sources":["../../../src/canonical/bridge.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAEtC,OAAO,EAAE,eAAe,EAAE,MAAM,sBAAsB,CAAC;AAEvD,MAAM,aAAa,GAAG,SAAS,CAAC,QAAQ,CAAC,CAAC;AAW1C,MAAM,OAAO,oBAAqB,SAAQ,KAAK;IACpC,IAAI,GAAG,iCAAiC,CAAC;IAElD,YAAY,OAAe;QACzB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,sBAAsB,CAAC;IACrC,CAAC;CACF;AAED,SAAS,MAAM,CAAC,IAAY;IAC1B,IAAI,MAAM,GAAG,eAAe,CAAC,YAAY,CAAC,IAAI,CAAC,CAAC;IAChD,sEAAsE;IACtE,yEAAyE;IACzE,IAAI,CAAC;QACH,MAAM,MAAM,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAY,CAAC;QAC3C,MAAM,GAAG,IAAI,CAAC,SAAS,CAAC,eAAe,CAAC,YAAY,CAAC,MAAM,CAAC,CAAC,CAAC;IAChE,CAAC;IAAC,MAAM,CAAC;QACP,uEAAuE;IACzE,CAAC;IACD,OAAO,MAAM;SACV,OAAO,CAAC,4JAA4J,EAAE,gBAAgB,CAAC;SACvL,OAAO,CAAC,qDAAqD,EAAE,cAAc,CAAC,CAAC;AACpF,CAAC;AAED,MAAM,OAAO,kBAAkB;IACZ,OAAO,CAAU;IACjB,aAAa,CAAU;IACvB,UAAU,CAAW;IACrB,SAAS,CAAS;IAClB,QAAQ,CAAU;IAClB,MAAM,CAAuC;IAE9D,YAAY,UAAqC,EAAE;QACjD,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC,OAAO,IAAI,OAAO,CAAC,GAAG,CAAC,oBAAoB,CAAC;QACnE,IAAI,CAAC,aAAa,GAAG,OAAO,CAAC,aAAa,IAAI,OAAO,CAAC,GAAG,CAAC,kBAAkB,CAAC;QAC7E,IAAI,CAAC,UAAU,GAAG,OAAO,CAAC,IAAI,IAAI,EAAE,CAAC;QACrC,IAAI,CAAC,SAAS,GAAG,OAAO,CAAC,SAAS,IAAI,MAAM,CAAC,OAAO,CAAC,GAAG,CAAC,2BAA2B,IAAI,MAAM,CAAC,CAAC;QAChG,IAAI,CAAC,QAAQ,GAAG,OAAO,CAAC,QAAQ,IAAI,OAAO,CAAC,GAAG,CAAC,yBAAyB,KAAK,GAAG,CAAC;QAClF,IAAI,CAAC,MAAM,GAAG,OAAO,CAAC,MAAM,CAAC;IAC/B,CAAC;IAED,IAAI,YAAY;QACd,OAAO,OAAO,CAAC,IAAI,CAAC,MAAM,IAAI,IAAI,CAAC,OAAO,CAAC,CAAC;IAC9C,CAAC;IAED,qEAAqE;IACrE,IAAI,UAAU;QACZ,OAAO,IAAI,CAAC,QAAQ,CAAC;IACvB,CAAC;IAED,KAAK,CAAC,GAAG,CAAC,IAAc;QACtB,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,OAAO,GAAG;YACd,GAAG,CAAC,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,QAAQ,EAAE,IAAI,CAAC,aAAa,CAAC,CAAC,CAAC,CAAC,EAAE,CAAC;YAC7D,GAAG,IAAI;SACR,CAAC;QAEF,IAAI,IAAI,CAAC,MAAM,EAAE,CAAC;YAChB,MAAM,MAAM,GAAG,MAAM,IAAI,CAAC,MAAM,CAAC,OAAO,CAAC,CAAC;YAC1C,OAAO;gBACL,OAAO;gBACP,QAAQ,EAAE,MAAM,CAAC,QAAQ;gBACzB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;aAC9B,CAAC;QACJ,CAAC;QAED,IAAI,CAAC;YACH,MAAM,MAAM,GAAG,MAAM,aAAa,CAAC,IAAI,CAAC,OAAQ,EAAE,CAAC,GAAG,IAAI,CAAC,UAAU,EAAE,GAAG,OAAO,CAAC,EAAE;gBAClF,GAAG,EAAE,OAAO,CAAC,GAAG;gBAChB,OAAO,EAAE,IAAI,CAAC,SAAS;gBACvB,SAAS,EAAE,CAAC,GAAG,IAAI,GAAG,IAAI;gBAC1B,QAAQ,EAAE,MAAM;aACjB,CAAC,CAAC;YACH,OAAO;gBACL,OAAO;gBACP,QAAQ,EAAE,CAAC;gBACX,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;gBAC7B,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC;aAC9B,CAAC;QACJ,CAAC;QAAC,OAAO,KAAU,EAAE,CAAC;YACpB,MAAM,QAAQ,GAAG,OAAO,KAAK,EAAE,IAAI,KAAK,QAAQ,CAAC,CAAC,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC,CAAC,CAAC,CAAC;YAClE,OAAO;gBACL,OAAO;gBACP,QAAQ;gBACR,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,EAAE,CAAC,CAAC;gBAC3C,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,KAAK,EAAE,MAAM,IAAI,KAAK,EAAE,OAAO,IAAI,EAAE,CAAC,CAAC;gBAC7D,QAAQ,EAAE,OAAO,CAAC,KAAK,EAAE,MAAM,CAAC;aACjC,CAAC;QACJ,CAAC;IACH,CAAC;IAED,KAAK,CAAC,SAAS,CAAC,KAAwB;QACtC,MAAM,IAAI,GAAqE;YAC7E,OAAO,EAAE,KAAK,CAAC,OAAO;YACtB,WAAW,EAAE,KAAK,CAAC,WAAW;YAC9B,QAAQ,EAAE,EAAE;SACb,CAAC;QAEF,IAAI,CAAC,IAAI,CAAC,YAAY,EAAE,CAAC;YACvB,IAAI,IAAI,CAAC,QAAQ,EAAE,CAAC;gBAClB,OAAO;oBACL,GAAG,IAAI;oBACP,MAAM,EAAE,SAAS;oBACjB,SAAS,EAAE,eAAe;oBAC1B,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE;oBACnG,OAAO,EAAE,qCAAqC;iBAC/C,CAAC;YACJ,CAAC;YACD,MAAM,IAAI,oBAAoB,CAAC,qCAAqC,CAAC,CAAC;QACxE,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,UAAU,CAAC,CAAC,CAAC;QAC/C,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QACpC,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC7B,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,WAAW;gBACtB,MAAM,EAAE,EAAE,SAAS,EAAE,SAAS,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE;gBACnG,OAAO,EAAE,SAAS,CAAC,MAAM,IAAI,SAAS,CAAC,MAAM,IAAI,uCAAuC;gBACxF,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC;QACJ,CAAC;QAED,MAAM,QAAQ,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,IAAI,EAAE,QAAQ,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC/E,IAAI,CAAC,QAAQ,CAAC,QAAQ,GAAG,QAAQ,CAAC;QAClC,IAAI,QAAQ,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC5B,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,UAAU;gBACrB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE;gBAClG,OAAO,EAAE,QAAQ,CAAC,MAAM,IAAI,QAAQ,CAAC,MAAM,IAAI,yCAAyC;gBACxF,OAAO,EAAE,QAAQ,CAAC,OAAO;aAC1B,CAAC;QACJ,CAAC;QAED,MAAM,SAAS,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC,CAAC,SAAS,EAAE,YAAY,EAAE,KAAK,CAAC,OAAO,CAAC,CAAC,CAAC;QAC3E,IAAI,CAAC,QAAQ,CAAC,SAAS,GAAG,SAAS,CAAC;QACpC,IAAI,SAAS,GAAG,KAAK,CAAC;QACtB,IAAI,CAAC;YACH,MAAM,OAAO,GAAG,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAkE,CAAC;YAC9G,SAAS,GAAG,CAAC,OAAO,CAAC,cAAc,IAAI,EAAE,CAAC,CAAC,IAAI,CAC7C,CAAC,KAAK,EAAE,EAAE,CAAC,KAAK,CAAC,GAAG,EAAE,WAAW,EAAE,KAAK,KAAK,CAAC,WAAW,CAAC,WAAW,EAAE,IAAI,KAAK,CAAC,MAAM,KAAK,WAAW,CACxG,CAAC;QACJ,CAAC;QAAC,MAAM,CAAC;YACP,SAAS,GAAG,KAAK,CAAC;QACpB,CAAC;QACD,IAAI,SAAS,CAAC,QAAQ,KAAK,CAAC,IAAI,CAAC,SAAS,EAAE,CAAC;YAC3C,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,WAAW;gBACtB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,SAAS,EAAE,WAAW,EAAE,SAAS,EAAE;gBACjG,OAAO,EAAE,SAAS,CAAC,MAAM,IAAI,oEAAoE;gBACjG,OAAO,EAAE,SAAS,CAAC,OAAO;aAC3B,CAAC;QACJ,CAAC;QAED,MAAM,WAAW,GAAG,MAAM,IAAI,CAAC,GAAG,CAAC;YACjC,OAAO;YACP,UAAU;YACV,YAAY;YACZ,KAAK,CAAC,OAAO;YACb,UAAU;YACV,MAAM;SACP,CAAC,CAAC;QACH,IAAI,CAAC,QAAQ,CAAC,WAAW,GAAG,WAAW,CAAC;QACxC,IAAI,WAAW,CAAC,QAAQ,KAAK,CAAC,EAAE,CAAC;YAC/B,OAAO;gBACL,GAAG,IAAI;gBACP,MAAM,EAAE,SAAS;gBACjB,SAAS,EAAE,aAAa;gBACxB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,SAAS,EAAE;gBAChG,OAAO,EAAE,WAAW,CAAC,MAAM,IAAI,WAAW,CAAC,MAAM,IAAI,mCAAmC;gBACxF,OAAO,EAAE,WAAW,CAAC,OAAO;aAC7B,CAAC;QACJ,CAAC;QAED,OAAO;YACL,GAAG,IAAI;YACP,MAAM,EAAE,QAAQ;YAChB,MAAM,EAAE,EAAE,SAAS,EAAE,QAAQ,EAAE,QAAQ,EAAE,QAAQ,EAAE,SAAS,EAAE,QAAQ,EAAE,WAAW,EAAE,QAAQ,EAAE;SAChG,CAAC;IACJ,CAAC;CACF"}

package/dist/src/canonical/cli.d.ts

@@ -0,0 +1,8 @@
+import { CanonicalLabBridge } from "./bridge.js";
+import { LabPreflightInput, LabPreflightResult } from "./types.js";
+export interface CanonicalPreflightResponse {
+    exitCode: 0 | 2;
+    result: LabPreflightResult;
+}
+export declare function runCanonicalPreflight(input: LabPreflightInput, bridge?: CanonicalLabBridge): Promise<CanonicalPreflightResponse>;
+//# sourceMappingURL=cli.d.ts.map

package/dist/src/canonical/cli.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.d.ts","sourceRoot":"","sources":["../../../src/canonical/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AACjD,OAAO,EAAE,iBAAiB,EAAE,kBAAkB,EAAE,MAAM,YAAY,CAAC;AAEnE,MAAM,WAAW,0BAA0B;IACzC,QAAQ,EAAE,CAAC,GAAG,CAAC,CAAC;IAChB,MAAM,EAAE,kBAAkB,CAAC;CAC5B;AAED,wBAAsB,qBAAqB,CACzC,KAAK,EAAE,iBAAiB,EACxB,MAAM,qBAA6C,GAClD,OAAO,CAAC,0BAA0B,CAAC,CAMrC"}

package/dist/src/canonical/cli.js

@@ -0,0 +1,9 @@
+import { CanonicalLabBridge } from "./bridge.js";
+export async function runCanonicalPreflight(input, bridge = new CanonicalLabBridge({ required: true })) {
+    const result = await bridge.preflight(input);
+    return {
+        exitCode: result.status === "passed" ? 0 : 2,
+        result,
+    };
+}
+//# sourceMappingURL=cli.js.map

package/dist/src/canonical/cli.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"cli.js","sourceRoot":"","sources":["../../../src/canonical/cli.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,kBAAkB,EAAE,MAAM,aAAa,CAAC;AAQjD,MAAM,CAAC,KAAK,UAAU,qBAAqB,CACzC,KAAwB,EACxB,MAAM,GAAG,IAAI,kBAAkB,CAAC,EAAE,QAAQ,EAAE,IAAI,EAAE,CAAC;IAEnD,MAAM,MAAM,GAAG,MAAM,MAAM,CAAC,SAAS,CAAC,KAAK,CAAC,CAAC;IAC7C,OAAO;QACL,QAAQ,EAAE,MAAM,CAAC,MAAM,KAAK,QAAQ,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC,CAAC;QAC5C,MAAM;KACP,CAAC;AACJ,CAAC"}

package/dist/src/canonical/index.d.ts

@@ -0,0 +1,4 @@
+export * from "./types.js";
+export * from "./bridge.js";
+export * from "./cli.js";
+//# sourceMappingURL=index.d.ts.map

package/dist/src/canonical/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../../src/canonical/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC"}

package/dist/src/canonical/index.js

@@ -0,0 +1,4 @@
+export * from "./types.js";
+export * from "./bridge.js";
+export * from "./cli.js";
+//# sourceMappingURL=index.js.map

package/dist/src/canonical/index.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.js","sourceRoot":"","sources":["../../../src/canonical/index.ts"],"names":[],"mappings":"AAAA,cAAc,YAAY,CAAC;AAC3B,cAAc,aAAa,CAAC;AAC5B,cAAc,UAAU,CAAC"}

package/dist/src/canonical/types.d.ts

@@ -0,0 +1,32 @@
+export interface CanonicalCommandResult {
+    command: string[];
+    exitCode: number;
+    stdout: string;
+    stderr: string;
+    timedOut?: boolean;
+}
+export interface LabPreflightInput {
+    assetId: string;
+    linearIssue: string;
+}
+export interface LabPreflightResult {
+    status: "passed" | "blocked";
+    assetId: string;
+    linearIssue: string;
+    checks: {
+        inventory: "passed" | "blocked";
+        identity: "passed" | "blocked" | "not_run";
+        ownership: "passed" | "blocked" | "not_run";
+        releaseLine: "passed" | "blocked" | "not_run";
+    };
+    blockedAt?: "inventory" | "identity" | "ownership" | "releaseLine" | "configuration";
+    message?: string;
+    command?: string[];
+    evidence: {
+        inventory?: CanonicalCommandResult;
+        identity?: CanonicalCommandResult;
+        ownership?: CanonicalCommandResult;
+        releaseLine?: CanonicalCommandResult;
+    };
+}
+//# sourceMappingURL=types.d.ts.map

package/dist/src/canonical/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../../src/canonical/types.ts"],"names":[],"mappings":"AAAA,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,QAAQ,EAAE,MAAM,CAAC;IACjB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,OAAO,CAAC;CACpB;AAED,MAAM,WAAW,iBAAiB;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;CACrB;AAED,MAAM,WAAW,kBAAkB;IACjC,MAAM,EAAE,QAAQ,GAAG,SAAS,CAAC;IAC7B,OAAO,EAAE,MAAM,CAAC;IAChB,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE;QACN,SAAS,EAAE,QAAQ,GAAG,SAAS,CAAC;QAChC,QAAQ,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;QAC3C,SAAS,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;QAC5C,WAAW,EAAE,QAAQ,GAAG,SAAS,GAAG,SAAS,CAAC;KAC/C,CAAC;IACF,SAAS,CAAC,EAAE,WAAW,GAAG,UAAU,GAAG,WAAW,GAAG,aAAa,GAAG,eAAe,CAAC;IACrF,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,EAAE,CAAC;IACnB,QAAQ,EAAE;QACR,SAAS,CAAC,EAAE,sBAAsB,CAAC;QACnC,QAAQ,CAAC,EAAE,sBAAsB,CAAC;QAClC,SAAS,CAAC,EAAE,sBAAsB,CAAC;QACnC,WAAW,CAAC,EAAE,sBAAsB,CAAC;KACtC,CAAC;CACH"}

package/dist/src/canonical/types.js

@@ -0,0 +1,2 @@
+export {};
+//# sourceMappingURL=types.js.map

package/dist/src/canonical/types.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.js","sourceRoot":"","sources":["../../../src/canonical/types.ts"],"names":[],"mappings":""}

package/dist/src/credentials/errors.d.ts

@@ -0,0 +1,16 @@
+/**
+ * Structured credential resolution failures.
+ *
+ * These errors exist to make one thing impossible: silently booting the MCP
+ * server (or executing a tool) against synthetic/mock hypervisor and
+ * appliance state without the caller having explicitly opted in. See QA-395.
+ */
+export type CredentialResolutionFailureReason = "no_credentials_found" | "doppler_unreachable" | "partial_credentials";
+export declare class CredentialResolutionError extends Error {
+    readonly code = "CREDENTIAL_RESOLUTION_ERROR";
+    readonly reason: CredentialResolutionFailureReason;
+    readonly remediation: string;
+    readonly missing: string[];
+    constructor(message: string, reason: CredentialResolutionFailureReason, remediation: string, missing?: string[]);
+}
+//# sourceMappingURL=errors.d.ts.map

package/dist/src/credentials/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../../src/credentials/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,MAAM,MAAM,iCAAiC,GACzC,sBAAsB,GACtB,qBAAqB,GACrB,qBAAqB,CAAC;AAE1B,qBAAa,yBAA0B,SAAQ,KAAK;IAClD,QAAQ,CAAC,IAAI,iCAAiC;IAC9C,QAAQ,CAAC,MAAM,EAAE,iCAAiC,CAAC;IACnD,QAAQ,CAAC,WAAW,EAAE,MAAM,CAAC;IAC7B,QAAQ,CAAC,OAAO,EAAE,MAAM,EAAE,CAAC;gBAGzB,OAAO,EAAE,MAAM,EACf,MAAM,EAAE,iCAAiC,EACzC,WAAW,EAAE,MAAM,EACnB,OAAO,GAAE,MAAM,EAAO;CAQzB"}

package/dist/src/credentials/errors.js

@@ -0,0 +1,21 @@
+/**
+ * Structured credential resolution failures.
+ *
+ * These errors exist to make one thing impossible: silently booting the MCP
+ * server (or executing a tool) against synthetic/mock hypervisor and
+ * appliance state without the caller having explicitly opted in. See QA-395.
+ */
+export class CredentialResolutionError extends Error {
+    code = "CREDENTIAL_RESOLUTION_ERROR";
+    reason;
+    remediation;
+    missing;
+    constructor(message, reason, remediation, missing = []) {
+        super(message);
+        this.name = "CredentialResolutionError";
+        this.reason = reason;
+        this.remediation = remediation;
+        this.missing = missing;
+    }
+}
+//# sourceMappingURL=errors.js.map

package/dist/src/credentials/errors.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.js","sourceRoot":"","sources":["../../../src/credentials/errors.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAOH,MAAM,OAAO,yBAA0B,SAAQ,KAAK;IACzC,IAAI,GAAG,6BAA6B,CAAC;IACrC,MAAM,CAAoC;IAC1C,WAAW,CAAS;IACpB,OAAO,CAAW;IAE3B,YACE,OAAe,EACf,MAAyC,EACzC,WAAmB,EACnB,UAAoB,EAAE;QAEtB,KAAK,CAAC,OAAO,CAAC,CAAC;QACf,IAAI,CAAC,IAAI,GAAG,2BAA2B,CAAC;QACxC,IAAI,CAAC,MAAM,GAAG,MAAM,CAAC;QACrB,IAAI,CAAC,WAAW,GAAG,WAAW,CAAC;QAC/B,IAAI,CAAC,OAAO,GAAG,OAAO,CAAC;IACzB,CAAC;CACF"}

package/dist/src/credentials/resolver.d.ts

@@ -10,8 +10,24 @@ export declare class CredentialResolver {
     private readonly defaultLabProtectedVmids;
     private readonly defaultMiniProtectedVmids;
     private readonly defaultEsxiProtectedVms;
+    /**
+     * Returns true only when mock mode was EXPLICITLY requested by the caller,
+     * either to force it immediately or to permit it as a fallback when real
+     * resolution is incomplete/unavailable. Mock mode must never engage
+     * implicitly — see QA-395 (ct-lab-mcp fabricated success against
+     * nonexistent hosts when Doppler resolution silently failed).
+     */
+    private isForceMock;
+    private isMockPermitted;
     /**
      * Resolve all lab credentials through the 3-tier cascade.
+     *
+     * Mock substitution (full OR partial, i.e. filling in a single missing
+     * host) NEVER happens implicitly. If real resolution is incomplete and
+     * the caller has not explicitly permitted mock mode (forceMock,
+     * CT_LAB_MCP_ALLOW_MOCK=1, CT_LAB_MOCK_MODE=true, PROXMOX_MOCK_MODE=true,
+     * or NODE_ENV=test-mock), this throws CredentialResolutionError instead of
+     * returning a synthetic success. See QA-395.
      */
     resolve(options?: ResolutionOptions): Promise<CredentialResolutionResult>;
     /**

package/dist/src/credentials/resolver.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/credentials/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAKL,iBAAiB,EACjB,0BAA0B,EAE3B,MAAM,YAAY,CAAC;AAKpB,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAwB;IACjE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAgB;IAC1D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAQtC;IAEF;;OAEG;IACG,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IA4HnF;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAmGhC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA0F7B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAuE5B,OAAO,CAAC,gBAAgB;IAiBxB,OAAO,CAAC,qBAAqB;IAwB7B,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,uBAAuB;IAQ/B,OAAO,CAAC,kBAAkB;CAwB3B;AAED,eAAO,MAAM,kBAAkB,oBAA2B,CAAC"}
+{"version":3,"file":"resolver.d.ts","sourceRoot":"","sources":["../../../src/credentials/resolver.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAKL,iBAAiB,EACjB,0BAA0B,EAE3B,MAAM,YAAY,CAAC;AAcpB,qBAAa,kBAAkB;IAC7B,OAAO,CAAC,QAAQ,CAAC,wBAAwB,CAAwB;IACjE,OAAO,CAAC,QAAQ,CAAC,yBAAyB,CAAgB;IAC1D,OAAO,CAAC,QAAQ,CAAC,uBAAuB,CAQtC;IAEF;;;;;;OAMG;IACH,OAAO,CAAC,WAAW;IASnB,OAAO,CAAC,eAAe;IASvB;;;;;;;;;OASG;IACG,OAAO,CAAC,OAAO,GAAE,iBAAsB,GAAG,OAAO,CAAC,0BAA0B,CAAC;IAuLnF;;OAEG;IACH,OAAO,CAAC,wBAAwB;IAmGhC;;OAEG;IACH,OAAO,CAAC,qBAAqB;IA0F7B;;OAEG;IACH,OAAO,CAAC,oBAAoB;IA+F5B,OAAO,CAAC,gBAAgB;IAiBxB,OAAO,CAAC,qBAAqB;IAwB7B,OAAO,CAAC,kBAAkB;IAiB1B,OAAO,CAAC,uBAAuB;IAQ/B,OAAO,CAAC,kBAAkB;CAwB3B;AAED,eAAO,MAAM,kBAAkB,oBAA2B,CAAC"}

package/dist/src/credentials/resolver.js

@@ -8,6 +8,13 @@
 import { DopplerClient } from "./doppler.js";
 import { registerSecret } from "../utils/redactor.js";
 import { logger } from "../utils/logger.js";
+import { CredentialResolutionError } from "./errors.js";
+const ALLOW_MOCK_REMEDIATION = "This is intentional: ct-lab-mcp never silently substitutes fabricated " +
+    "hypervisor/appliance state for missing credentials (QA-395). Either " +
+    "supply real credentials (LAB_PROXMOX_*, LAB_PROXMOX_MINIS_*, GOVC_*/LAB_ESXI_*, " +
+    "LAB_VM_CREDENTIALS_*) directly or via DOPPLER_TOKEN (+ DOPPLER_PROJECT/DOPPLER_CONFIG), " +
+    "or explicitly opt into offline mock mode with CT_LAB_MCP_ALLOW_MOCK=1 " +
+    "(or --force-mock / forceMock) if this is a genuine test/offline run.";
 export class CredentialResolver {
     defaultLabProtectedVmids = [100, 101, 102, 104];
     defaultMiniProtectedVmids = [];
@@ -20,15 +27,39 @@ export class CredentialResolver {
         "k8s-master",
         "esxi-template-base"
     ];
+    /**
+     * Returns true only when mock mode was EXPLICITLY requested by the caller,
+     * either to force it immediately or to permit it as a fallback when real
+     * resolution is incomplete/unavailable. Mock mode must never engage
+     * implicitly — see QA-395 (ct-lab-mcp fabricated success against
+     * nonexistent hosts when Doppler resolution silently failed).
+     */
+    isForceMock(options, env) {
+        return Boolean(options.forceMock ||
+            env.CT_LAB_MOCK_MODE === "true" ||
+            env.PROXMOX_MOCK_MODE === "true" ||
+            env.NODE_ENV === "test-mock");
+    }
+    isMockPermitted(options, env) {
+        return (this.isForceMock(options, env) ||
+            Boolean(options.allowMock) ||
+            env.CT_LAB_MCP_ALLOW_MOCK === "1" ||
+            env.CT_LAB_MCP_ALLOW_MOCK === "true");
+    }
     /**
      * Resolve all lab credentials through the 3-tier cascade.
+     *
+     * Mock substitution (full OR partial, i.e. filling in a single missing
+     * host) NEVER happens implicitly. If real resolution is incomplete and
+     * the caller has not explicitly permitted mock mode (forceMock,
+     * CT_LAB_MCP_ALLOW_MOCK=1, CT_LAB_MOCK_MODE=true, PROXMOX_MOCK_MODE=true,
+     * or NODE_ENV=test-mock), this throws CredentialResolutionError instead of
+     * returning a synthetic success. See QA-395.
      */
     async resolve(options = {}) {
         const env = options.env || process.env;
-        const forceMock = options.forceMock ||
-            env.CT_LAB_MOCK_MODE === "true" ||
-            env.PROXMOX_MOCK_MODE === "true" ||
-            env.NODE_ENV === "test-mock";
+        const forceMock = this.isForceMock(options, env);
+        const mockPermitted = this.isMockPermitted(options, env);
         if (forceMock) {
             logger.info("Mock mode forced via configuration. Utilizing Tier 3 (Mock Fallback).");
             return this.createMockResult();
@@ -39,12 +70,16 @@ export class CredentialResolver {
             this.extractProxmoxHostConfig("proxmox-mini", "LAB_PROXMOX_MINI_", env, 4, this.defaultMiniProtectedVmids);
         const directEsxi = this.extractEsxiHostConfig(env);
         const directVmCreds = this.extractVmCredentials(env);
-        // If all essential direct credentials exist, return Tier 1
+        // If all essential direct credentials exist, return Tier 1 (fully real, no mock involved)
         if (directLab && directMini && directEsxi) {
             logger.info("Resolved full credentials for Proxmox and ESXi hosts from Direct Environment Variables (Tier 1).");
             const proxmoxHosts = [directLab, directMini];
             const esxiHosts = [directEsxi];
-            const vmCredentials = directVmCreds || this.createMockVmCredentials();
+            const vmCredentials = directVmCreds || (mockPermitted ? this.createMockVmCredentials() : null);
+            if (!vmCredentials) {
+                throw new CredentialResolutionError("Proxmox and ESXi hypervisor credentials resolved, but no appliance SSH " +
+                    "credentials (LAB_VM_CREDENTIALS / LAB_VM_CREDENTIALS_USERNAME+PASSWORD) were found.", "partial_credentials", ALLOW_MOCK_REMEDIATION, ["vmCredentials"]);
+            }
             this.registerAllSecrets(proxmoxHosts, esxiHosts, vmCredentials);
             return {
                 tier: "direct_env",
@@ -76,6 +111,21 @@ export class CredentialResolver {
                 const dopplerEsxi = directEsxi || this.extractEsxiHostConfig(mergedSecrets);
                 const dopplerVmCreds = directVmCreds || this.extractVmCredentials(mergedSecrets);
                 if (dopplerLab || dopplerMini || dopplerEsxi) {
+                    const fullyResolved = Boolean(dopplerLab && dopplerMini && dopplerEsxi && dopplerVmCreds);
+                    if (!fullyResolved && !mockPermitted) {
+                        const missing = [];
+                        if (!dopplerLab)
+                            missing.push("proxmox-lab");
+                        if (!dopplerMini)
+                            missing.push("proxmox-mini");
+                        if (!dopplerEsxi)
+                            missing.push("esxi");
+                        if (!dopplerVmCreds)
+                            missing.push("vmCredentials");
+                        throw new CredentialResolutionError(`Doppler API resolved credentials for [${[dopplerLab && "proxmox-lab", dopplerMini && "proxmox-mini", dopplerEsxi && "esxi"]
+                            .filter(Boolean)
+                            .join(", ") || "none"}] but is missing [${missing.join(", ")}].`, "partial_credentials", ALLOW_MOCK_REMEDIATION, missing);
+                    }
                     const proxmoxHosts = [];
                     proxmoxHosts.push(dopplerLab || this.createMockProxmoxHost("proxmox-lab", 2, this.defaultLabProtectedVmids));
                     proxmoxHosts.push(dopplerMini || this.createMockProxmoxHost("proxmox-mini", 4, this.defaultMiniProtectedVmids));
@@ -95,13 +145,29 @@ export class CredentialResolver {
                 }
             }
             catch (err) {
+                if (err instanceof CredentialResolutionError) {
+                    throw err;
+                }
                 const msg = err instanceof Error ? err.message : String(err);
-                logger.warn(`Doppler API resolution failed: ${msg}. Falling back to partial / Tier 3.`);
+                if (!mockPermitted) {
+                    throw new CredentialResolutionError(`Doppler API resolution failed: ${msg}`, "doppler_unreachable", ALLOW_MOCK_REMEDIATION);
+                }
+                logger.warn(`Doppler API resolution failed: ${msg}. Mock fallback explicitly permitted; falling back to partial / Tier 3.`);
             }
         }
         // --- Partial Direct Env Fallback ---
         if (directLab || directMini || directEsxi) {
-            logger.info("Engaging partial direct environment resolution with mock fallback for missing targets.");
+            if (!mockPermitted) {
+                const missing = [];
+                if (!directLab)
+                    missing.push("proxmox-lab");
+                if (!directMini)
+                    missing.push("proxmox-mini");
+                if (!directEsxi)
+                    missing.push("esxi");
+                throw new CredentialResolutionError(`Partial direct-environment credentials resolved for [${[directLab && "proxmox-lab", directMini && "proxmox-mini", directEsxi && "esxi"].filter(Boolean).join(", ")}] but missing [${missing.join(", ")}].`, "partial_credentials", ALLOW_MOCK_REMEDIATION, missing);
+            }
+            logger.info("Engaging partial direct environment resolution with mock fallback for missing targets (explicitly permitted).");
             const proxmoxHosts = [];
             proxmoxHosts.push(directLab || this.createMockProxmoxHost("proxmox-lab", 2, this.defaultLabProtectedVmids));
             proxmoxHosts.push(directMini || this.createMockProxmoxHost("proxmox-mini", 4, this.defaultMiniProtectedVmids));
@@ -118,7 +184,11 @@ export class CredentialResolver {
             };
         }
         // --- Tier 3: Mock Fallback Mode ---
-        logger.info("No hypervisor credentials found. Engaging Tier 3 (In-Memory Mock Fallback).");
+        if (!mockPermitted) {
+            throw new CredentialResolutionError("No hypervisor or appliance credentials were found in the environment, direct " +
+                "config, or Doppler (DOPPLER_TOKEN was not set or not provided).", "no_credentials_found", ALLOW_MOCK_REMEDIATION);
+        }
+        logger.info("No hypervisor credentials found. Mock fallback explicitly permitted; engaging Tier 3 (In-Memory Mock Fallback).");
         return this.createMockResult();
     }
     /**
@@ -337,13 +407,37 @@ export class CredentialResolver {
         const port = portRaw ? parseInt(portRaw, 10) : 2222;
         if (username || password || privateKey) {
             return {
-                username: username ? username.trim() : "admin",
+                username: username ? username.trim() : "calltelemetry",
                 password: password ? password.trim() : undefined,
                 privateKey: privateKey ? privateKey.trim() : undefined,
                 passphrase: passphrase ? passphrase.trim() : undefined,
                 port: isNaN(port) ? 2222 : port
             };
         }
+        // 3. Check for specific Doppler secret patterns: LAB_VM_CREDENTIALS_<UUID> or LAB_VM_CT_*
+        for (const [key, val] of Object.entries(record)) {
+            if (key.startsWith("LAB_VM_CREDENTIALS_") && val && typeof val === "string" && val.startsWith("{")) {
+                try {
+                    const parsed = JSON.parse(val);
+                    if (parsed?.ssh?.password || parsed?.password) {
+                        return {
+                            username: parsed.ssh?.username || parsed.username || "calltelemetry",
+                            password: parsed.ssh?.password || parsed.password,
+                            privateKey: parsed.ssh?.privateKey || parsed.privateKey,
+                            port: parsed.ssh?.port ? Number(parsed.ssh.port) : 2222
+                        };
+                    }
+                }
+                catch { }
+            }
+            if (key.includes("LAB_VM") && key.includes("PASSWORD") && val) {
+                return {
+                    username: record.LAB_VM_CT_086_STABLE_QA_USERNAME || "calltelemetry",
+                    password: val.trim(),
+                    port: 2222
+                };
+            }
+        }
         return null;
     }
     createMockResult() {