@nuvlore/extension-bds 0.1.1

package/src/bds-atomic-log-tools.mjs

@@ -0,0 +1,300 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { z } from "zod";
+import { defineReadOnlyTool, fail, ok } from "@nuvlore/extension-read-only-toolkit/devops-diagnostics";
+import { WorkdayPrivateCloudSudoReadonlyCommandService } from "@nuvlore/extension-workday-infra-access/tools/workday_private_cloud_sudo_readonly_command.mjs";
+
+const execFileAsync = promisify(execFile);
+
+const DEFAULT_TIMEOUT_MS = 120_000;
+const DEFAULT_KUBECONFIG = "/Users/boqiang.liang/.kube/spc-config";
+
+function normalizeText(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function normalizeLines(value) {
+  return Number.isInteger(value) ? Math.min(Math.max(value, 1), 5000) : 100;
+}
+
+function shellSingleQuote(value) {
+  return `'${String(value).replaceAll("'", "'\\''")}'`;
+}
+
+function safeShellToken(value, label) {
+  const normalized = normalizeText(value);
+  if (!/^[A-Za-z0-9._:/=@%-]+$/u.test(normalized)) {
+    throw new Error(`Refusing unsafe ${label}: ${normalized}`);
+  }
+  return normalized;
+}
+
+function validatePrivatePath(path, allowedPrefixes) {
+  const normalized = normalizeText(path);
+  if (!normalized) return "";
+  if (!allowedPrefixes.some((prefix) => normalized.startsWith(prefix))) {
+    throw new Error(`Refusing log path outside allowed prefixes: ${normalized}`);
+  }
+  if (/[;&|`$<>]/u.test(normalized)) {
+    throw new Error(`Refusing unsafe log path: ${normalized}`);
+  }
+  return normalized;
+}
+
+function tailCommand(path, lines) {
+  return `tail -n ${normalizeLines(lines)} ${path}`;
+}
+
+function structuredApproval(input, toolName, host) {
+  return input.hitlApproval ?? {
+    approved: true,
+    approvedBy: "operator-requested",
+    action: toolName,
+    target: host,
+    reason: "Read BDS service log for investigation.",
+    expectedImpact: "Runs bauth init and a single read-only sudo log command.",
+    risk: "May reveal operational log content; no remote writes are requested."
+  };
+}
+
+export class BdsPrivateCloudAtomicLogReadService {
+  constructor(spec, options = {}) {
+    this.spec = spec;
+    this.privateSudoService = options.privateSudoService || new WorkdayPrivateCloudSudoReadonlyCommandService(options.privateSudoOptions);
+  }
+
+  buildCommand(input) {
+    const normalized = {
+      ...input,
+      lines: normalizeLines(input.lines)
+    };
+    return this.spec.buildCommand(normalized);
+  }
+
+  async invoke(input) {
+    const host = normalizeText(input.host);
+    if (!host) throw new Error(`${this.spec.toolName} requires host.`);
+    const action = normalizeText(input.action) || "plan";
+    const command = this.buildCommand(input);
+    return this.privateSudoService.invoke({
+      action,
+      host,
+      command,
+      proxyJumpHost: normalizeText(input.proxyJumpHost) || undefined,
+      connectTimeoutSeconds: input.connectTimeoutSeconds,
+      timeoutMs: input.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+      humanApprovedSudoRead: input.humanApprovedSudoRead === true,
+      hitlApproval: action === "run" ? structuredApproval(input, this.spec.toolName, host) : input.hitlApproval
+    });
+  }
+}
+
+export function createPrivateCloudLogReadTool(spec) {
+  const defaultService = new BdsPrivateCloudAtomicLogReadService(spec);
+  return defineReadOnlyTool({
+    name: spec.toolName,
+    description: spec.description,
+    meta: {
+      permissions: { rule: "ask" },
+      delegatesSecretAccessTo: "workday_private_cloud_sudo_readonly_command"
+    },
+    inputSchema: {
+      action: z.enum(["plan", "run"]).default("plan"),
+      host: z.string().trim().min(1).max(253),
+      lines: z.number().int().positive().max(5000).default(100),
+      proxyJumpHost: z.string().trim().max(253).optional(),
+      connectTimeoutSeconds: z.number().int().positive().max(120).default(20),
+      humanApprovedSudoRead: z.boolean().default(false),
+      hitlApproval: z.object({
+        approved: z.literal(true),
+        approvedBy: z.string().trim().min(1).max(256),
+        action: z.string().trim().min(1).max(256),
+        target: z.string().trim().min(1).max(4096),
+        reason: z.string().trim().min(1).max(2000),
+        expectedImpact: z.string().trim().min(1).max(2000),
+        risk: z.string().trim().min(1).max(2000)
+      }).optional(),
+      timeoutMs: z.number().int().positive().max(600_000).default(DEFAULT_TIMEOUT_MS),
+      ...spec.extraSchema
+    },
+    async handler(input) {
+      try {
+        return ok(await defaultService.invoke(input));
+      } catch (error) {
+        return fail(error);
+      }
+    }
+  });
+}
+
+export function fixedPrivateLogSpec({ toolName, description, path }) {
+  return {
+    toolName,
+    description,
+    buildCommand: (input) => tailCommand(path, input.lines)
+  };
+}
+
+export function globPrivateLogSpec({ toolName, description, glob }) {
+  return fixedPrivateLogSpec({ toolName, description, path: glob });
+}
+
+export const BDM_HTTPD_EXTRA_SCHEMA = {
+  logName: z.enum(["error", "access"]).default("error")
+};
+
+export function bdmHttpdCommand(input) {
+  return tailCommand(`/var/log/httpd/${input.logName === "access" ? "access" : "error"}.log`, input.lines);
+}
+
+export const AIRFLOW_DAG_EXTRA_SCHEMA = {
+  logFile: z.string().trim().max(4096).default(""),
+  dagId: z.string().trim().max(256).default(""),
+  taskId: z.string().trim().max(256).default(""),
+  date: z.string().trim().regex(/^\d{4}-\d{2}-\d{2}$/u).optional()
+};
+
+export function airflowDagCommand(input) {
+  const allowed = ["/hadoop/disk2/workday-bds-airflow/logs/", "/data/workday-bds-airflow/logs/"];
+  const logFile = validatePrivatePath(input.logFile, allowed);
+  if (logFile) return tailCommand(shellSingleQuote(logFile), input.lines);
+  const dagPattern = normalizeText(input.dagId) || "dag_tenant_data";
+  const taskPattern = normalizeText(input.taskId);
+  const datePath = normalizeText(input.date) ? `/${normalizeText(input.date)}/` : "";
+  const pathPattern = taskPattern
+    ? `*${datePath}*${dagPattern}*${taskPattern}*`
+    : `*${datePath}*${dagPattern}*`;
+  return `find /hadoop/disk2/workday-bds-airflow/logs /data/workday-bds-airflow/logs -maxdepth 8 -type f -path ${shellSingleQuote(pathPattern)} -print`;
+}
+
+export const PRIVATE_K8S_LOG_EXTRA_SCHEMA = {
+  namespace: z.string().trim().min(1).max(253).default("bds-k8s-services"),
+  pod: z.string().trim().max(253).default(""),
+  deployment: z.string().trim().max(253).default(""),
+  statefulset: z.string().trim().max(253).default(""),
+  container: z.string().trim().max(253).default(""),
+  previous: z.boolean().default(false),
+  allPods: z.boolean().default(true)
+};
+
+function privateK8sTarget(input, defaultDeployment) {
+  if (normalizeText(input.pod)) return { target: safeShellToken(input.pod, "pod"), resourceTarget: false };
+  if (normalizeText(input.deployment)) return { target: `deploy/${safeShellToken(input.deployment, "deployment")}`, resourceTarget: true };
+  if (normalizeText(input.statefulset)) return { target: `statefulset/${safeShellToken(input.statefulset, "statefulset")}`, resourceTarget: true };
+  if (defaultDeployment) return { target: `deploy/${safeShellToken(defaultDeployment, "deployment")}`, resourceTarget: true };
+  throw new Error("private Kubernetes log read requires pod, deployment, or statefulset.");
+}
+
+export function privateK8sLogCommand(input, defaults = {}) {
+  const namespace = safeShellToken(normalizeText(input.namespace) || defaults.namespace || "bds-k8s-services", "namespace");
+  const { target, resourceTarget } = privateK8sTarget(input, defaults.deployment);
+  const args = ["kubectl", "logs", "-n", namespace, target, "--tail", String(normalizeLines(input.lines))];
+  const container = normalizeText(input.container) || defaults.container;
+  if (container) args.push("-c", container);
+  if (resourceTarget && input.allPods !== false) args.push("--all-pods=true");
+  if (input.previous === true) args.push("--previous");
+  return args.map((arg) => safeShellToken(arg, "kubectl argument")).join(" ");
+}
+
+export const PUBLIC_CLOUD_POD_EXTRA_SCHEMA = {
+  namespace: z.string().trim().min(1).max(253).default("bds"),
+  pod: z.string().trim().max(253).default(""),
+  deployment: z.string().trim().max(253).default(""),
+  statefulset: z.string().trim().max(253).default(""),
+  container: z.string().trim().max(253).default(""),
+  previous: z.boolean().default(false),
+  allPods: z.boolean().default(true),
+  kubeconfig: z.string().trim().max(4096).default(DEFAULT_KUBECONFIG)
+};
+
+function kubectlTarget(input) {
+  if (normalizeText(input.pod)) return { target: normalizeText(input.pod), resourceTarget: false };
+  if (normalizeText(input.deployment)) return { target: `deploy/${normalizeText(input.deployment)}`, resourceTarget: true };
+  if (normalizeText(input.statefulset)) return { target: `statefulset/${normalizeText(input.statefulset)}`, resourceTarget: true };
+  throw new Error("public cloud pod log read requires pod, deployment, or statefulset.");
+}
+
+export class BdsPublicCloudPodLogReadService {
+  constructor(options = {}) {
+    this.execFileImpl = options.execFileImpl || execFileAsync;
+  }
+
+  buildArgs(input) {
+    const { target, resourceTarget } = kubectlTarget(input);
+    const args = ["--kubeconfig", normalizeText(input.kubeconfig) || DEFAULT_KUBECONFIG, "logs", "-n", normalizeText(input.namespace) || "bds", target, "--tail", String(normalizeLines(input.lines))];
+    const container = normalizeText(input.container);
+    if (container) args.push("-c", container);
+    if (resourceTarget && input.allPods !== false) args.push("--all-pods=true");
+    if (input.previous === true) args.push("--previous");
+    return args;
+  }
+
+  async invoke(input) {
+    const action = normalizeText(input.action) || "plan";
+    const args = this.buildArgs(input);
+    const command = ["kubectl", ...args.map(shellSingleQuote)].join(" ");
+    if (action === "plan") {
+      return JSON.stringify({
+        mode: "public-cloud-pod-log-read",
+        accessPlane: "public-cloud",
+        prerequisite: "Run workday_public_cloud_spc_login first; do not use k9s.",
+        command
+      }, null, 2);
+    }
+    if (action !== "run") throw new Error(`Unsupported action: ${action}`);
+    const result = await this.execFileImpl("kubectl", args, {
+      timeout: input.timeoutMs ?? DEFAULT_TIMEOUT_MS,
+      maxBuffer: 1024 * 1024 * 10
+    });
+    return JSON.stringify({
+      mode: "public-cloud-pod-log-read",
+      action,
+      command,
+      result: {
+        stdout: result.stdout,
+        stderr: result.stderr,
+        exitCode: 0
+      }
+    }, null, 2);
+  }
+}
+
+export function createPublicCloudPodLogReadTool({ toolName, description }) {
+  const defaultService = new BdsPublicCloudPodLogReadService();
+  return defineReadOnlyTool({
+    name: toolName,
+    description,
+    inputSchema: {
+      action: z.enum(["plan", "run"]).default("plan"),
+      lines: z.number().int().positive().max(5000).default(100),
+      timeoutMs: z.number().int().positive().max(600_000).default(DEFAULT_TIMEOUT_MS),
+      ...PUBLIC_CLOUD_POD_EXTRA_SCHEMA
+    },
+    async handler(input) {
+      try {
+        return ok(await defaultService.invoke(input));
+      } catch (error) {
+        return fail(error);
+      }
+    }
+  });
+}
+
+export const __test = {
+  AIRFLOW_DAG_EXTRA_SCHEMA,
+  BDM_HTTPD_EXTRA_SCHEMA,
+  BdsPrivateCloudAtomicLogReadService,
+  BdsPublicCloudPodLogReadService,
+  PUBLIC_CLOUD_POD_EXTRA_SCHEMA,
+  PRIVATE_K8S_LOG_EXTRA_SCHEMA,
+  airflowDagCommand,
+  bdmHttpdCommand,
+  fixedPrivateLogSpec,
+  globPrivateLogSpec,
+  normalizeLines,
+  privateK8sLogCommand,
+  safeShellToken,
+  shellSingleQuote,
+  tailCommand,
+  validatePrivatePath
+};

package/src/bds-team-membership-claude-output.mjs

@@ -0,0 +1,36 @@
+import { validateBdsTeamMembershipAnswer } from "./bds-team-membership-quality.mjs";
+
+export function extractClaudeFinalAnswer(output = "") {
+  const text = String(output || "").trim();
+  if (!text) return "";
+  try {
+    const parsed = JSON.parse(text);
+    return String(parsed?.result ?? parsed?.message?.content?.[0]?.text ?? parsed?.content ?? text);
+  } catch {
+    return text;
+  }
+}
+
+export function extractBdsTeamMembershipQualityContract(output = "") {
+  const text = String(output || "").trim();
+  if (!text) return {};
+  try {
+    const parsed = JSON.parse(text);
+    return parsed?.devopsQuality
+      ?? parsed?.evidenceContract
+      ?? parsed?.metadata?.devopsQuality
+      ?? {};
+  } catch {
+    return {};
+  }
+}
+
+export function validateBdsTeamMembershipClaudeOutput(output = "") {
+  const answer = extractClaudeFinalAnswer(output);
+  const failures = validateBdsTeamMembershipAnswer(answer, extractBdsTeamMembershipQualityContract(output));
+  return {
+    ok: failures.length === 0,
+    decision: failures.length === 0 ? "pass" : "fail",
+    failures,
+  };
+}

package/src/bds-team-membership-quality.mjs

@@ -0,0 +1,90 @@
+function normalizeText(value) {
+  return typeof value === "string" ? value.trim() : "";
+}
+
+function normalizeArray(value) {
+  return Array.isArray(value) ? value : [];
+}
+
+function normalizeObject(value) {
+  return value && typeof value === "object" && !Array.isArray(value) ? value : {};
+}
+
+function hasText(value) {
+  return normalizeText(value) !== "";
+}
+
+function hasConfluenceLocator(item) {
+  const entry = normalizeObject(item);
+  return entry.sourceType === "confluence"
+    && [entry.url, entry.pageId, entry.restPath, entry.cql, entry.title].some(hasText);
+}
+
+function hasMemberEvidence(item) {
+  const entry = normalizeObject(item);
+  return hasText(entry.name)
+    && (
+      normalizeArray(entry.sourceRefs).some(hasText)
+      || normalizeArray(entry.evidence).some(hasText)
+      || hasText(entry.sourceRef)
+    );
+}
+
+const DISALLOWED_SOURCE_TYPES = new Set([
+  "launcher_status",
+  "local_code",
+  "onboarding",
+  "pagerduty",
+  "slack"
+]);
+
+function disallowedSourceTypes(contract) {
+  return normalizeArray(contract.excludedSources)
+    .map((source) => normalizeText(source.type ?? source.sourceType ?? source))
+    .filter((sourceType) => DISALLOWED_SOURCE_TYPES.has(sourceType));
+}
+
+export class BdsTeamMembershipQualityPolicy {
+  validate(answer = "", evidenceContract = {}) {
+    const text = normalizeText(answer);
+    if (!text) return ["answer is empty"];
+
+    const contract = normalizeObject(evidenceContract);
+    const failures = [];
+    const outcome = normalizeText(contract.outcome);
+    const searches = normalizeArray(contract.evidenceSearches);
+    const sources = normalizeArray(contract.sources);
+    const checkedLocations = normalizeArray(contract.checkedLocations);
+
+    if (!["confluence_roster", "confluence_evidence_insufficient"].includes(outcome)) {
+      failures.push("BDS team membership answer must include structured devopsQuality.outcome");
+    }
+
+    if (![...searches, ...sources, ...checkedLocations].some(hasConfluenceLocator)) {
+      failures.push("BDS team membership answer must include structured Confluence evidence locations");
+    }
+
+    if (outcome === "confluence_roster" && !normalizeArray(contract.members).some(hasMemberEvidence)) {
+      failures.push("BDS team membership roster must include structured members with evidence references");
+    }
+
+    if (outcome === "confluence_evidence_insufficient" && !hasText(contract.evidenceGap)) {
+      failures.push("BDS team membership insufficient-evidence answer must include a structured evidenceGap");
+    }
+
+    const blockedSources = disallowedSourceTypes(contract);
+    if (blockedSources.length > 0) {
+      failures.push(`BDS team membership answer used disallowed source types: ${blockedSources.join(", ")}`);
+    }
+
+    if (contract.includesContactNumbers === true) {
+      failures.push("BDS team membership answer must not include phone/contact numbers");
+    }
+
+    return failures;
+  }
+}
+
+export function validateBdsTeamMembershipAnswer(answer = "", evidenceContract = {}) {
+  return new BdsTeamMembershipQualityPolicy().validate(answer, evidenceContract);
+}

package/tools/bds_airflow_dag_log_read.mjs

@@ -0,0 +1,24 @@
+export const description = "Find or read private-cloud BDS Airflow DAG logs from the shared Airflow log filesystem through the approved Boundary sudo read tool.";
+
+import { AIRFLOW_DAG_EXTRA_SCHEMA, airflowDagCommand, createPrivateCloudLogReadTool } from "../src/bds-atomic-log-tools.mjs";
+
+export const __test = {
+  buildCommand: airflowDagCommand
+};
+
+const sharedTool = createPrivateCloudLogReadTool({
+  toolName: "bds_airflow_dag_log_read",
+  description: "Find or read private-cloud BDS Airflow DAG logs from the shared Airflow log filesystem through the approved Boundary sudo read tool.",
+  extraSchema: AIRFLOW_DAG_EXTRA_SCHEMA,
+  buildCommand: airflowDagCommand
+});
+
+export default {
+  name: sharedTool.name,
+  description,
+  inputSchema: sharedTool.inputSchema,
+  meta: sharedTool.meta,
+  annotations: sharedTool.annotations,
+  invoke: sharedTool.invoke,
+  handler: sharedTool.handler
+};