@nuvlore/extension-workday-infra-access 0.1.1

package/vendor/extension-read-only-toolkit/src/enterprise-api-read.mjs

@@ -0,0 +1,180 @@
+import { execFile } from "node:child_process";
+import { promisify } from "node:util";
+import { assertNonHtmlApiResponse } from "./devops-diagnostics.mjs";
+
+const execFileAsync = promisify(execFile);
+
+export function normalizeBaseUrl(value) {
+  const raw = String(value || "").trim();
+  if (!raw) return "";
+  try {
+    const url = new URL(raw);
+    url.pathname = url.pathname.replace(/\/+$/, "");
+    url.search = "";
+    url.hash = "";
+    return url.toString().replace(/\/+$/, "");
+  } catch {
+    return "";
+  }
+}
+
+export function appendQueryValue(searchParams, key, value) {
+  if (Array.isArray(value)) {
+    for (const item of value) appendQueryValue(searchParams, key, item);
+    return;
+  }
+  if (value === undefined || value === null) return;
+  searchParams.append(key, String(value));
+}
+
+export function buildRequestUrl(baseUrl, requestPath, query) {
+  const url = new URL(`${baseUrl}${requestPath}`);
+  for (const [key, value] of Object.entries(query || {})) {
+    if (key) appendQueryValue(url.searchParams, key, value);
+  }
+  return url;
+}
+
+export function extractTokenFromKeychainSecret(rawSecret = "") {
+  const text = typeof rawSecret === "string" ? rawSecret.trim() : "";
+  if (!text) return "";
+  try {
+    const parsed = JSON.parse(text);
+    return typeof parsed?.token === "string" ? parsed.token.trim() : "";
+  } catch {
+    return text;
+  }
+}
+
+export async function readTokenFromKeychain({ execFileImpl = execFileAsync, keychainService, keychainAccount }) {
+  try {
+    const result = await execFileImpl("/usr/bin/security", [
+      "find-generic-password",
+      "-s",
+      keychainService,
+      "-a",
+      keychainAccount,
+      "-w"
+    ], { maxBuffer: 1024 * 1024 });
+    return extractTokenFromKeychainSecret(String(result?.stdout || ""));
+  } catch {
+    return "";
+  }
+}
+
+export function parseResponseBody(text) {
+  try {
+    return JSON.parse(text);
+  } catch {
+    return String(text || "");
+  }
+}
+
+export class KeychainBearerAuthProvider {
+  constructor(options = {}) {
+    this.mode = "keychain";
+    this.execFileImpl = options.execFileImpl || execFileAsync;
+    this.keychainService = options.keychainService;
+    this.keychainAccount = options.keychainAccount;
+    this.authorizationHeader = options.authorizationHeader || ((token) => `Bearer ${token}`);
+  }
+
+  async buildHeaders() {
+    const token = await readTokenFromKeychain({
+      execFileImpl: this.execFileImpl,
+      keychainService: this.keychainService,
+      keychainAccount: this.keychainAccount
+    });
+    if (!token) {
+      throw new Error(
+        `Keychain token missing for ${this.keychainService}/${this.keychainAccount}. Save the personal access token in Keychain.`
+      );
+    }
+    return { authorization: this.authorizationHeader(token) };
+  }
+}
+
+/** Cookie SSO auth — inject `resolveCookieHeader(input)` from @nuvlore/extension-browser-sso. */
+export class CookieSsoAuthProvider {
+  constructor(options = {}) {
+    this.mode = "cookie-sso";
+    this.resolveCookieHeader = options.resolveCookieHeader;
+    if (typeof this.resolveCookieHeader !== "function") {
+      throw new Error("CookieSsoAuthProvider requires resolveCookieHeader(input) async function.");
+    }
+  }
+
+  async buildHeaders(input = {}) {
+    const cookie = await this.resolveCookieHeader(input);
+    if (!cookie) {
+      throw new Error("Browser SSO cookie header is missing. Open the service in Chrome via Okta and retry.");
+    }
+    return { cookie };
+  }
+}
+
+export class EnterpriseApiReadService {
+  constructor(options = {}) {
+    this.fetchImpl = options.fetchImpl || globalThis.fetch;
+    this.execFileImpl = options.execFileImpl || execFileAsync;
+    this.serviceName = options.serviceName;
+    this.defaultBaseUrl = options.defaultBaseUrl;
+    this.defaultUserAgent = options.defaultUserAgent;
+    this.keychainService = options.keychainService;
+    this.keychainAccount = options.keychainAccount;
+    this.normalizePath = options.normalizePath;
+    this.accept = options.accept || "application/json";
+    this.extraHeaders = options.extraHeaders || {};
+    this.authorizationHeader = options.authorizationHeader || ((token) => `Bearer ${token}`);
+    this.formatErrorPayload = options.formatErrorPayload;
+    this.includeMethodInPayload = options.includeMethodInPayload === true;
+    this.transformPayload = options.transformPayload || ((payload) => payload);
+    this.authProvider =
+      options.authProvider ??
+      new KeychainBearerAuthProvider({
+        execFileImpl: this.execFileImpl,
+        keychainService: this.keychainService,
+        keychainAccount: this.keychainAccount,
+        authorizationHeader: this.authorizationHeader
+      });
+  }
+
+  async invoke(input = {}) {
+    if (typeof this.fetchImpl !== "function") {
+      throw new Error(`Fetch API is unavailable for ${this.serviceName} requests.`);
+    }
+    const baseUrl = normalizeBaseUrl(input.baseUrl || this.defaultBaseUrl);
+    if (!baseUrl) {
+      throw new Error(`${this.serviceName} base URL is missing or invalid. Expected something like ${this.defaultBaseUrl}.`);
+    }
+    const requestPath = this.normalizePath(input.restPath || input.path);
+    const url = buildRequestUrl(baseUrl, requestPath, input.query);
+    const authHeaders = await this.authProvider.buildHeaders(input);
+    const response = await this.fetchImpl(url, {
+      method: "GET",
+      headers: {
+        accept: this.accept,
+        "user-agent": this.defaultUserAgent,
+        ...this.extraHeaders,
+        ...authHeaders,
+        ...(input.headers ?? {})
+      }
+    });
+    const text = await response.text();
+    assertNonHtmlApiResponse(this.serviceName, text);
+    const payload = parseResponseBody(text);
+    if (!response.ok) {
+      throw new Error(`${this.serviceName} request failed with status ${response.status}: ${this.formatErrorPayload(payload)}.`);
+    }
+    const output = {
+      baseUrl,
+      restPath: requestPath,
+      path: requestPath,
+      url: url.toString(),
+      status: response.status,
+      data: this.transformPayload(payload)
+    };
+    if (this.includeMethodInPayload) output.method = "GET";
+    return JSON.stringify(output, null, 2);
+  }
+}

package/vendor/extension-read-only-toolkit/src/read-only-command-pack.mjs

@@ -0,0 +1 @@
+export * from "./read-only-plan.mjs";

package/vendor/extension-read-only-toolkit/src/read-only-plan.mjs

@@ -0,0 +1,45 @@
+export function shellQuote(value) {
+  return `'${String(value).replaceAll("'", "'\\''")}'`;
+}
+
+export function remoteCommandInput({ host, command, timeoutMs = 60_000 }) {
+  return {
+    targetType: "ssh",
+    host,
+    command,
+    timeoutMs
+  };
+}
+
+export class ReadOnlyStep {
+  constructor({ id, purpose, command, expectedEvidence }) {
+    this.id = id;
+    this.purpose = purpose;
+    this.command = command;
+    this.expectedEvidence = expectedEvidence;
+  }
+
+  toMarkdown() {
+    return [
+      `### ${this.id}`,
+      `Purpose: ${this.purpose}`,
+      "",
+      "```bash",
+      this.command,
+      "```",
+      "",
+      `Evidence to capture: ${this.expectedEvidence}`
+    ].join("\n");
+  }
+
+  toJson() {
+    return {
+      id: this.id,
+      purpose: this.purpose,
+      command: this.command,
+      expectedEvidence: this.expectedEvidence
+    };
+  }
+}
+
+export class ReadOnlyCommand extends ReadOnlyStep {}

package/vendor/extension-read-only-toolkit/src/read-only-shell-policy.d.mts

@@ -0,0 +1,26 @@
+export type ReadOnlyValidation = {
+  allowed: boolean;
+  reason: string;
+};
+
+export type ReadOnlyPolicyConfig = {
+  extraReadOnlyCommandPatterns?: RegExp[];
+};
+
+export const READ_ONLY_ALLOWED_TOOLS: readonly string[];
+export const READ_ONLY_DISALLOWED_TOOLS: readonly string[];
+export const MUTATING_SHELL_TOKENS: RegExp[];
+export const READ_ONLY_COMMAND_PATTERNS: RegExp[];
+
+export class ReadOnlyShellPolicy {
+  constructor(config?: ReadOnlyPolicyConfig);
+  validate(command: string): ReadOnlyValidation;
+  readOnlyPatterns(): RegExp[];
+}
+
+export class ReadOnlyPolicyDescription {
+  text(): string;
+}
+
+export function isReadOnlyShellCommand(command: string, config?: ReadOnlyPolicyConfig): ReadOnlyValidation;
+export function describeReadOnlyPolicy(): string;

package/vendor/extension-read-only-toolkit/src/read-only-shell-policy.mjs

@@ -0,0 +1,170 @@
+export const READ_ONLY_ALLOWED_TOOLS = [
+  "Read",
+  "Glob",
+  "Grep"
+];
+
+export const READ_ONLY_DISALLOWED_TOOLS = [
+  "Agent",
+  "Task",
+  "TaskCreate",
+  "Write",
+  "Edit",
+  "NotebookEdit",
+  "TodoWrite",
+  "ExitPlanMode",
+  "EnterWorktree",
+  "WebFetch",
+  "WebSearch",
+  "AskUserQuestion"
+];
+
+export const MUTATING_SHELL_TOKENS = [
+  /\bapply\b/i,
+  /\bcreate\b/i,
+  /\bdelete\b/i,
+  /\bdestroy\b/i,
+  /\bedit\b/i,
+  /\binstall\b/i,
+  /\bpatch\b/i,
+  /\bpush\b/i,
+  /\breplace\b/i,
+  /\brestart\b/i,
+  /\brollout\s+(restart|undo)\b/i,
+  /\brm\b/i,
+  /\bscale\b/i,
+  /\bset\b/i,
+  /\bstart\b/i,
+  /\bstop\b/i,
+  /\btaint\b/i,
+  /\buntaint\b/i,
+  /\bupgrade\b/i,
+  /\bwrite\b/i,
+  /\bchmod\b/i,
+  /\bchown\b/i,
+  /\bmv\b/i,
+  /\bcp\b/i,
+  /\bmkdir\b/i,
+  /\btouch\b/i,
+  /\btee\b/i,
+  /\bcurl\b.*\|\s*(sh|bash)\b/i,
+  /\bwget\b.*\|\s*(sh|bash)\b/i,
+  /(^|[^<])>(?!\s*&\d)/,
+  />>/,
+  /\|\s*(xargs\s+)?(sh|bash|kubectl\s+apply|terraform\s+apply|helm\s+upgrade|rm|tee)\b/i,
+  /(^|[^&|]);\s*/,
+  /&&|\|\|/,
+  /`|\$\(/,
+  /\b--write\b/i,
+  /\b--force\b/i,
+  /\b--yes\b|\b-y\b/i
+];
+
+export const READ_ONLY_COMMAND_PATTERNS = [
+  /^\s*pwd\s*$/,
+  /^\s*ls(\s|$)/,
+  /^\s*find\s+/,
+  /^\s*(rg|grep)\s+/,
+  /^\s*(cat|head|tail|sed|awk|wc)\s+/,
+  /^\s*curl\s+-k\s+-sS\s+-o\s+\/dev\/null\s+-w\s+'[A-Za-z0-9_=%{}:./ -]+\\n'\s+https:\/\/[A-Za-z0-9_.:-]+\/[A-Za-z0-9_./:@%+=,~-]+(\s|$)/,
+  /^\s*hostname(\s|$)/,
+  /^\s*command\s+-v\s+/,
+  /^\s*klist(\s|$)/,
+  /^\s*git\s+(status|diff|log|show|branch|remote|rev-parse|describe|ls-files)(\s|$)/,
+  /^\s*kubectl\s+(get|describe|logs|top|api-resources|api-versions|explain|version|cluster-info|config\s+(current-context|get-contexts|view))(\s|$)/,
+  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+airflow\s+dags\s+list-runs\s+-d\s+[A-Za-z0-9_.:@/-]+(?:\s+--no-backfill)?(?:\s+--output\s+(?:json|table|yaml|plain))?(?:\s+\|\s+head\s+-\d+)?\s*$/,
+  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+airflow\s+tasks\s+states-for-dag-run\s+[A-Za-z0-9_.:@/-]+\s+[A-Za-z0-9_.:@+=,~%/-]+(?:\s+--output\s+(?:json|table|yaml|plain))?(?:\s+\|\s+head\s+-\d+)?\s*$/,
+  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+airflow\s+tasks\s+logs\s+[A-Za-z0-9_.:@/-]+\s+[A-Za-z0-9_.:@/-]+\s+[A-Za-z0-9_.:@+=,~%/-]+\s+--try-number\s+\d+\s+\|\s+head\s+-\d+\s*$/,
+  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+airflow\s+tasks\s+render\s+[A-Za-z0-9_.:@/-]+\s+[A-Za-z0-9_.:@/-]+\s+[A-Za-z0-9_.:@+=,~%/-]+\s+\|\s+head\s+-\d+\s*$/,
+  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+cat\s+\/(?:(?:data|hadoop\/disk2)\/workday-bds-airflow|data\/airflow)\/logs\/[A-Za-z0-9_.:@+=,~%/-]+(?:\s+\|\s+head\s+-\d+)?\s*$/,
+  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+grep\s+-E\s+'[A-Za-z0-9_.:@+=,~%|/-]+'\s+\/(?:(?:data|hadoop\/disk2)\/workday-bds-airflow|data\/airflow)\/logs\/[A-Za-z0-9_.:@+=,~%/-]+(?:\s+\|\s+tail\s+-n\s+\d+)?\s*$/,
+  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+grep\s+-E\s+'[A-Za-z0-9_.:@+=,~%|/-]+'\s+\/usr\/local\/airflow\/(?:airflow_s3_config\.json|dags\/[A-Za-z0-9_.:@+=,~%/-]+)(?:\s+\|\s+(?:head|tail)\s+-\d+)?\s*$/,
+  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+printenv\s+\|\s+grep\s+-E\s+'\^\(AWS_\|GOOGLE_\|GOOGLE_APPLICATION_CREDENTIALS\|HADOOP_\|HADOOP_CONF_DIR\|AIRFLOW_S3_CONFIG_PATH\)'\s+\|\s+sed\s+-E\s+'s\/=\.\*\/=\[present\]\/'\s+\|\s+head\s+-\d+\s*$/,
+  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+printenv\s+HADOOP_CREDENTIAL_PROVIDER_PATH\s*$/,
+  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+hadoop\s+credential\s+list\s+\|\s+head\s+-\d+\s*$/,
+  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+grep\s+-h\s+-E\s+'fs\.s3a\.aws\.credentials\.provider\|fs\.s3a\.endpoint\|fs\.s3a\.impl\|google\.cloud\.auth'\s+\/etc\/hadoop\/conf\/(?:core-site|hdfs-site|mapred-site|yarn-site)\.xml(?:\s+\/etc\/hadoop\/conf\/(?:core-site|hdfs-site|mapred-site|yarn-site)\.xml)*\s+\|\s+head\s+-\d+\s*$/,
+  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+cat\s+\/usr\/local\/airflow\/(?:airflow_s3_config\.json|dags\/[A-Za-z0-9_.:@+=,~%/-]+)(?:\s+\|\s+head\s+-\d+)?\s*$/,
+  /^\s*kubectl\s+exec\s+-n\s+airflow\s+(?:pod\/)?[A-Za-z0-9._:@%/-]+(?:\s+-c\s+[A-Za-z0-9._:@%/-]+)?\s+--\s+hadoop\s+fs\s+-(?:ls|du|count|stat|test)(?:\s+-d)?\s+s3a:\/\/[A-Za-z0-9][A-Za-z0-9_.-]*[A-Za-z0-9](?:\/[A-Za-z0-9_.:@+=,~%/-]*)?(?:\s+\|\s+head\s+-\d+)?\s*$/,
+  /^\s*kcsb\s+(get|describe|logs|top|api-resources|api-versions|explain|version|cluster-info|config\s+(current-context|get-contexts|view))(\s|$)/,
+  /^\s*kinit\s+-kt\s+\/[A-Za-z0-9._/-]+\s+[A-Za-z0-9_.@/-]+(\s|$)/,
+  /^\s*yarn\s+application\s+-status\s+application_[0-9]+_[0-9]+(\s|$)/,
+  /^\s*yarn\s+logs\s+-applicationId\s+application_[0-9]+_[0-9]+(\s|$)/,
+  /^\s*yarn\s+node\s+-status\s+(?!-)[A-Za-z0-9._:@%-]+:45454(\s|$)/,
+  /^\s*hdfs\s+crypto\s+-listZones(\s|$)/,
+  /^\s*hdfs\s+dfs\s+-(ls|du|find|cat|tail|test|count|stat)\s+/,
+  /^\s*hdfs\s+dfsadmin\s+-report(\s|$)/,
+  /^\s*hadoop\s+fs\s+-(ls|cat|head|du|count|stat|test|text)(\s|$)/,
+  /^\s*helm\s+(list|status|history|get|version|repo\s+list)(\s|$)/,
+  /^\s*aws\s+(?:--profile\s+\S+\s+)?(?:--region\s+\S+\s+)?sts\s+get-caller-identity(\s|$)/,
+  /^\s*aws\s+(?:--profile\s+\S+\s+)?(?:--region\s+\S+\s+)?[a-z0-9-]+\s+(describe|list|get|head)-[a-z0-9-]+(\s|$)/,
+  /^\s*aws\s+(?:--profile\s+\S+\s+)?(?:--region\s+\S+\s+)?s3\s+ls(\s|$)/,
+  /^\s*gcloud\s+(?:--project=\S+\s+)?(?:--account=\S+\s+)?auth\s+list(\s|$)/,
+  /^\s*gcloud\s+(?:--project=\S+\s+)?(?:--account=\S+\s+)?config\s+list(\s|$)/,
+  /^\s*gcloud\s+(?:--project=\S+\s+)?(?:--account=\S+\s+)?projects\s+(describe|get-iam-policy)(\s|$)/,
+  /^\s*gcloud\s+(?:--project=\S+\s+)?(?:--account=\S+\s+)?[a-z0-9-]+(?:\s+[a-z0-9-]+)*\s+(list|describe|read)(\s|$)/,
+  /^\s*gcloud\s+storage\s+(buckets|objects)\s+list(\s|$)/,
+  /^\s*terraform\s+(version|show|state\s+list|state\s+show|providers|workspace\s+show|output)(\s|$)/,
+  /^\s*docker\s+(ps|images|logs|inspect|stats|version|info)(\s|$)/,
+  /^\s*(df|du|free|uptime|uname|whoami|id|date|env|printenv)(\s|$)/,
+  /^\s*journalctl\s+-k\s+--since\s+/,
+  /^\s*(systemctl|journalctl)\s+(status|-u|--unit)(\s|$)/
+];
+
+export class ReadOnlyShellPolicy {
+  constructor(config = {}) {
+    this.config = config;
+  }
+
+  validate(command) {
+    const normalized = String(command ?? "").trim();
+
+    if (!normalized) {
+      return { allowed: false, reason: "empty shell command" };
+    }
+    if (normalized.includes("\n") || normalized.includes("\r")) {
+      return { allowed: false, reason: "multi-line shell commands are not allowed" };
+    }
+
+    const mutatingToken = MUTATING_SHELL_TOKENS.find((token) => token.test(normalized));
+    if (mutatingToken) {
+      return {
+        allowed: false,
+        reason: `shell command contains mutating or high-risk syntax: ${mutatingToken.source}`
+      };
+    }
+
+    if (this.readOnlyPatterns().some((pattern) => pattern.test(normalized))) {
+      return { allowed: true, reason: "matches read-only command allowlist" };
+    }
+
+    return { allowed: false, reason: "command is not in the read-only allowlist" };
+  }
+
+  readOnlyPatterns() {
+    return [
+      ...READ_ONLY_COMMAND_PATTERNS,
+      ...(this.config.extraReadOnlyCommandPatterns ?? [])
+    ];
+  }
+}
+
+export class ReadOnlyPolicyDescription {
+  text() {
+    return [
+      "Read-only DevOps policy:",
+      `- Auto-approved tools: ${READ_ONLY_ALLOWED_TOOLS.join(", ")}`,
+      `- Always denied tools: ${READ_ONLY_DISALLOWED_TOOLS.join(", ")}`,
+      "- Bash: denied by default; only explicit read-only command patterns are allowed.",
+      "- Filesystem sandbox: enabled with denyWrite on all paths.",
+      "- Permission mode: dontAsk, so unapproved tools fail closed."
+    ].join("\n");
+  }
+}
+
+export function isReadOnlyShellCommand(command, config = {}) {
+  return new ReadOnlyShellPolicy(config).validate(command);
+}
+
+export function describeReadOnlyPolicy() {
+  return new ReadOnlyPolicyDescription().text();
+}

package/workflows/public-cloud-readonly-investigation.js

@@ -0,0 +1,99 @@
+export const meta = {
+  name: "public-cloud-readonly-investigation",
+  description: "Investigate AWS CUST or GCP cloud state through approved federation/local identity and read-only evidence commands only.",
+  whenToUse: "Use when an incident, Bamboo result, Slack thread, or operator request requires AWS CUST or GCP resource inspection without cloud mutation.",
+  phases: ["Plan", "Identity", "Evidence", "Reply"],
+};
+
+phase("Plan");
+const plan = await agent(
+  [
+    "Extract platform, account/account alias or GCP project, region/zone, service, resource, and incident evidence.",
+    "For AWS CUST federated access, call only mcp__devops_tool__aws_cust_federated_readonly_command_pack.",
+    "For GCP, call only mcp__devops_tool__gcp_readonly_command_pack.",
+    "If the platform is ambiguous, report that blocker and do not guess.",
+    "Do not authenticate, open browser federation, read credential files, use Bash, or call cloud APIs in this phase.",
+  ].join("\n"),
+  {
+    label: "public-cloud-plan",
+    phase: "Plan",
+    tools: "mcp__devops_tool__aws_cust_federated_readonly_command_pack,mcp__devops_tool__gcp_readonly_command_pack",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Identity");
+const identity = await agent(
+  [
+    "Verify identity only after approved local federation/login outside this workflow.",
+    "For AWS, run the plan's aws sts get-caller-identity via permitted local read-only execution.",
+    "For GCP, run the plan's gcloud auth list and gcloud config list via permitted local read-only execution.",
+    "If local execution is unavailable or denied, return the exact identity command that must be run manually and mark identity as unverified.",
+    "Never run aws configure, gcloud auth login, gcloud config set, or read ~/.aws, ADC, or credential files.",
+    "",
+    "Plan:",
+    plan,
+  ].join("\n"),
+  {
+    label: "public-cloud-identity",
+    phase: "Identity",
+    tools: "",
+    disallowedTools: "Agent,Task,TaskCreate,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Evidence");
+const evidence = await agent(
+  [
+    "Collect read-only cloud evidence using commands emitted by the plan.",
+    "Allowed action families are describe, list, get metadata, head, read logs, and get-iam-policy.",
+    "For AWS S3, never run cp, mv, rm, sync, put-object, delete-object, or get-object for secrets/private material.",
+    "For GCP Storage, never run cp, mv, rm, update, compose, or rewrite.",
+    "For IAM/KMS/Secrets Manager, read metadata only; never request secret values, private keys, or key material.",
+    "If a command is denied by the read-only runtime or cloud IAM, preserve the denied action as an evidence gap.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Identity:",
+    identity,
+  ].join("\n"),
+  {
+    label: "public-cloud-evidence",
+    phase: "Evidence",
+    tools: "",
+    disallowedTools: "Agent,Task,TaskCreate,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+phase("Reply");
+const reply = await agent(
+  [
+    "Draft a concise answer from collected cloud evidence only.",
+    "State platform, account/project, identity state, commands run/blocked, observations, and evidence gaps.",
+    "Distinguish IAM/access denial from resource absence.",
+    "State remediation only as a human-reviewed manual recommendation; do not execute writes.",
+    "",
+    "Plan:",
+    plan,
+    "",
+    "Identity:",
+    identity,
+    "",
+    "Evidence:",
+    evidence,
+  ].join("\n"),
+  {
+    label: "public-cloud-reply",
+    phase: "Reply",
+    tools: "",
+    disallowedTools: "Agent,Task,TaskCreate,Bash,Read,Glob,Grep,WebFetch,WebSearch,Write,Edit,NotebookEdit,AskUserQuestion",
+  },
+);
+
+return {
+  plan,
+  identity,
+  evidence,
+  reply,
+};