@nuvlore/extension-bds 0.1.1 → 0.1.2

package/vendor/extension-workday-infra-access/tools/workday_spc_argo_readonly_command_pack.mjs

@@ -1,215 +0,0 @@
-export const description = "Create a local-only, read-only Workday SPC + Argo UI access command pack using saved Keychain LDAP credentials; does not authenticate, port-forward, or mutate Argo/Kubernetes.";
-
-import { z } from "zod";
-import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
-
-const DEFAULT_TIER = "dev";
-const DEFAULT_KEYCHAIN_SERVICE = "eldwin";
-const DEFAULT_KEYCHAIN_ACCOUNT = "eldwin.workday_prod_ldap";
-const DEFAULT_KUBECONFIG = "$HOME/.kube/spc-config";
-const DEFAULT_ARGO_NAMESPACE = "argocdapp";
-const DEFAULT_ARGO_SERVICE = "argocdapp-server";
-const DEFAULT_LOCAL_PORT = 8080;
-
-function normalizeText(value) {
-  return typeof value === "string" ? value.trim() : "";
-}
-
-function shellQuote(value) {
-  return `'${String(value).replaceAll("'", "'\\''")}'`;
-}
-
-function spcCommand(input) {
-  const developerFlag = input.developerAccess ? " -d" : "";
-  return `spc${developerFlag} connect ${shellQuote(input.tier)} ${shellQuote(input.cluster)}`;
-}
-
-function spcTtyCommand(input) {
-  return `/usr/bin/script -q /tmp/spc-${input.cluster}.out ${spcCommand(input)}`;
-}
-
-function portForwardCommand(input) {
-  return [
-    "kubectl",
-    `--kubeconfig=${input.kubeconfig}`,
-    "-n",
-    shellQuote(input.argoNamespace),
-    "port-forward",
-    `svc/${shellQuote(input.argoService)}`,
-    `${input.localPort}:443`
-  ].join(" ");
-}
-
-function argocdStatusCommands(input) {
-  const appNames = input.appNames.length ? input.appNames.map(shellQuote).join(" ") : "";
-  const appSelector = appNames || "-A";
-  const kubeconfig = `--kubeconfig=${input.kubeconfig}`;
-  return [
-    `kubectl ${kubeconfig} get app -n ${shellQuote(input.argoNamespace)} ${appSelector}`,
-    `kubectl ${kubeconfig} get app -n ${shellQuote(input.argoNamespace)} ${appSelector} -o json | jq '.items[]? // .'`,
-    `kubectl ${kubeconfig} get componentrelease -n ${shellQuote(input.workloadNamespace)} ${appNames || ""} -o wide`,
-    `kubectl ${kubeconfig} get componentrelease -n ${shellQuote(input.workloadNamespace)} ${appNames || ""} -o json | jq '.items[]? // . | {name:.metadata.name, chartVersion:.spec.chartVersion, replicas:.spec.chartValues.component.replicas, conditions:.status.conditions}'`,
-    `kubectl ${kubeconfig} get helmrelease -n ${shellQuote(input.workloadNamespace)} ${appNames || ""} -o json | jq '.items[]? // . | {name:.metadata.name, ownerReferences:.metadata.ownerReferences, driftDetection:.spec.driftDetection, replicas:.spec.values.component.replicas, conditions:.status.conditions}'`,
-    `kubectl ${kubeconfig} get deploy,statefulset -n ${shellQuote(input.workloadNamespace)} -o wide`,
-    `kubectl ${kubeconfig} get pods -n ${shellQuote(input.workloadNamespace)} -o wide`,
-    `kubectl ${kubeconfig} get svc,endpoints -n ${shellQuote(input.workloadNamespace)} -o wide`,
-    `kubectl ${kubeconfig} get pods -n ${shellQuote(input.workloadNamespace)} --show-labels`,
-    `kubectl ${kubeconfig} get hpa,vpa,scaledobject -n ${shellQuote(input.workloadNamespace)} 2>/dev/null || true`,
-    `kubectl ${kubeconfig} get events -n ${shellQuote(input.workloadNamespace)} --sort-by=.lastTimestamp`
-  ].filter((command) => !command.endsWith("  -o wide"));
-}
-
-function rbacProbeCommands(input) {
-  const kubeconfig = `--kubeconfig=${input.kubeconfig}`;
-  const namespace = shellQuote(input.workloadNamespace);
-  return [
-    `kubectl ${kubeconfig} auth whoami 2>&1 || true`,
-    `kubectl ${kubeconfig} auth can-i patch deployments/scale -n ${namespace}`,
-    `kubectl ${kubeconfig} auth can-i patch deployments -n ${namespace}`,
-    `kubectl ${kubeconfig} auth can-i patch componentreleases.component.workday.com -n ${namespace}`,
-    `kubectl ${kubeconfig} auth can-i patch helmreleases.helm.toolkit.fluxcd.io -n ${namespace}`
-  ];
-}
-
-function smokeDependencyCommands(input) {
-  const kubeconfig = `--kubeconfig=${input.kubeconfig}`;
-  const namespace = shellQuote(input.workloadNamespace);
-  return [
-    `kubectl ${kubeconfig} get pods -n ${namespace} -l name=prism -o wide`,
-    `kubectl ${kubeconfig} get deploy -n ${namespace} -l name=prism -o wide`,
-    `kubectl ${kubeconfig} get svc,endpoints -n ${namespace} | grep -E 'prism|NAME' || true`
-  ];
-}
-
-function componentControllerCommands(input) {
-  const kubeconfig = `--kubeconfig=${input.kubeconfig}`;
-  return [
-    `kubectl ${kubeconfig} get crd componentreleases.component.workday.com -o json | jq '.spec.versions[]? | select(.served==true) | .schema.openAPIV3Schema.properties.spec.properties | keys'`,
-    `kubectl ${kubeconfig} -n isd-component-controller get deploy isd-component-controller-controller-manager -o json | jq '{image:.spec.template.spec.containers[0].image,args:.spec.template.spec.containers[0].args,labels:.metadata.labels}'`,
-    `kubectl ${kubeconfig} -n isd-component-controller get configmap isd-component-controller-component-controller-config -o json | jq -r '.data | to_entries[] | .value'`
-  ];
-}
-
-function normalizeInput(input = {}) {
-  const appNames = Array.isArray(input.appNames)
-    ? input.appNames.map(normalizeText).filter(Boolean)
-    : [];
-  const tier = normalizeText(input.tier ?? input.domain) || DEFAULT_TIER;
-  const developerAccess = typeof input.developerAccess === "boolean"
-    ? input.developerAccess
-    : ["dev", "eng"].includes(tier);
-  return {
-    cluster: normalizeText(input.cluster),
-    tier,
-    developerAccess,
-    workloadNamespace: normalizeText(input.workloadNamespace) || "bds",
-    argoNamespace: normalizeText(input.argoNamespace) || DEFAULT_ARGO_NAMESPACE,
-    argoService: normalizeText(input.argoService) || DEFAULT_ARGO_SERVICE,
-    keychainService: DEFAULT_KEYCHAIN_SERVICE,
-    keychainAccount: DEFAULT_KEYCHAIN_ACCOUNT,
-    kubeconfig: normalizeText(input.kubeconfig) || DEFAULT_KUBECONFIG,
-    localPort: Number.isInteger(input.localPort) ? input.localPort : DEFAULT_LOCAL_PORT,
-    appNames
-  };
-}
-
-export class WorkdaySpcArgoReadonlyPlanService {
-  invoke(input) {
-    const normalized = normalizeInput(input);
-    if (!normalized.cluster) {
-      throw new Error("cluster is required, for example proteusaws00020.");
-    }
-
-    return JSON.stringify({
-      mode: "atomic-helper",
-      target: {
-        cluster: normalized.cluster,
-        tier: normalized.tier,
-        developerAccess: normalized.developerAccess,
-        workloadNamespace: normalized.workloadNamespace,
-        argoNamespace: normalized.argoNamespace,
-        argoService: normalized.argoService,
-        appNames: normalized.appNames
-      },
-      credentialSource: {
-        keychainService: normalized.keychainService,
-        keychainAccount: normalized.keychainAccount,
-        secretHandling: "do not read PROD password in this command pack; use workday_public_cloud_spc_login for SPC login"
-      },
-      localStateChanges: [
-        "spc may open a local session and update local kubeconfig/context state",
-        "spc connectivity does not grant Kubernetes RBAC; verify the resulting identity with kubectl auth whoami and can-i",
-        "kubectl port-forward opens a localhost listener only"
-      ],
-      commands: {
-        publicCloudLoginTool: `mcp__devops-tool__workday_public_cloud_spc_login ${JSON.stringify({ action: "login", tier: normalized.tier, cluster: normalized.cluster, namespace: normalized.workloadNamespace, humanApprovedLocalWrite: true })}`,
-        spcConnect: spcCommand(normalized),
-        spcConnectTty: spcTtyCommand(normalized),
-        argoPortForward: portForwardCommand(normalized),
-        argoUiUrl: `https://localhost:${normalized.localPort}/`,
-        readOnlyStatus: argocdStatusCommands(normalized),
-        smokeDependencies: smokeDependencyCommands(normalized),
-        rbacProbes: rbacProbeCommands(normalized),
-        componentControllerStatus: componentControllerCommands(normalized)
-      },
-      forbiddenActions: [
-        "Argo Sync",
-        "Argo Hard Refresh",
-        "Argo Delete",
-        "Argo Rollback",
-        "Kubernetes Scale",
-        "Kubernetes Patch",
-        "Kubernetes Restart"
-      ],
-      remoteWrite: "not_executed"
-    }, null, 2);
-  }
-}
-
-const defaultService = new WorkdaySpcArgoReadonlyPlanService();
-
-function workdaySpcArgoReadonlyPlan(input) {
-  return defaultService.invoke(input);
-}
-
-export default defineReadOnlyTool({
-  name: "workday_spc_argo_readonly_command_pack",
-  description: "Create a local-only, read-only Workday SPC + Argo UI access command pack using saved Keychain LDAP credentials; does not authenticate, port-forward, or mutate Argo/Kubernetes.",
-  meta: {
-    permissions: { rule: "ask" },
-    secret_provider: "keychain"
-  },
-  inputSchema: {
-    cluster: z.string().trim().min(1).max(253),
-    domain: z.string().trim().min(1).max(64).optional().describe("Deprecated alias for tier. Use tier for the current SPC CLI shape."),
-    tier: z.string().trim().min(1).max(64).default(DEFAULT_TIER),
-    developerAccess: z.boolean().optional(),
-    workloadNamespace: z.string().trim().min(1).max(253).default("bds"),
-    argoNamespace: z.string().trim().min(1).max(253).default(DEFAULT_ARGO_NAMESPACE),
-    argoService: z.string().trim().min(1).max(253).default(DEFAULT_ARGO_SERVICE),
-    appNames: z.array(z.string().trim().min(1).max(253)).max(32).default([]),
-    kubeconfig: z.string().trim().min(1).max(2048).default(DEFAULT_KUBECONFIG),
-    localPort: z.number().int().min(1024).max(65535).default(DEFAULT_LOCAL_PORT)
-  },
-  async handler(input) {
-    try {
-      return ok(workdaySpcArgoReadonlyPlan(input));
-    } catch (error) {
-      return fail(error);
-    }
-  }
-});
-
-export const __test = {
-  WorkdaySpcArgoReadonlyPlanService,
-  normalizeInput,
-  shellQuote,
-  spcCommand,
-  spcTtyCommand,
-  portForwardCommand,
-  argocdStatusCommands,
-  smokeDependencyCommands,
-  rbacProbeCommands,
-  componentControllerCommands,
-  workdaySpcArgoReadonlyPlan
-};

package/vendor/extension-workday-infra-access/workflows/public-cloud-readonly-investigation.js

@@ -1,99 +0,0 @@
-export const meta = {
-  name: "public-cloud-readonly-investigation",
-  description: "Investigate AWS CUST or GCP cloud state through approved federation/local identity and read-only evidence commands only.",
-  whenToUse: "Use when an incident, Bamboo result, Slack thread, or operator request requires AWS CUST or GCP resource inspection without cloud mutation.",
-  phases: ["Plan", "Identity", "Evidence", "Reply"],
-};
-
-phase("Plan");
-const plan = await agent(
-  [
-    "Extract platform, account/account alias or GCP project, region/zone, service, resource, and incident evidence.",
-    "For AWS CUST federated access, call only mcp__devops_tool__aws_cust_federated_readonly_command_pack.",
-    "For GCP, call only mcp__devops_tool__gcp_readonly_command_pack.",
-    "If the platform is ambiguous, report that blocker and do not guess.",
-    "Do not authenticate, open browser federation, read credential files, use Bash, or call cloud APIs in this phase.",
-  ].join("\n"),
-  {
-    label: "public-cloud-plan",
-    phase: "Plan",
-    tools: "mcp__devops_tool__aws_cust_federated_readonly_command_pack,mcp__devops_tool__gcp_readonly_command_pack",
-    disallowedTools: "Agent,Task,TaskCreate,Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
-  },
-);
-
-phase("Identity");
-const identity = await agent(
-  [
-    "Verify identity only after approved local federation/login outside this workflow.",
-    "For AWS, run the plan's aws sts get-caller-identity via permitted local read-only execution.",
-    "For GCP, run the plan's gcloud auth list and gcloud config list via permitted local read-only execution.",
-    "If local execution is unavailable or denied, return the exact identity command that must be run manually and mark identity as unverified.",
-    "Never run aws configure, gcloud auth login, gcloud config set, or read ~/.aws, ADC, or credential files.",
-    "",
-    "Plan:",
-    plan,
-  ].join("\n"),
-  {
-    label: "public-cloud-identity",
-    phase: "Identity",
-    tools: "",
-    disallowedTools: "Agent,Task,TaskCreate,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
-  },
-);
-
-phase("Evidence");
-const evidence = await agent(
-  [
-    "Collect read-only cloud evidence using commands emitted by the plan.",
-    "Allowed action families are describe, list, get metadata, head, read logs, and get-iam-policy.",
-    "For AWS S3, never run cp, mv, rm, sync, put-object, delete-object, or get-object for secrets/private material.",
-    "For GCP Storage, never run cp, mv, rm, update, compose, or rewrite.",
-    "For IAM/KMS/Secrets Manager, read metadata only; never request secret values, private keys, or key material.",
-    "If a command is denied by the read-only runtime or cloud IAM, preserve the denied action as an evidence gap.",
-    "",
-    "Plan:",
-    plan,
-    "",
-    "Identity:",
-    identity,
-  ].join("\n"),
-  {
-    label: "public-cloud-evidence",
-    phase: "Evidence",
-    tools: "",
-    disallowedTools: "Agent,Task,TaskCreate,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
-  },
-);
-
-phase("Reply");
-const reply = await agent(
-  [
-    "Draft a concise answer from collected cloud evidence only.",
-    "State platform, account/project, identity state, commands run/blocked, observations, and evidence gaps.",
-    "Distinguish IAM/access denial from resource absence.",
-    "State remediation only as a human-reviewed manual recommendation; do not execute writes.",
-    "",
-    "Plan:",
-    plan,
-    "",
-    "Identity:",
-    identity,
-    "",
-    "Evidence:",
-    evidence,
-  ].join("\n"),
-  {
-    label: "public-cloud-reply",
-    phase: "Reply",
-    tools: "",
-    disallowedTools: "Agent,Task,TaskCreate,Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
-  },
-);
-
-return {
-  plan,
-  identity,
-  evidence,
-  reply,
-};