@vfarcic/dot-ai 0.195.0 → 1.0.0

package/README.md

@@ -42,16 +42,11 @@ DevOps AI Toolkit brings AI-powered intelligence to platform engineering, Kubern
 - Automated repository setup with governance files
 - Shared prompt libraries for consistent workflows
 
-## Deployment Options
+## Deployment
 
 > **For the easiest setup**, we recommend installing the complete dot-ai stack which includes all components pre-configured. See the [Stack Installation Guide](https://devopstoolkit.ai/docs/stack).
 
-For individual component installation:
-
-- **[Kubernetes Setup](https://devopstoolkit.ai/docs/mcp/setup/kubernetes-setup/)** - Individual component deployment with full features
-- **[ToolHive Setup](https://devopstoolkit.ai/docs/mcp/setup/kubernetes-toolhive-setup/)** - Operator-managed Kubernetes deployment
-- **[Docker Setup](https://devopstoolkit.ai/docs/mcp/setup/docker-setup/)** - Local development (manual capability scanning only)
-- **[NPX Setup](https://devopstoolkit.ai/docs/mcp/setup/npx-setup/)** - Quick trials with Node.js
+For individual component installation, see the **[MCP Setup Guide](https://devopstoolkit.ai/docs/mcp/setup/mcp-setup/)**.
 
 [Read the Documentation](https://devopstoolkit.ai/docs/mcp/)
 

package/dist/core/capability-scan-workflow.d.ts

@@ -8,6 +8,7 @@ import { Logger } from './error-handling';
 import { CapabilityVectorService } from './capability-vector-service';
 import { KubernetesDiscovery } from './discovery';
 import { CapabilityInferenceEngine } from './capabilities';
+import type { PluginManager } from './plugin-manager';
 export type TransitionCapabilitySessionFn = (session: CapabilityScanSession, nextStep: CapabilityScanSession['currentStep'], updates: Partial<CapabilityScanSession>, args: any) => void;
 export type CleanupCapabilitySessionFn = (session: CapabilityScanSession, args: any, logger: Logger, requestId: string) => void;
 export type ParseNumericResponseFn = (response: string, validOptions: string[]) => string;
@@ -58,14 +59,14 @@ export declare function scanSingleResource(resourceName: string, discovery: Kube
 /**
  * Handle resource selection step
  */
-export declare function handleResourceSelection(session: CapabilityScanSession, args: any, logger: Logger, requestId: string, capabilityService: CapabilityVectorService, parseNumericResponse: ParseNumericResponseFn, transitionCapabilitySession: TransitionCapabilitySessionFn, cleanupCapabilitySession: CleanupCapabilitySessionFn, createCapabilityScanCompletionResponse: CreateCapabilityScanCompletionResponseFn, handleScanningFn: (session: CapabilityScanSession, args: any, logger: Logger, requestId: string, capabilityService: CapabilityVectorService, parseNumericResponse: ParseNumericResponseFn, transitionCapabilitySession: TransitionCapabilitySessionFn, cleanupCapabilitySession: CleanupCapabilitySessionFn, createCapabilityScanCompletionResponse: CreateCapabilityScanCompletionResponseFn) => Promise<any>): Promise<any>;
+export declare function handleResourceSelection(session: CapabilityScanSession, args: any, logger: Logger, requestId: string, capabilityService: CapabilityVectorService, parseNumericResponse: ParseNumericResponseFn, transitionCapabilitySession: TransitionCapabilitySessionFn, cleanupCapabilitySession: CleanupCapabilitySessionFn, createCapabilityScanCompletionResponse: CreateCapabilityScanCompletionResponseFn, handleScanningFn: (session: CapabilityScanSession, args: any, logger: Logger, requestId: string, capabilityService: CapabilityVectorService, parseNumericResponse: ParseNumericResponseFn, transitionCapabilitySession: TransitionCapabilitySessionFn, cleanupCapabilitySession: CleanupCapabilitySessionFn, createCapabilityScanCompletionResponse: CreateCapabilityScanCompletionResponseFn, pluginManager?: PluginManager) => Promise<any>, pluginManager?: PluginManager): Promise<any>;
 /**
  * Handle resource specification step
  */
-export declare function handleResourceSpecification(session: CapabilityScanSession, args: any, logger: Logger, requestId: string, capabilityService: CapabilityVectorService, parseNumericResponse: ParseNumericResponseFn, transitionCapabilitySession: TransitionCapabilitySessionFn, cleanupCapabilitySession: CleanupCapabilitySessionFn, createCapabilityScanCompletionResponse: CreateCapabilityScanCompletionResponseFn, handleScanningFn: (session: CapabilityScanSession, args: any, logger: Logger, requestId: string, capabilityService: CapabilityVectorService, parseNumericResponse: ParseNumericResponseFn, transitionCapabilitySession: TransitionCapabilitySessionFn, cleanupCapabilitySession: CleanupCapabilitySessionFn, createCapabilityScanCompletionResponse: CreateCapabilityScanCompletionResponseFn) => Promise<any>): Promise<any>;
+export declare function handleResourceSpecification(session: CapabilityScanSession, args: any, logger: Logger, requestId: string, capabilityService: CapabilityVectorService, parseNumericResponse: ParseNumericResponseFn, transitionCapabilitySession: TransitionCapabilitySessionFn, cleanupCapabilitySession: CleanupCapabilitySessionFn, createCapabilityScanCompletionResponse: CreateCapabilityScanCompletionResponseFn, handleScanningFn: (session: CapabilityScanSession, args: any, logger: Logger, requestId: string, capabilityService: CapabilityVectorService, parseNumericResponse: ParseNumericResponseFn, transitionCapabilitySession: TransitionCapabilitySessionFn, cleanupCapabilitySession: CleanupCapabilitySessionFn, createCapabilityScanCompletionResponse: CreateCapabilityScanCompletionResponseFn, pluginManager?: PluginManager) => Promise<any>, pluginManager?: PluginManager): Promise<any>;
 /**
  * Handle scanning step (actual capability analysis - auto mode only)
  */
-export declare function handleScanning(session: CapabilityScanSession, args: any, logger: Logger, requestId: string, capabilityService: CapabilityVectorService, parseNumericResponse: ParseNumericResponseFn, transitionCapabilitySession: TransitionCapabilitySessionFn, cleanupCapabilitySession: CleanupCapabilitySessionFn, createCapabilityScanCompletionResponse: CreateCapabilityScanCompletionResponseFn): Promise<any>;
+export declare function handleScanning(session: CapabilityScanSession, args: any, logger: Logger, requestId: string, capabilityService: CapabilityVectorService, parseNumericResponse: ParseNumericResponseFn, transitionCapabilitySession: TransitionCapabilitySessionFn, cleanupCapabilitySession: CleanupCapabilitySessionFn, createCapabilityScanCompletionResponse: CreateCapabilityScanCompletionResponseFn, pluginManager?: PluginManager): Promise<any>;
 export {};
 //# sourceMappingURL=capability-scan-workflow.d.ts.map

package/dist/core/capability-scan-workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"capability-scan-workflow.d.ts","sourceRoot":"","sources":["../../src/core/capability-scan-workflow.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAI3D,MAAM,MAAM,6BAA6B,GAAG,CAAC,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,qBAAqB,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC;AACzL,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;AAChI,MAAM,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;AAC1F,MAAM,MAAM,wCAAwC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,GAAG,CAAC;AAoBlN,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAGD,UAAU,gBAAgB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACrC;AAGD,UAAU,qBAAqB;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,oBAAoB,GAAG,wBAAwB,GAAG,UAAU,GAAG,UAAU,CAAC;IACvF,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CACrD;AAED;;GAEG;AACH,UAAU,kBAAkB;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,mBAAmB,EAC9B,MAAM,EAAE,yBAAyB,EACjC,iBAAiB,EAAE,uBAAuB,EAC1C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAsI7B;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,uBAAuB,EAC1C,oBAAoB,EAAE,sBAAsB,EAC5C,2BAA2B,EAAE,6BAA6B,EAC1D,wBAAwB,EAAE,0BAA0B,EACpD,sCAAsC,EAAE,wCAAwC,EAChF,gBAAgB,EAAE,CAAC,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,sCAAsC,EAAE,wCAAwC,KAAK,OAAO,CAAC,GAAG,CAAC,GAC7Y,OAAO,CAAC,GAAG,CAAC,CAgJd;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,uBAAuB,EAC1C,oBAAoB,EAAE,sBAAsB,EAC5C,2BAA2B,EAAE,6BAA6B,EAC1D,wBAAwB,EAAE,0BAA0B,EACpD,sCAAsC,EAAE,wCAAwC,EAChF,gBAAgB,EAAE,CAAC,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,sCAAsC,EAAE,wCAAwC,KAAK,OAAO,CAAC,GAAG,CAAC,GAC7Y,OAAO,CAAC,GAAG,CAAC,CA8Cd;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,uBAAuB,EAC1C,oBAAoB,EAAE,sBAAsB,EAC5C,2BAA2B,EAAE,6BAA6B,EAC1D,wBAAwB,EAAE,0BAA0B,EACpD,sCAAsC,EAAE,wCAAwC,GAC/E,OAAO,CAAC,GAAG,CAAC,CAoUd"}
+{"version":3,"file":"capability-scan-workflow.d.ts","sourceRoot":"","sources":["../../src/core/capability-scan-workflow.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,uBAAuB,EAAE,MAAM,6BAA6B,CAAC;AACtE,OAAO,EAAE,mBAAmB,EAAE,MAAM,aAAa,CAAC;AAClD,OAAO,EAAE,yBAAyB,EAAE,MAAM,gBAAgB,CAAC;AAE3D,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAGtD,MAAM,MAAM,6BAA6B,GAAG,CAAC,OAAO,EAAE,qBAAqB,EAAE,QAAQ,EAAE,qBAAqB,CAAC,aAAa,CAAC,EAAE,OAAO,EAAE,OAAO,CAAC,qBAAqB,CAAC,EAAE,IAAI,EAAE,GAAG,KAAK,IAAI,CAAC;AACzL,MAAM,MAAM,0BAA0B,GAAG,CAAC,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,IAAI,CAAC;AAChI,MAAM,MAAM,sBAAsB,GAAG,CAAC,QAAQ,EAAE,MAAM,EAAE,YAAY,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC;AAC1F,MAAM,MAAM,wCAAwC,GAAG,CAAC,SAAS,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,UAAU,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,EAAE,cAAc,EAAE,MAAM,EAAE,IAAI,EAAE,MAAM,GAAG,QAAQ,EAAE,OAAO,CAAC,EAAE,OAAO,KAAK,GAAG,CAAC;AAoBlN,UAAU,gBAAgB;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,EAAE,MAAM,CAAC;CACnB;AAGD,UAAU,gBAAgB;IACxB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,KAAK,EAAE,MAAM,CAAC;IACd,cAAc,EAAE,MAAM,CAAC;IACvB,cAAc,CAAC,EAAE,gBAAgB,EAAE,CAAC;CACrC;AAGD,UAAU,qBAAqB;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,WAAW,EAAE,oBAAoB,GAAG,wBAAwB,GAAG,UAAU,GAAG,UAAU,CAAC;IACvF,iBAAiB,CAAC,EAAE,MAAM,EAAE,GAAG,KAAK,CAAC;IACrC,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,oBAAoB,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,EAAE,GAAG,CAAC;IACf,SAAS,EAAE,MAAM,CAAC;IAClB,YAAY,EAAE,MAAM,CAAC;IACrB,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CACrD;AAED;;GAEG;AACH,UAAU,kBAAkB;IAC1B,OAAO,EAAE,OAAO,CAAC;IACjB,QAAQ,EAAE,MAAM,CAAC;IACjB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,YAAY,CAAC,EAAE,MAAM,EAAE,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,EAAE,CAAC;IACrB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB;AAED;;;GAGG;AACH,wBAAsB,kBAAkB,CACtC,YAAY,EAAE,MAAM,EACpB,SAAS,EAAE,mBAAmB,EAC9B,MAAM,EAAE,yBAAyB,EACjC,iBAAiB,EAAE,uBAAuB,EAC1C,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,aAAa,CAAC,EAAE,MAAM,GACrB,OAAO,CAAC,kBAAkB,CAAC,CAsI7B;AAED;;GAEG;AACH,wBAAsB,uBAAuB,CAC3C,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,uBAAuB,EAC1C,oBAAoB,EAAE,sBAAsB,EAC5C,2BAA2B,EAAE,6BAA6B,EAC1D,wBAAwB,EAAE,0BAA0B,EACpD,sCAAsC,EAAE,wCAAwC,EAChF,gBAAgB,EAAE,CAAC,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,sCAAsC,EAAE,wCAAwC,EAAE,aAAa,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,GAAG,CAAC,EAC7a,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,GAAG,CAAC,CA8Jd;AAED;;GAEG;AACH,wBAAsB,2BAA2B,CAC/C,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,uBAAuB,EAC1C,oBAAoB,EAAE,sBAAsB,EAC5C,2BAA2B,EAAE,6BAA6B,EAC1D,wBAAwB,EAAE,0BAA0B,EACpD,sCAAsC,EAAE,wCAAwC,EAChF,gBAAgB,EAAE,CAAC,OAAO,EAAE,qBAAqB,EAAE,IAAI,EAAE,GAAG,EAAE,MAAM,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,EAAE,iBAAiB,EAAE,uBAAuB,EAAE,oBAAoB,EAAE,sBAAsB,EAAE,2BAA2B,EAAE,6BAA6B,EAAE,wBAAwB,EAAE,0BAA0B,EAAE,sCAAsC,EAAE,wCAAwC,EAAE,aAAa,CAAC,EAAE,aAAa,KAAK,OAAO,CAAC,GAAG,CAAC,EAC7a,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,GAAG,CAAC,CA8Cd;AAED;;GAEG;AACH,wBAAsB,cAAc,CAClC,OAAO,EAAE,qBAAqB,EAC9B,IAAI,EAAE,GAAG,EACT,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,iBAAiB,EAAE,uBAAuB,EAC1C,oBAAoB,EAAE,sBAAsB,EAC5C,2BAA2B,EAAE,6BAA6B,EAC1D,wBAAwB,EAAE,0BAA0B,EACpD,sCAAsC,EAAE,wCAAwC,EAChF,aAAa,CAAC,EAAE,aAAa,GAC5B,OAAO,CAAC,GAAG,CAAC,CAiTd"}

package/dist/core/capability-scan-workflow.js

@@ -138,7 +138,7 @@ async function scanSingleResource(resourceName, discovery, engine, capabilitySer
 /**
  * Handle resource selection step
  */
-async function handleResourceSelection(session, args, logger, requestId, capabilityService, parseNumericResponse, transitionCapabilitySession, cleanupCapabilitySession, createCapabilityScanCompletionResponse, handleScanningFn) {
+async function handleResourceSelection(session, args, logger, requestId, capabilityService, parseNumericResponse, transitionCapabilitySession, cleanupCapabilitySession, createCapabilityScanCompletionResponse, handleScanningFn, pluginManager) {
     if (!args.response) {
         // Show initial resource selection prompt
         return {
@@ -185,13 +185,26 @@ async function handleResourceSelection(session, args, logger, requestId, capabil
     // Process user response
     const normalizedResponse = parseNumericResponse(args.response, ['all', 'specific']);
     if (normalizedResponse === 'all') {
+        // Guard: Verify plugin is available before starting background scan
+        if (!pluginManager) {
+            logger.error('Cannot start capability scan: plugin system not available', undefined, { requestId, sessionId: session.sessionId });
+            return {
+                success: false,
+                operation: 'scan',
+                dataType: 'capabilities',
+                error: {
+                    message: 'Plugin system not available',
+                    details: 'Capability scanning requires the agentic-tools plugin for kubectl operations. Ensure the plugin is deployed and configured.'
+                }
+            };
+        }
         // Transition directly to scanning (auto mode only - manual mode removed)
         transitionCapabilitySession(session, 'scanning', {
             selectedResources: 'all',
             currentResourceIndex: 0 // Start with first resource
         }, args);
         // Start scanning in background (don't await) to avoid MCP timeout
-        handleScanningFn(session, { ...args, response: undefined }, logger, requestId, capabilityService, parseNumericResponse, transitionCapabilitySession, cleanupCapabilitySession, createCapabilityScanCompletionResponse)
+        handleScanningFn(session, { ...args, response: undefined }, logger, requestId, capabilityService, parseNumericResponse, transitionCapabilitySession, cleanupCapabilitySession, createCapabilityScanCompletionResponse, pluginManager)
             .catch(error => {
             logger.error('Background capability scan failed', error, {
                 requestId,
@@ -275,7 +288,7 @@ async function handleResourceSelection(session, args, logger, requestId, capabil
 /**
  * Handle resource specification step
  */
-async function handleResourceSpecification(session, args, logger, requestId, capabilityService, parseNumericResponse, transitionCapabilitySession, cleanupCapabilitySession, createCapabilityScanCompletionResponse, handleScanningFn) {
+async function handleResourceSpecification(session, args, logger, requestId, capabilityService, parseNumericResponse, transitionCapabilitySession, cleanupCapabilitySession, createCapabilityScanCompletionResponse, handleScanningFn, pluginManager) {
     if (!args.resourceList) {
         return {
             success: false,
@@ -316,12 +329,12 @@ async function handleResourceSpecification(session, args, logger, requestId, cap
         currentResourceIndex: 0
     }, args);
     // Begin actual capability scanning and return completion summary
-    return await handleScanningFn(session, { ...args, response: undefined }, logger, requestId, capabilityService, parseNumericResponse, transitionCapabilitySession, cleanupCapabilitySession, createCapabilityScanCompletionResponse);
+    return await handleScanningFn(session, { ...args, response: undefined }, logger, requestId, capabilityService, parseNumericResponse, transitionCapabilitySession, cleanupCapabilitySession, createCapabilityScanCompletionResponse, pluginManager);
 }
 /**
  * Handle scanning step (actual capability analysis - auto mode only)
  */
-async function handleScanning(session, args, logger, requestId, capabilityService, parseNumericResponse, transitionCapabilitySession, cleanupCapabilitySession, createCapabilityScanCompletionResponse) {
+async function handleScanning(session, args, logger, requestId, capabilityService, parseNumericResponse, transitionCapabilitySession, cleanupCapabilitySession, createCapabilityScanCompletionResponse, pluginManager) {
     try {
         // Validate and initialize AI provider
         let aiProvider;
@@ -356,8 +369,12 @@ async function handleScanning(session, args, logger, requestId, capabilityServic
             // For 'all' mode, discover actual cluster resources first
             try {
                 logger.info('Discovering all cluster resources for capability scanning', { requestId, sessionId: session.sessionId });
+                // PRD #343: pluginManager required for all kubectl operations
+                if (!pluginManager) {
+                    throw new Error('Plugin system not available. Capability scanning requires agentic-tools plugin.');
+                }
                 const discovery = new discovery_1.KubernetesDiscovery();
-                await discovery.connect();
+                discovery.setPluginManager(pluginManager);
                 // Discover all available resources
                 const resourceMap = await discovery.discoverResources();
                 const allResources = [...resourceMap.resources, ...resourceMap.custom];
@@ -483,38 +500,23 @@ async function handleScanning(session, args, logger, requestId, capabilityServic
                 progress: progressData
             }, args);
         };
-        // Setup kubectl access
-        const discovery = new discovery_1.KubernetesDiscovery();
-        try {
-            await discovery.connect();
-            logger.info('Connected to Kubernetes for capability scanning', {
-                requestId,
-                sessionId: session.sessionId
-            });
-        }
-        catch (error) {
-            return {
-                success: false,
-                operation: 'scan',
-                dataType: 'capabilities',
-                error: {
-                    message: 'Could not connect to Kubernetes cluster',
-                    details: error instanceof Error ? error.message : String(error),
-                    sessionId: session.sessionId
-                }
-            };
+        // PRD #343: pluginManager required for all kubectl operations
+        if (!pluginManager) {
+            throw new Error('Plugin system not available. Capability scanning requires agentic-tools plugin.');
         }
+        // Setup kubectl access via plugin
+        const discovery = new discovery_1.KubernetesDiscovery();
+        discovery.setPluginManager(pluginManager);
+        logger.info('Ready for capability scanning via plugin', {
+            requestId,
+            sessionId: session.sessionId
+        });
         // Process each resource using scanSingleResource
+        // Progress is tracked via updateProgress() and available via the progress endpoint
         for (let i = 0; i < resources.length; i++) {
             const currentResource = resources[i];
             // Update progress before processing
             updateProgress(i + 1, currentResource, processedResults.length, errors.length, errors);
-            logger.info(`Processing resource ${i + 1}/${totalResources}`, {
-                requestId,
-                sessionId: session.sessionId,
-                resource: currentResource,
-                percentage: Math.round(((i + 1) / totalResources) * 100)
-            });
             // Call the shared single-resource scan function
             const result = await scanSingleResource(currentResource, discovery, engine, capabilityService, logger, requestId, args.interaction_id);
             if (result.success) {
@@ -526,13 +528,6 @@ async function handleScanning(session, args, logger, requestId, capabilityServic
                     complexity: result.complexity,
                     confidence: result.confidence
                 });
-                logger.info(`Successfully processed resource ${i + 1}/${totalResources}`, {
-                    requestId,
-                    sessionId: session.sessionId,
-                    resource: currentResource,
-                    capabilitiesFound: result.capabilities?.length || 0,
-                    percentage: Math.round(((i + 1) / totalResources) * 100)
-                });
             }
             else {
                 errors.push({

package/dist/core/circuit-breaker.d.ts

@@ -79,6 +79,7 @@ export declare class CircuitBreaker {
     private lastSuccessTime?;
     private openedAt?;
     private halfOpenAttempts;
+    private lastCircuitOpenLogTime?;
     constructor(name: string, config?: CircuitBreakerConfig, logger?: Logger);
     /**
      * Execute an operation through the circuit breaker

package/dist/core/circuit-breaker.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"circuit-breaker.d.ts","sourceRoot":"","sources":["../../src/core/circuit-breaker.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAiB,MAAM,kBAAkB,CAAC;AAEzD;;GAEG;AACH,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kCAAkC;IAClC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9E;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,YAAY,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,mBAAmB,EAAE,MAAM,CAAC;IAC5C,SAAgB,KAAK,EAAE,YAAY,CAAC;gBAExB,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM;CAO7D;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsG;IAC7H,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,mBAAmB,CAAa;IACxC,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,eAAe,CAAC,CAAO;IAC/B,OAAO,CAAC,eAAe,CAAC,CAAO;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAO;IACxB,OAAO,CAAC,gBAAgB,CAAa;gBAEzB,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,MAAM;IAWxE;;;;OAIG;IACG,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IA6BzD;;OAEG;IACH,aAAa,IAAI,IAAI;IAerB;;OAEG;IACH,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI;IAyBlC;;OAEG;IACH,KAAK,IAAI,IAAI;IAab;;OAEG;IACH,QAAQ,IAAI,YAAY;IAWxB;;OAEG;IACH,QAAQ,IAAI,mBAAmB;IAa/B;;OAEG;IACH,MAAM,IAAI,OAAO;IAIjB;;OAEG;IACH,OAAO,IAAI,MAAM;IAIjB;;OAEG;IACH,OAAO,CAAC,UAAU;IAgBlB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IASlC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACH,OAAO,CAAC,YAAY;CAKrB;AAED;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;gBAEvD,aAAa,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,MAAM;IAKjE;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,oBAAoB,GAAG,cAAc;IAexE;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C;;OAEG;IACH,QAAQ,IAAI,IAAI;IAMhB;;OAEG;IACH,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC;CAOnD"}
+{"version":3,"file":"circuit-breaker.d.ts","sourceRoot":"","sources":["../../src/core/circuit-breaker.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,MAAM,EAAiB,MAAM,kBAAkB,CAAC;AAEzD;;GAEG;AACH,oBAAY,YAAY;IACtB,MAAM,WAAW;IACjB,IAAI,SAAS;IACb,SAAS,cAAc;CACxB;AAED;;GAEG;AACH,MAAM,WAAW,oBAAoB;IACnC,yEAAyE;IACzE,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,gGAAgG;IAChG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,kFAAkF;IAClF,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,kCAAkC;IAClC,aAAa,CAAC,EAAE,CAAC,IAAI,EAAE,YAAY,EAAE,EAAE,EAAE,YAAY,EAAE,IAAI,EAAE,MAAM,KAAK,IAAI,CAAC;CAC9E;AAED;;GAEG;AACH,MAAM,WAAW,mBAAmB;IAClC,KAAK,EAAE,YAAY,CAAC;IACpB,mBAAmB,EAAE,MAAM,CAAC;IAC5B,aAAa,EAAE,MAAM,CAAC;IACtB,cAAc,EAAE,MAAM,CAAC;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,eAAe,CAAC,EAAE,IAAI,CAAC;IACvB,QAAQ,CAAC,EAAE,IAAI,CAAC;IAChB,gBAAgB,EAAE,MAAM,CAAC;CAC1B;AAED;;GAEG;AACH,qBAAa,gBAAiB,SAAQ,KAAK;IACzC,SAAgB,WAAW,EAAE,MAAM,CAAC;IACpC,SAAgB,mBAAmB,EAAE,MAAM,CAAC;IAC5C,SAAgB,KAAK,EAAE,YAAY,CAAC;gBAExB,WAAW,EAAE,MAAM,EAAE,mBAAmB,EAAE,MAAM;CAO7D;AAED;;;;;;;;;;;;;;;GAeG;AACH,qBAAa,cAAc;IACzB,OAAO,CAAC,QAAQ,CAAC,IAAI,CAAS;IAC9B,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAsG;IAC7H,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAEhC,OAAO,CAAC,KAAK,CAAqC;IAClD,OAAO,CAAC,mBAAmB,CAAa;IACxC,OAAO,CAAC,aAAa,CAAa;IAClC,OAAO,CAAC,cAAc,CAAa;IACnC,OAAO,CAAC,eAAe,CAAC,CAAO;IAC/B,OAAO,CAAC,eAAe,CAAC,CAAO;IAC/B,OAAO,CAAC,QAAQ,CAAC,CAAO;IACxB,OAAO,CAAC,gBAAgB,CAAa;IACrC,OAAO,CAAC,sBAAsB,CAAC,CAAO;gBAE1B,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,MAAM;IAWxE;;;;OAIG;IACG,OAAO,CAAC,CAAC,EAAE,SAAS,EAAE,MAAM,OAAO,CAAC,CAAC,CAAC,GAAG,OAAO,CAAC,CAAC,CAAC;IAqCzD;;OAEG;IACH,aAAa,IAAI,IAAI;IAerB;;OAEG;IACH,aAAa,CAAC,KAAK,CAAC,EAAE,KAAK,GAAG,IAAI;IAyBlC;;OAEG;IACH,KAAK,IAAI,IAAI;IAcb;;OAEG;IACH,QAAQ,IAAI,YAAY;IAWxB;;OAEG;IACH,QAAQ,IAAI,mBAAmB;IAa/B;;OAEG;IACH,MAAM,IAAI,OAAO;IAIjB;;OAEG;IACH,OAAO,IAAI,MAAM;IAIjB;;OAEG;IACH,OAAO,CAAC,UAAU;IAgBlB;;OAEG;IACH,OAAO,CAAC,0BAA0B;IASlC;;OAEG;IACH,OAAO,CAAC,oBAAoB;IAU5B;;OAEG;IACH,OAAO,CAAC,YAAY;CAKrB;AAED;;GAEG;AACH,qBAAa,qBAAqB;IAChC,OAAO,CAAC,QAAQ,CAAC,aAAa,CAAuB;IACrD,OAAO,CAAC,QAAQ,CAAC,MAAM,CAAS;IAChC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAA0C;gBAEvD,aAAa,CAAC,EAAE,oBAAoB,EAAE,MAAM,CAAC,EAAE,MAAM;IAKjE;;OAEG;IACH,WAAW,CAAC,IAAI,EAAE,MAAM,EAAE,MAAM,CAAC,EAAE,oBAAoB,GAAG,cAAc;IAexE;;OAEG;IACH,GAAG,CAAC,IAAI,EAAE,MAAM,GAAG,cAAc,GAAG,SAAS;IAI7C;;OAEG;IACH,QAAQ,IAAI,IAAI;IAMhB;;OAEG;IACH,WAAW,IAAI,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC;CAOnD"}

package/dist/core/circuit-breaker.js

@@ -64,6 +64,7 @@ class CircuitBreaker {
     lastSuccessTime;
     openedAt;
     halfOpenAttempts = 0;
+    lastCircuitOpenLogTime;
     constructor(name, config, logger) {
         this.name = name;
         this.config = {
@@ -83,9 +84,15 @@ class CircuitBreaker {
         // Check if we should allow the request
         if (!this.canExecute()) {
             const remainingCooldown = this.getRemainingCooldown();
-            this.logger.warn(`Circuit '${this.name}' is open, blocking request`, {
-                remainingCooldownMs: remainingCooldown
-            });
+            // Only log once per circuit open period to avoid log spam
+            if (!this.lastCircuitOpenLogTime ||
+                this.lastCircuitOpenLogTime < this.openedAt) {
+                this.logger.warn(`Circuit '${this.name}' is open, blocking requests`, {
+                    remainingCooldownMs: remainingCooldown,
+                    willRetryAt: new Date(Date.now() + remainingCooldown).toISOString()
+                });
+                this.lastCircuitOpenLogTime = new Date();
+            }
             throw new CircuitOpenError(this.name, remainingCooldown);
         }
         // Track half-open attempts
@@ -157,6 +164,7 @@ class CircuitBreaker {
         this.consecutiveFailures = 0;
         this.halfOpenAttempts = 0;
         this.openedAt = undefined;
+        this.lastCircuitOpenLogTime = undefined;
         if (previousState !== CircuitState.CLOSED) {
             this.logger.info(`Circuit '${this.name}' manually reset to closed`);
             this.config.onStateChange?.(previousState, CircuitState.CLOSED, this.name);

package/dist/core/command-executor.d.ts

@@ -4,8 +4,12 @@
  * Provides common command execution logic for tools (remediate, operate, etc.)
  * Uses continue-on-error pattern: executes all commands sequentially regardless
  * of individual failures.
+ *
+ * PRD #343: Commands are executed through the plugin system via shell_exec tool.
+ * The plugin container has RBAC permissions; the MCP server does not.
  */
 import { Logger } from './error-handling';
+import { PluginManager } from './plugin-manager';
 /**
  * Execution result for a single command
  */
@@ -27,12 +31,17 @@ export interface CommandExecutionOptions {
 /**
  * Execute a list of commands sequentially with continue-on-error pattern
  *
+ * PRD #343: Commands are executed through the plugin's shell_exec tool.
+ * The plugin container has RBAC; commands are executed exactly as provided
+ * (no parsing or transformation).
+ *
  * @param commands - Array of command strings to execute
  * @param logger - Logger instance for tracking execution
+ * @param pluginManager - Plugin manager for executing commands via plugin
  * @param options - Optional execution context and metadata
  * @returns Array of execution results and overall success status
  */
-export declare function executeCommands(commands: string[], logger: Logger, options?: CommandExecutionOptions): Promise<{
+export declare function executeCommands(commands: string[], logger: Logger, pluginManager: PluginManager, options?: CommandExecutionOptions): Promise<{
     results: CommandExecutionResult[];
     overallSuccess: boolean;
 }>;

package/dist/core/command-executor.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"command-executor.d.ts","sourceRoot":"","sources":["../../src/core/command-executor.ts"],"names":[],"mappings":"AAAA;;;;;;GAMG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAE1C;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACnC;AAED;;;;;;;GAOG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAAE,EAClB,MAAM,EAAE,MAAM,EACd,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CAAC,CAwEzE"}
+{"version":3,"file":"command-executor.d.ts","sourceRoot":"","sources":["../../src/core/command-executor.ts"],"names":[],"mappings":"AAAA;;;;;;;;;GASG;AAEH,OAAO,EAAE,MAAM,EAAE,MAAM,kBAAkB,CAAC;AAC1C,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAEjD;;GAEG;AACH,MAAM,WAAW,sBAAsB;IACrC,OAAO,EAAE,MAAM,CAAC;IAChB,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,WAAW,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,GAAG,CAAC,CAAC;CACnC;AAED;;;;;;;;;;;;GAYG;AACH,wBAAsB,eAAe,CACnC,QAAQ,EAAE,MAAM,EAAE,EAClB,MAAM,EAAE,MAAM,EACd,aAAa,EAAE,aAAa,EAC5B,OAAO,GAAE,uBAA4B,GACpC,OAAO,CAAC;IAAE,OAAO,EAAE,sBAAsB,EAAE,CAAC;IAAC,cAAc,EAAE,OAAO,CAAA;CAAE,CAAC,CAgHzE"}

package/dist/core/command-executor.js

@@ -5,51 +5,26 @@
  * Provides common command execution logic for tools (remediate, operate, etc.)
  * Uses continue-on-error pattern: executes all commands sequentially regardless
  * of individual failures.
+ *
+ * PRD #343: Commands are executed through the plugin system via shell_exec tool.
+ * The plugin container has RBAC permissions; the MCP server does not.
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.executeCommands = executeCommands;
 /**
  * Execute a list of commands sequentially with continue-on-error pattern
  *
+ * PRD #343: Commands are executed through the plugin's shell_exec tool.
+ * The plugin container has RBAC; commands are executed exactly as provided
+ * (no parsing or transformation).
+ *
  * @param commands - Array of command strings to execute
  * @param logger - Logger instance for tracking execution
+ * @param pluginManager - Plugin manager for executing commands via plugin
  * @param options - Optional execution context and metadata
  * @returns Array of execution results and overall success status
  */
-async function executeCommands(commands, logger, options = {}) {
+async function executeCommands(commands, logger, pluginManager, options = {}) {
     const results = [];
     let overallSuccess = true;
     const { sessionId, context = 'command execution', logMetadata = {} } = options;
@@ -63,26 +38,66 @@ async function executeCommands(commands, logger, options = {}) {
         const command = commands[i];
         const commandNum = i + 1;
         try {
-            logger.info(`Executing command ${commandNum}/${commands.length}`, {
+            logger.debug(`Executing command ${commandNum}/${commands.length}`, {
                 ...logMetadata,
                 sessionId,
                 command
             });
             // Clean up escape sequences that AI models sometimes add
             const cleanCommand = command.replace(/\\"/g, '"');
-            // Execute command using shared utility
-            const { execAsync } = await Promise.resolve().then(() => __importStar(require('./platform-utils.js')));
-            const { stdout } = await execAsync(cleanCommand);
-            results.push({
-                command,
-                success: true,
-                output: stdout?.trim() || '',
-                timestamp: new Date()
-            });
-            logger.info(`Command ${commandNum} succeeded`, {
-                ...logMetadata,
-                sessionId
-            });
+            // PRD #343: Execute command via plugin's shell_exec tool
+            const response = await pluginManager.invokeTool('shell_exec', { command: cleanCommand });
+            if (response.success) {
+                // Check for nested error - plugin wraps command errors in { success: false, error: "..." }
+                if (typeof response.result === 'object' && response.result !== null) {
+                    const result = response.result;
+                    if (result.success === false) {
+                        throw new Error(result.error || result.message || 'Command execution failed');
+                    }
+                }
+                // Extract only the data field - never pass JSON wrapper
+                let output;
+                if (typeof response.result === 'object' && response.result !== null) {
+                    const result = response.result;
+                    if (result.data !== undefined) {
+                        output = String(result.data);
+                    }
+                    else if (typeof result === 'string') {
+                        output = result;
+                    }
+                    else {
+                        throw new Error('Plugin returned unexpected response format - missing data field');
+                    }
+                }
+                else {
+                    output = String(response.result || '');
+                }
+                results.push({
+                    command,
+                    success: true,
+                    output: output,
+                    timestamp: new Date()
+                });
+                logger.debug(`Command ${commandNum} succeeded`, {
+                    ...logMetadata,
+                    sessionId
+                });
+            }
+            else {
+                const errorMessage = response.error?.message || 'Command execution failed';
+                overallSuccess = false;
+                results.push({
+                    command,
+                    success: false,
+                    error: errorMessage,
+                    timestamp: new Date()
+                });
+                logger.error(`Command ${commandNum} failed`, new Error(errorMessage), {
+                    ...logMetadata,
+                    sessionId,
+                    command
+                });
+            }
         }
         catch (error) {
             const errorMessage = error instanceof Error ? error.message : 'Unknown error';

package/dist/core/crd-availability.d.ts

@@ -3,12 +3,17 @@
  *
  * Checks once per MCP server lifecycle if Solution CRD is available,
  * then caches the result globally to avoid repeated cluster queries.
+ *
+ * PRD #343: Uses plugin system for K8s operations (MCP server has no RBAC)
  */
+import type { PluginManager } from './plugin-manager';
 /**
  * Helper function for checking CRD availability
  * Use this function throughout the codebase
+ *
+ * @param pluginManager - Optional plugin manager. If provided on first call, will be cached.
  */
-export declare function isSolutionCRDAvailable(): Promise<boolean>;
+export declare function isSolutionCRDAvailable(pluginManager?: PluginManager): Promise<boolean>;
 /**
  * Reset CRD availability cache (primarily for testing)
  */

package/dist/core/crd-availability.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"crd-availability.d.ts","sourceRoot":"","sources":["../../src/core/crd-availability.ts"],"names":[],"mappings":"AAAA;;;;;GAKG;AA4DH;;;GAGG;AACH,wBAAsB,sBAAsB,IAAI,OAAO,CAAC,OAAO,CAAC,CAG/D;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD"}
+{"version":3,"file":"crd-availability.d.ts","sourceRoot":"","sources":["../../src/core/crd-availability.ts"],"names":[],"mappings":"AAAA;;;;;;;GAOG;AAEH,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AAgGtD;;;;;GAKG;AACH,wBAAsB,sBAAsB,CAAC,aAAa,CAAC,EAAE,aAAa,GAAG,OAAO,CAAC,OAAO,CAAC,CAM5F;AAED;;GAEG;AACH,wBAAgB,yBAAyB,IAAI,IAAI,CAGhD"}

package/dist/core/crd-availability.js

@@ -4,44 +4,12 @@
  *
  * Checks once per MCP server lifecycle if Solution CRD is available,
  * then caches the result globally to avoid repeated cluster queries.
+ *
+ * PRD #343: Uses plugin system for K8s operations (MCP server has no RBAC)
  */
-var __createBinding = (this && this.__createBinding) || (Object.create ? (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    var desc = Object.getOwnPropertyDescriptor(m, k);
-    if (!desc || ("get" in desc ? !m.__esModule : desc.writable || desc.configurable)) {
-      desc = { enumerable: true, get: function() { return m[k]; } };
-    }
-    Object.defineProperty(o, k2, desc);
-}) : (function(o, m, k, k2) {
-    if (k2 === undefined) k2 = k;
-    o[k2] = m[k];
-}));
-var __setModuleDefault = (this && this.__setModuleDefault) || (Object.create ? (function(o, v) {
-    Object.defineProperty(o, "default", { enumerable: true, value: v });
-}) : function(o, v) {
-    o["default"] = v;
-});
-var __importStar = (this && this.__importStar) || (function () {
-    var ownKeys = function(o) {
-        ownKeys = Object.getOwnPropertyNames || function (o) {
-            var ar = [];
-            for (var k in o) if (Object.prototype.hasOwnProperty.call(o, k)) ar[ar.length] = k;
-            return ar;
-        };
-        return ownKeys(o);
-    };
-    return function (mod) {
-        if (mod && mod.__esModule) return mod;
-        var result = {};
-        if (mod != null) for (var k = ownKeys(mod), i = 0; i < k.length; i++) if (k[i] !== "default") __createBinding(result, mod, k[i]);
-        __setModuleDefault(result, mod);
-        return result;
-    };
-})();
 Object.defineProperty(exports, "__esModule", { value: true });
 exports.isSolutionCRDAvailable = isSolutionCRDAvailable;
 exports.resetCRDAvailabilityCache = resetCRDAvailabilityCache;
-const k8s = __importStar(require("@kubernetes/client-node"));
 /**
  * Singleton cache for CRD availability check
  * Checks once per MCP server lifecycle, caches result globally
@@ -49,6 +17,7 @@ const k8s = __importStar(require("@kubernetes/client-node"));
 class CRDAvailabilityCache {
     static instance;
     crdAvailable = null;
+    pluginManager = null;
     constructor() { }
     static getInstance() {
         if (!CRDAvailabilityCache.instance) {
@@ -56,32 +25,68 @@ class CRDAvailabilityCache {
         }
         return CRDAvailabilityCache.instance;
     }
+    /**
+     * Set plugin manager for K8s operations
+     */
+    setPluginManager(pluginManager) {
+        this.pluginManager = pluginManager;
+    }
     async isSolutionCRDAvailable() {
         // Return cached result if available
         if (this.crdAvailable !== null) {
             return this.crdAvailable;
         }
-        // Check cluster for Solution CRD
+        // PRD #343: All K8s operations go through plugin
+        if (!this.pluginManager) {
+            console.log('ℹ️  Plugin system not available - Solution CR generation disabled');
+            this.crdAvailable = false;
+            return false;
+        }
+        // Check cluster for Solution CRD via plugin
+        const crdName = 'solutions.dot-ai.devopstoolkit.live';
         try {
-            const kc = new k8s.KubeConfig();
-            kc.loadFromDefault();
-            const k8sApi = kc.makeApiClient(k8s.ApiextensionsV1Api);
-            const crdName = 'solutions.dot-ai.devopstoolkit.live';
-            await k8sApi.readCustomResourceDefinition({ name: crdName });
-            // CRD exists, cache result
-            this.crdAvailable = true;
-            console.log('✅ Solution CRD available - Solution CR generation enabled');
-            return true;
+            const response = await this.pluginManager.invokeTool('kubectl_get_resource_json', {
+                resource: `crd/${crdName}`
+            });
+            if (response.success) {
+                // Check for nested error - plugin wraps kubectl errors in { success: false, error: "..." }
+                const result = response.result;
+                if (result && result.success === false) {
+                    const errorMsg = result.error || '';
+                    if (errorMsg.includes('NotFound') || errorMsg.includes('not found')) {
+                        this.crdAvailable = false;
+                        console.log('ℹ️  Solution CRD not available - Solution CR generation disabled (graceful degradation)');
+                        return false;
+                    }
+                    throw new Error(`Failed to check Solution CRD availability: ${errorMsg}`);
+                }
+                // CRD exists, cache result
+                this.crdAvailable = true;
+                console.log('✅ Solution CRD available - Solution CR generation enabled');
+                return true;
+            }
+            else {
+                // CRD not found or error
+                const errorMsg = response.error?.message || '';
+                if (errorMsg.includes('NotFound') || errorMsg.includes('not found')) {
+                    this.crdAvailable = false;
+                    console.log('ℹ️  Solution CRD not available - Solution CR generation disabled (graceful degradation)');
+                    return false;
+                }
+                // Other errors - don't cache, throw
+                throw new Error(`Failed to check Solution CRD availability: ${errorMsg}`);
+            }
         }
         catch (error) {
-            if (error.statusCode === 404 || error.response?.statusCode === 404) {
-                // CRD not found, cache result
+            // Check if it's a "not found" error
+            const errorMsg = error.message || String(error);
+            if (errorMsg.includes('NotFound') || errorMsg.includes('not found')) {
                 this.crdAvailable = false;
                 console.log('ℹ️  Solution CRD not available - Solution CR generation disabled (graceful degradation)');
                 return false;
             }
-            // Other errors (cluster unreachable, etc.) - don't cache, throw
-            throw new Error(`Failed to check Solution CRD availability: ${error.message || error}`);
+            // Other errors - don't cache, throw
+            throw new Error(`Failed to check Solution CRD availability: ${errorMsg}`);
         }
     }
     /**
@@ -94,9 +99,14 @@ class CRDAvailabilityCache {
 /**
  * Helper function for checking CRD availability
  * Use this function throughout the codebase
+ *
+ * @param pluginManager - Optional plugin manager. If provided on first call, will be cached.
  */
-async function isSolutionCRDAvailable() {
+async function isSolutionCRDAvailable(pluginManager) {
     const cache = CRDAvailabilityCache.getInstance();
+    if (pluginManager) {
+        cache.setPluginManager(pluginManager);
+    }
     return cache.isSolutionCRDAvailable();
 }
 /**