@nuvlore/extension-bds 0.1.1 → 0.1.2

package/vendor/extension-workday-infra-access/skills/workday-infra-access/SKILL.md

@@ -1,102 +0,0 @@
----
-name: workday-infra-access
-description: Use when the user needs Workday infrastructure access planning, including DC/Boundary connectivity with LDAP credentials or public-cloud connection planning.
-allowed-tools:
-  - mcp__devops_tool__workday_boundary_login
-  - mcp__devops_tool__workday_public_cloud_environment_map
-  - mcp__devops_tool__workday_public_cloud_spc_login
-  - mcp__devops_tool__workday_private_cloud_sudo_readonly_command
-  - mcp__devops_tool__workday_spc_argo_readonly_command_pack
-  - mcp__devops_tool__public_cloud_access_status
-  - mcp__devops_tool__aws_cust_federated_readonly_command_pack
-  - mcp__devops_tool__gcp_readonly_command_pack
-  - mcp__devops_tool__remote_readonly_command
-  - mcp__devops_tool__remote_log_pattern_summary
----
-
-# Workday Infrastructure Access
-
-Use this skill for Workday DC/Boundary access planning, saved LDAP
-credential-backed `bauth init`, explicit-host ordinary SSH checks, SPC + Argo UI
-inspection, AWS CUST federated access planning, and GCP read-only access
-planning.
-
-Shared access conventions for DC login, Scylla BDM access, and sudo stdin live
-in `workday-access-profiles`; package tools should reuse those profiles instead
-of copying Boundary, Keychain, SSH, or BDM command templates.
-
-Load `references/access-runbook.md` as the router, then load only the matching
-access-path reference: `references/access-boundary-runbook.md`,
-`references/access-spc-argo-runbook.md`, or
-`references/access-scylla-cloud-runbook.md`.
-
-## Routing
-
-- Boundary/DC host access: start with `workday_boundary_login` action `status`.
-  If login preparation is required, use action `login` only after explicit
-  human approval with `humanApprovedLocalWrite: true` and a complete structured
-  `hitlApproval` object.
-- Public cloud environment mapping: when the user gives a logical environment
-  such as CP2, call `workday_public_cloud_environment_map` first to resolve the
-  concrete SPC cluster and platform-specific follow-up reads.
-- Public cloud environment login: after mapping, call
-  `workday_public_cloud_spc_login`.
-  For customer SPC clusters, the tool must refresh `sso-cust` with
-  `sso-cli aws --force --profile sso-cust`, then run SPC with
-  `AWS_PROFILE=sso-cust` only. Do not pass `AWS_REGION` into `sso-cli aws`,
-  `spc connect`, or the follow-up kubectl environment unless the operator
-  explicitly requests a region override.
-- Workday SPC + Argo UI inspection after public-cloud login: call `workday_spc_argo_readonly_command_pack`.
-- Generic public cloud access planning: call `public_cloud_access_status`.
-- AWS CUST federated access: call `aws_cust_federated_readonly_command_pack` first.
-- GCP project access: call `gcp_readonly_command_pack` first.
-- Private cloud sudo evidence collection: for an explicit private cloud/DC
-  host, use only `workday_private_cloud_sudo_readonly_command` for commands
-  that need sudo. The tool itself runs `bauth init` with LDAP PROD, then uses
-  ordinary `ssh <host>`.
-- Non-sudo remote evidence collection: after Boundary login is ready and the
-  target host is explicit, use only `remote_readonly_command` or
-  `remote_log_pattern_summary` with ordinary SSH. Private cloud/DC does not use
-  SPC.
-
-## Guardrails
-
-- Never ask the user to paste LDAP passwords into chat.
-- Never print, summarize, or store LDAP passwords, Keychain JSON, tokens,
-  private keys, kubeconfig, ADC, AWS credential files, or cloud session
-  material.
-- Login preparation can update local auth state; keep it separate from remote
-  inspection evidence and require explicit approval. Public cloud uses SPC;
-  private cloud/DC uses Boundary through `bauth init`.
-- Both public cloud SPC login and private cloud Boundary login require an
-  already-active Workday Security Network session first.
-- Only `workday_boundary_login`, `workday_public_cloud_spc_login`, and
-  `workday_private_cloud_sudo_readonly_command` may read the LDAP PROD password
-  from Keychain. Other tools and agents must not call Keychain directly.
-- Do not authenticate, port-forward, mutate Argo/Kubernetes, call cloud APIs, or
-  run cloud login/config commands from a tool unless the operator is actively
-  doing that approved local setup in an interactive session.
-- Do not invent hostnames. If no host or resolvable target is provided, ask for
-  the host or state the blocker.
-- Treat permission/RBAC/IAM denials as evidence gaps, not proof that a resource,
-  service, pod, or log is absent.
-
-## Evidence Order
-
-1. Classify the request as Boundary/DC, SPC/Argo, AWS CUST, GCP, generic public
-   cloud, or explicit remote read-only inspection.
-2. Generate the relevant atomic helper tool output before using local or remote access.
-3. Verify cloud/session identity and authorization before evidence reads:
-   for public-cloud SPC, check `AWS_PROFILE=sso-cust aws sts get-caller-identity`
-   before `kubectl auth whoami` and `kubectl auth can-i`; for other paths use
-   `aws sts get-caller-identity`,
-   `gcloud auth list`, or `gcloud config list` as applicable.
-4. Collect only bounded read-only evidence from explicit hosts, namespaces,
-   projects, accounts, or services.
-5. Report exact status, evidence, blockers, and next read-only checks.
-
-## Output
-
-Return Boundary/SPC/cloud readiness, target checked, identity or authorization
-evidence, read-only command result summary, blockers such as missing Keychain
-credential or unavailable `bauth`, and the next safe read-only check.

package/vendor/extension-workday-infra-access/skills/workday-infra-access/references/access-boundary-runbook.md

@@ -1,43 +0,0 @@
-# Boundary And BDS DC Access Runbook
-
-Use for private cloud/DC `bauth init`, explicit BDS DC hosts, ordinary SSH,
-sudo stdin, root-owned read-only state, and remote command examples. Owner:
-`workday-infra-access/SKILL.md`.
-
-## Shared Profiles
-
-- Reuse shared profiles for DC SSH and `SudoEnvironmentProfile` for routing
-  sudo reads to the dedicated sudo tool.
-
-## Boundary Access
-
-- Check Boundary status with `workday_boundary_login` using `action: "status"`.
-- If Boundary is not ready and the user explicitly approves local auth-state
-  changes, call `workday_boundary_login` with `action: "login"`,
-  `humanApprovedLocalWrite: true`, and a complete `hitlApproval` object with
-  `approved`, `approvedBy`, `action`, `target`, `reason`, `expectedImpact`, and
-  `risk`.
-- The tool consumes the saved macOS Keychain LDAP credential in place for
-  approved `bauth init`; do not ask the user to paste LDAP passwords into chat.
-- For BDS customer DC hosts, use the explicit hostname from incident or
-  environment evidence unchanged. After `bauth init`, connect with ordinary
-  `ssh <host>`; do not use SPC for private cloud and do not invent `.bnd`
-  aliases.
-- Start remote work as the normal SSH user. Use `sudo` only for root-owned
-  read-only state such as root kubeconfig, bounded `journalctl`, or service
-  status.
-- When sudo needs a password, use `workday_private_cloud_sudo_readonly_command`.
-  The tool reads the LDAP PROD password from Keychain, runs `bauth init`, then
-  passes the same secret only to remote sudo stdin. Agents and command packs
-  must not call Keychain directly.
-
-## Read-Only Command Boundary
-
-- Read-only examples: `hostname -f`, `date -u`, `whoami`,
-  `kubectl get/describe/logs`, `hdfs dfs -ls/-du/-cat/-tail`, `yarn logs`,
-  `getent hosts`, `ip route get`, bounded `curl` connect probes, `journalctl`
-  reads, and `systemctl status`.
-- Mutating examples forbidden in read-only investigations: service restarts,
-  `kubectl apply/delete/patch/scale/rollout restart`, Airflow `clear`,
-  `backfill`, `trigger`, `mark_success`, HDFS writes/removals, migration
-  cancel/retry, and `aws s3 cp` object writes.

package/vendor/extension-workday-infra-access/skills/workday-infra-access/references/access-runbook.md

@@ -1,15 +0,0 @@
-# Workday Infrastructure Access Runbook Router
-
-This file is only a router for `workday-infra-access/SKILL.md`. Load the
-smallest access-path reference that matches the request.
-
-Both public-cloud SPC and private-cloud Boundary paths require an active Workday
-Security Network session before starting environment login.
-
-- Private cloud/DC `bauth init`, BDS DC ordinary SSH, sudo stdin, and
-  read-only remote commands:
-  `access-boundary-runbook.md`.
-- Public cloud SPC login, Argo UI, ComponentRelease, Flux HelmRelease,
-  smoke-test dependency namespace checks: `access-spc-argo-runbook.md`.
-- Scylla BDM, AWS CUST, and GCP public-cloud read-only access after SPC login:
-  `access-scylla-cloud-runbook.md`.

package/vendor/extension-workday-infra-access/skills/workday-infra-access/references/access-scylla-cloud-runbook.md

@@ -1,39 +0,0 @@
-# Scylla BDM And Public Cloud Access Runbook
-
-Use for Scylla BDM bucket checks, AWS CUST read-only access, and GCP read-only
-access. Owner: `workday-infra-access/SKILL.md`.
-
-## Scylla BDM Access
-
-- Reuse `ScyllaAccessProfile` for BDM `kcsb`, `bucketdetails-config`, and RBAC.
-- Connect to the target Scylla environment, read `bucketdetails-config`, then use
-  BDM `kcsb exec <bdm-pod> -- sh -lc 'hadoop fs ...'` and bounded BDM logs.
-- Before claiming SIR, Galahad, OMS, or ORS pods/logs are absent, run namespace
-  `kubectl auth can-i` checks through the SPC kubeconfig.
-
-## AWS CUST
-
-- Use `aws_cust_federated_readonly_command_pack` first. The operator must complete AWS
-  federated access using the approved CCOE guide
-  `AWS - Federated Access to CUST Accounts - User Guide`; tools must not open
-  browser federation, run `aws configure`, read `~/.aws`, or store cloud session
-  material.
-- Always run `aws sts get-caller-identity` before AWS evidence reads. Verify
-  account ID, role ARN, region, and profile against incident evidence before
-  reading service metadata.
-- AWS read-only commands are limited to `describe-*`, `list-*`, `get-*`,
-  `head-*`, `aws s3 ls`, and `aws sts get-caller-identity`.
-- Treat `aws s3 cp`, `mv`, `rm`, `sync`, `s3api put-object`,
-  `s3api delete-object`, `secretsmanager get-secret-value`, and IAM/KMS mutation
-  as forbidden.
-
-## GCP
-
-- Use `gcp_readonly_command_pack` first. Use an already-approved local `gcloud`
-  identity only; do not run `gcloud auth login`, `gcloud config set`, read ADC
-  credentials, or change active project/impersonation from a tool.
-- Always verify `gcloud auth list` and `gcloud config list` before GCP evidence
-  reads.
-- GCP read-only commands are limited to project/IAM policy inspection,
-  list/describe/read operations, and Cloud Storage bucket/object listing.
-- A cloud IAM denial is an evidence gap, not proof that the resource is absent.

package/vendor/extension-workday-infra-access/skills/workday-infra-access/references/access-spc-argo-runbook.md

@@ -1,99 +0,0 @@
-# SPC, Argo, And ComponentRelease Access Runbook
-
-Use for public cloud SPC connection, Argo UI inspection,
-ComponentRelease/HelmRelease drift, and smoke-test dependency namespace checks.
-Private cloud/DC login uses Boundary through `bauth init` instead. Owner:
-`workday-infra-access/SKILL.md`.
-
-## SPC And Argo UI
-
-- Confirm Workday Security Network login/session is active before SPC login.
-- If the user gives a logical environment name instead of an SPC cluster, map it
-  first with `workday_public_cloud_environment_map`. Do not treat logical names
-  like `CP2` as SPC cluster names.
-- Preserve the operator-provided tier and cluster mapping. Current SPC CLI shape
-  is `spc [-d] connect <tier> <cluster>`; `-d` means developer access for
-  DEV/ENG, not the tier argument. Examples:
-  `spc -d connect dev proteusaws00020` and `spc connect cust s0026`.
-- Use `workday_public_cloud_spc_login` for the reusable public-cloud login
-  step. It may update local SPC kubeconfig/session state only after structured
-  HITL approval.
-- The verified public-cloud login sequence is:
-  1. Confirm Workday Security Network is active.
-  2. Refresh the AWS source credential with
-     `sso-cli aws --force --profile sso-cust`.
-  3. Start SPC with `AWS_PROFILE=sso-cust spc connect cust <cluster>`.
-  4. Verify with
-     `AWS_PROFILE=sso-cust kubectl --kubeconfig=$HOME/.kube/spc-config config current-context`,
-     `auth whoami`, and `auth can-i get pods -n <namespace>`.
-  Do not export `AWS_REGION` or `AWS_DEFAULT_REGION` into the `spc connect` or
-  `kubectl` environment. Do not pass `--region` to `sso-cli aws` unless the
-  operator explicitly requests it; forcing a region into SPC caused DynamoDB
-  `ResourceNotFoundException` during live testing.
-- Use macOS Keychain service `eldwin`, account `eldwin.workday_prod_ldap` for
-  public cloud SPC login across tiers. Legacy `wallee` entries are fallback
-  secret sources only. Some entries are JSON; extract only the top-level
-  `token` and pass it through `expect`/stdin.
-- `spc` requires a TTY password prompt. A plain pipe may fail with
-  `inappropriate ioctl for device`; use an `expect` wrapper. If `spc` exits
-  before a password prompt during debugging, a TTY wrapper such as
-  `/usr/bin/script -q /tmp/spc-<cluster>.out spc connect <tier> <cluster>` can
-  establish the session without exposing the secret.
-- Ensure local `PATH` includes `session-manager-plugin`, `sso-cli`, `kubectl`,
-  and `spc`; missing PATH entries can make `spc connect` or kubeconfig exec auth
-  fail even when binaries are installed.
-- On this workstation the verified binary locations are:
-  `/Users/boqiang.liang/bin/sso-cli`,
-  `/usr/local/bin/spc`,
-  `/usr/local/bin/kubectl`, and
-  `/usr/local/bin/session-manager-plugin`. Non-login shells may not include
-  these paths by default, so tools must set the PATH explicitly.
-- `spc list cust --url` is a useful preflight after AWS refresh. SPC cluster
-  names are values such as `s0026` and `s0109`; names like `wd103perf` can be
-  AWS profile aliases or legacy kube contexts and are not necessarily valid SPC
-  cluster names.
-- CP2 examples:
-  - AWS-backed public cloud: refresh AWS with `sso-cli aws --force --profile
-    sso-cust`, then `AWS_PROFILE=sso-cust spc connect cust s0054`, then use
-    bounded `kcsb get pod` or explicit `kubectl --kubeconfig=$HOME/.kube/spc-config`
-    reads.
-  - GCS-backed public cloud: refresh AWS with `sso-cli aws --force --profile
-    sso-cust`, then `AWS_PROFILE=sso-cust spc connect cust s0029`, then use
-    bounded `kcsb get pod`; if approved read-only pod shell access is needed,
-    `kcsb exec -it bdm-0 -- bash` may be used only for bounded reads such as
-    `gsutil ls gs://scylla-218441665564-bds-tenant-s0020/data/tenants/`.
-- Use `kcsb` or explicit `kubectl` commands so evidence is copyable, bounded,
-  and auditable.
-- Clean up long-running `spc connect` and port-forward processes when done.
-- After `spc` is connected, Argo UI can be inspected through
-  `kubectl --kubeconfig=$HOME/.kube/spc-config -n argocdapp port-forward svc/argocdapp-server 8080:443`
-  and `https://localhost:8080/`.
-- `spc connect` proves connectivity, not Kubernetes authorization. Before any
-  approved remediation such as `kubectl scale`, `patch`, or `rollout restart`,
-  verify identity with `kubectl auth whoami` and the target verb with
-  `kubectl auth can-i ... -n <namespace>`.
-- Argo UI inspection is read-only only if you avoid state-changing controls:
-  `Sync`, `Hard Refresh`, `Delete`, `Rollback`, `Scale`, `Patch`, and `Restart`.
-- Prefer CLI reads where possible:
-  `kubectl --kubeconfig=$HOME/.kube/spc-config get app -n argocdapp ... -o json`,
-  `kubectl get componentrelease -n <namespace> ...`, and
-  `kubectl get deploy,statefulset,pods -n <namespace> -o wide`.
-- Before claiming a service, pod, or log is absent, check namespace RBAC with
-  `kubectl --kubeconfig=$HOME/.kube/spc-config auth can-i get pods -n <namespace>`,
-  plus equivalent service, endpoints, deployment, and logs checks.
-
-## ComponentRelease And Smoke-Test Dependencies
-
-- For BDS/Proteus ComponentRelease investigations, verify all five layers:
-  scylla `component-config` source of truth, Argo Application sync/health,
-  ComponentRelease desired/deployed status, Flux HelmRelease desired status and
-  `spec.driftDetection`, and live Deployment/StatefulSet/pod replicas.
-- Treat `HelmRelease.spec.driftDetection` as a Flux Helm Controller setting. If
-  it is null/disabled and live workloads drift from non-zero desired replicas,
-  the deeper platform question is whether `isd-component-controller` and the
-  ComponentRelease CRD/default HelmRelease spec expose or set drift detection.
-- When a Bamboo smoke test waits on a dependency selector such as `name=prism`,
-  inspect that dependency namespace directly. Compare ComponentRelease and
-  HelmRelease desired state with live deployments, pods selected by the exact
-  label, and service endpoints; do not assume a successful ComponentRelease
-  means dependency pods are running.

package/vendor/extension-workday-infra-access/src/workday-access-profiles.mjs

@@ -1,194 +0,0 @@
-export const DEFAULT_DC_BOUNDARY_ADDR = "https://dccust.pam.gowday.com";
-export const DEFAULT_BOUNDARY_BINARY_DIR = "/opt/homebrew/bin";
-export const DEFAULT_BOUNDARY_PROXY_JUMP_HOST = "proxy-jump.atl.bnd";
-export const DEFAULT_WORKDAY_LDAP_KEYCHAIN_SERVICE = "eldwin";
-export const DEFAULT_WORKDAY_LDAP_SERVICE_KEY = "workday_prod_ldap";
-export const DEFAULT_WORKDAY_LDAP_PROD_SERVICE_KEY = "workday_prod_ldap";
-export const DEFAULT_WORKDAY_LDAP_CORP_SERVICE_KEY = "workday_corp_ldap";
-export const DEFAULT_WORKDAY_LDAP_KEYCHAIN_ACCOUNT = "eldwin.workday_prod_ldap";
-export const DEFAULT_WORKDAY_LDAP_PROD_KEYCHAIN_ACCOUNT = "eldwin.workday_prod_ldap";
-export const DEFAULT_WORKDAY_LDAP_CORP_KEYCHAIN_ACCOUNT = "eldwin.workday_corp_ldap";
-export const LEGACY_WORKDAY_LDAP_KEYCHAIN_SERVICE = ["wal", "lee"].join("");
-export const LEGACY_WORKDAY_LDAP_KEYCHAIN_ACCOUNT = `${LEGACY_WORKDAY_LDAP_KEYCHAIN_SERVICE}.workday_prod_ldap`;
-export const LEGACY_WORKDAY_LDAP_PROD_KEYCHAIN_ACCOUNT = `${LEGACY_WORKDAY_LDAP_KEYCHAIN_SERVICE}.workday_prod_ldap`;
-export const LEGACY_WORKDAY_LDAP_CORP_KEYCHAIN_ACCOUNT = `${LEGACY_WORKDAY_LDAP_KEYCHAIN_SERVICE}.workday_corp_ldap`;
-export const DEFAULT_ADMIN_KUBECONFIG_PATH = "/etc/kubernetes/admin.conf";
-export const DEFAULT_SCYLLA_NAMESPACE = "bds";
-export const DEFAULT_SCYLLA_BDM_POD = "bdm-0";
-
-function normalizeText(value) {
-  return typeof value === "string" ? value.trim() : "";
-}
-
-export function shellQuote(value) {
-  return `'${String(value).replaceAll("'", "'\\''")}'`;
-}
-
-export function extractTokenFromKeychainSecret(rawSecret = "") {
-  const text = normalizeText(rawSecret);
-  if (!text) return "";
-  try {
-    const parsed = JSON.parse(text);
-    return normalizeText(parsed?.token);
-  } catch {
-    return text;
-  }
-}
-
-export function keychainAccountCandidates(account, { canonicalPrefix = "eldwin." } = {}) {
-  const raw = normalizeText(account);
-  if (!raw) return [];
-  const prefixed = raw.startsWith(canonicalPrefix) ? raw : `${canonicalPrefix}${raw}`;
-  return Array.from(new Set([raw, prefixed]));
-}
-
-export function uniqueCredentialCandidates(candidates = []) {
-  return candidates
-    .filter((candidate) => candidate?.service && candidate?.account)
-    .filter((candidate, index, all) =>
-      all.findIndex((item) => item.service === candidate.service && item.account === candidate.account) === index
-    );
-}
-
-export function workdayProdCredentialCandidates() {
-  return uniqueCredentialCandidates([
-    { service: DEFAULT_WORKDAY_LDAP_KEYCHAIN_SERVICE, account: DEFAULT_WORKDAY_LDAP_PROD_KEYCHAIN_ACCOUNT },
-    { service: LEGACY_WORKDAY_LDAP_KEYCHAIN_SERVICE, account: LEGACY_WORKDAY_LDAP_PROD_KEYCHAIN_ACCOUNT }
-  ]);
-}
-
-export class DcLoginProfile {
-  constructor(input = {}) {
-    this.boundaryAddr = input.boundaryAddr ?? DEFAULT_DC_BOUNDARY_ADDR;
-    this.boundaryBinaryDir = input.boundaryBinaryDir ?? DEFAULT_BOUNDARY_BINARY_DIR;
-    this.boundaryProxyJumpHost = input.boundaryProxyJumpHost ?? DEFAULT_BOUNDARY_PROXY_JUMP_HOST;
-    this.useBoundaryBnd = input.useBoundaryBnd ?? false;
-  }
-
-  boundaryHostFor(host) {
-    const value = String(host || "");
-    if (!this.useBoundaryBnd || value.includes("<") || value.endsWith(".bnd")) return value;
-    return `${value}.bnd`;
-  }
-
-  environmentPrefix() {
-    return `BOUNDARY_ADDR=${shellQuote(this.boundaryAddr)} BOUNDARY_SKIP_CACHE_DAEMON=true PATH=${shellQuote(this.boundaryBinaryDir)}:/Users/boqiang.liang/bin:/usr/local/bin:$PATH`;
-  }
-
-  sshCommandFor(host, remoteCommand, { connectTimeout = 20 } = {}) {
-    return `${this.environmentPrefix()} ssh -o BatchMode=yes -o ConnectTimeout=${connectTimeout} -- ${this.boundaryHostFor(host)} ${JSON.stringify(remoteCommand)}`;
-  }
-
-  proxyJumpCommandFor(host, remoteCommand, { connectTimeout = 20 } = {}) {
-    return `${this.environmentPrefix()} ssh -o BatchMode=yes -o ConnectTimeout=${connectTimeout} -J ${shellQuote(this.boundaryProxyJumpHost)} -- ${host} ${JSON.stringify(remoteCommand)}`;
-  }
-
-  toJson() {
-    return {
-      boundaryAddr: this.boundaryAddr,
-      boundaryBinaryDir: this.boundaryBinaryDir,
-      boundaryProxyJumpHost: this.boundaryProxyJumpHost,
-      useBoundaryBnd: this.useBoundaryBnd
-    };
-  }
-}
-
-export class SudoEnvironmentProfile {
-  constructor(input = {}) {
-    this.keychainService = input.keychainService ?? DEFAULT_WORKDAY_LDAP_KEYCHAIN_SERVICE;
-    this.keychainAccount = input.keychainAccount ?? DEFAULT_WORKDAY_LDAP_KEYCHAIN_ACCOUNT;
-    this.fallbackCredentials = input.fallbackCredentials ?? workdayProdCredentialCandidates().slice(1);
-    this.kubeconfigPath = input.kubeconfigPath ?? DEFAULT_ADMIN_KUBECONFIG_PATH;
-  }
-
-  keychainCandidates() {
-    return uniqueCredentialCandidates([
-      { service: this.keychainService, account: this.keychainAccount },
-      ...this.fallbackCredentials
-    ]);
-  }
-
-  keychainReadCommand() {
-    return "Direct PROD password reads are restricted. Use workday_private_cloud_sudo_readonly_command.";
-  }
-
-  stdinSudoRemoteCommand(command) {
-    return `IFS= read -r SUDOPASS || exit 11; printf '%s\\n' "$SUDOPASS" | sudo -S -p '' bash -lc ${JSON.stringify(command)}`;
-  }
-
-  sudoWrapperFor({ dcProfile, host, command }) {
-    const target = dcProfile.boundaryHostFor(host);
-    return `mcp__devops_tool__workday_private_cloud_sudo_readonly_command ${JSON.stringify({
-      action: "run",
-      host: target,
-      command,
-      humanApprovedSudoRead: true,
-      hitlApproval: {
-        approved: true,
-        approvedBy: "<operator>",
-        action: "Run private-cloud sudo read-only command",
-        target,
-        reason: "<why this sudo read is needed>",
-        expectedImpact: "Read-only sudo command; no remote writes.",
-        risk: "Privileged read may expose sensitive host state."
-      }
-    })}`;
-  }
-
-  sudoKubectl(command) {
-    return `sudo -n kubectl --kubeconfig=${this.kubeconfigPath} ${command}`;
-  }
-
-  verificationCommand({ host, dcProfile = new DcLoginProfile() }) {
-    return this.sudoWrapperFor({ dcProfile, host, command: "hostname" });
-  }
-
-  toJson() {
-    return {
-      keychainService: this.keychainService,
-      keychainAccount: this.keychainAccount,
-      keychainCandidates: this.keychainCandidates(),
-      kubeconfigPath: this.kubeconfigPath
-    };
-  }
-}
-
-export class ScyllaAccessProfile {
-  constructor(input = {}) {
-    this.cluster = input.cluster;
-    this.namespace = input.namespace ?? DEFAULT_SCYLLA_NAMESPACE;
-    this.bdmPod = input.bdmPod ?? DEFAULT_SCYLLA_BDM_POD;
-    this.kubeconfigPath = input.kubeconfigPath ?? "$HOME/.kube/spc-config";
-    this.connectionTool = input.connectionTool ?? "kcsb";
-  }
-
-  podExec(command, { container } = {}) {
-    const containerArg = container ? ` -c ${container}` : "";
-    return `${this.connectionTool} exec ${this.bdmPod}${containerArg} -- sh -lc ${shellQuote(command)}`;
-  }
-
-  podLogs({ pod = this.bdmPod, container = "bdm", since = "4h", pattern = "" } = {}) {
-    const grep = pattern ? ` | egrep ${shellQuote(pattern)}` : "";
-    return `${this.connectionTool} logs ${pod} -c ${container} --since=${since}${grep}`;
-  }
-
-  bucketConfigCommand() {
-    return `${this.connectionTool} get cm bucketdetails-config -o yaml`;
-  }
-
-  rbacBoundaryCommand(namespaces = ["sir", "galahad", "ors", "oms", "argocdapp", "bds"]) {
-    return `for ns in ${namespaces.map(shellQuote).join(" ")}; do for r in pods services endpoints deployments.apps; do kubectl --kubeconfig=${this.kubeconfigPath} auth can-i get "$r" -n "$ns"; done; done`;
-  }
-
-  toJson() {
-    return {
-      cluster: this.cluster,
-      namespace: this.namespace,
-      bdmPod: this.bdmPod,
-      kubeconfigPath: this.kubeconfigPath,
-      connectionTool: this.connectionTool,
-      bucketConfigCommand: this.bucketConfigCommand(),
-      rbacBoundaryCommand: this.rbacBoundaryCommand()
-    };
-  }
-}