@dzhechkov/cloudru-hub 0.1.12 → 0.1.14

package/docs/HERMES-CODEX.md

@@ -0,0 +1,34 @@
+# Cloud.ru tools in Codex, Hermes, OpenCode and Pi
+
+`cloudru-hub mcp-safe` is the common process boundary. It starts only the binary whose SHA-256 matches the package pin and the classification baseline. Its default profile advertises the 78 golden `allow` tools and rejects `ask`, `deny`, unknown tools and unsupported MCP methods before forwarding a call. Some planning tools may still write local plan files. Filesystem and shell access granted separately to an agent remain outside this MCP boundary.
+
+Installers default to the smaller `inventory` toolset (11 tools). Select comma-separated groups with `--toolsets inventory,billing`; the available groups are `inventory`, `compute`, `kubernetes`, `data`, `network`, `storage`, and `billing`. `--toolsets all` exposes all 78 allow-classified tools. The proxy checks the chosen set on every `tools/call`, so a tool hidden from discovery cannot be invoked directly.
+
+For the read-only billing tools, put `agreement_id` in the same owner-only credential file as `key_id`, `secret` and `project_id`, then select `--toolsets billing` or `inventory,billing`. The safe proxy passes `agreement_id` to the Go engine as `CLOUDRU_AGREEMENT_ID`; Codex installation inherits the credential-file path and billing environment variables. If the file is absent, an existing environment-only setup still works. An explicitly configured but missing or invalid file is an error. `billing_consumption` currently returns an agreement-wide aggregate. The Cloud.ru API documents project filtering, but this adapter has not implemented or live-verified that filter; do not label its total as a project-only charge.
+
+The separate `--toolsets vm-deploy` profile allows one reviewed VM plan and remote commands on the VM returned by that plan. Put temporary credentials in `~/.config/cloudru-hub/credentials.json` (owner-only mode `0600`) as `{"key_id":"…","secret":"…","project_id":"UUID","region":"ru.AZ-2"}`. The proxy reads JSON directly and passes values to the pinned Go child as environment variables; it never runs shell `eval`. The region may also be a zone UUID. After `deploy_plan` returns a persisted plan, inspect its VM shape and RUB/month estimate, then run `cloudru-hub approve --plan-id <id> --max-monthly-rub <cap>`. This creates a ten-minute, one-use approval for the exact plan bytes and project. `deploy_apply` ignores the model's `confirmed` value and supplies it only after consuming that approval. Successful deployment opens a two-hour `vm_exec` session for that VM UUID and the plan's SSH login. A generated login password is removed from the MCP result because the engine uses its own SSH key. The deployment profile gives Codex and Hermes a 1200-second per-tool timeout, covering VM boot, SSH and API retries. A same-name VM blocks creation; inspect the returned UUID and live inventory before retrying with a different name. The profile does not expose `destroy`; inspect the VM ID and remove the test resource through a separate supervised cleanup step.
+
+This local approval is an operator workflow, not a hard security boundary against an agent with unrestricted shell access as the same Unix user: such an agent could invoke `approve` or edit the local files itself. Use process/user isolation and cloud IAM limits if the deployment agent is untrusted. The cost number is an estimate, and the operator cap controls the reviewed plan, not Cloud.ru's final bill.
+
+The launcher archive does **not bundle** the engine. A Linux/x64 npm install pulls `@dzhechkov/cloudru-vm-linux-x64@0.2.6` as an exact optional dependency. On other platforms, or when optional dependencies are disabled, set `CLOUDRU_VM_BIN` to a trusted copy whose hash matches `package.json.cloudruHub.binaryHashes`. Run `cloudru-hub self-test --json` first. A missing or changed binary makes `mcp-safe` refuse startup.
+
+| Host | Setup | Activation check |
+|---|---|---|
+| Codex | `cloudru-hub install --target codex --dir /trusted/project --toolsets vm-deploy` writes `.codex/config.toml` with `required=true`, 12 enabled tools, an explicit 1200-second timeout and inherited paths for the pinned engine and credentials file | Trust the project; in a fresh session call local-only `status` before planning. The profile requests host `auto`, but `codex exec` with approval policy `never` blocked even `status` in the local probe; `--approve-for-me` allowed it. The proxy still requires a separate plan-bound approval for `deploy_apply` |
+| OpenCode | `cloudru-hub install --target opencode --dir /trusted/project` writes `opencode.json` with a local server | `opencode mcp list`, then inspect tools in a session; installer refuses an existing `opencode.jsonc` to avoid conflicting configs |
+| Pi | `cloudru-hub install --target pi --dir /trusted/project` writes `.pi/mcp.json` | Use a Pi release with built-in MCP, trust the project, run `pi mcp list`, then `/mcp` in a session; an older Pi may require an adapter |
+| Hermes | With a hash-verified engine available, `cloudru-hub install --target hermes` adds a guarded entry to `$HERMES_HOME/config.yaml` with an explicit nonempty include list and `CLOUDRU_VM_BIN` path; `--hermes-home` selects a test directory | Run `hermes mcp test cloudru_hub`; complex YAML and existing Cloud.ru entries are refused for manual review |
+
+Hermes needs model authentication separately from the Cloud.ru service-account file. On this server, `hermes model` → **OpenAI Codex** → import existing Codex CLI credentials configured the default Hermes profile without changing `~/.codex/auth.json`. Choose a model, then check `hermes auth status openai-codex` and make a short inference probe before attempting a cloud operation. Hermes keeps an independent copy of the imported OAuth session in its own auth store; subsequent token refreshes are not shared with Codex CLI. A successful model probe alone does not establish that the Cloud.ru MCP server has credentials or that a VM deployment passed.
+
+Hermes sends periodic MCP tool-list keepalives. The pinned proxy answers repeat listings from its filtered in-process cache while the Go engine handles a long deployment. This prevents the keepalive from waiting behind a serial `deploy_apply` and losing that call's result on reconnect. The first listing still comes from the engine; restart the proxy after changing the pinned engine or classification.
+
+Project configs contain an absolute path to this installed package. Regenerate them after moving the package or copying the project to another machine. Hermes filters inherited environment variables when starting an MCP server, so its installer first checks the local engine hash and writes the engine's absolute path into the server-specific `env`. The proxy hashes that file again on every start. Hermes installation refuses a missing or mismatched engine without changing YAML; regenerate the entry after moving the binary. The installers preserve unrelated simple configuration and refuse an existing Cloud.ru server instead of silently overwriting it. Codex refuses existing MCP declarations whose TOML semantics need review. Hermes inserts only into a plain mapping, keeps unrelated YAML text, and refuses anchors or unusual structure. A Hermes plugin's `pre_tool_call` hook is supplementary: plugin failures and some plugin dispatch paths do not provide a reliable enforcement boundary. The proxy enforces its policy even when plugins are disabled.
+
+Host-side registration and read checks alone do not prove a live VM deployment. The package tests use a fake engine to show that an unapproved call never reaches the backend and a VM command cannot target an unrelated VM. Do not switch these host entries to raw `mcp` to recover write access. Codex and Hermes each completed the two live Snake scenarios; their HTTP checks and cleanup evidence are in the feature acceptance record.
+
+This integration follows the current [Codex MCP configuration](https://developers.openai.com/codex/extend/mcp), [OpenCode MCP](https://opencode.ai/docs/mcp-servers), [Pi MCP](https://github.com/earendil-works/pi/blob/main/packages/coding-agent/docs/mcp.md) and locally inspected Hermes `mcp_servers` contract. Host versions and effective configuration should be recorded when testing a real installation.
+
+## Ideas worth carrying forward from EVO
+
+The [EVO CLI](https://github.com/shatim-ops/evo-cli) currently has a broader standalone Go CLI, more MCP operations, HTTP transport, selectable `--toolsets`, `--allow-project`, `doctor`, JSON output and dry-run/preview flows. Those are concrete advantages over this thin adapter. The most useful next work in our own Go engine is a shared operation registry for CLI and MCP, a measured toolset/profile switch to reduce context use, and an explanation of resource cost before changes. A `confirmed=true` argument supplied by a model is not evidence that a human approved a mutation; any write mode in our hub must enforce approval independently of that argument.

package/docs/LOCAL-TESTING.md

@@ -1,7 +1,6 @@
-# Local testing — @dzhechkov/cloudru-hub (no publish, no licence needed)
+# Local testing — @dzhechkov/cloudru-hub
 
-The launcher and everything around it run TODAY against a locally present engine build.
-Nothing here publishes anything; the ADR-001 hold stays untouched.
+The launcher runs against the pinned Go build. Its archive contains no engine bytes; the Linux/x64 optional package contains the static engine and its dependency-license inventory.
 
 ## 1. Point the launcher at an engine binary
 
@@ -9,23 +8,19 @@ Any of the three, in this precedence order:
 
 ```bash
 # a) environment variable (simplest — what the self-test proof below uses)
-export CLOUDRU_VM_BIN=/path/to/hermes-engine-main/engine-build/cloudru-vm
+export CLOUDRU_VM_BIN=/path/to/dz-harness-hub/packages/@dzhechkov/cloudru-vm-linux-x64/native/cloudru-vm
 
 # b) persistent config
 mkdir -p ~/.cloudru-hub
 cat > ~/.cloudru-hub/config.json <<'EOF'
-{ "enginePath": "/path/to/hermes-engine-main/engine-build/cloudru-vm" }
+{ "enginePath": "/path/to/dz-harness-hub/packages/@dzhechkov/cloudru-vm-linux-x64/native/cloudru-vm" }
 EOF
 
-# c) (post-grant only) the platform package @dzhechkov/cloudru-vm-linux-x64
+# c) no override: the installed Linux/x64 optional platform package
 ```
 
-The pinned baseline archive is
-`features/hermes-claude-adaptation/evidence/hermes-engine-src-20260718.tgz` (sha256 in
-`evidence/ENGINE-BASELINE.json`); the matching prebuilt binary identifies itself as
-`cloudru-vm 0.2.3-20260718`, sha256
-`59f83fc0678b95146ca539764d0c805bd2514b8588f198c1e835b26e54c05124` — the launcher
-verifies the resolved binary against exactly this pin and says so.
+The pinned binary identifies itself as `cloudru-vm 0.2.6-20261020` and has SHA-256
+`4463b09323c9dfe0c32d618d335734a947e7fab0a75d07a7bea089b97a97c9b6`.
 
 ## 2. Self-test (end-to-end, no credentials required)
 
@@ -34,19 +29,18 @@ cd packages/@dzhechkov/cloudru-hub
 node bin/cloudru-hub.js self-test
 ```
 
-Expected output (MEASURED — live run on this server, 2026-08-10, baseline binary):
+Expected output for the current private build:
 
 ```
-✓ resolve: …/engine-build/cloudru-vm (source: env)
-✓ sha256: 59f83fc0678b95146ca539764d0c805bd2514b8588f198c1e835b26e54c05124 — MATCHES pinned baseline
-✓ engine-version: cloudru-vm 0.2.3-20260718
+✓ resolve: …/cloudru-vm-linux-x64/native/cloudru-vm (source: env)
+✓ sha256: 4463b09323c9dfe0c32d618d335734a947e7fab0a75d07a7bea089b97a97c9b6 — MATCHES pinned baseline
+✓ engine-version: cloudru-vm 0.2.6-20261020
 ✓ tools-list: 144 tools live (snapshot: 144)
 ✓ classification-coverage: every live tool is classified (144 golden entries)
 self-test: ALL GREEN
 ```
 
-`tools/list` needs no Cloud.ru credentials; real tool calls do (env
-`CLOUDRU_KEY_ID`/`CLOUDRU_SECRET`/`CLOUDRU_PROJECT_ID`, see the engine's own docs).
+`tools/list` needs no Cloud.ru credentials. For `--toolsets vm-deploy`, place temporary keys in the owner-only JSON file described in `HERMES-CODEX.md`; the proxy maps them to the Go child's environment without shell evaluation.
 
 ## 3. Optional: `npm link` for a global `cloudru-hub`
 
@@ -70,8 +64,6 @@ success unless the veto executes. Finish with the manual probe it prints: in a f
 Claude Code session, call `mcp__cloudru-vm__deploy` and confirm a permission prompt
 appears; note which prefix spelling the runtime used.
 
-## 5. Testing from another server AFTER the grant (`npm install` path)
+## 5. Testing from another server (`npm install` path)
 
-Blocked until ADR-001 clears — see README "Post-grant publish checklist". Until then,
-another server can test by copying this package directory (or `npm pack` + install the
-tarball) plus an engine binary, then steps 1–4 exactly as above.
+On Linux/x64, install `@dzhechkov/cloudru-hub@0.1.14` normally and run `cloudru-hub self-test` without setting `CLOUDRU_VM_BIN`. npm installs the exact optional engine package. If optional dependencies were disabled or the platform is unsupported, provide a matching trusted binary explicitly.

package/package.json

@@ -1,11 +1,11 @@
 {
   "name": "@dzhechkov/cloudru-hub",
-  "version": "0.1.12",
+  "version": "0.1.14",
   "licenseHold": {
     "adr": "features/hermes-claude-adaptation/03_adr/001-licence-and-provenance-precondition.md",
-    "note": "SATISFIED hold (ADR-001 AM-2, grant recorded 2026-08-12 — see grant-record-2026-08-12.md). The field deliberately STAYS: the dz guard `licence-hold` rule passes a satisfied hold with the trigger in place and keeps verifying LICENSE (no PENDING placeholder, Grant-Confirmation URL), THIRD_PARTY_NOTICES and the SPDX license field on every publish. test/pack-holds.test.mjs goes RED if this field is dropped or the LICENSE grant record is degraded."
+    "note": "SATISFIED hold. Timur is credited for substantial Cloud.ru API testing. The 2026-10-20 correction is in the historical grant record. This field keeps the dz guard licence-hold rule checking LICENSE, THIRD_PARTY_NOTICES and SPDX on every publish."
   },
-  "description": "Unofficial Cloud.ru Evolution launcher for Claude Code and harness-cli targets: thin JS launcher for the cloudru-vm MCP engine (144 tools), per-target installers with a deterministic paid-step brake (permission ask/deny + PreToolUse veto hooks), and skill dialect compiler. The engine binary is resolved at RUNTIME, never bundled. NOT affiliated with Cloud.ru.",
+  "description": "Unofficial Cloud.ru Evolution launcher with a pinned cloud-write-blocking MCP proxy for Codex, Hermes, OpenCode and Pi, Claude Code permissions, and skill dialect compiler. Engine binary resolved at runtime, never bundled. NOT affiliated with Cloud.ru.",
   "main": "src/cli.js",
   "bin": {
     "cloudru-hub": "./bin/cloudru-hub.js"
@@ -26,9 +26,9 @@
   ],
   "cloudruHub": {
     "binaryHashes": {
-      "linux-x64": "59f83fc0678b95146ca539764d0c805bd2514b8588f198c1e835b26e54c05124"
+      "linux-x64": "4463b09323c9dfe0c32d618d335734a947e7fab0a75d07a7bea089b97a97c9b6"
     },
-    "engineVersion": "cloudru-vm 0.2.3-20260718",
+    "engineVersion": "cloudru-vm 0.2.6-20261020",
     "platformPackages": {
       "linux-x64": "@dzhechkov/cloudru-vm-linux-x64"
     }
@@ -49,19 +49,25 @@
   "engines": {
     "node": ">=18.0.0"
   },
+  "dependencies": {
+    "yaml": "^2.9.0"
+  },
+  "optionalDependencies": {
+    "@dzhechkov/cloudru-vm-linux-x64": "0.2.6"
+  },
+  "scripts": {
+    "test": "node --test 'test/*.test.mjs'"
+  },
   "repository": {
     "type": "git",
     "url": "git+https://github.com/djd1m/dz-harness.git",
     "directory": "packages/@dzhechkov/cloudru-hub"
   },
-  "homepage": "https://github.com/djd1m/dz-harness/tree/main/packages/@dzhechkov/cloudru-hub#readme",
+  "homepage": "https://aicoding.space",
   "bugs": {
     "url": "https://github.com/djd1m/dz-harness/issues"
   },
   "publishConfig": {
     "access": "public"
-  },
-  "scripts": {
-    "test": "node --test 'test/*.test.mjs'"
   }
-}
+}

package/sbom.json

@@ -15,7 +15,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "edc0f1b076a22dc14b863bef8b287c1b9d8618a12b7ecf9f6eb0c497f74361f3"
+          "content": "4d6d0e6f47b09b017a32e4f3287c0669821e61569835c397245e5077435f5b15"
         }
       ]
     },
@@ -25,7 +25,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "68da42b10dcc095cdfd7249557cee30285664e5dea00dc85475ff047d975616a"
+          "content": "78a14ae697528fa79451ea10725c5ca356f6658378bfb39849b51d05207ab3f3"
         }
       ]
     },
@@ -35,7 +35,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "504ce5cd5b6293b3606f861f31406ae89aa6fee45a03c9099d793aa5a456ced1"
+          "content": "2c25bbd9659f1a02e2a7a5413de8673e8735d67e583458fdede75dfd032b6106"
         }
       ]
     },
@@ -45,7 +45,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "109cffdaaf9402e88f6cc35a0497ba49db015b329fce87ba20762f34dc95c051"
+          "content": "1986a75d5f90631adea8fb40c9fc182371cb875c9d62d65d07fd479b32c876df"
         }
       ]
     },
@@ -85,7 +85,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "13d6a3e87d767d0015f6b2af0223633fa99e49c69c9a8adcec8f6fce6e46d36e"
+          "content": "9abb3ca6347b0cd6cd51b23649c59e0a0c816e6c12a325f573b392affa350d0b"
         }
       ]
     },
@@ -95,7 +95,17 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "56221fa8170f2b32ab6d3a907261badc07695f47ae9ac4adca4e43d2ea5ee06f"
+          "content": "dff98bb859dfbbf8ed2fb6f16f17b767444cc2172ecc7684ca3df8188c95707c"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "docs/HERMES-CODEX.md",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "3605797972f9a7c79c13fbcce0cd9ac8b8fb3a8249abbab938f2b1a45f515420"
         }
       ]
     },
@@ -105,7 +115,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "092142c00295c54866330f2159a13284d04e2f35a749b32dff0ca4f2ab28ea54"
+          "content": "de6f709e820fbb831f390e274238b28ba938644670a8db04fd50d1fa0d86da75"
         }
       ]
     },
@@ -119,7 +129,7 @@
         },
         {
           "name": "dz:canonical-json-sha256-v2",
-          "value": "c40ea35a6a994034e4643310bdd990367abcb033f49279f5349e95fe489b4e1a"
+          "value": "d906ed1871af834274d77dbd3a345b168604456b15360f009a9474778273b11f"
         }
       ]
     },
@@ -139,7 +149,27 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "db981ad0078c80ba7a859057638a2576d7f02d87ca2891f8083a92a8147742dd"
+          "content": "a22f3fcced6e9970e7bed6b935fc03637b6d4b8d3cd6cc65a2685595a6549c1c"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "src/credentials.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "21f074b4bf5b5ee9e893a2c1919cf4bb62f9fa05a0d7a1a8c04afc051ccb0e78"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "src/deploy-approval.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "5c1fba3d298df73ff82f28c72bc5199d23acc6dfc64022438874b0e3381c9394"
         }
       ]
     },
@@ -159,7 +189,27 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5d087b289aaf8cd2e1b4cffbd2227eb3bdc7264cddc0877561e08bc0ea6d6fd2"
+          "content": "c928db48febfb4a79884ce1830365a8302122a55fb5d6ada8e771c049396ca89"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "src/k8s-approval.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "014c2effd1e843d870ae1af4f93f5c82faff9972e9f6ca028ed39d47ec33ee3a"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "src/probe-child.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "0f7a0c1f6d0d033006ca816df49c24e69eb82aa6b70ec03491bce9e4d674bdd4"
         }
       ]
     },
@@ -169,7 +219,27 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "5cbd0861c2973fab62271269b10f748b9638e74f40e8ea034f78ac63bed58001"
+          "content": "d3eba14c23be5bfb7e73952e6ae27908667d535f91be9c43e11dbf7b7c4de49d"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "src/safe-mcp.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "4f95cfb9576c411232503b26053ece6d8d186e4b337beff9bd4afd249f74a014"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "src/toolsets.js",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "89229c882b6a3f5bb9ee542b31d1a40374b91879747582a3e82e8aadc72decb3"
         }
       ]
     },
@@ -183,13 +253,33 @@
         }
       ]
     },
+    {
+      "type": "file",
+      "name": "test/billing-credentials.test.mjs",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "f2e1b05bdb6a6e811844ee19b0142daa02647b387f5d96b4a5d29bd34e3c985d"
+        }
+      ]
+    },
     {
       "type": "file",
       "name": "test/classification.test.mjs",
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "25290e9a8715d13670d617e23cb47c4c2d71b1506a8d98e5b682733b626a18b8"
+          "content": "026e3031180ce9227b4d31775b9c886b10ad0cb418ed0754aed75b12ded84e31"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "test/deploy-approval.test.mjs",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "d72e4363fd50d0fcc65fd23b40601516bd73368c3659f2a55a394c4d1ed3f85c"
         }
       ]
     },
@@ -199,7 +289,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "9b83b2e2cbbee4ead33af61db840833ce4aa2dd0cf5a4448d72d5886098639c6"
+          "content": "3e6236f0cfb159dd73477b6243f6af536925968308085fd248df93932a2bebbf"
         }
       ]
     },
@@ -219,7 +309,17 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e986b29346672bf75b384ab6d8657265b8ecb8f62df6563dca317c1fc63fc8fc"
+          "content": "07fe729b0dc6955329d0a3121ce97d575582f8c6f2895e72d0c38175f82b52d2"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "test/k8s-approval.test.mjs",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "af04d1941fb7aed2cc51b05f65ffed1c440d4d23a7fb26e13261d45e07b0a1f8"
         }
       ]
     },
@@ -239,7 +339,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "e56ee7b4ba160f28687423ca113d1bfbcbfdd351fe9d31ad5a19b4d0069dbe3a"
+          "content": "09b8fdc28bbe5df9b4cfd7d563c1acb479532157bbe1a99e909b3b370dd96630"
         }
       ]
     },
@@ -249,7 +349,7 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "a083ff619f1d97b3e0e1b95dec6e98b56c4296da5171e2eb41c713dd983c8d69"
+          "content": "f5e66cce7344efb22c40bba91b422ce84979948b66bb0305377f8c12eb078002"
         }
       ]
     },
@@ -259,7 +359,17 @@
       "hashes": [
         {
           "alg": "SHA-256",
-          "content": "6b524f69c5ed03aaafab67e734e58092033423b86feade28ad03f516feba2380"
+          "content": "9ad83ba418dee86ef680575a0cc7da4af4be3ae995c00f23f84b336838fbda47"
+        }
+      ]
+    },
+    {
+      "type": "file",
+      "name": "test/safe-mcp.test.mjs",
+      "hashes": [
+        {
+          "alg": "SHA-256",
+          "content": "45406dabeee0635ede5cda3d2f4144c5c13886d624287fd223b01252d2859b87"
         }
       ]
     }

package/src/cli.js

@@ -6,6 +6,9 @@ const { spawn, spawnSync } = require('child_process');
 const { resolveEngine } = require('./resolve');
 const { loadClassification, loadSnapshot, coverageGaps } = require('./classification');
 const { install } = require('./install');
+const { runSafeMcp } = require('./safe-mcp');
+const { issueApproval } = require('./deploy-approval');
+const { issueK8sApproval } = require('./k8s-approval');
 const { compileSkill, writeCompiled } = require('./dialects');
 const PKG = require('../package.json');
 
@@ -13,22 +16,30 @@ function showHelp(write) {
   write(`cloudru-hub ${PKG.version} — unofficial Cloud.ru Evolution launcher (NOT affiliated with Cloud.ru)
 
 The cloudru-vm engine binary is resolved at RUNTIME, never bundled in this package.
-Engine additions authored by Тимур (publication approved — grant record in LICENSE Part 2);
-launcher, adapters and CLI foundation by Dmitry Zhechkov (MIT).
+Тимур contributed extensive Cloud.ru API testing and identified API defects.
 
 Usage: cloudru-hub <command> [options]
 
 Commands:
   resolve [--json]         Locate the engine binary (env CLOUDRU_VM_BIN → ~/.cloudru-hub/config.json
                            enginePath → optional platform package) and verify its sha256 pin.
-  self-test [--json]       End-to-end local check: resolve → sha256 → engine version → live
-                           tools/list probe → golden-classification coverage. Exit 0 = all green.
+  self-test [--json]       Local check: resolve → sha256 → engine version → live tools/list
+                           → golden-classification coverage. Exit 0 = all green.
   mcp                      Run the resolved engine as an MCP stdio server (what .mcp.json points at).
-  install --target <t>     Emit the per-target integration per ADR-005 tiering:
-                           claude-code (full: .mcp.json + permission brake + PreToolUse veto, with an
-                           EXECUTED veto probe), codex (plan-only), agents-md|gemini (pointer-only),
-                           openclaude|opencode|cursor|windsurf|copilot (refused: DEGRADED until live probe).
-           [--dir <path>]  Project directory (default: cwd).  [--npx] use the npx form in .mcp.json.
+  mcp-safe [--toolsets <groups>]  Run a pinned MCP proxy; vm-deploy and k8s-deploy enable bounded deployment.
+  approve --plan-id <id> --max-monthly-rub <amount> [--site-sha256 <digest>]
+                           Authorize one exact VM plan for ten minutes within a RUB/month cap.
+                           Static sites require the artifact digest shown by deploy_plan.
+  k8s-approve --cluster-id <uuid> --namespace <name> --manifest <file> --manifest-sha256 <digest>
+                           Authorize one exact three-resource Snake manifest on an existing cluster.
+  install --target <t>     claude-code: permissions + executed hook probe;
+                           codex|opencode|pi: project MCP config using mcp-safe;
+                           hermes: guarded $HERMES_HOME/config.yaml entry using mcp-safe;
+                           openclaude|cursor|windsurf|copilot: refused pending live probe.
+           [--dir <path>]  Project directory (default: cwd). [--toolsets <groups>] defaults to
+                           inventory for safe hosts; all|compute|kubernetes|data|network|storage|billing|vm-deploy|k8s-deploy.
+                           [--hermes-home <dir>] overrides $HERMES_HOME for Hermes.
+                           [--npx] use the npx form in Claude .mcp.json.
   compile-skill --canonical <dir> --target <t> --out <dir>
                            Generate a target dialect of the canonical skill tree (ADR-006). The
                            canonical corpus is NOT shipped here; point --canonical at the skill/
@@ -53,8 +64,7 @@ function parseArgs(argv) {
 }
 
 function jsonRpcProbe(binPath, timeoutMs = 20_000) {
-  const req = JSON.stringify({ jsonrpc: '2.0', id: 1, method: 'tools/list' }) + '\n';
-  const r = spawnSync(binPath, ['mcp'], { input: req, encoding: 'utf8', timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024 });
+  const r = spawnSync(process.execPath, [require('path').join(__dirname, 'probe-child.js'), binPath], { encoding: 'utf8', timeout: timeoutMs, maxBuffer: 16 * 1024 * 1024 });
   if (r.error) return { error: String(r.error.message || r.error) };
   const line = String(r.stdout || '').split('\n').find((l) => l.trim().startsWith('{'));
   if (!line) return { error: 'engine produced no JSON-RPC response line' };
@@ -76,7 +86,7 @@ function cmdResolve(flags, write) {
   write(`source   ${r.source}`);
   write(`sha256   ${r.sha256}`);
   write(`pinned   ${r.pinned || '<no pin for ' + r.key + '>'}`);
-  write(`verified ${r.verified ? 'yes — matches the pinned baseline' : 'NO — not the pinned baseline (tolerated for env/config paths)'}`);
+  write(`verified ${r.verified ? 'yes — matches the pinned baseline' : 'NO — not the pinned baseline (resolution only; MCP launch refused)'}`);
   return 0;
 }
 
@@ -87,7 +97,11 @@ function cmdSelfTest(flags, write) {
   const r = resolveEngine();
   if (r.error) { step('resolve', false, r.error.split('\n')[0]); if (flags.has('json')) write(JSON.stringify(out, null, 2)); return 1; }
   step('resolve', true, `${r.path} (source: ${r.source})`);
-  step('sha256', true, `${r.sha256}${r.verified ? ' — MATCHES pinned baseline' : ' — no pin match (dev build?)'}`);
+  step('sha256', r.verified, `${r.sha256}${r.verified ? ' — MATCHES pinned baseline' : ' — DOES NOT MATCH pinned baseline'}`);
+  if (!r.verified) {
+    if (flags.has('json')) write(JSON.stringify(out, null, 2));
+    return 1;
+  }
 
   const ver = spawnSync(r.path, ['version'], { encoding: 'utf8', timeout: 10_000 });
   const verOk = ver.status === 0;
@@ -97,13 +111,13 @@ function cmdSelfTest(flags, write) {
   if (probe.error) { step('tools-list', false, probe.error); if (flags.has('json')) write(JSON.stringify(out, null, 2)); return 1; }
   const names = probe.tools.map((t) => t.name);
   const snap = loadSnapshot();
-  step('tools-list', true, `${names.length} tools live (snapshot: ${snap.toolCount})`);
+  step('tools-list', names.length === snap.toolCount, `${names.length} tools live (snapshot: ${snap.toolCount})`);
 
   const gaps = coverageGaps(names);
-  const gapsOk = gaps.unknown.length === 0;
+  const gapsOk = gaps.unknown.length === 0 && gaps.missing.length === 0;
   step('classification-coverage', gapsOk, gapsOk
     ? `every live tool is classified (${Object.keys(loadClassification().tools).length} golden entries)${gaps.missing.length ? `; ${gaps.missing.length} classified tool(s) absent live: ${gaps.missing.join(', ')}` : ''}`
-    : `UNCLASSIFIED live tools (deny-by-default — update data/tools-classification.json): ${gaps.unknown.join(', ')}`);
+    : `tool drift: unclassified=${gaps.unknown.join(', ') || '<none>'}; missing=${gaps.missing.join(', ') || '<none>'}`);
 
   out.ok = out.steps.every((s) => s.ok);
   if (flags.has('json')) write(JSON.stringify(out, null, 2));
@@ -114,6 +128,10 @@ function cmdSelfTest(flags, write) {
 function cmdMcp() {
   const r = resolveEngine();
   if (r.error) { process.stderr.write(r.error + '\n'); return 1; }
+  if (!r.verified) {
+    process.stderr.write(`cloudru-hub mcp: engine sha256 ${r.sha256} does not match pinned ${r.pinned || '<none>'}; refusing to launch\n`);
+    return 1;
+  }
   const child = spawn(r.path, ['mcp'], { stdio: 'inherit' });
   child.on('exit', (code, signal) => process.exit(signal ? 1 : code === null ? 1 : code));
   child.on('error', (e) => { process.stderr.write('cloudru-hub mcp: ' + e.message + '\n'); process.exit(1); });
@@ -139,10 +157,40 @@ function main(argv, write = (s) => process.stdout.write(s + '\n')) {
       const rc = cmdMcp();
       return rc === null ? null : rc;
     }
+    case 'mcp-safe':
+      return runSafeMcp({ toolsets: opts.get('toolsets') || 'all' });
+    case 'approve': {
+      const amount = Number(opts.get('max-monthly-rub'));
+      if (!opts.get('plan-id') || !opts.has('max-monthly-rub') || !Number.isFinite(amount) || amount < 0) {
+        write('cloudru-hub approve: --plan-id and non-negative --max-monthly-rub are required');
+        return 1;
+      }
+      try {
+        const approval = issueApproval(opts.get('plan-id'), amount, process.env, Date.now(), opts.get('site-sha256') || '');
+        write(flags.has('json') ? JSON.stringify(approval, null, 2) :
+          `approved ${approval.planId}: ${approval.vmName}, estimated ${approval.estimatedMonthlyRub} RUB/month (cap ${approval.maxMonthlyRub}); expires ${new Date(approval.expiresAt).toISOString()}${approval.staticSite ? `; static source ${approval.staticSite.source}, SHA-256 ${approval.staticSite.sha256} (${approval.staticSite.sizeBytes} bytes, ${approval.staticSite.files.length} files), ${approval.staticSite.ingress}; ${approval.staticSite.estimateScope}` : ''}`);
+        return 0;
+      } catch (error) {
+        write(`cloudru-hub approve: ${error.message}`);
+        return 1;
+      }
+    }
+    case 'k8s-approve': {
+      try {
+        const approval = issueK8sApproval(opts.get('cluster-id'), opts.get('namespace'),
+          opts.get('manifest'), opts.get('manifest-sha256'));
+        write(flags.has('json') ? JSON.stringify(approval, null, 2) :
+          `approved ${approval.approvalId}: cluster ${approval.clusterId}, namespace ${approval.namespace}, SHA-256 ${approval.manifestSha256}; expires ${new Date(approval.expiresAt).toISOString()}`);
+        return 0;
+      } catch (error) {
+        write(`cloudru-hub k8s-approve: ${error.message}`);
+        return 1;
+      }
+    }
     case 'install': {
       const target = opts.get('target');
       if (!target) { write('cloudru-hub install: --target is required (claude-code|codex|agents-md|gemini|…)'); return 1; }
-      const res = install(target, opts.get('dir') || process.cwd(), { npx: flags.has('npx') });
+      const res = install(target, opts.get('dir') || process.cwd(), { npx: flags.has('npx'), toolsets: opts.get('toolsets') || 'inventory', hermesHome: opts.get('hermes-home') });
       for (const line of res.lines) write(line);
       return res.code;
     }