@elinpf/dsh-ops-tool-prometheus 0.3.0 → 0.4.1

package/lib/index.d.ts

@@ -9,17 +9,18 @@
  * reaches the result, the displayed command, or any error text (every
  * returned string is scrubbed against it defensively).
  *
- * The result shape `{ exitCode, stdout, stderr, command, error? }`, output
- * schema, and render duplicate the ops-shell-tool contract verbatim — that
- * factory wraps ctx.shell commands, which this tool is not, and it does not
- * export the contract separately.
+ * The result shape `{ exitCode, stdout, stderr, command, error? }` and the
+ * output schema/render come from `shellToolOutput`/`ShellToolResult` in
+ * ops-shell-tool — the suite-standard contract, reused (that factory wraps
+ * ctx.shell commands, which this tool is not, but the contract stands alone).
  *
  * @module @elinpf/dsh-ops-tool-prometheus
  */
 import type { Context } from '@deepseek-ai/cordis';
 import z from '@deepseek-ai/schemastery';
 import type { PrometheusToolConfig } from './types.js';
-export type { PrometheusToolConfig, PrometheusToolResult } from './types.js';
+export type { PrometheusToolConfig } from './types.js';
+export type { ShellToolResult as PrometheusToolResult } from '@elinpf/dsh-ops-shell-tool';
 export declare const name = "ops-tool-prometheus";
 export declare const inject: string[];
 export declare const Config: z<PrometheusToolConfig>;

package/lib/index.js

@@ -9,16 +9,17 @@
  * reaches the result, the displayed command, or any error text (every
  * returned string is scrubbed against it defensively).
  *
- * The result shape `{ exitCode, stdout, stderr, command, error? }`, output
- * schema, and render duplicate the ops-shell-tool contract verbatim — that
- * factory wraps ctx.shell commands, which this tool is not, and it does not
- * export the contract separately.
+ * The result shape `{ exitCode, stdout, stderr, command, error? }` and the
+ * output schema/render come from `shellToolOutput`/`ShellToolResult` in
+ * ops-shell-tool — the suite-standard contract, reused (that factory wraps
+ * ctx.shell commands, which this tool is not, but the contract stands alone).
  *
  * @module @elinpf/dsh-ops-tool-prometheus
  */
 import z from '@deepseek-ai/schemastery';
 import { defineTool } from '@deepseek-ai/dsh-tools';
 import { readFile } from 'node:fs/promises';
+import { shellToolOutput } from '@elinpf/dsh-ops-shell-tool';
 // ── Plugin identity ───────────────────────────────────────────────────────────
 export const name = 'ops-tool-prometheus';
 export const inject = ['tools'];
@@ -27,36 +28,8 @@ export const Config = z.object({
     /** Per-call HTTP timeout for Prometheus queries (ms). Slow queries may need more. */
     timeoutMs: z.number().default(30000),
 });
-// ── Output contract (verbatim copy of the ops-shell-tool one) ────────────────
-const output = {
-    schema: {
-        type: 'object',
-        additionalProperties: false,
-        properties: {
-            exitCode: { type: 'number', required: true },
-            stdout: { type: 'string', required: true },
-            stderr: { type: 'string', required: true },
-            command: { type: 'string', required: true },
-            error: { type: 'string' },
-        },
-    },
-    // Pure function of (args, value): same inputs, same text, no state touched.
-    render: (_args, value) => {
-        const parts = [];
-        if (value.command)
-            parts.push(`$ ${value.command}`);
-        if (value.stdout)
-            parts.push(value.stdout);
-        if (value.stderr)
-            parts.push(`[stderr]\n${value.stderr}`);
-        if (value.error)
-            parts.push(`[error] ${value.error}`);
-        if (value.exitCode !== 0 && value.exitCode !== undefined && value.exitCode !== null) {
-            parts.push(`[exit code: ${value.exitCode}]`);
-        }
-        return [{ type: 'text', text: parts.join('\n\n') || '(no output)' }];
-    },
-};
+// ── Output contract: the ops-shell-tool one, shared ──────────────────────────
+const output = shellToolOutput;
 // ── Formatting ───────────────────────────────────────────────────────────────
 /** Hard caps guarding the model's context against a fat range query. */
 const MAX_SERIES = 100;
@@ -156,6 +129,7 @@ export function createPrometheusTool(ctx, config, deps = {}) {
             end: { type: 'string', description: 'Range query end (RFC3339 or unix seconds). Requires start and step.' },
             step: { type: 'string', description: 'Range query resolution step, e.g. "15s", "1m". Requires start and end.' },
             timeoutSec: { type: 'number', description: 'Optional per-call timeout in seconds (default 30, max 600). Use only for a query you KNOW is slow (a wide range over many series) — a longer wait does not fix an unreachable server.' },
+            tier: { type: 'string', enum: ['ro', 'rw'], description: 'Credential tier for THIS call. Omit = decided by the grant. "ro" = deliberate downgrade under an rw grant (declare it for pure queries). "rw" = require the write tier; fails loudly without a session grant and points at request_access.' },
         },
         output,
         async execute(args, exec) {
@@ -192,8 +166,10 @@ export function createPrometheusTool(ctx, config, deps = {}) {
                 }
                 // Pass the caller agent through so the access gate (if mounted) can
                 // key grants on the session id. Core tolerates a `prometheus/` prefix
-                // on the name.
-                const profile = await opsAccess.resolve('prometheus', cluster, exec.agent);
+                // on the name. An explicit tier arg is the per-call declaration
+                // ('ro' = deliberate downgrade; 'rw' = fail loudly when ungranted).
+                const tierArg = args.tier === 'ro' || args.tier === 'rw' ? args.tier : undefined;
+                const profile = await opsAccess.resolve('prometheus', cluster, exec.agent, tierArg ? { tier: tierArg } : undefined);
                 const baseUrl = String(profile.fields.url ?? '');
                 const endpoint = isRange ? '/api/v1/query_range' : '/api/v1/query';
                 command = `${display} @ ${baseUrl}${endpoint}`;

package/lib/types.d.ts

@@ -13,17 +13,3 @@ export interface PrometheusToolConfig {
     /** Per-call HTTP timeout for Prometheus queries (ms). Slow queries may need more. */
     timeoutMs: number;
 }
-/**
- * The suite-standard tool result shape — identical to ShellToolResult in
- * @elinpf/dsh-ops-shell-tool. Duplicated here (with the output schema/render)
- * because this tool speaks HTTP, not shell: it does not go through
- * registerProfiledShellTool, and ops-shell-tool does not export the contract
- * separately.
- */
-export interface PrometheusToolResult {
-    exitCode: number;
-    stdout: string;
-    stderr: string;
-    command: string;
-    error?: string;
-}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@elinpf/dsh-ops-tool-prometheus",
-  "version": "0.3.0",
+  "version": "0.4.1",
   "description": "prometheus tool consumer of the ops-access seam — resolves prometheus profiles and runs PromQL instant/range queries over the Prometheus HTTP API, injecting the bearer token automatically.",
   "type": "module",
   "main": "lib/index.js",
@@ -33,12 +33,13 @@
     }
   },
   "dependencies": {
-    "@deepseek-ai/schemastery": "^3.18.1"
+    "@deepseek-ai/schemastery": "^3.18.1",
+    "@elinpf/dsh-ops-shell-tool": "0.4.1"
   },
   "peerDependencies": {
     "@deepseek-ai/cordis": "^4.0.1",
     "@deepseek-ai/dsh-tools": "^0.1.0-rc.8",
-    "@elinpf/dsh-ops-access": "^0.3.0"
+    "@elinpf/dsh-ops-access": "^0.4.1"
   },
   "devDependencies": {
     "@deepseek-ai/cordis": "4.0.1",
@@ -46,7 +47,8 @@
     "@types/node": "^22.0.0",
     "typescript": "^5.4.0",
     "vitest": "^4.1.11",
-    "@elinpf/dsh-ops-access": "0.3.0"
+    "@elinpf/dsh-ops-test-support": "0.0.0",
+    "@elinpf/dsh-ops-access": "0.4.1"
   },
   "license": "MIT",
   "publishConfig": {