@calltelemetry/ct-lab-mcp 0.8.69 → 0.8.70

package/dist/src/tools/slot-kubernetes.js

@@ -0,0 +1,108 @@
+/** Fixed namespace transport for physical-slot custody. Never retry an unknown write. */
+import { execFile } from "node:child_process";
+import * as fs from "node:fs";
+import { userInfo } from "node:os";
+import { join } from "node:path";
+import { fetch, Agent } from "undici";
+export class SlotApiError extends Error {
+    status;
+    constructor(status, message) {
+        super(message);
+        this.status = status;
+    }
+}
+const TOKEN = "/var/run/secrets/kubernetes.io/serviceaccount/token";
+const CA = "/var/run/secrets/kubernetes.io/serviceaccount/ca.crt";
+export const SLOT_CONTEXT = "do-nyc1-cluster-ny1";
+export const SLOT_SERVER = "https://28a6e4a4-fbff-4b51-a9bd-6073ffd8cdb2.k8s.ondigitalocean.com";
+const MAX_BYTES = 1_048_576;
+const COLLECTIONS = ["/apis/coordination.k8s.io/v1/namespaces/ct-lab/leases", "/apis/calltelemetry.com/v1alpha1/namespaces/ct-lab/applianceclaims"];
+export function assertSlotPath(path, method) {
+    const cleanPath = path.split("?")[0];
+    if (path !== cleanPath && !/^\?limit=500(?:&continue=[A-Za-z0-9%._~-]+)?$/.test(path.slice(cleanPath.length)))
+        throw new Error("physical slot query refused");
+    const collection = COLLECTIONS.find(p => cleanPath === p || cleanPath.startsWith(p + "/"));
+    if (!collection)
+        throw new Error("physical slot API path refused");
+    const name = cleanPath.slice(collection.length + 1);
+    if (cleanPath !== collection && (name.length > 253 || !name.split(".").every(label => /^[a-z0-9](?:[a-z0-9-]{0,61}[a-z0-9])?$/.test(label))))
+        throw new Error("physical slot object name refused");
+    if (method === "POST" && cleanPath !== collection || method !== "POST" && cleanPath === collection && !(method === "GET" && collection === COLLECTIONS[1]))
+        throw new Error("physical slot method refused");
+    if (collection === COLLECTIONS[0] && method === "DELETE")
+        throw new Error("MCP cannot release a durable physical reservation");
+    if (collection === COLLECTIONS[1] && method === "PUT")
+        throw new Error("physical slot adapter cannot replace a claim");
+}
+function parse(text) {
+    if (Buffer.byteLength(text) > MAX_BYTES)
+        throw new Error("physical slot response exceeds bound");
+    const value = JSON.parse(text);
+    if (!value || typeof value !== "object" || Array.isArray(value))
+        throw new Error("physical slot response is not an object");
+    return value;
+}
+function kubectl(args, body, env) {
+    return new Promise((resolve, reject) => {
+        const child = execFile("kubectl", args, { env, timeout: 10_000, maxBuffer: MAX_BYTES }, (err, stdout, stderr) => {
+            if (err) {
+                // kubectl has no machine-readable HTTP code. Only exact NotFound is absence.
+                const status = /\(NotFound\)/.test(stderr) ? 404 : /\(AlreadyExists\)|\(Conflict\)/.test(stderr) ? 409 : null;
+                reject(new SlotApiError(status, `physical slot Kubernetes request failed (${status ?? "unknown"}); retain custody`));
+            }
+            else
+                resolve(stdout);
+        });
+        if (body !== undefined)
+            child.stdin?.end(JSON.stringify(body));
+    });
+}
+export function createSlotApi() {
+    // The selected transport cannot change after a timeout or failed mutation.
+    const inCluster = fs.existsSync(TOKEN);
+    let localReady;
+    const env = { ...process.env };
+    for (const key of ["KUBECONFIG", "KUBERNETES_MASTER", "KUBECTL_KUBERC", "HTTP_PROXY", "HTTPS_PROXY", "ALL_PROXY", "http_proxy", "https_proxy", "all_proxy"])
+        delete env[key];
+    env.KUBECTL_KUBERC = "false";
+    const base = ["--kubeconfig", join(userInfo().homedir, ".kube", "config"), "--context", SLOT_CONTEXT, "--server", SLOT_SERVER, "--insecure-skip-tls-verify=false", "--request-timeout=10s"];
+    return { async request(path, method, body) {
+            assertSlotPath(path, method);
+            if (inCluster) {
+                if (!fs.existsSync(CA))
+                    throw new Error("physical slot Kubernetes CA unavailable");
+                const host = process.env.KUBERNETES_SERVICE_HOST || "kubernetes.default.svc";
+                const port = process.env.KUBERNETES_SERVICE_PORT || "443";
+                if (!/^[a-zA-Z0-9.-]+$/.test(host) || !/^\d{1,5}$/.test(port))
+                    throw new Error("physical slot Kubernetes service identity refused");
+                const agent = new Agent({ connect: { ca: fs.readFileSync(CA), rejectUnauthorized: true } });
+                try {
+                    const response = await fetch(`https://${host}:${port}${path}`, { method, headers: { Authorization: `Bearer ${fs.readFileSync(TOKEN, "utf8").trim()}`, "Content-Type": "application/json" }, body: body === undefined ? undefined : JSON.stringify(body), dispatcher: agent, signal: AbortSignal.timeout(10_000) });
+                    if (response.status === 404 && method === "GET")
+                        return null;
+                    if (!response.ok)
+                        throw new SlotApiError(response.status, `physical slot Kubernetes request failed (${response.status}); retain custody`);
+                    return parse(await response.text());
+                }
+                finally {
+                    await agent.close();
+                }
+            }
+            localReady ??= (async () => {
+                const cluster = parse(await kubectl([...base, "config", "view", "--minify", "--raw", "-o", "jsonpath={.clusters[0].cluster}"], undefined, env));
+                if (cluster.server !== SLOT_SERVER || cluster["insecure-skip-tls-verify"] === true || !(cluster["certificate-authority-data"] || cluster["certificate-authority"]) || cluster["proxy-url"] || cluster["tls-server-name"] && cluster["tls-server-name"] !== new URL(SLOT_SERVER).hostname)
+                    throw new Error("physical slot fixed cluster TLS binding refused");
+            })();
+            await localReady;
+            const command = method === "GET" ? "get" : method === "POST" ? "create" : method === "PUT" ? "replace" : "delete";
+            try {
+                return parse(await kubectl([...base, command, "--raw", path, ...(body === undefined ? [] : ["-f", "-"])], body, env));
+            }
+            catch (err) {
+                if (method === "GET" && err instanceof SlotApiError && err.status === 404)
+                    return null;
+                throw err;
+            }
+        } };
+}
+//# sourceMappingURL=slot-kubernetes.js.map

package/dist/src/tools/slot-kubernetes.js.map

@@ -0,0 +1 @@
+{"version":3,"file":"slot-kubernetes.js","sourceRoot":"","sources":["../../../src/tools/slot-kubernetes.ts"],"names":[],"mappings":"AAAA,yFAAyF;AACzF,OAAO,EAAE,QAAQ,EAAE,MAAM,oBAAoB,CAAC;AAC9C,OAAO,KAAK,EAAE,MAAM,SAAS,CAAC;AAC9B,OAAO,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AACnC,OAAO,EAAE,IAAI,EAAE,MAAM,WAAW,CAAC;AACjC,OAAO,EAAE,KAAK,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAItC,MAAM,OAAO,YAAa,SAAQ,KAAK;IACT;IAA5B,YAA4B,MAAqB,EAAE,OAAe;QAAI,KAAK,CAAC,OAAO,CAAC,CAAC;QAAzD,WAAM,GAAN,MAAM,CAAe;IAAqC,CAAC;CACxF;AACD,MAAM,KAAK,GAAG,qDAAqD,CAAC;AACpE,MAAM,EAAE,GAAG,sDAAsD,CAAC;AAClE,MAAM,CAAC,MAAM,YAAY,GAAG,qBAAqB,CAAC;AAClD,MAAM,CAAC,MAAM,WAAW,GAAG,qEAAqE,CAAC;AACjG,MAAM,SAAS,GAAG,SAAS,CAAC;AAC5B,MAAM,WAAW,GAAG,CAAC,uDAAuD,EAAE,oEAAoE,CAAC,CAAC;AACpJ,MAAM,UAAU,cAAc,CAAC,IAAY,EAAE,MAAkB;IAC7D,MAAM,SAAS,GAAG,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,CAAC,CAAC,CAAC;IACrC,IAAI,IAAI,KAAK,SAAS,IAAI,CAAC,+CAA+C,CAAC,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,SAAS,CAAC,MAAM,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,6BAA6B,CAAC,CAAC;IAC9J,MAAM,UAAU,GAAG,WAAW,CAAC,IAAI,CAAC,CAAC,CAAC,EAAE,CAAC,SAAS,KAAK,CAAC,IAAI,SAAS,CAAC,UAAU,CAAC,CAAC,GAAG,GAAG,CAAC,CAAC,CAAC;IAC3F,IAAI,CAAC,UAAU;QAAE,MAAM,IAAI,KAAK,CAAC,gCAAgC,CAAC,CAAC;IACnE,MAAM,IAAI,GAAG,SAAS,CAAC,KAAK,CAAC,UAAU,CAAC,MAAM,GAAG,CAAC,CAAC,CAAC;IACpD,IAAI,SAAS,KAAK,UAAU,IAAI,CAAC,IAAI,CAAC,MAAM,GAAG,GAAG,IAAI,CAAC,IAAI,CAAC,KAAK,CAAC,GAAG,CAAC,CAAC,KAAK,CAAC,KAAK,CAAC,EAAE,CAAC,wCAAwC,CAAC,IAAI,CAAC,KAAK,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,mCAAmC,CAAC,CAAC;IACnM,IAAI,MAAM,KAAK,MAAM,IAAI,SAAS,KAAK,UAAU,IAAI,MAAM,KAAK,MAAM,IAAI,SAAS,KAAK,UAAU,IAAI,CAAC,CAAC,MAAM,KAAK,KAAK,IAAI,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,8BAA8B,CAAC,CAAC;IAC5M,IAAI,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM,KAAK,QAAQ;QAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;IAC/H,IAAI,UAAU,KAAK,WAAW,CAAC,CAAC,CAAC,IAAI,MAAM,KAAK,KAAK;QAAE,MAAM,IAAI,KAAK,CAAC,8CAA8C,CAAC,CAAC;AACzH,CAAC;AACD,SAAS,KAAK,CAAC,IAAY;IACzB,IAAI,MAAM,CAAC,UAAU,CAAC,IAAI,CAAC,GAAG,SAAS;QAAE,MAAM,IAAI,KAAK,CAAC,sCAAsC,CAAC,CAAC;IACjG,MAAM,KAAK,GAAG,IAAI,CAAC,KAAK,CAAC,IAAI,CAAC,CAAC;IAC/B,IAAI,CAAC,KAAK,IAAI,OAAO,KAAK,KAAK,QAAQ,IAAI,KAAK,CAAC,OAAO,CAAC,KAAK,CAAC;QAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;IAC5H,OAAO,KAAK,CAAC;AACf,CAAC;AACD,SAAS,OAAO,CAAC,IAAc,EAAE,IAAa,EAAE,GAAsB;IACpE,OAAO,IAAI,OAAO,CAAC,CAAC,OAAO,EAAE,MAAM,EAAE,EAAE;QACrC,MAAM,KAAK,GAAG,QAAQ,CAAC,SAAS,EAAE,IAAI,EAAE,EAAE,GAAG,EAAE,OAAO,EAAE,MAAM,EAAE,SAAS,EAAE,SAAS,EAAE,EAAE,CAAC,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,EAAE;YAC9G,IAAI,GAAG,EAAE,CAAC;gBACR,6EAA6E;gBAC7E,MAAM,MAAM,GAAG,cAAc,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,gCAAgC,CAAC,IAAI,CAAC,MAAM,CAAC,CAAC,CAAC,CAAC,GAAG,CAAC,CAAC,CAAC,IAAI,CAAC;gBAC9G,MAAM,CAAC,IAAI,YAAY,CAAC,MAAM,EAAE,4CAA4C,MAAM,IAAI,SAAS,mBAAmB,CAAC,CAAC,CAAC;YACvH,CAAC;;gBAAM,OAAO,CAAC,MAAM,CAAC,CAAC;QACzB,CAAC,CAAC,CAAC;QACH,IAAI,IAAI,KAAK,SAAS;YAAE,KAAK,CAAC,KAAK,EAAE,GAAG,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,CAAC,CAAC;IACjE,CAAC,CAAC,CAAC;AACL,CAAC;AACD,MAAM,UAAU,aAAa;IAC3B,2EAA2E;IAC3E,MAAM,SAAS,GAAG,EAAE,CAAC,UAAU,CAAC,KAAK,CAAC,CAAC;IACvC,IAAI,UAAqC,CAAC;IAC1C,MAAM,GAAG,GAAG,EAAE,GAAG,OAAO,CAAC,GAAG,EAAE,CAAC;IAC/B,KAAK,MAAM,GAAG,IAAI,CAAC,YAAY,EAAE,mBAAmB,EAAE,gBAAgB,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,EAAE,YAAY,EAAE,aAAa,EAAE,WAAW,CAAC;QAAE,OAAO,GAAG,CAAC,GAAG,CAAC,CAAC;IAC7K,GAAG,CAAC,cAAc,GAAG,OAAO,CAAC;IAC7B,MAAM,IAAI,GAAG,CAAC,cAAc,EAAE,IAAI,CAAC,QAAQ,EAAE,CAAC,OAAO,EAAE,OAAO,EAAE,QAAQ,CAAC,EAAE,WAAW,EAAE,YAAY,EAAE,UAAU,EAAE,WAAW,EAAE,kCAAkC,EAAE,uBAAuB,CAAC,CAAC;IAC5L,OAAO,EAAE,KAAK,CAAC,OAAO,CAAC,IAAI,EAAE,MAAM,EAAE,IAAI;YACvC,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,CAAC;YAC7B,IAAI,SAAS,EAAE,CAAC;gBACd,IAAI,CAAC,EAAE,CAAC,UAAU,CAAC,EAAE,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,yCAAyC,CAAC,CAAC;gBACnF,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,wBAAwB,CAAC;gBAC7E,MAAM,IAAI,GAAG,OAAO,CAAC,GAAG,CAAC,uBAAuB,IAAI,KAAK,CAAC;gBAC1D,IAAI,CAAC,kBAAkB,CAAC,IAAI,CAAC,IAAI,CAAC,IAAI,CAAC,WAAW,CAAC,IAAI,CAAC,IAAI,CAAC;oBAAE,MAAM,IAAI,KAAK,CAAC,mDAAmD,CAAC,CAAC;gBACpI,MAAM,KAAK,GAAG,IAAI,KAAK,CAAC,EAAE,OAAO,EAAE,EAAE,EAAE,EAAE,EAAE,CAAC,YAAY,CAAC,EAAE,CAAC,EAAE,kBAAkB,EAAE,IAAI,EAAE,EAAE,CAAC,CAAC;gBAC5F,IAAI,CAAC;oBACH,MAAM,QAAQ,GAAG,MAAM,KAAK,CAAC,WAAW,IAAI,IAAI,IAAI,GAAG,IAAI,EAAE,EAAE,EAAE,MAAM,EAAE,OAAO,EAAE,EAAE,aAAa,EAAE,UAAU,EAAE,CAAC,YAAY,CAAC,KAAK,EAAE,MAAM,CAAC,CAAC,IAAI,EAAE,EAAE,EAAE,cAAc,EAAE,kBAAkB,EAAE,EAAE,IAAI,EAAE,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,IAAI,CAAC,SAAS,CAAC,IAAI,CAAC,EAAE,UAAU,EAAE,KAAK,EAAE,MAAM,EAAE,WAAW,CAAC,OAAO,CAAC,MAAM,CAAC,EAAE,CAAC,CAAC;oBACnT,IAAI,QAAQ,CAAC,MAAM,KAAK,GAAG,IAAI,MAAM,KAAK,KAAK;wBAAE,OAAO,IAAI,CAAC;oBAC7D,IAAI,CAAC,QAAQ,CAAC,EAAE;wBAAE,MAAM,IAAI,YAAY,CAAC,QAAQ,CAAC,MAAM,EAAE,4CAA4C,QAAQ,CAAC,MAAM,mBAAmB,CAAC,CAAC;oBAC1I,OAAO,KAAK,CAAC,MAAM,QAAQ,CAAC,IAAI,EAAE,CAAC,CAAC;gBACtC,CAAC;wBAAS,CAAC;oBAAC,MAAM,KAAK,CAAC,KAAK,EAAE,CAAC;gBAAC,CAAC;YACpC,CAAC;YACD,UAAU,KAAK,CAAC,KAAK,IAAI,EAAE;gBACzB,MAAM,OAAO,GAAG,KAAK,CAAC,MAAM,OAAO,CAAC,CAAC,GAAG,IAAI,EAAE,QAAQ,EAAE,MAAM,EAAE,UAAU,EAAE,OAAO,EAAE,IAAI,EAAE,iCAAiC,CAAC,EAAE,SAAS,EAAE,GAAG,CAAC,CAAC,CAAC;gBAChJ,IAAI,OAAO,CAAC,MAAM,KAAK,WAAW,IAAI,OAAO,CAAC,0BAA0B,CAAC,KAAK,IAAI,IAAI,CAAC,CAAC,OAAO,CAAC,4BAA4B,CAAC,IAAI,OAAO,CAAC,uBAAuB,CAAC,CAAC,IAAI,OAAO,CAAC,WAAW,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,IAAI,OAAO,CAAC,iBAAiB,CAAC,KAAK,IAAI,GAAG,CAAC,WAAW,CAAC,CAAC,QAAQ;oBAAE,MAAM,IAAI,KAAK,CAAC,iDAAiD,CAAC,CAAC;YAC/V,CAAC,CAAC,EAAE,CAAC;YACL,MAAM,UAAU,CAAC;YACjB,MAAM,OAAO,GAAG,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,KAAK,CAAC,CAAC,CAAC,MAAM,KAAK,MAAM,CAAC,CAAC,CAAC,QAAQ,CAAC,CAAC,CAAC,MAAM,KAAK,KAAK,CAAC,CAAC,CAAC,SAAS,CAAC,CAAC,CAAC,QAAQ,CAAC;YAClH,IAAI,CAAC;gBAAC,OAAO,KAAK,CAAC,MAAM,OAAO,CAAC,CAAC,GAAG,IAAI,EAAE,OAAO,EAAE,OAAO,EAAE,IAAI,EAAE,GAAG,CAAC,IAAI,KAAK,SAAS,CAAC,CAAC,CAAC,EAAE,CAAC,CAAC,CAAC,CAAC,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC,EAAE,IAAI,EAAE,GAAG,CAAC,CAAC,CAAC;YAAC,CAAC;YAC9H,OAAO,GAAG,EAAE,CAAC;gBAAC,IAAI,MAAM,KAAK,KAAK,IAAI,GAAG,YAAY,YAAY,IAAI,GAAG,CAAC,MAAM,KAAK,GAAG;oBAAE,OAAO,IAAI,CAAC;gBAAC,MAAM,GAAG,CAAC;YAAC,CAAC;QACpH,CAAC,EAAE,CAAC;AACN,CAAC"}

package/dist/src/tools/vm-action.d.ts

@@ -137,8 +137,8 @@ export declare const VmActionInputSchema: z.ZodEffects<z.ZodObject<{
     vmid?: string | number | undefined;
     reason?: string | undefined;
     timeoutSeconds?: number | undefined;
-    assetId?: string | undefined;
     hostAssetId?: string | undefined;
+    assetId?: string | undefined;
     artifactReceipt?: string | undefined;
     receiptFile?: string | undefined;
     confirmAssetId?: string | undefined;
@@ -168,8 +168,8 @@ export declare const VmActionInputSchema: z.ZodEffects<z.ZodObject<{
     format?: "table" | "json" | undefined;
     reason?: string | undefined;
     timeoutSeconds?: number | undefined;
-    assetId?: string | undefined;
     hostAssetId?: string | undefined;
+    assetId?: string | undefined;
     artifactReceipt?: string | undefined;
     apply?: boolean | undefined;
     receiptFile?: string | undefined;
@@ -207,8 +207,8 @@ export declare const VmActionInputSchema: z.ZodEffects<z.ZodObject<{
     vmid?: string | number | undefined;
     reason?: string | undefined;
     timeoutSeconds?: number | undefined;
-    assetId?: string | undefined;
     hostAssetId?: string | undefined;
+    assetId?: string | undefined;
     artifactReceipt?: string | undefined;
     receiptFile?: string | undefined;
     confirmAssetId?: string | undefined;
@@ -238,8 +238,8 @@ export declare const VmActionInputSchema: z.ZodEffects<z.ZodObject<{
     format?: "table" | "json" | undefined;
     reason?: string | undefined;
     timeoutSeconds?: number | undefined;
-    assetId?: string | undefined;
     hostAssetId?: string | undefined;
+    assetId?: string | undefined;
     artifactReceipt?: string | undefined;
     apply?: boolean | undefined;
     receiptFile?: string | undefined;

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@calltelemetry/ct-lab-mcp",
-  "version": "0.8.69",
+  "version": "0.8.70",
   "description": "Expanded Model Context Protocol (MCP) server for Call Telemetry lab, fleet, and appliance management across Proxmox VE and VMware ESXi.",
   "type": "module",
   "main": "./dist/src/index.js",
@@ -15,7 +15,7 @@
     "LICENSE"
   ],
   "scripts": {
-    "build": "tsc -p tsconfig.build.json && chmod +x dist/bin/*.js",
+    "build": "tsc -p tsconfig.build.json && node tools/copy-physical-slot-schema.mjs && chmod +x dist/bin/*.js",
     "typecheck": "tsc --noEmit",
     "pretest": "npm run build",
     "test": "vitest run",