@opscompass/skills 0.1.0

package/skills/opscompass-resources/.opscompass-runtime/tools/opsc-cli-defaults.js

@@ -0,0 +1,125 @@
+import { existsSync, readFileSync } from "node:fs";
+import os from "node:os";
+import path from "node:path";
+import { resolveCliContext, } from "./opsc-cli-context.js";
+/** Production defaults path, retained for explicit known-path operations. */
+export const DEFAULTS_PATH = path.join(os.homedir(), ".opscompass", "defaults.json");
+/** Allowed paths across Opscompass config roots. */
+export const KNOWN_DEFAULTS_PATHS = [
+    DEFAULTS_PATH,
+    path.join(os.homedir(), ".opscompassdemo", "defaults.json"),
+    path.join(os.homedir(), ".opscompassdev", "defaults.json"),
+];
+/** Locate defaults only within the selected CLI's configuration home. */
+export function getDefaultsPath(context = resolveCliContext()) {
+    return path.join(context.opscompassHome, "defaults.json");
+}
+/** Deeply sort an object by key for deterministic output. */
+export function sortObject(value) {
+    if (Array.isArray(value))
+        return value.map(sortObject);
+    if (value !== null && typeof value === "object") {
+        return Object.fromEntries(Object.keys(value)
+            .sort()
+            .map((key) => [
+            key,
+            sortObject(value[key]),
+        ]));
+    }
+    return value;
+}
+/**
+ * Shell-quote a single token: single-quote and escape internal quotes.
+ * Unquoted strings are returned as-is if they match a safe pattern.
+ */
+export function shellQuote(value) {
+    if (/^[A-Za-z0-9_./:-]+$/.test(value))
+        return value;
+    return `'${value.replaceAll("'", "'\\''")}'`;
+}
+/** Join an array of shell tokens into a quoted command string. */
+export function commandText(command) {
+    return command.map(shellQuote).join(" ");
+}
+/**
+ * Read and validate a defaults JSON file.
+ * @param filePath - absolute path to the defaults file; defaults to the selected CLI home.
+ * @returns a validated JSON object, or an empty object if the file does not exist.
+ * @throws if the file contains invalid JSON or a non-object payload.
+ */
+export function loadDefaults(filePath = getDefaultsPath()) {
+    if (!existsSync(filePath))
+        return {};
+    const text = readFileSync(filePath, "utf8");
+    const parsed = JSON.parse(text);
+    if (parsed === null || typeof parsed !== "object" || Array.isArray(parsed)) {
+        throw new Error(`defaults file is not a JSON object: ${filePath}`);
+    }
+    return parsed;
+}
+/**
+ * Extract the company value from defaults, returning null when absent.
+ * @param filePath - optional path override.
+ */
+export function getDefaultCompany(filePath = getDefaultsPath()) {
+    const value = loadDefaults(filePath).company;
+    if (value === undefined || value === null)
+        return null;
+    const company = String(value).trim();
+    return company || null;
+}
+/**
+ * Resolve an explicit company argument, falling back to defaults.
+ * @param explicitCompany - user-supplied company, may be undefined.
+ * @param options - configuration flags.
+ * @param options.ignoreDefaults - when true, reject if no explicit company is provided.
+ * @returns the resolved company string, or throws if unavailable.
+ */
+export function resolveCompany(explicitCompany, options) {
+    if (explicitCompany)
+        return explicitCompany;
+    if (options?.ignoreDefaults) {
+        throw new Error("--company is required when --ignore-defaults is set");
+    }
+    // Host context is authoritative; never resolve ambient identity or search other homes.
+    const context = options?.context ?? resolveCliContext();
+    const defaultCompany = getDefaultCompany(getDefaultsPath(context));
+    if (defaultCompany)
+        return defaultCompany;
+    throw new Error(`resources command needs --company or configured OpsCompass defaults; run \`${context.cliCommand} data-gathering setup\`, run \`${context.cliCommand} defaults set-defaults --company <company>\`, or pass --company`);
+}
+/**
+ * Build a validated `opscompass defaults set-defaults` CLI command array.
+ */
+export function buildSetDefaultsCommand(args, context = resolveCliContext()) {
+    const command = [context.cliCommand, "defaults", "set-defaults"];
+    if (args.company)
+        command.push("--company", args.company);
+    if (args.account)
+        command.push("--account", args.account);
+    if (args.monitoringConfigurationId) {
+        command.push("--monitoring-configuration-id", args.monitoringConfigurationId);
+    }
+    for (const value of args.maskValues ?? [])
+        command.push("--mask-values", value);
+    if (command.length === 3) {
+        throw new Error("set requires at least one of --company, --account, --monitoring-configuration-id, or --mask-values");
+    }
+    return command;
+}
+/**
+ * Build a validated `opscompass data-gathering setup` CLI command array.
+ */
+export function buildSetupCommand(args, context = resolveCliContext()) {
+    const command = [context.cliCommand, "data-gathering", "setup"];
+    if (args.nonInteractive)
+        command.push("--non-interactive");
+    if (args.company)
+        command.push("--company", args.company);
+    if (args.account)
+        command.push("--account", args.account);
+    if (args.monitoringConfigurationId) {
+        command.push("--monitoring-configuration-id", args.monitoringConfigurationId);
+    }
+    return command;
+}

package/skills/opscompass-resources/.opscompass-runtime/tools/opsc-cli.js

@@ -0,0 +1,90 @@
+import { spawn } from "node:child_process";
+const MAX_TIMEOUT_SECONDS = 120;
+const MAX_OUTPUT_BYTES = 100_000;
+export async function runCli(context, args) {
+    const child = spawn(context.cliEntryPoint, args, {
+        cwd: context.workspaceRoot,
+        // The host-selected executable must win over ambient standalone overrides.
+        env: {
+            ...process.env,
+            OPSCOMPASS_CLI_ENTRYPOINT: context.cliEntryPoint,
+            ELECTRON_RUN_AS_NODE: "1",
+            OPSCOMPASS_STUDIO: "1",
+        },
+        stdio: ["ignore", "pipe", "pipe"],
+        detached: process.platform !== "win32",
+    });
+    const chunks = [];
+    let outputBytes = 0;
+    let timedOut = false;
+    const collect = (chunk) => {
+        if (outputBytes >= MAX_OUTPUT_BYTES)
+            return;
+        const bounded = chunk.subarray(0, MAX_OUTPUT_BYTES - outputBytes);
+        chunks.push(bounded);
+        outputBytes += bounded.length;
+    };
+    child.stdout?.on("data", collect);
+    child.stderr?.on("data", collect);
+    let graceTimer;
+    const forceKill = () => {
+        try {
+            if (process.platform !== "win32" && child.pid)
+                process.kill(-child.pid, "SIGKILL");
+            else
+                child.kill("SIGKILL");
+        }
+        catch {
+            try {
+                child.kill("SIGKILL");
+            }
+            catch {
+                // The child may have exited between termination attempts.
+            }
+        }
+    };
+    const kill = () => {
+        try {
+            const sent = process.platform !== "win32" && child.pid
+                ? process.kill(-child.pid, "SIGTERM")
+                : child.kill("SIGTERM");
+            if (process.platform !== "win32" && sent && graceTimer === undefined) {
+                graceTimer = setTimeout(forceKill, 5_000);
+            }
+        }
+        catch {
+            forceKill();
+        }
+    };
+    const result = new Promise((resolve, reject) => {
+        child.once("error", reject);
+        child.once("close", (code) => {
+            const output = Buffer.concat(chunks).toString("utf8");
+            if (context.signal.aborted)
+                reject(new Error("Opscompass command aborted."));
+            else if (timedOut)
+                reject(new Error(`Opscompass command timed out after ${MAX_TIMEOUT_SECONDS} seconds.`));
+            else if (code !== 0)
+                reject(new Error(output.trim() ||
+                    `Opscompass command failed with exit code ${code}.`));
+            else
+                resolve(output);
+        });
+    });
+    const timeout = setTimeout(() => {
+        timedOut = true;
+        kill();
+    }, MAX_TIMEOUT_SECONDS * 1_000);
+    if (context.signal.aborted)
+        kill();
+    else
+        context.signal.addEventListener("abort", kill, { once: true });
+    try {
+        return await result;
+    }
+    finally {
+        clearTimeout(timeout);
+        clearTimeout(graceTimer);
+        context.signal.removeEventListener("abort", kill);
+    }
+}

package/skills/opscompass-resources/SKILL.md

@@ -0,0 +1,335 @@
+---
+name: opscompass-resources
+description: Analyze Oracle and SQL Server workloads across cloud and on-prem infrastructure using `opscompass resources list` plus list-follow-up actions `get-latest-configuration` and `get-compliance`. Use when users need to identify licensing risk, sprawl, misconfiguration, and workload hosting context for Oracle, SQL Server, Azure SQL, AWS RDS, AWS EC2, VMware vCenter, or Nutanix resources.
+---
+
+# OpsCompass Resources
+
+**Hosted execution:** the host-selected CLI identity and home govern every query and reported command. Use the CLI identity returned by execution tools; their generic `opscompass` labels and the production examples below do not override it. For development, report `opscompassdev`; for demo, report `opscompassdemo`. Standalone examples default to production unless `--cli` selects otherwise.
+
+## Overview
+
+Use this skill for a narrow workflow centered on Oracle and SQL Server risk analysis across cloud and on-prem infrastructure:
+- `opscompass resources list` to find matching resources
+- `opscompass resources get-latest-configuration` to inspect full configuration for resource `--id` values from the list results
+- `opscompass resources get-compliance` to inspect compliance findings for resource `--id` values from the list results (with `--status`) when that resource type actually has compliance coverage
+
+Translate user intent into exact commands, run them, and return concise risk-oriented summaries.
+
+This skill is primarily for:
+- Oracle license risk analysis
+- SQL Server and Oracle sprawl analysis
+- tracing workloads to AWS, Azure, VMware, or Nutanix infrastructure
+- identifying misconfiguration and placement context from latest configuration data
+
+For Oracle licensing and sprawl work, date-bounded inventory is a standard workflow. The model should remember it can start with `resources list` filtered by:
+- `--resource-creation-date-beginning` for "created on or after" questions
+- `--resource-creation-date-end` for "created before" questions
+- both flags together for date-range questions
+
+For Oracle specifically, licensing risk is a workload-plus-infrastructure problem, not just a database-config problem. The answer is stronger when it establishes:
+- the Oracle workload identity
+- where it is hosted
+- the underlying compute or core exposure
+- the configuration or compliance evidence supporting the license-risk conclusion
+
+## CLI Environment and Execution
+
+The `opscompass` examples below use production by default; apply the selected context to every resource/default command and login/setup instruction. A company named `opscompassdemo` is a tenant identifier, not an environment selector.
+
+- In embedded use, the host-supplied `OpscompassCliContext` (`cliEntryPoint`, `cliCommand`, `opscompassHome`) is authoritative, including over ambient settings. Prefer approved resource tools and `opscompass_resources_defaults` for defaults inspection. Do not assume a global executable on `PATH`, a production session, or `~/.opscompass`.
+- Standalone installed helpers need no host integration, Studio, Electron, or harness package. Use Node.js 22+ and the selected CLI/session for live queries. Pass `--cli opscompass|opscompassdev|opscompassdemo` to `scripts/build_resources_command.js` or `scripts/list_and_fetch_latest_configs.js`. The CLI identities select respectively `~/.opscompass`, `~/.opscompassdev`, and `~/.opscompassdemo`. Pure summarizers process supplied JSON and do not accept `--cli`.
+- `OPSCOMPASS_CLI_ENTRYPOINT` can select a standalone executable or custom path. A recognized bare command selects its matching home when `--cli` is absent. An arbitrary path retains production identity unless paired with explicit `--cli`; its filename does not select a home. Explicit `--cli` overrides a conflicting recognized ambient command, while a custom executable override can pair with that explicit identity.
+- Use only the selected home's defaults and authentication state. Never fall back to another environment. An explicit company wins over defaults.
+- A command builder or tool result with `execute: false` is a preview: it has not run the resource query. Label it as proposed, and obtain actual execution output before claiming inventory, successful authentication, or findings.
+
+Standalone dev defaults inspection: `opscompassdev defaults list-defaults`. For a custom executable in dev, preview a resource command from an installed Skill directory: `OPSCOMPASS_CLI_ENTRYPOINT=/opt/opscompass/bin/custom-cli node scripts/build_resources_command.js --cli opscompassdev --company acme --param resource-types=databases/oracle`.
+
+## Workflow
+
+1. Confirm whether the user is asking about licensing risk, sprawl, misconfiguration, hosting context, or generic inventory.
+2. Resolve required scope: prefer an explicit `--company`; if absent, use `opscompass_resources_defaults` or the selected CLI's `defaults list-defaults` to inspect `<selected-home>/defaults.json` and use its configured `company`.
+3. If filtering is needed, add only the `list` filters needed (start minimal, then refine).
+4. Build and run `opscompass resources list`.
+5. Read the list output and collect the numeric resource `id` values.
+6. Iterate the ids needed for the user's objective and run one or both follow-up actions:
+   - `opscompass resources get-latest-configuration --company ... --id ...`
+   - `opscompass resources get-compliance --company ... --id ... --status ...`
+7. When the question is about Oracle license risk, SQL Server/Oracle sprawl, or hosting context, continue correlating the workload to infrastructure rather than stopping at the workload resource alone.
+8. Summarize the result(s) and include the exact command(s).
+
+Before running live queries, ensure the selected CLI is available and its environment is authenticated. In embedded use, rely on the host's approved tools and selected context rather than testing a global `opscompass` on `PATH`.
+In embedded use, use the approved `opscompass_resources_defaults` tool to inspect company, account, and monitoring configuration defaults from the selected home; standalone inspection uses the selected CLI's `defaults list-defaults`.
+Use the selected CLI's interactive `data-gathering setup` as the preferred user-guided setup path, or `defaults set-defaults --company ... --account ... --monitoring-configuration-id ...` when the user explicitly wants direct defaults changes.
+Changing defaults is a local mutating operation; do not change them unless the user asks.
+To ignore defaults, pass explicit scope in commands and use helper-script `--ignore-defaults --company <company>`.
+Even when defaults provide the company, include `--company <resolved-company>` in every generated `opscompass resources ...` command so transcripts show the tenant scope.
+
+In Opscompass inventory, `cloud_provider: "mlss"` should generally be interpreted as a database or on-prem infrastructure context such as VMware or Nutanix, not as a final hosting-platform answer by itself.
+When the user says `Oracle` in this skill, interpret it as Oracle database workloads by default, not Oracle Cloud infrastructure. Only treat `Oracle` as Oracle Cloud / OCI when the user explicitly asks about Oracle Cloud, OCI, or cloud-provider/platform inventory.
+
+## Filter Selection
+
+Use `references/resources-commands.md` for the supported `list` filters and the `get-latest-configuration` follow-up action.
+Use `scripts/build_resources_command.js` to generate valid commands for:
+- `list`
+- `get-latest-configuration` (by numeric `--id`)
+- `get-compliance` (by numeric `--id` plus `--status`)
+When using `scripts/build_resources_command.js` for compliance, pass the compliance status as `--param status=...` to the builder. The final printed `opscompass resources get-compliance ...` command will use `--status ...`.
+In embedded use, use the approved `opscompass_resources_defaults` tool to inspect defaults or preview requested setup/set commands with `dryRun: true`; only execute defaults changes when the user asks.
+Use `scripts/summarize_resources_list.js` to summarize large `resources list` JSON output.
+Use `scripts/summarize_latest_configuration.js` to summarize one or many `get-latest-configuration` JSON results into model-friendly summaries across resource types.
+Use `scripts/list_and_fetch_latest_configs.js` to automate the full paired workflow (`list` -> iterate ids -> `get-latest-configuration` and/or `get-compliance` -> summary) when the user wants details for many resources.
+When `scripts/list_and_fetch_latest_configs.js` collects mixed Oracle plus Nutanix or VMware VM configurations, it will also emit the Oracle workload to platform vCPU summary automatically.
+
+Prefer tools/scripts this way:
+- embedded host with approved resource/default tools -> use those tools with the host context rather than substituting standalone shell commands
+- standalone, one or a few resources -> `scripts/build_resources_command.js` plus actual execution of the generated command
+- standalone, many matching resources -> `scripts/list_and_fetch_latest_configs.js`
+- many raw list rows already collected -> `scripts/summarize_resources_list.js`
+- many config payloads already collected -> `scripts/summarize_latest_configuration.js`
+
+Important: in this skill, `get-latest-configuration` and `get-compliance` are follow-up actions after `list`.
+The `id` for follow-up actions should come from the `list` results in the same workflow.
+Use the numeric OpsCompass resource `--id` for follow-up actions. Do not use `--resource-id` or `--resource-ids` for `get-latest-configuration` or `get-compliance`; those represent cloud platform resource identifiers such as ARNs or Azure resource ids and are not the same thing.
+Do not use `opscompass resources show` in this skill.
+For Oracle resources, version/edition are available in `get-latest-configuration` output under `document.version` and `document.edition`.
+If the user asks "Do I have any Oracle?" or "Show me my Oracle," default to `--resource-types databases/oracle`.
+For Oracle resources, `get-compliance` should usually be interpreted as Oracle license compliance rather than generic infrastructure/security compliance.
+For Oracle resources, the important answer is usually the compliance findings themselves, not just the number of compliance problems. Oracle compliance findings should usually be treated as evidence of licensed feature, option, pack, or parameter usage that may put the workload out of compliance with Oracle entitlements.
+For Oracle resources, `get-latest-configuration` also contains feature-usage evidence. Inspect `document.productUsageConcerns` for product/feature usage concerns and inspect `document.parameters` for entries where `isConcerning` is `true`.
+For Oracle databases, do not say per-database feature usage is unavailable until both `get-compliance --status open` and `get-latest-configuration` have been checked for that database. In current Oracle configs, fields such as `document.productUsageConcerns` and concerning `document.parameters` are feature-usage evidence.
+If a prior `resources list` result already shows `compliance_problems > 0` for Oracle or SQL Server resources and the user asks what the specific problems are, the next step is to run `get-compliance --status open` for those resource ids. Do not stop at the count-level list output.
+For Oracle licensing questions, do not stop at Oracle config alone if hosting and compute context can be established. Correlate the database workload to the infrastructure it runs on and use that to inform license-risk analysis.
+For Oracle on VMware or Nutanix, the hosting path matters: database workload -> VM -> host -> broader platform context. If that chain cannot be established, state that the Oracle license-risk conclusion is partial.
+Opscompass currently does not provide compliance checks for VMware vCenter or Nutanix resource types in this skill's scope. For those resource types, focus on `get-latest-configuration`, not `get-compliance`.
+For VMware vCenter resources, host and virtual machine configuration are related. When investigating VMware placement, movement, or change questions, inspect the latest configuration for both `vcenter/virtualMachine` and `vcenter/host` resources. The latest-configuration payloads include VM and host ids, so relationships can be analyzed and established from those results. In host configs, look at `document.virtualMachines[].id` and `document.virtualMachines[].name` together with host-level fields like `document.id`, `document.name`, `document.cluster`, and `document.datacenter`.
+For VMware vCPU mapping, inspect VM latest-configuration for direct CPU count fields such as `numCpu`, `numCPU`, `cpuCount`, `numCpus`, `vcpuCount`, or nested hardware/config equivalents like `hardware.numCPU` and `hardware.numCoresPerSocket`.
+For Nutanix resources, VM, host, and cluster configuration are related. In `Nutanix/Vm` configs, inspect `document.host.extId` and `document.cluster.extId`. In `Nutanix/Host` configs, inspect `document.extId`, `document.hostName`, and `document.cluster.uuid`. In `Nutanix/Cluster` configs, inspect `document.extId` and `document.nodes.nodeList[].nodeUuid` to relate VMs, hosts, and clusters. This is especially important for Oracle and SQL Server use cases, because those databases are often hosted on Nutanix infrastructure and the workload-to-infrastructure link is part of the answer.
+For Nutanix host-to-VM mapping requests, proceed directly to latest-configuration relationship analysis. List `Nutanix/Vm` and `Nutanix/Host`, fetch latest configuration for the relevant ids, then map `Nutanix/Vm.document.host.extId` to `Nutanix/Host.document.extId`. Do not answer that relationships are unavailable from list output; list output is only the starting point.
+For Nutanix vCPU mapping, inspect `document.numSockets`, `document.numCoresPerSocket`, and `document.numThreadsPerCore`, then compute provisioned vCPU as `numSockets * numCoresPerSocket * numThreadsPerCore`.
+Naming conventions can provide strong supporting evidence for correlating Oracle or SQL Server workloads to Nutanix infrastructure when they align, but naming overlap is not required and its absence should not be treated as evidence that no relationship exists.
+
+For `--resource-types`, this skill is intentionally limited to these OpsCompass-formatted values:
+- `AWS::EC2::Instance`
+- `Microsoft.Sql/servers`
+- `AWS::RDS::DBInstance`
+- `databases/mssqlserver`
+- `databases/oracle`
+- `Nutanix/AuthorizationPolicy`
+- `Nutanix/Cluster`
+- `Nutanix/Host`
+- `Nutanix/Image`
+- `Nutanix/Role`
+- `Nutanix/Subnet`
+- `Nutanix/User`
+- `Nutanix/VirtualSwitch`
+- `Nutanix/Vm`
+- `Nutanix/VolumeGroup`
+- `vcenter/host`
+- `vcenter/virtualMachine`
+
+Common user intents this skill should handle:
+- "What Oracle licensing risk do I have?" -> treat as Oracle workload plus infrastructure analysis; use Oracle compliance/config plus hosting context
+- "Which Oracle databases were created on or after X?" -> use `resources list` with `--resource-creation-date-beginning`, usually together with `--resource-types databases/oracle`
+- "Which Oracle databases were created between X and Y?" -> use `resources list` with both `--resource-creation-date-beginning` and `--resource-creation-date-end`, usually together with `--resource-types databases/oracle`
+- "Which recently created Oracle or SQL Server workloads may be sprawl candidates?" -> start with `resources list` filtered by creation-date range, then inspect latest configuration and hosting context
+- "Do I have any Oracle?" -> default to `resources list --resource-types databases/oracle`
+- "Show me my Oracle" -> default to `resources list --resource-types databases/oracle`
+- "Do I have Oracle Cloud resources?" -> only then treat this as a provider/platform question rather than a database workload question
+- "Map Oracle databases to provisioned vCPU cores on Nutanix" -> collect Oracle plus `Nutanix/Vm` latest configurations, then use `scripts/map_oracle_workloads_to_platform_cpus.js`
+- "Map Oracle databases to provisioned vCPU cores on VMware" -> collect Oracle plus `vcenter/virtualMachine` latest configurations, then use `scripts/map_oracle_workloads_to_platform_cpus.js`
+- "Where is this Oracle database hosted and what infrastructure backs it?" -> correlate the Oracle workload to VMware or Nutanix resources instead of stopping at the database record
+- "Which Oracle or SQL Server workloads may be sprawl candidates?" -> list workloads, inspect latest config, and summarize hosting/platform footprint and notable risk signals
+- "What misconfigurations or concerning settings do these Oracle or SQL Server workloads have?" -> inspect latest configuration and compliance where applicable, then summarize the risk-oriented differences
+- "List resources created after X date" -> `--resource-creation-date-beginning`
+- "List resources created before X date" -> `--resource-creation-date-end`
+- "List resources for account/provider/region" -> `--accounts`, `--cloud-providers`, `--region-ids`
+- "List resources with open compliance issues" -> `--open-compliance-issues true`
+- "List resources with unacknowledged changes" -> `--unacknowledged-changes true`
+- "List resources by tag or type" -> `--tags`, `--resource-types` (restricted to the approved set above)
+- "List EC2 instances" -> `resources list ... --resource-types AWS::EC2::Instance`
+- "List Nutanix clusters" -> `resources list ... --resource-types Nutanix/Cluster`
+- "List Nutanix hosts" -> `resources list ... --resource-types Nutanix/Host`
+- "List Nutanix virtual machines" -> `resources list ... --resource-types Nutanix/Vm`
+- "Map Nutanix hosts to VMs" -> collect `Nutanix/Vm` and `Nutanix/Host` latest configurations, then map `vm.document.host.extId` to `host.document.extId`
+- "Which VMs are running on each Nutanix host?" -> collect `Nutanix/Vm` and `Nutanix/Host` latest configurations, then group VMs by matched host
+- "List Nutanix subnets" -> `resources list ... --resource-types Nutanix/Subnet`
+- "List Nutanix volume groups" -> `resources list ... --resource-types Nutanix/VolumeGroup`
+- "List Nutanix infrastructure hosting Oracle or SQL Server related workloads" -> start with `resources list ... --resource-types Nutanix/Vm`, then refine by account, region, or tag if needed
+- "Show the Nutanix infrastructure behind this Oracle or SQL Server workload" -> correlate `Nutanix/Vm`, `Nutanix/Host`, and `Nutanix/Cluster` latest configurations and explain the workload-to-infrastructure relationship
+- "Show Nutanix compliance issues" -> explain that Nutanix resources do not currently have compliance checks here; inspect latest configuration instead
+- "List VMware hosts" -> `resources list ... --resource-types vcenter/host`
+- "List VMware virtual machines" -> `resources list ... --resource-types vcenter/virtualMachine`
+- "Investigate VMware VM movement or host placement changes" -> inspect both `vcenter/virtualMachine` and `vcenter/host` latest configurations, then use VM/host ids in those payloads to establish the relationships
+- "Show VMware compliance issues" -> explain that vCenter resources do not currently have compliance checks here; inspect latest configuration instead
+- "List Oracle databases and show their latest configs" -> `resources list ... --resource-types databases/oracle`, then iterate each returned `id` with `get-latest-configuration`
+- "List SQL Server databases and show their latest configs" -> `resources list ... --resource-types databases/mssqlserver`, then iterate each returned `id` with `get-latest-configuration`
+- "List VMware virtual machines hosting Oracle or SQL Server related workloads" -> start with `resources list ... --resource-types vcenter/virtualMachine`, then refine by account, region, or tag if needed
+- "List Azure SQL servers and show their latest configs" -> `resources list ... --resource-types Microsoft.Sql/servers`, then iterate each returned `id` with `get-latest-configuration`
+- "List AWS RDS instances and show their latest configs" -> `resources list ... --resource-types AWS::RDS::DBInstance`, then iterate each returned `id` with `get-latest-configuration`
+- "Which Oracle DBs are version 19 / Enterprise Edition?" -> list Oracle resources, then inspect each with `get-latest-configuration` and read `document.version` / `document.edition`
+- "Show open compliance issues for each Oracle database" -> treat this as Oracle license compliance by default; list Oracle resources, then iterate each returned `id` with `get-compliance --status open`
+
+## Command Rules
+
+- Use only these actions:
+  - `opscompass resources list`
+  - `opscompass resources get-latest-configuration`
+  - `opscompass resources get-compliance`
+- Choose follow-up actions with this priority:
+  - Oracle license/compliance question -> `get-compliance` plus `get-latest-configuration`, then correlate to infrastructure when possible
+  - Oracle or SQL Server hosting/sprawl/misconfiguration question -> `get-latest-configuration` first, then correlate to infrastructure
+  - VMware or Nutanix question -> `get-latest-configuration`, not `get-compliance`
+  - generic inventory question -> `list`, then only fetch follow-up data if needed to answer the question
+- For Oracle licensing or sprawl questions scoped to time, start with a date-bounded `resources list` rather than a broad list. Use `--resource-creation-date-beginning`, `--resource-creation-date-end`, or both.
+- Prefer explicit long flags exactly as documented.
+- Keep filters minimal first, then narrow further if the user asks.
+- If output is empty, remove the most restrictive filter first.
+- For date filters, use the CLI-help format:
+  - `--resource-creation-date-beginning "YYYY-MM-DD HH:MM:SS.mmm"`
+  - `--resource-creation-date-end "YYYY-MM-DD HH:MM:SS.mmm"`
+- For enum filters, only use allowed values (`cloud-providers`, compliance/change booleans).
+- For `--resource-types`, only use the approved resource types listed in this skill.
+- Use the helper validation to fail fast on missing company/defaults and invalid enum values.
+- If `--company` is omitted in helper scripts, they may read `<selected-home>/defaults.json`; pass `--ignore-defaults --company <company>` to require explicit company scope.
+- For configuration inspection, prefer `--id` taken from list output in the same session/workflow.
+- For compliance inspection, require `--status` and use allowed values from CLI help (`open`, `remediated`, `policy-exception`, `mitigation`).
+- For hosting questions, do not assume `cloud_provider: "mlss"` alone answers the infrastructure question. Treat it as a signal that the workload may be backed by on-prem infrastructure such as VMware or Nutanix and continue correlation when possible.
+- For Oracle databases, interpret compliance questions as license compliance unless the user clearly asks about something else.
+- If the user pivots from a VMware or Nutanix thread to "Oracle" or "SQL Server", re-evaluate the request from scratch and default to the workload resource type (`databases/oracle` or `databases/mssqlserver`) rather than staying in the prior infrastructure/resource-type context.
+- For Oracle license compliance workflows, pair `get-compliance` with `get-latest-configuration` so the answer can include `document.version`, `document.edition`, `document.productUsageConcerns`, and concerning `document.parameters`.
+- For Oracle latest-configuration, treat non-empty `document.productUsageConcerns` as per-database licensed feature/option usage concern evidence.
+- For Oracle latest-configuration, treat `document.parameters.*.isConcerning=true` as license-relevant parameter evidence; for example, `CONTROL_MANAGEMENT_PACK_ACCESS=DIAGNOSTIC+TUNING` indicates Diagnostic Pack and Tuning Pack exposure.
+- For Oracle compliance questions, prioritize the actual findings and their license impact over the raw `compliance_problems` count.
+- If a resource list already established which Oracle or SQL Server resources have non-zero `compliance_problems`, and the user asks for the specific problems, iterate those ids with `get-compliance --status open` rather than restating the counts.
+- For Oracle license-risk workflows, try to establish where the database is hosted and what underlying compute context applies. If that infrastructure evidence is missing, say the license-risk conclusion is incomplete or partial.
+- For Oracle workload-to-vCPU mapping on Nutanix or VMware, prefer collecting mixed Oracle and VM latest-configuration payloads and running `scripts/map_oracle_workloads_to_platform_cpus.js` instead of extracting CPU fields manually in the model.
+- Do not use `get-compliance` for `vcenter/*` or `Nutanix/*` resource types in normal workflows, because Opscompass does not currently provide compliance checks for those resource types.
+- For VMware workflows involving movement, placement, or change analysis, pair VM and host `get-latest-configuration` lookups and use VM/host ids in those payloads to establish the relationships.
+- When VMware VM and host configs are collected together, `scripts/list_and_fetch_latest_configs.js` can summarize VM-to-host relationships from those payloads.
+- In VMware host configs, inspect `document.virtualMachines[]` to map hosted VMs back to the host, cluster, and datacenter context.
+- For Nutanix workflows involving VM placement or infrastructure analysis, pair `Nutanix/Vm`, `Nutanix/Host`, and `Nutanix/Cluster` `get-latest-configuration` lookups and use the extId/uuid fields in those payloads to establish the relationships.
+- For Nutanix host-to-VM mapping, do not stop after listing hosts and VMs. Use latest configuration to map `Nutanix/Vm.document.host.extId` to `Nutanix/Host.document.extId`.
+- For Oracle and SQL Server on Nutanix, treat the VM/host/cluster relationship as part of the core answer, not optional context.
+- When workload and infrastructure names clearly align, use that as strong correlation evidence, but do not require naming matches before relating Oracle/SQL Server workloads to Nutanix infrastructure.
+- For large result sets, prefer paging with `--skip` rather than dumping one broad unfiltered list.
+
+## Output Rules
+
+- Report the actual command run and selected environment/company. Clearly separate command previews (`execute: false` or builder output) from executed commands and retrieved evidence.
+- Prioritize the answer in this order when applicable:
+  - risk type and severity
+  - affected workload(s)
+  - hosting platform and placement
+  - underlying compute/core evidence or other infrastructure context
+  - supporting configuration/compliance evidence
+  - gaps or next evidence needed
+- For list output, report the most relevant fields only (resource ids/names, provider, account, region, counts).
+- For `get-latest-configuration`, report key metadata (`id`, `name`, `type`, `location`) and the most relevant document fields for the user's request.
+- For Oracle databases, check `document.version` and `document.edition` (not list output).
+- For Oracle databases, check `document.productUsageConcerns` and concerning `document.parameters` before saying feature usage is unavailable.
+- For `get-compliance`, report finding count and key fields per finding (`checkName`, `checkSeverity`, `status`, `errorMessage`, `recommendedAction`, compliance framework/control names).
+- For Oracle `get-compliance`, frame findings as Oracle license compliance findings and call out version/edition context when relevant.
+- For Oracle `get-compliance`, explain the finding in terms of the Oracle feature, option, pack, or parameter in use and why that usage can create an entitlement/compliance issue.
+- For Oracle compliance answers, do not lead with "N databases have compliance problems" unless the user asked for counts; lead with the actual license-relevant findings.
+- Do not claim the Opscompass CLI lacks resource-level compliance detail unless an actual `get-compliance` command failed and the failure output supports that conclusion.
+- If `get-compliance` fails, report the real command failure or stderr and state that the detailed compliance answer is partial because retrieval failed.
+- For Oracle license-risk answers, explicitly state whether hosting/platform evidence and underlying compute context were established. If not, say the conclusion is partial and identify what infrastructure evidence is still missing.
+- For VMware and Nutanix resource types, do not frame the answer around compliance findings; frame the answer around latest configuration structure, relationships, placement, changes, and supporting infrastructure context.
+- For Oracle workload-to-vCPU mapping answers, report the Oracle workload, matched VM, platform, provisioned vCPU count, and the CPU fields used to derive that count.
+- For VMware config questions, call out that relevant changes may appear in both the VM and host latest configuration payloads, and use the VM/host ids in those payloads to explain the relationship when possible.
+- For VMware host config summaries, call out hosted VM names/ids from `document.virtualMachines[]` plus `document.cluster` and `document.datacenter` when relevant.
+- For Nutanix config questions, call out VM-to-host and VM-to-cluster relationships from `document.host.extId`, `document.cluster.extId`, `document.cluster.uuid`, and `document.nodes.nodeList[].nodeUuid` when relevant.
+- For Nutanix host-to-VM mappings, report whether the mapping is complete for all retrieved VMs. If pagination or limits mean only a subset was retrieved, say "retrieved VMs" rather than "all VMs." Include unmapped VMs, host extIds when useful, hosts with no mapped VMs, and duplicate VM names or resource ids when duplicates appear.
+- For Oracle and SQL Server workloads on Nutanix, explicitly connect the workload VM back to the supporting host and cluster when the data is available.
+- If a workload resource shows `cloud_provider: "mlss"`, explain that this usually indicates a database or on-prem infrastructure context and keep tracing to VMware or Nutanix when the user is asking about hosting.
+- If naming conventions support the correlation, mention that as supporting evidence. If naming conventions do not align, state that the relationship was established from configuration data instead.
+- When iterating many resources, summarize repeated fields in a compact table/list and call out exceptions or concerning values.
+- When inspecting many configs, prefer collecting JSON results and running `scripts/summarize_latest_configuration.js` so the model gets a compact cross-resource summary in context.
+- When the user wants configs and/or compliance for many matching resources, prefer `scripts/list_and_fetch_latest_configs.js` instead of manually writing shell loops.
+- When list results are large, report that pagination was used and avoid flooding the response with raw rows.
+- If output is empty, state which filters likely constrained results and provide the next command to broaden the query.
+- Report the actual error, preserving useful diagnostics without exposing credentials. Distinguish authentication failures from missing scope/defaults, authorization denial, invalid arguments, and service/network failures. Do not classify every failed query as expired login or an empty inventory.
+- Recommend login only when authentication evidence supports it, using the selected CLI's `login` or `login --use-device-code` guidance. For missing scope, request the company or inspect selected-home defaults; for authorization denial, explain the access issue rather than switching environments.
+- If the selected executable cannot be launched, report that executable failure and use the host's setup guidance or the Opscompass CLI install article as appropriate. Do not require a global `opscompass` when the host supplies an entrypoint.
+
+## Examples
+
+These are production examples. For standalone non-production calls to `build_resources_command.js` or `list_and_fetch_latest_configs.js`, add `--cli opscompassdev` or `--cli opscompassdemo`; use that environment's executable for direct CLI commands. Do not add `--cli` to pure summarizers. Company names and sample resource ids below do not select an environment or constitute collected evidence.
+
+```bash
+opscompass resources list --company acme --cloud-providers aws --resource-types AWS::RDS::DBInstance --open-compliance-issues true
+```
+
+```bash
+opscompass resources list --company acme --cloud-providers aws --resource-types AWS::EC2::Instance
+```
+
+```bash
+opscompass resources list --company acme --resource-types Nutanix/Vm
+```
+
+```bash
+opscompass resources list --company acme --resource-types vcenter/virtualMachine
+```
+
+```bash
+opscompass resources list --company acme --cloud-providers azure --resource-types Microsoft.Sql/servers
+```
+
+```bash
+opscompass resources list --company acme --resource-creation-date-beginning "2025-01-01 00:00:00.000"
+```
+
+```bash
+opscompass resources list --company acme --accounts 406219038857 --unacknowledged-changes true
+```
+
+```bash
+node scripts/build_resources_command.js --company acme --param resource-creation-date-beginning="2025-01-01 00:00:00.000" --param resource-types=databases/oracle
+```
+
+```bash
+node scripts/build_resources_command.js --action get-latest-configuration --company opscompassdemo --id 9403537
+```
+
+```bash
+node scripts/build_resources_command.js --action get-compliance --company opscompassdemo --id 7180543 --param status=open
+```
+
+```bash
+opscompass resources list --company opscompassdemo --resource-types databases/oracle
+# then use returned ids (for example 9403537) with:
+opscompass resources get-latest-configuration --company opscompassdemo --id 9403537
+```
+
+```bash
+opscompass resources get-latest-configuration --company opscompassdemo --id 9403537
+```
+
+```bash
+opscompass resources get-compliance --company opscompassdemo --status open --id 7180543
+```
+
+```bash
+opscompass resources list --company opscompassdemo --accounts 406219038857 > resources.json
+node scripts/summarize_resources_list.js --input resources.json --top 5
+```
+
+```bash
+opscompass resources get-latest-configuration --company opscompassdemo --id 9403537 > config.json
+node scripts/summarize_latest_configuration.js --input config.json
+```
+
+```bash
+node scripts/list_and_fetch_latest_configs.js --company opscompassdemo --param resource-types=databases/oracle --summary-top 10 --max-resources 25
+```
+
+```bash
+node scripts/list_and_fetch_latest_configs.js --company opscompassdemo --param resource-types=databases/oracle --compliance-status open --summary-top 10 --max-resources 25
+```
+
+```bash
+node scripts/list_and_fetch_latest_configs.js --company opscompassdemo --param resource-types=AWS::EC2::Instance --page-size-hint 250 --max-pages 4 --summary-top 10 --max-resources 100
+```

package/skills/opscompass-resources/package.json

@@ -0,0 +1,3 @@
+{
+  "type": "module"
+}