@nimbus-dev/connectors 0.2.2 → 0.2.3

package/README.md

@@ -21,7 +21,9 @@ Run standalone, a connector gives you:
   parameters in front of you, and does nothing unless you approve.
 - **A write-scope allow-list**, enforced by the server and unreachable by the model.
 - **A mutation budget** per session, which caps a runaway agent loop.
-- **A local, hash-chained, append-only audit log**, when `NIMBUS_MCP_AUDIT_LOG` is set.
+- **A local, hash-chained, append-only audit log**, when `NIMBUS_MCP_AUDIT_LOG` is set — one file
+  can serve every connector you run, within the bounds
+  [Configuration](./docs/configuration.md#the-audit-log) lists.
 
 It does **not** give you the process sandbox, OS-keychain credential storage, the egress ledger, or
 owner-controlled consent. Those are properties of the Nimbus gateway and no published package can
@@ -62,8 +64,8 @@ Full matrix, versions tested, and the provenance of each claim:
 ```
 
 Credentials come from the environment. There is no Vault outside the gateway, so whoever writes this
-config holds the secret. Every variable, and the two behaviours that look like bugs and are not, are
-in [Configuration](./docs/configuration.md).
+config holds the secret. Every variable, and the three behaviours that look like bugs and are not,
+are in [Configuration](./docs/configuration.md).
 
 Each connector has its own README at `connectors/<id>/README.md`. Most list their tools and
 credentials, but some — `github`, `slack` and `jira` among them — are still only a short gateway

package/connectors/athena/src/tools.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import {
   asArray,
-  cliArg,
+  awsCliArg,
   createCliJsonRunner,
   isRecord,
   strField,
@@ -12,8 +12,10 @@ import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connect
 
 /**
  * A catalog / database / table name passed as a value to the `aws athena` CLI.
- * Rejected at the schema boundary if it begins with `-` (argv flag smuggling) or
- * contains control characters.
+ * Rejected at the schema boundary (`awsCliArg`) if it begins with `-` (argv flag
+ * smuggling), contains control characters, or starts with a prefix that makes the
+ * CLI read the value from a file or a URL instead — `file://<path>` as a table name
+ * would send that file to AWS, and an error can quote it back.
  */
 
 /**
@@ -70,8 +72,8 @@ export function registerAthenaTools(reg: ZodToolRegistrar): void {
     "athena_list",
     "List Athena data catalogs, the databases in a catalog, or the tables in a database — METADATA ONLY. With no arguments, lists data catalogs (`aws athena list-data-catalogs`). With `catalog` set, lists that catalog's databases (`aws athena list-databases`). With `catalog` + `database` set, lists that database's table metadata (`aws athena list-table-metadata`) — each entry carries `Name`, `TableType`, `Columns`, and `PartitionKeys`. Never runs a query or returns row/cell data.",
     z.object({
-      catalog: cliArg.optional(),
-      database: cliArg.optional(),
+      catalog: awsCliArg.optional(),
+      database: awsCliArg.optional(),
     }),
     async (p) => {
       if (p.catalog === undefined) {
@@ -100,9 +102,9 @@ export function registerAthenaTools(reg: ZodToolRegistrar): void {
     "athena_get",
     "Fetch one Athena table's schema + METADATA (`aws athena get-table-metadata`). Returns the table object including `Columns` (column names + types only), `PartitionKeys`, `TableType`, `Parameters`, and timestamps. No cell values or query results are returned — schema/metadata only.",
     z.object({
-      catalog: cliArg,
-      database: cliArg,
-      table: cliArg,
+      catalog: awsCliArg,
+      database: awsCliArg,
+      table: awsCliArg,
     }),
     async (p) => {
       return jsonResult(
@@ -123,8 +125,8 @@ export function registerAthenaTools(reg: ZodToolRegistrar): void {
     "athena_search",
     "Substring search over Athena catalog, database, and table NAMES (case-insensitive) — METADATA ONLY. With no `catalog`, searches data-catalog names. With `catalog` set (no `database`), searches that catalog's database names. With `catalog` + `database` set, searches that database's table names. Returns a `{ matches: [...] }` envelope of metadata entries. Never runs a query or samples row data.",
     z.object({
-      catalog: cliArg.optional(),
-      database: cliArg.optional(),
+      catalog: awsCliArg.optional(),
+      database: awsCliArg.optional(),
       query: z.string().min(1),
     }),
     async (p) => {

package/connectors/aws/src/tools.ts

@@ -2,6 +2,7 @@ import { mkdtempSync, readFileSync, rmSync, writeFileSync } from "node:fs";
 import { tmpdir } from "node:os";
 import { join } from "node:path";
 import { z } from "zod";
+import { awsCliArg } from "../../../shared/cli-json-kit.ts";
 import type { ConsentServer } from "../../../shared/consent-kit.ts";
 import { createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
 import {
@@ -66,7 +67,7 @@ export function registerAwsTools(
   reg(
     "aws_ecs_service_list",
     "List ECS services in a cluster.",
-    z.object({ cluster: z.string().min(1) }),
+    z.object({ cluster: awsCliArg }),
     async (p) => jsonResult(await awsJson(["ecs", "list-services", "--cluster", p.cluster])),
   );
 
@@ -83,9 +84,9 @@ export function registerAwsTools(
     },
     "Update ECS service (e.g. new task definition).",
     z.object({
-      cluster: z.string().min(1),
-      service: z.string().min(1),
-      taskDefinition: z.string().min(1),
+      cluster: awsCliArg,
+      service: awsCliArg,
+      taskDefinition: awsCliArg,
     }),
     async (p) => {
       const cmd = [
@@ -114,7 +115,8 @@ export function registerAwsTools(
     },
     "Invoke a Lambda function.",
     z.object({
-      functionName: z.string().min(1),
+      functionName: awsCliArg,
+      // Written to a temp file the CLI is pointed at with file://, never passed as an argument.
       payloadJson: z.string().optional(),
     }),
     async (p) => {
@@ -167,7 +169,7 @@ export function registerAwsTools(
       scopeTargetOf: (p) => ({ kind: "instance", value: p.instanceIds }),
     },
     "Stop EC2 instances.",
-    z.object({ instanceIds: z.string().min(1) }),
+    z.object({ instanceIds: awsCliArg }),
     async (p) => {
       await runCliOkThrowing(
         ["aws", "ec2", "stop-instances", "--instance-ids", p.instanceIds],
@@ -185,7 +187,7 @@ export function registerAwsTools(
       scopeTargetOf: (p) => ({ kind: "instance", value: p.instanceIds }),
     },
     "Start EC2 instances.",
-    z.object({ instanceIds: z.string().min(1) }),
+    z.object({ instanceIds: awsCliArg }),
     async (p) => {
       await runCliOkThrowing(
         ["aws", "ec2", "start-instances", "--instance-ids", p.instanceIds],

package/connectors/azure/src/tools.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { azCliArg } from "../../../shared/cli-json-kit.ts";
 import type { ConsentServer } from "../../../shared/consent-kit.ts";
 import { createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
 import {
@@ -44,8 +45,8 @@ export function registerAzureTools(
     "azure_app_service_list",
     "List App Services in a resource group.",
     z.object({
-      subscriptionId: z.string().min(1),
-      resourceGroup: z.string().min(1),
+      subscriptionId: azCliArg,
+      resourceGroup: azCliArg,
     }),
     async (p) =>
       jsonResult(
@@ -69,9 +70,9 @@ export function registerAzureTools(
     },
     "Restart an App Service.",
     z.object({
-      subscriptionId: z.string().min(1),
-      resourceGroup: z.string().min(1),
-      name: z.string().min(1),
+      subscriptionId: azCliArg,
+      resourceGroup: azCliArg,
+      name: azCliArg,
     }),
     async (p) => {
       await runCliOkThrowing(
@@ -101,10 +102,10 @@ export function registerAzureTools(
     },
     "Scale an AKS node pool.",
     z.object({
-      subscriptionId: z.string().min(1),
-      resourceGroup: z.string().min(1),
-      clusterName: z.string().min(1),
-      poolName: z.string().min(1),
+      subscriptionId: azCliArg,
+      resourceGroup: azCliArg,
+      clusterName: azCliArg,
+      poolName: azCliArg,
       nodeCount: z.number().int().min(0),
     }),
     async (p) => {

package/connectors/cloud-logging/src/tools.ts

@@ -1,5 +1,6 @@
 import { z } from "zod";
 import {
+  cliArg,
   createCliJsonRunner,
   gcloudProjectArgs,
   isRecord,
@@ -8,7 +9,6 @@ import {
 import { mcpJsonResult as jsonResult } from "../../../shared/mcp-tool-kit.ts";
 import { nimbusSpawn } from "../../../shared/nimbus-spawn.ts";
 import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connector.ts";
-import { assertSafeCliArg } from "../../../shared/safe-cli-arg.ts";
 
 /**
  * GCP Cloud Logging (Tier-3, no-row-data) MCP tool surface. ALL tools index log
@@ -75,15 +75,12 @@ export function registerCloudLoggingTools(reg: ZodToolRegistrar): void {
     "cloud_logging_get",
     "Fetch one Cloud Logging routing sink's configuration METADATA (`gcloud logging sinks describe <sink>`). Returns the sink's `name`, `destination`, `filter`, `description`, `disabled` flag, and create/update timestamps. No log-entry contents are returned — metadata only.",
     z.object({
-      sinkName: z.string().min(1),
+      // A bare positional to `gcloud logging sinks describe`, so it is refused here, at the
+      // schema, if gcloud would misread it: a value starting with "-" would be parsed as a flag.
+      sinkName: cliArg,
     }),
     async (p) => {
-      // `sinkName` is a bare positional to `gcloud logging sinks describe`; guard
-      // against argv flag smuggling (a value beginning with "-" would be parsed as
-      // a gcloud flag).
-      return jsonResult(
-        await gcloudLogging(["sinks", "describe", assertSafeCliArg(p.sinkName, "sinkName")]),
-      );
+      return jsonResult(await gcloudLogging(["sinks", "describe", p.sinkName]));
     },
   );
 

package/connectors/cloudwatch/src/tools.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import {
   asArray,
-  cliArg,
+  awsCliArg,
   createCliJsonRunner,
   isRecord,
   strField,
@@ -12,8 +12,9 @@ import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connect
 
 /**
  * A log-group name / prefix passed as a value to the `aws logs` CLI. Rejected at
- * the schema boundary if it begins with `-` (argv flag smuggling) or contains
- * control characters.
+ * the schema boundary (`awsCliArg`) if it begins with `-` (argv flag smuggling),
+ * contains control characters, or starts with a prefix that makes the CLI read the
+ * value from a file or a URL instead.
  */
 
 /**
@@ -65,7 +66,7 @@ export function registerCloudwatchTools(reg: ZodToolRegistrar): void {
     "cloudwatch_list",
     "List CloudWatch log GROUPS — METADATA ONLY (`aws logs describe-log-groups`). Each entry carries `logGroupName`, `arn`, `creationTime`, `retentionInDays`, `storedBytes`, and `metricFilterCount`. Optionally filter by a `prefix` on the log-group name. Never fetches log-event contents / row data.",
     z.object({
-      prefix: cliArg.optional(),
+      prefix: awsCliArg.optional(),
     }),
     async (p) => {
       const args = ["describe-log-groups", "--limit", LIMIT];
@@ -80,7 +81,7 @@ export function registerCloudwatchTools(reg: ZodToolRegistrar): void {
     "cloudwatch_get",
     "Fetch one CloudWatch log group's METADATA plus a stream summary. Returns the matching `describe-log-groups` entry (name, ARN, retention, stored bytes, metric-filter count) and the group's `describe-log-streams` METADATA (stream names, last-event timestamps, stored bytes) ordered by last activity. No log-event contents are returned — metadata only.",
     z.object({
-      logGroupName: cliArg,
+      logGroupName: awsCliArg,
     }),
     async (p) => {
       const group = await logsCli([

package/connectors/gcp/src/tools.ts

@@ -1,5 +1,5 @@
 import { z } from "zod";
-import { gcloudEnv } from "../../../shared/cli-json-kit.ts";
+import { cliArg, gcloudEnv } from "../../../shared/cli-json-kit.ts";
 import type { ConsentServer } from "../../../shared/consent-kit.ts";
 import { createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
 import {
@@ -40,7 +40,7 @@ export function registerGcpTools(
   reg(
     "gcp_cloud_run_service_list",
     "List Cloud Run services in a region.",
-    z.object({ projectId: z.string().min(1), region: z.string().min(1) }),
+    z.object({ projectId: cliArg, region: cliArg }),
     async (p) =>
       jsonResult(
         await gcloudJson([
@@ -62,10 +62,10 @@ export function registerGcpTools(
     },
     "Deploy a container image to Cloud Run.",
     z.object({
-      projectId: z.string().min(1),
-      region: z.string().min(1),
-      service: z.string().min(1),
-      image: z.string().min(1),
+      projectId: cliArg,
+      region: cliArg,
+      service: cliArg,
+      image: cliArg,
     }),
     async (p) => {
       await runCliOkThrowing(
@@ -94,11 +94,11 @@ export function registerGcpTools(
     },
     "Restart a GKE deployment rollout via kubectl (uses current cluster credentials).",
     z.object({
-      projectId: z.string().min(1),
-      location: z.string().min(1),
-      cluster: z.string().min(1),
-      namespace: z.string().min(1),
-      deployment: z.string().min(1),
+      projectId: cliArg,
+      location: cliArg,
+      cluster: cliArg,
+      namespace: cliArg,
+      deployment: cliArg,
     }),
     async (p) => {
       await runCliOkThrowing(

package/connectors/iac/src/tools.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { awsCliArg, awsCliDocument, cliArg } from "../../../shared/cli-json-kit.ts";
 import type { ConsentServer } from "../../../shared/consent-kit.ts";
 import { createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
 import {
@@ -39,7 +40,7 @@ export function registerIacTools(
   reg(
     "iac_terraform_plan",
     "Run terraform plan in a directory.",
-    z.object({ workingDirectory: z.string().min(1) }),
+    z.object({ workingDirectory: cliArg }),
     async (p) => {
       await runCliOkThrowing(["terraform", "-chdir", p.workingDirectory, "plan", "-input=false"], {
         ...processEnv,
@@ -56,7 +57,7 @@ export function registerIacTools(
       scopeTargetOf: (p) => ({ kind: "dir", value: p.workingDirectory }),
     },
     "Run terraform apply.",
-    z.object({ workingDirectory: z.string().min(1) }),
+    z.object({ workingDirectory: cliArg }),
     async (p) => {
       await runCliOkThrowing(
         ["terraform", "-chdir", p.workingDirectory, "apply", "-auto-approve", "-input=false"],
@@ -78,7 +79,7 @@ export function registerIacTools(
       scopeTargetOf: (p) => ({ kind: "dir", value: p.workingDirectory }),
     },
     "Run terraform destroy.",
-    z.object({ workingDirectory: z.string().min(1) }),
+    z.object({ workingDirectory: cliArg }),
     async (p) => {
       await runCliOkThrowing(
         ["terraform", "-chdir", p.workingDirectory, "destroy", "-auto-approve", "-input=false"],
@@ -97,8 +98,8 @@ export function registerIacTools(
     },
     "Deploy a CloudFormation stack via AWS CLI.",
     z.object({
-      stackName: z.string().min(1),
-      templateBody: z.string().min(1),
+      stackName: awsCliArg,
+      templateBody: awsCliDocument,
     }),
     async (p) => {
       await runCliOkThrowing(
@@ -122,7 +123,7 @@ export function registerIacTools(
   reg(
     "iac_pulumi_preview",
     "Run pulumi preview in a stack directory.",
-    z.object({ workingDirectory: z.string().min(1) }),
+    z.object({ workingDirectory: cliArg }),
     async (p) => {
       await runCliOkThrowing(
         ["pulumi", "preview", "--cwd", p.workingDirectory, "--non-interactive"],
@@ -140,7 +141,7 @@ export function registerIacTools(
       scopeTargetOf: (p) => ({ kind: "dir", value: p.workingDirectory }),
     },
     "Run pulumi up.",
-    z.object({ workingDirectory: z.string().min(1) }),
+    z.object({ workingDirectory: cliArg }),
     async (p) => {
       await runCliOkThrowing(
         ["pulumi", "up", "--yes", "--cwd", p.workingDirectory, "--non-interactive"],

package/connectors/kubernetes/src/tools.ts

@@ -1,4 +1,5 @@
 import { z } from "zod";
+import { cliArg } from "../../../shared/cli-json-kit.ts";
 import type { ConsentServer } from "../../../shared/consent-kit.ts";
 import { createWriteToolRegistrar } from "../../../shared/consent-kit.ts";
 import {
@@ -34,7 +35,7 @@ async function kubectlJson(rest: string[]): Promise<unknown> {
   return runCliJsonThrowing(cmd, kubeEnv());
 }
 
-const optionalNamespaceSchema = z.object({ namespace: z.string().min(1).optional() });
+const optionalNamespaceSchema = z.object({ namespace: cliArg.optional() });
 
 async function k8sListNamespacedResource(p: { namespace?: string | undefined }, resource: string) {
   const ns = p.namespace ?? "default";
@@ -92,9 +93,9 @@ export function registerKubernetesTools(
     },
     "Restart a rollout (e.g. deployment).",
     z.object({
-      namespace: z.string().min(1).optional(),
-      resourceType: z.string().min(1),
-      name: z.string().min(1),
+      namespace: cliArg.optional(),
+      resourceType: cliArg,
+      name: cliArg,
     }),
     async (p) => {
       const ns = p.namespace ?? "default";
@@ -117,8 +118,8 @@ export function registerKubernetesTools(
     },
     "Delete a pod.",
     z.object({
-      namespace: z.string().min(1).optional(),
-      podName: z.string().min(1),
+      namespace: cliArg.optional(),
+      podName: cliArg,
     }),
     async (p) => {
       const ns = p.namespace ?? "default";
@@ -137,8 +138,8 @@ export function registerKubernetesTools(
     },
     "Scale a deployment.",
     z.object({
-      namespace: z.string().min(1).optional(),
-      deploymentName: z.string().min(1),
+      namespace: cliArg.optional(),
+      deploymentName: cliArg,
       replicas: z.number().int().min(0),
     }),
     async (p) => {

package/connectors/sagemaker/src/tools.ts

@@ -1,7 +1,7 @@
 import { z } from "zod";
 import {
   asArray,
-  cliArg,
+  awsCliArg,
   createCliJsonRunner,
   isRecord,
   strField,
@@ -13,9 +13,9 @@ import type { ZodToolRegistrar } from "../../../shared/run-read-only-mcp-connect
 /**
  * The argv-injection guard every SageMaker model name passes through on its way to the
  * `aws sagemaker` CLI. Re-exported so this connector's own test can assert the guard rejects a
- * `-`-prefixed value.
+ * `-`-prefixed value, and one the CLI would replace by a file's contents (`file://<path>`).
  */
-export { cliArg };
+export { awsCliArg };
 
 /**
  * Amazon SageMaker (Tier-3, metadata-only) MCP tool surface. ALL tools index
@@ -65,7 +65,7 @@ export function registerSagemakerTools(reg: ZodToolRegistrar): void {
     "sagemaker_list",
     "List Amazon SageMaker models — METADATA ONLY (`aws sagemaker list-models`). Each entry carries `ModelName`, `ModelArn`, and `CreationTime`. Optionally filter by a `nameContains` substring on the model name. Never invokes an endpoint and never fetches inference / training / model-artifact data.",
     z.object({
-      nameContains: cliArg.optional(),
+      nameContains: awsCliArg.optional(),
     }),
     async (p) => {
       const args = ["list-models", "--max-results", PAGE];
@@ -80,7 +80,7 @@ export function registerSagemakerTools(reg: ZodToolRegistrar): void {
     "sagemaker_get",
     "Fetch one Amazon SageMaker model's METADATA (`aws sagemaker describe-model`). Returns the model object including `ModelName`, `ModelArn`, `PrimaryContainer` (container `Image` reference + `ModelDataUrl` S3 pointer — a URI string, NOT the model bytes), `ExecutionRoleArn`, and `CreationTime`. No inference, training, or model-artifact data is returned — registry metadata only.",
     z.object({
-      modelName: cliArg,
+      modelName: awsCliArg,
     }),
     async (p) => {
       return jsonResult(await sagemakerCli(["describe-model", "--model-name", p.modelName]));

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@nimbus-dev/connectors",
-  "version": "0.2.2",
+  "version": "0.2.3",
   "publishConfig": {
     "access": "public"
   },