@vfarcic/dot-ai 1.7.0 → 1.9.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- package/dist/core/ai-provider-factory.d.ts.map +1 -1
- package/dist/core/ai-provider-factory.js +1 -2
- package/dist/core/embedding-service.d.ts.map +1 -1
- package/dist/core/model-config.d.ts +3 -4
- package/dist/core/model-config.d.ts.map +1 -1
- package/dist/core/model-config.js +4 -5
- package/dist/core/providers/vercel-provider.d.ts.map +1 -1
- package/dist/core/providers/vercel-provider.js +6 -5
- package/dist/core/rbac/audit-logger.d.ts +23 -0
- package/dist/core/rbac/audit-logger.d.ts.map +1 -0
- package/dist/core/rbac/audit-logger.js +63 -0
- package/dist/core/rbac/check-access.d.ts +48 -0
- package/dist/core/rbac/check-access.d.ts.map +1 -0
- package/dist/core/rbac/check-access.js +156 -0
- package/dist/core/rbac/index.d.ts +3 -0
- package/dist/core/rbac/index.d.ts.map +1 -0
- package/dist/core/rbac/index.js +11 -0
- package/dist/core/schema.d.ts.map +1 -1
- package/dist/core/schema.js +14 -1
- package/dist/interfaces/mcp.d.ts.map +1 -1
- package/dist/interfaces/mcp.js +129 -44
- package/dist/interfaces/rest-api.d.ts.map +1 -1
- package/dist/interfaces/rest-api.js +70 -1
- package/dist/tools/generate-manifests.d.ts.map +1 -1
- package/dist/tools/generate-manifests.js +22 -2
- package/dist/tools/manage-knowledge.d.ts.map +1 -1
- package/dist/tools/manage-knowledge.js +20 -0
- package/dist/tools/operate.d.ts.map +1 -1
- package/dist/tools/operate.js +37 -0
- package/dist/tools/organizational-data.d.ts.map +1 -1
- package/dist/tools/organizational-data.js +27 -0
- package/dist/tools/recommend.d.ts.map +1 -1
- package/dist/tools/recommend.js +24 -0
- package/dist/tools/remediate.d.ts.map +1 -1
- package/dist/tools/remediate.js +67 -18
- package/package.json +12 -9
- package/shared-prompts/prd-update-decisions.md +7 -0
package/dist/tools/operate.js
CHANGED
|
@@ -46,6 +46,8 @@ exports.handleOperateTool = handleOperateTool;
|
|
|
46
46
|
const zod_1 = require("zod");
|
|
47
47
|
const error_handling_1 = require("../core/error-handling");
|
|
48
48
|
const generic_session_manager_1 = require("../core/generic-session-manager");
|
|
49
|
+
const request_context_1 = require("../interfaces/request-context");
|
|
50
|
+
const rbac_1 = require("../core/rbac");
|
|
49
51
|
const pattern_vector_service_1 = require("../core/pattern-vector-service");
|
|
50
52
|
const policy_vector_service_1 = require("../core/policy-vector-service");
|
|
51
53
|
const capability_vector_service_1 = require("../core/capability-vector-service");
|
|
@@ -260,7 +262,42 @@ async function operate(args, pluginManager) {
|
|
|
260
262
|
* PRD #343: pluginManager is required - all kubectl operations go through plugin.
|
|
261
263
|
*/
|
|
262
264
|
async function handleOperateTool(args, pluginManager) {
|
|
265
|
+
// PRD #392 Milestone 2: execution route requires 'apply' verb
|
|
266
|
+
if (args.sessionId && args.executeChoice) {
|
|
267
|
+
const identity = (0, request_context_1.getCurrentIdentity)();
|
|
268
|
+
const rbacResult = await (0, rbac_1.checkToolAccess)(identity, {
|
|
269
|
+
toolName: 'operate',
|
|
270
|
+
verb: 'apply',
|
|
271
|
+
});
|
|
272
|
+
if (!rbacResult.allowed) {
|
|
273
|
+
return {
|
|
274
|
+
content: [
|
|
275
|
+
{
|
|
276
|
+
type: 'text',
|
|
277
|
+
text: JSON.stringify({
|
|
278
|
+
error: 'FORBIDDEN',
|
|
279
|
+
message: `Access denied: executing operations requires 'apply' permission on 'operate'. You can analyze and plan operations, but applying changes requires additional authorization.`,
|
|
280
|
+
tool: 'operate',
|
|
281
|
+
user: identity?.email,
|
|
282
|
+
}),
|
|
283
|
+
},
|
|
284
|
+
],
|
|
285
|
+
};
|
|
286
|
+
}
|
|
287
|
+
}
|
|
263
288
|
const result = await operate(args, pluginManager);
|
|
289
|
+
// PRD #392 Milestone 2: If analysis complete, check apply permission to adjust guidance
|
|
290
|
+
if (result.status === 'awaiting_user_approval') {
|
|
291
|
+
const identity = (0, request_context_1.getCurrentIdentity)();
|
|
292
|
+
const applyResult = await (0, rbac_1.checkToolAccess)(identity, {
|
|
293
|
+
toolName: 'operate',
|
|
294
|
+
verb: 'apply',
|
|
295
|
+
});
|
|
296
|
+
if (!applyResult.allowed) {
|
|
297
|
+
result.message = `Operational proposal generated successfully. Executing operations requires 'apply' permission on 'operate', which is not granted for the current user. Review the proposed changes and apply them manually using kubectl or your GitOps workflow.`;
|
|
298
|
+
result.nextAction = `Review the proposed changes. To apply them, use kubectl or push to Git — executing via operate requires 'apply' permission.`;
|
|
299
|
+
}
|
|
300
|
+
}
|
|
264
301
|
// Build content blocks - JSON for REST API, agent instruction for MCP agents
|
|
265
302
|
const content = [
|
|
266
303
|
{
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"organizational-data.d.ts","sourceRoot":"","sources":["../../src/tools/organizational-data.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"organizational-data.d.ts","sourceRoot":"","sources":["../../src/tools/organizational-data.ts"],"names":[],"mappings":"AAAA;;;;;;;;GAQG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAGxB,OAAO,EAAE,KAAK,EAAE,MAAM,eAAe,CAAC;AACtC,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAiBhD,eAAO,MAAM,6BAA6B,kBAAkB,CAAC;AAC7D,eAAO,MAAM,oCAAoC,+jBAAyjB,CAAC;AAG3mB,eAAO,MAAM,qCAAqC;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;;CA+BjD,CAAC;AAEF;;GAEG;AACH,MAAM,WAAW,uBAAuB;IACtC,QAAQ,EAAE,SAAS,GAAG,QAAQ,GAAG,cAAc,CAAC;IAChD,SAAS,EAAE,QAAQ,GAAG,MAAM,GAAG,KAAK,GAAG,QAAQ,GAAG,WAAW,GAAG,MAAM,GAAG,SAAS,GAAG,UAAU,GAAG,QAAQ,CAAC;IAC3G,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,EAAE,CAAC,EAAE,MAAM,CAAC;IACZ,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE;QACT,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,UAAU,EAAE,MAAM,CAAC;KACpB,CAAC;IACF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAstBD;;;GAGG;AACH,wBAAsB,4BAA4B,CAChD,IAAI,EAAE,uBAAuB,EAC7B,MAAM,EAAE,KAAK,GAAG,IAAI,EACpB,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,GAChB,OAAO,CAAC;IAAE,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAA;CAAE,CAAC,CAsJ7D"}
|
|
@@ -58,6 +58,8 @@ const capability_scan_workflow_1 = require("../core/capability-scan-workflow");
|
|
|
58
58
|
const crypto_1 = require("crypto");
|
|
59
59
|
const fs = __importStar(require("fs"));
|
|
60
60
|
const path = __importStar(require("path"));
|
|
61
|
+
const request_context_1 = require("../interfaces/request-context");
|
|
62
|
+
const rbac_1 = require("../core/rbac");
|
|
61
63
|
// Tool metadata for MCP registration
|
|
62
64
|
exports.ORGANIZATIONAL_DATA_TOOL_NAME = 'manageOrgData';
|
|
63
65
|
exports.ORGANIZATIONAL_DATA_TOOL_DESCRIPTION = 'Unified tool for managing cluster data: organizational patterns, policy intents, and resource capabilities. For patterns and policies: supports create, list, get, delete, deleteAll, and search operations (patterns also support step-by-step creation workflow). For capabilities: supports scan, list, get, delete, deleteAll, and progress operations for cluster resource capability discovery and management. Use dataType parameter to specify what to manage: "pattern" for organizational patterns, "policy" for policy intents, "capabilities" for resource capabilities.';
|
|
@@ -668,6 +670,31 @@ async function handleOrganizationalDataTool(args, _dotAI, logger, requestId) {
|
|
|
668
670
|
input: args
|
|
669
671
|
});
|
|
670
672
|
}
|
|
673
|
+
// PRD #392 Milestone 8: Mutating operations require 'apply' verb
|
|
674
|
+
const MUTATING_OPERATIONS = new Set(['create', 'delete', 'deleteAll']);
|
|
675
|
+
if (MUTATING_OPERATIONS.has(args.operation)) {
|
|
676
|
+
const identity = (0, request_context_1.getCurrentIdentity)();
|
|
677
|
+
const rbacResult = await (0, rbac_1.checkToolAccess)(identity, {
|
|
678
|
+
toolName: 'manageOrgData',
|
|
679
|
+
verb: 'apply',
|
|
680
|
+
});
|
|
681
|
+
if (!rbacResult.allowed) {
|
|
682
|
+
return {
|
|
683
|
+
content: [
|
|
684
|
+
{
|
|
685
|
+
type: 'text',
|
|
686
|
+
text: JSON.stringify({
|
|
687
|
+
error: 'FORBIDDEN',
|
|
688
|
+
message: `Access denied: '${args.operation}' on organizational data requires 'apply' permission on 'manageOrgData'. Read operations (list, get, search) are available with 'execute' permission.`,
|
|
689
|
+
tool: 'manageOrgData',
|
|
690
|
+
operation: args.operation,
|
|
691
|
+
user: identity?.email,
|
|
692
|
+
}),
|
|
693
|
+
},
|
|
694
|
+
],
|
|
695
|
+
};
|
|
696
|
+
}
|
|
697
|
+
}
|
|
671
698
|
// Route to appropriate handler based on data type
|
|
672
699
|
let result;
|
|
673
700
|
switch (args.dataType) {
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"recommend.d.ts","sourceRoot":"","sources":["../../src/tools/recommend.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,KAAK,EAA0B,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;
|
|
1
|
+
{"version":3,"file":"recommend.d.ts","sourceRoot":"","sources":["../../src/tools/recommend.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAExB,OAAO,EAAuB,QAAQ,EAAE,MAAM,gBAAgB,CAAC;AAC/D,OAAO,EAAE,KAAK,EAA0B,MAAM,eAAe,CAAC;AAC9D,OAAO,EAAE,MAAM,EAAE,MAAM,wBAAwB,CAAC;AAYhD,OAAO,EAAE,aAAa,EAAE,MAAM,oBAAoB,CAAC;AACnD,OAAO,KAAK,EAAE,aAAa,EAAE,MAAM,wBAAwB,CAAC;AAM5D,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAC/C,eAAO,MAAM,0BAA0B,yXAAyX,CAAC;AAGja,eAAO,MAAM,2BAA2B;;;;;;;;CAWvC,CAAC;AAIF,MAAM,WAAW,YAAY;IAC3B,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,CAAC,EAAE,WAAW,GAAG,WAAW,GAAG,WAAW,GAAG,UAAU,CAAC;IAC7D,MAAM,EAAE,MAAM,CAAC;IACf,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,EAAE,MAAM,EAAE,CAAC;IAElB,SAAS,CAAC,EAAE,KAAK,CAAC;QAChB,IAAI,EAAE,MAAM,CAAC;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC,CAAC;IAEH,KAAK,CAAC,EAAE,aAAa,CAAC;IACtB,SAAS,EAAE;QACT,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;QACtB,KAAK,CAAC,EAAE,QAAQ,EAAE,CAAC;QACnB,QAAQ,CAAC,EAAE,QAAQ,EAAE,CAAC;QACtB,IAAI,CAAC,EAAE;YAAE,QAAQ,EAAE,MAAM,CAAC;YAAC,WAAW,EAAE,MAAM,CAAC;YAAC,MAAM,CAAC,EAAE,MAAM,CAAA;SAAE,CAAC;QAClE,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;KAC7B,CAAC;IACF,OAAO,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IACjC,SAAS,EAAE,MAAM,CAAC;IAClB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAE3B,kBAAkB,CAAC,EAAE;QACnB,IAAI,EAAE,KAAK,GAAG,MAAM,GAAG,WAAW,CAAC;QACnC,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,KAAK,CAAC,EAAE,KAAK,CAAC;YAAE,YAAY,EAAE,MAAM,CAAC;YAAC,OAAO,EAAE,MAAM,CAAA;SAAE,CAAC,CAAC;QACzD,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,KAAK,CAAC,EAAE;YACN,UAAU,EAAE,MAAM,CAAC;YACnB,cAAc,EAAE,MAAM,CAAC;YACvB,SAAS,EAAE,MAAM,CAAC;YAClB,OAAO,EAAE,MAAM,CAAC;SACjB,CAAC;QACF,WAAW,CAAC,EAAE,MAAM,CAAC;QACrB,SAAS,CAAC,EAAE,MAAM,CAAC;QACnB,kBAAkB,CAAC,EAAE,MAAM,CAAC;QAC5B,iBAAiB,CAAC,EAAE,MAAM,CAAC;KAC5B,CAAC;IAEF,oBAAoB,CAAC,EAAE,UAAU,GAAG,OAAO,GAAG,UAAU,GAAG,MAAM,CAAC;IAClE,iBAAiB,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAClC,YAAY,CAAC,EAAE,KAAK,CAAC;QACnB,UAAU,EAAE,MAAM,CAAC;QACnB,IAAI,EAAE,MAAM,CAAC;QACb,KAAK,EAAE,MAAM,CAAC;QACd,WAAW,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC,CAAC;IACH,qBAAqB,CAAC,EAAE;QACtB,sBAAsB,EAAE,MAAM,CAAC;QAC/B,cAAc,EAAE,MAAM,CAAC;QACvB,aAAa,EAAE,MAAM,CAAC;QACtB,aAAa,EAAE,MAAM,CAAC;QACtB,iBAAiB,EAAE,MAAM,CAAC;QAC1B,iBAAiB,EAAE,MAAM,CAAC;KAC3B,CAAC;CACH;AAiCD;;GAEG;AACH,UAAU,iBAAiB;IACzB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,OAAO,CAAC;IAChB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;IAClC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAmBD;;;GAGG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,iBAAiB,EACvB,KAAK,EAAE,KAAK,EACZ,MAAM,EAAE,MAAM,EACd,SAAS,EAAE,MAAM,EACjB,aAAa,EAAE,aAAa,GAC3B,OAAO,CAAC;IAAE,OAAO,EAAE;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,EAAE,CAAA;CAAE,CAAC,CA6axD"}
|
package/dist/tools/recommend.js
CHANGED
|
@@ -15,6 +15,8 @@ const answer_question_1 = require("./answer-question");
|
|
|
15
15
|
const generate_manifests_1 = require("./generate-manifests");
|
|
16
16
|
const deploy_manifests_1 = require("./deploy-manifests");
|
|
17
17
|
const shared_prompt_loader_1 = require("../core/shared-prompt-loader");
|
|
18
|
+
const request_context_1 = require("../interfaces/request-context");
|
|
19
|
+
const rbac_1 = require("../core/rbac");
|
|
18
20
|
const platform_utils_1 = require("../core/platform-utils");
|
|
19
21
|
const visualization_1 = require("../core/visualization");
|
|
20
22
|
const artifacthub_1 = require("../core/artifacthub");
|
|
@@ -90,6 +92,28 @@ async function handleRecommendTool(args, dotAI, logger, requestId, pluginManager
|
|
|
90
92
|
return await (0, generate_manifests_1.handleGenerateManifestsTool)(args, dotAI, logger, requestId, pluginManager);
|
|
91
93
|
}
|
|
92
94
|
if (stage === 'deployManifests') {
|
|
95
|
+
// PRD #392 Milestone 2: deployManifests requires 'apply' verb
|
|
96
|
+
const identity = (0, request_context_1.getCurrentIdentity)();
|
|
97
|
+
const rbacResult = await (0, rbac_1.checkToolAccess)(identity, {
|
|
98
|
+
toolName: 'recommend',
|
|
99
|
+
verb: 'apply',
|
|
100
|
+
});
|
|
101
|
+
if (!rbacResult.allowed) {
|
|
102
|
+
return {
|
|
103
|
+
content: [
|
|
104
|
+
{
|
|
105
|
+
type: 'text',
|
|
106
|
+
text: JSON.stringify({
|
|
107
|
+
error: 'FORBIDDEN',
|
|
108
|
+
message: `Access denied: deploying manifests requires 'apply' permission on 'recommend'. Save the files locally or push to Git to apply them through your own workflow.`,
|
|
109
|
+
tool: 'recommend',
|
|
110
|
+
stage: 'deployManifests',
|
|
111
|
+
user: identity?.email,
|
|
112
|
+
}),
|
|
113
|
+
},
|
|
114
|
+
],
|
|
115
|
+
};
|
|
116
|
+
}
|
|
93
117
|
// PRD #359: Uses unified plugin registry for kubectl operations
|
|
94
118
|
return await (0, deploy_manifests_1.handleDeployManifestsTool)(args, dotAI, logger, requestId);
|
|
95
119
|
}
|
|
@@ -1 +1 @@
|
|
|
1
|
-
{"version":3,"file":"remediate.d.ts","sourceRoot":"","sources":["../../src/tools/remediate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,OAAO,EAEL,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;
|
|
1
|
+
{"version":3,"file":"remediate.d.ts","sourceRoot":"","sources":["../../src/tools/remediate.ts"],"names":[],"mappings":"AAAA;;GAEG;AAEH,OAAO,EAAE,CAAC,EAAE,MAAM,KAAK,CAAC;AAYxB,OAAO,EAEL,qBAAqB,EACtB,MAAM,uBAAuB,CAAC;AAsB/B,eAAO,MAAM,mBAAmB,cAAc,CAAC;AAC/C,eAAO,MAAM,0BAA0B,yfACgd,CAAC;AAGxf,eAAO,MAAM,2BAA2B;;;;;;;;;;;;;;;;CAsDvC,CAAC;AAGF,MAAM,WAAW,cAAc;IAC7B,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,IAAI,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC9B,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,YAAY,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IACzC,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB;AAID,MAAM,WAAW,oBAAqB,SAAQ,qBAAqB;IACjE,QAAQ,EAAE,WAAW,CAAC;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,QAAQ,GAAG,WAAW,CAAC;IAC7B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,aAAa,CAAC,EAAE,eAAe,CAAC;IAChC,MAAM,EACF,eAAe,GACf,mBAAmB,GACnB,QAAQ,GACR,uBAAuB,GACvB,sBAAsB,GACtB,WAAW,CAAC;IAChB,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;CACtC;AAGD,MAAM,MAAM,gBAAgB,GAAG;IAC7B,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,SAAS,EAAE,MAAM,CAAC;IAClB,IAAI,EAAE,oBAAoB,CAAC;CAC5B,CAAC;AAEF,MAAM,WAAW,iBAAiB;IAChC,WAAW,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;IAChC,SAAS,EAAE,MAAM,CAAC;CACnB;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,MAAM,CAAC;IACf,OAAO,EAAE,OAAO,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,SAAS,EAAE,IAAI,CAAC;CACjB;AAED,MAAM,WAAW,eAAe;IAC9B,EAAE,EAAE,MAAM,CAAC;IACX,KAAK,EAAE,MAAM,CAAC;IACd,WAAW,EAAE,MAAM,CAAC;IACpB,IAAI,CAAC,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;CAClC;AAED,MAAM,WAAW,eAAe;IAC9B,MAAM,EAAE,SAAS,GAAG,QAAQ,GAAG,wBAAwB,GAAG,oBAAoB,CAAC;IAC/E,SAAS,EAAE,MAAM,CAAC;IAClB,aAAa,EAAE;QACb,UAAU,EAAE,MAAM,CAAC;QACnB,YAAY,EAAE,MAAM,EAAE,CAAC;KACxB,CAAC;IACF,QAAQ,EAAE;QACR,SAAS,EAAE,MAAM,CAAC;QAClB,UAAU,EAAE,MAAM,CAAC;QACnB,OAAO,EAAE,MAAM,EAAE,CAAC;KACnB,CAAC;IACF,WAAW,EAAE;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC7B,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;KACjC,CAAC;IAEF,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAE1B,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,OAAO,CAAC,EAAE,MAAM,CAAC;IAEjB,gBAAgB,CAAC,EAAE,eAAe,EAAE,CAAC;IACrC,QAAQ,CAAC,EAAE,OAAO,CAAC;IACnB,OAAO,CAAC,EAAE,eAAe,EAAE,CAAC;IAC5B,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,CAAC,EAAE,QAAQ,GAAG,WAAW,CAAC;CAC/B;AAID;;GAEG;AACH,MAAM,WAAW,qBAAqB;IACpC,OAAO,EAAE,KAAK,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,IAAI,EAAE,MAAM,CAAA;KAAE,CAAC,CAAC;CAChD;AA4ND;;GAEG;AACH,UAAU,uBAAuB;IAC/B,WAAW,EAAE,QAAQ,GAAG,UAAU,GAAG,cAAc,CAAC;IACpD,SAAS,EAAE,MAAM,CAAC;IAClB,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,WAAW,EAAE;QACX,OAAO,EAAE,MAAM,CAAC;QAChB,OAAO,EAAE,iBAAiB,EAAE,CAAC;QAC7B,IAAI,EAAE,KAAK,GAAG,QAAQ,GAAG,MAAM,CAAC;KACjC,CAAC;IACF,gBAAgB,CAAC,EAAE,MAAM,CAAC;CAC3B;AAED;;GAEG;AACH,wBAAgB,oBAAoB,CAClC,UAAU,EAAE,MAAM,GACjB,uBAAuB,CAyHzB;AAqcD;;;;;GAKG;AACH,wBAAsB,mBAAmB,CACvC,IAAI,EAAE,cAAc,GACnB,OAAO,CAAC,qBAAqB,CAAC,CA8QhC"}
|
package/dist/tools/remediate.js
CHANGED
|
@@ -48,6 +48,8 @@ const visualization_1 = require("../core/visualization");
|
|
|
48
48
|
const plugin_registry_1 = require("../core/plugin-registry");
|
|
49
49
|
const fs = __importStar(require("fs"));
|
|
50
50
|
const path = __importStar(require("path"));
|
|
51
|
+
const request_context_1 = require("../interfaces/request-context");
|
|
52
|
+
const rbac_1 = require("../core/rbac");
|
|
51
53
|
// PRD #143 Milestone 1: Hybrid approach - AI can use kubectl_api_resources tool OR continue with JSON dataRequests
|
|
52
54
|
// Tool metadata for direct MCP registration
|
|
53
55
|
exports.REMEDIATE_TOOL_NAME = 'remediate';
|
|
@@ -718,6 +720,27 @@ async function handleRemediateTool(args) {
|
|
|
718
720
|
const validatedInput = validateRemediateInput(args);
|
|
719
721
|
// Handle choice execution if provided
|
|
720
722
|
if (validatedInput.executeChoice && validatedInput.sessionId) {
|
|
723
|
+
// PRD #392 Milestone 2: execution requires 'apply' verb
|
|
724
|
+
const identity = (0, request_context_1.getCurrentIdentity)();
|
|
725
|
+
const rbacResult = await (0, rbac_1.checkToolAccess)(identity, {
|
|
726
|
+
toolName: 'remediate',
|
|
727
|
+
verb: 'apply',
|
|
728
|
+
});
|
|
729
|
+
if (!rbacResult.allowed) {
|
|
730
|
+
return {
|
|
731
|
+
content: [
|
|
732
|
+
{
|
|
733
|
+
type: 'text',
|
|
734
|
+
text: JSON.stringify({
|
|
735
|
+
error: 'FORBIDDEN',
|
|
736
|
+
message: `Access denied: executing remediation commands requires 'apply' permission on 'remediate'. You can diagnose issues, but applying fixes requires additional authorization.`,
|
|
737
|
+
tool: 'remediate',
|
|
738
|
+
user: identity?.email,
|
|
739
|
+
}),
|
|
740
|
+
},
|
|
741
|
+
],
|
|
742
|
+
};
|
|
743
|
+
}
|
|
721
744
|
logger.info('Executing user choice from previous session', {
|
|
722
745
|
requestId,
|
|
723
746
|
choice: validatedInput.executeChoice,
|
|
@@ -800,27 +823,53 @@ async function handleRemediateTool(args) {
|
|
|
800
823
|
};
|
|
801
824
|
// Add execution choices for manual mode (awaiting_user_approval status)
|
|
802
825
|
if (executionDecision.finalStatus === 'awaiting_user_approval') {
|
|
803
|
-
|
|
804
|
-
|
|
805
|
-
|
|
806
|
-
|
|
807
|
-
|
|
808
|
-
|
|
809
|
-
|
|
810
|
-
|
|
811
|
-
|
|
812
|
-
|
|
813
|
-
|
|
814
|
-
|
|
815
|
-
|
|
816
|
-
|
|
826
|
+
// PRD #392 Milestone 2: only offer execution choices if user has 'apply' permission
|
|
827
|
+
const identity = (0, request_context_1.getCurrentIdentity)();
|
|
828
|
+
const applyResult = await (0, rbac_1.checkToolAccess)(identity, {
|
|
829
|
+
toolName: 'remediate',
|
|
830
|
+
verb: 'apply',
|
|
831
|
+
});
|
|
832
|
+
if (applyResult.allowed) {
|
|
833
|
+
finalResult.executionChoices = [
|
|
834
|
+
{
|
|
835
|
+
id: 1,
|
|
836
|
+
label: 'Execute automatically via MCP',
|
|
837
|
+
description: 'Run the kubectl commands shown above automatically via MCP\n',
|
|
838
|
+
risk: finalAnalysis.remediation.risk,
|
|
839
|
+
},
|
|
840
|
+
{
|
|
841
|
+
id: 2,
|
|
842
|
+
label: 'Execute via agent',
|
|
843
|
+
description: 'STEP 1: Execute the kubectl commands using your Bash tool\nSTEP 2: Call the remediate tool again for validation with the provided validation message\n',
|
|
844
|
+
risk: finalAnalysis.remediation.risk,
|
|
845
|
+
},
|
|
846
|
+
];
|
|
847
|
+
}
|
|
848
|
+
else {
|
|
849
|
+
finalResult.fallbackReason = `Executing remediation commands requires 'apply' permission on 'remediate', which is not granted for the current user. Review the proposed remediation and apply fixes manually using kubectl or your GitOps workflow.`;
|
|
850
|
+
}
|
|
817
851
|
}
|
|
818
852
|
// Execute remediation actions if automatic mode approves it
|
|
819
853
|
if (executionDecision.shouldExecute) {
|
|
820
|
-
//
|
|
821
|
-
|
|
822
|
-
|
|
823
|
-
|
|
854
|
+
// PRD #392 Milestone 2: automatic execution also requires 'apply' verb
|
|
855
|
+
const identity = (0, request_context_1.getCurrentIdentity)();
|
|
856
|
+
const rbacResult = await (0, rbac_1.checkToolAccess)(identity, {
|
|
857
|
+
toolName: 'remediate',
|
|
858
|
+
verb: 'apply',
|
|
859
|
+
});
|
|
860
|
+
if (!rbacResult.allowed) {
|
|
861
|
+
// Downgrade to awaiting_user_approval with explanation
|
|
862
|
+
finalResult.status = 'awaiting_user_approval';
|
|
863
|
+
finalResult.executed = false;
|
|
864
|
+
finalResult.fallbackReason = `Automatic execution blocked: 'apply' permission on 'remediate' is required. You can review the proposed remediation but applying fixes requires additional authorization.`;
|
|
865
|
+
// Don't offer execution choices since user can't execute
|
|
866
|
+
}
|
|
867
|
+
else {
|
|
868
|
+
// Update session object with final analysis for execution
|
|
869
|
+
session.data.finalAnalysis = finalAnalysis;
|
|
870
|
+
// Execute commands and return the complete result (includes post-execution validation)
|
|
871
|
+
return await executeRemediationCommands(session, sessionManager, logger, requestId, validatedInput.interaction_id);
|
|
872
|
+
}
|
|
824
873
|
}
|
|
825
874
|
// Generate visualization URL for analysis response
|
|
826
875
|
const visualizationUrl = (0, visualization_1.getVisualizationUrl)(session.sessionId);
|
package/package.json
CHANGED
|
@@ -1,6 +1,6 @@
|
|
|
1
1
|
{
|
|
2
2
|
"name": "@vfarcic/dot-ai",
|
|
3
|
-
"version": "1.
|
|
3
|
+
"version": "1.9.0",
|
|
4
4
|
"description": "AI-powered development productivity platform that enhances software development workflows through intelligent automation and AI-driven assistance",
|
|
5
5
|
"mcpName": "io.github.vfarcic/dot-ai",
|
|
6
6
|
"main": "dist/index.js",
|
|
@@ -27,7 +27,6 @@
|
|
|
27
27
|
"test:integration:gemini-flash": "AI_PROVIDER=google_flash DEBUG_DOT_AI=true ./tests/integration/infrastructure/run-integration-tests.sh",
|
|
28
28
|
"test:integration:grok": "AI_PROVIDER=xai DEBUG_DOT_AI=true ./tests/integration/infrastructure/run-integration-tests.sh",
|
|
29
29
|
"test:integration:kimi": "AI_PROVIDER=kimi DEBUG_DOT_AI=true ./tests/integration/infrastructure/run-integration-tests.sh",
|
|
30
|
-
"test:integration:kimi-thinking": "AI_PROVIDER=kimi_thinking DEBUG_DOT_AI=true ./tests/integration/infrastructure/run-integration-tests.sh",
|
|
31
30
|
"test:integration:bedrock": "AI_PROVIDER=amazon_bedrock AI_MODEL=global.anthropic.claude-sonnet-4-20250514-v1:0 DEBUG_DOT_AI=true ./tests/integration/infrastructure/run-integration-tests.sh",
|
|
32
31
|
"test:integration:custom-endpoint": "AI_PROVIDER=openai DEBUG_DOT_AI=true ./tests/integration/infrastructure/run-integration-tests.sh",
|
|
33
32
|
"eval:comparative": "DEBUG_DOT_AI=true npx tsx src/evaluation/eval-runner.ts",
|
|
@@ -107,16 +106,17 @@
|
|
|
107
106
|
"vitest": "^3.2.4"
|
|
108
107
|
},
|
|
109
108
|
"dependencies": {
|
|
110
|
-
"@ai-sdk/amazon-bedrock": "^
|
|
111
|
-
"@ai-sdk/anthropic": "^
|
|
112
|
-
"@ai-sdk/google": "^
|
|
113
|
-
"@ai-sdk/openai": "^
|
|
114
|
-
"@ai-sdk/
|
|
109
|
+
"@ai-sdk/amazon-bedrock": "^4.0.77",
|
|
110
|
+
"@ai-sdk/anthropic": "^3.0.58",
|
|
111
|
+
"@ai-sdk/google": "^3.0.43",
|
|
112
|
+
"@ai-sdk/openai": "^3.0.41",
|
|
113
|
+
"@ai-sdk/openai-compatible": "^2.0.35",
|
|
114
|
+
"@ai-sdk/xai": "^3.0.67",
|
|
115
115
|
"@grpc/grpc-js": "^1.14.3",
|
|
116
116
|
"@grpc/proto-loader": "^0.8.0",
|
|
117
117
|
"@kubernetes/client-node": "^1.3.0",
|
|
118
118
|
"@modelcontextprotocol/sdk": "^1.27.1",
|
|
119
|
-
"@openrouter/ai-sdk-provider": "^
|
|
119
|
+
"@openrouter/ai-sdk-provider": "^2.2.5",
|
|
120
120
|
"@opentelemetry/api": "^1.9.0",
|
|
121
121
|
"@opentelemetry/exporter-trace-otlp-http": "^0.207.0",
|
|
122
122
|
"@opentelemetry/resources": "^2.2.0",
|
|
@@ -124,7 +124,7 @@
|
|
|
124
124
|
"@opentelemetry/sdk-trace-node": "^2.2.0",
|
|
125
125
|
"@opentelemetry/semantic-conventions": "^1.37.0",
|
|
126
126
|
"@qdrant/js-client-rest": "^1.15.0",
|
|
127
|
-
"ai": "^
|
|
127
|
+
"ai": "^6.0.116",
|
|
128
128
|
"bcryptjs": "^3.0.3",
|
|
129
129
|
"handlebars": "^4.7.8",
|
|
130
130
|
"jsonwebtoken": "^9.0.3",
|
|
@@ -133,6 +133,9 @@
|
|
|
133
133
|
"simple-git": "^3.32.3",
|
|
134
134
|
"yaml": "^2.8.0"
|
|
135
135
|
},
|
|
136
|
+
"overrides": {
|
|
137
|
+
"express-rate-limit": "^8.2.2"
|
|
138
|
+
},
|
|
136
139
|
"optionalDependencies": {
|
|
137
140
|
"@rollup/rollup-linux-x64-gnu": "4.52.5"
|
|
138
141
|
}
|
|
@@ -92,6 +92,13 @@ Update the appropriate PRD sections:
|
|
|
92
92
|
- **Workflow Updates**: Update process examples when user interaction patterns or step sequences change
|
|
93
93
|
- **Mark for Verification**: Flag code examples that need manual testing to ensure they still work
|
|
94
94
|
|
|
95
|
+
### Task and Milestone Updates
|
|
96
|
+
- **Create new tasks** when decisions introduce work not covered by existing tasks (e.g., a new integration, migration step, or validation requirement)
|
|
97
|
+
- **Add new milestones** when decisions significantly change project scope or phasing (e.g., a new phase for a deferred feature, or an additional delivery checkpoint)
|
|
98
|
+
- **Update existing tasks** when decisions change what a task requires or how it should be implemented
|
|
99
|
+
- **Remove or defer tasks** that are no longer relevant due to scope changes or eliminated requirements
|
|
100
|
+
- **Reorder priorities** when decisions shift what should be delivered first
|
|
101
|
+
|
|
95
102
|
### Risk and Dependency Updates
|
|
96
103
|
- Add new risks introduced by design decisions
|
|
97
104
|
- Update mitigation strategies if approach changed
|