@zaip-ai/cli 1.0.4 → 1.0.7

package/templates/.zaip-aios/templates/tools/mcp/observability/grafana/manifest.yaml

@@ -1,26 +0,0 @@
-schema_version: 1
-id: grafana
-name: "Grafana"
-type: mcp
-category: observability
-status: example
-enabled: false
-transport: external
-installation:
-  implementation: required
-  command: null
-  args: []
-authentication:
-  source: environment
-  required_variables:
-    - GRAFANA_URL
-    - GRAFANA_TOKEN
-capabilities:
-    - dashboards.read
-    - datasources.read
-    - dashboards.write
-security:
-  default_access: read-only
-  write_requires_approval: true
-  redact_secrets: true
-  destructive_operations: blocked

package/templates/.zaip-aios/templates/tools/mcp/observability/kibana/README.md

@@ -1,21 +0,0 @@
-# Kibana
-
-Exemplo MCP desabilitado para `kibana`. Ele documenta descoberta e políticas; escolha e audite uma implementação real antes de ativar.
-
-## Capacidades
-
-- `dashboards.read`
-- `saved_objects.read`
-- `saved_objects.write`
-
-## Configuração
-
-1. Revise o manifest e limite as capacidades necessárias.
-2. Configure as variáveis fora do Git:
-
-- `KIBANA_URL`
-- `KIBANA_API_KEY`
-
-3. Teste em sandbox usando somente leitura.
-4. Registre aprovação antes de habilitar qualquer operação de escrita.
-5. Valide redaction, timeout, retry, rate limit e idempotência.

package/templates/.zaip-aios/templates/tools/mcp/observability/kibana/manifest.yaml

@@ -1,26 +0,0 @@
-schema_version: 1
-id: kibana
-name: "Kibana"
-type: mcp
-category: observability
-status: example
-enabled: false
-transport: external
-installation:
-  implementation: required
-  command: null
-  args: []
-authentication:
-  source: environment
-  required_variables:
-    - KIBANA_URL
-    - KIBANA_API_KEY
-capabilities:
-    - dashboards.read
-    - saved_objects.read
-    - saved_objects.write
-security:
-  default_access: read-only
-  write_requires_approval: true
-  redact_secrets: true
-  destructive_operations: blocked

package/templates/.zaip-aios/templates/tools/mcp/observability/loki/README.md

@@ -1,19 +0,0 @@
-# Grafana Loki
-
-Exemplo MCP desabilitado para `loki`. Ele documenta descoberta e políticas; escolha e audite uma implementação real antes de ativar.
-
-## Capacidades
-
-- `logs.read`
-- `logql.query`
-
-## Configuração
-
-1. Revise o manifest e limite as capacidades necessárias.
-2. Configure as variáveis fora do Git:
-
-- `LOKI_URL`
-
-3. Teste em sandbox usando somente leitura.
-4. Registre aprovação antes de habilitar qualquer operação de escrita.
-5. Valide redaction, timeout, retry, rate limit e idempotência.

package/templates/.zaip-aios/templates/tools/mcp/observability/loki/manifest.yaml

@@ -1,24 +0,0 @@
-schema_version: 1
-id: loki
-name: "Grafana Loki"
-type: mcp
-category: observability
-status: example
-enabled: false
-transport: external
-installation:
-  implementation: required
-  command: null
-  args: []
-authentication:
-  source: environment
-  required_variables:
-    - LOKI_URL
-capabilities:
-    - logs.read
-    - logql.query
-security:
-  default_access: read-only
-  write_requires_approval: true
-  redact_secrets: true
-  destructive_operations: blocked

package/templates/.zaip-aios/templates/tools/mcp/observability/new-relic/README.md

@@ -1,21 +0,0 @@
-# New Relic
-
-Exemplo MCP desabilitado para `new-relic`. Ele documenta descoberta e políticas; escolha e audite uma implementação real antes de ativar.
-
-## Capacidades
-
-- `apm.read`
-- `logs.read`
-- `alerts.write`
-
-## Configuração
-
-1. Revise o manifest e limite as capacidades necessárias.
-2. Configure as variáveis fora do Git:
-
-- `NEW_RELIC_API_KEY`
-- `NEW_RELIC_ACCOUNT_ID`
-
-3. Teste em sandbox usando somente leitura.
-4. Registre aprovação antes de habilitar qualquer operação de escrita.
-5. Valide redaction, timeout, retry, rate limit e idempotência.

package/templates/.zaip-aios/templates/tools/mcp/observability/new-relic/manifest.yaml

@@ -1,26 +0,0 @@
-schema_version: 1
-id: new-relic
-name: "New Relic"
-type: mcp
-category: observability
-status: example
-enabled: false
-transport: external
-installation:
-  implementation: required
-  command: null
-  args: []
-authentication:
-  source: environment
-  required_variables:
-    - NEW_RELIC_API_KEY
-    - NEW_RELIC_ACCOUNT_ID
-capabilities:
-    - apm.read
-    - logs.read
-    - alerts.write
-security:
-  default_access: read-only
-  write_requires_approval: true
-  redact_secrets: true
-  destructive_operations: blocked

package/templates/.zaip-aios/templates/tools/mcp/observability/opentelemetry/README.md

@@ -1,20 +0,0 @@
-# OpenTelemetry
-
-Exemplo MCP desabilitado para `opentelemetry`. Ele documenta descoberta e políticas; escolha e audite uma implementação real antes de ativar.
-
-## Capacidades
-
-- `traces.read`
-- `metrics.read`
-- `telemetry.export`
-
-## Configuração
-
-1. Revise o manifest e limite as capacidades necessárias.
-2. Configure as variáveis fora do Git:
-
-- `OTEL_EXPORTER_OTLP_ENDPOINT`
-
-3. Teste em sandbox usando somente leitura.
-4. Registre aprovação antes de habilitar qualquer operação de escrita.
-5. Valide redaction, timeout, retry, rate limit e idempotência.

package/templates/.zaip-aios/templates/tools/mcp/observability/opentelemetry/manifest.yaml

@@ -1,25 +0,0 @@
-schema_version: 1
-id: opentelemetry
-name: "OpenTelemetry"
-type: mcp
-category: observability
-status: example
-enabled: false
-transport: external
-installation:
-  implementation: required
-  command: null
-  args: []
-authentication:
-  source: environment
-  required_variables:
-    - OTEL_EXPORTER_OTLP_ENDPOINT
-capabilities:
-    - traces.read
-    - metrics.read
-    - telemetry.export
-security:
-  default_access: read-only
-  write_requires_approval: true
-  redact_secrets: true
-  destructive_operations: blocked

package/templates/.zaip-aios/templates/tools/mcp/observability/prometheus/README.md

@@ -1,19 +0,0 @@
-# Prometheus
-
-Exemplo MCP desabilitado para `prometheus`. Ele documenta descoberta e políticas; escolha e audite uma implementação real antes de ativar.
-
-## Capacidades
-
-- `metrics.read`
-- `promql.query`
-
-## Configuração
-
-1. Revise o manifest e limite as capacidades necessárias.
-2. Configure as variáveis fora do Git:
-
-- `PROMETHEUS_URL`
-
-3. Teste em sandbox usando somente leitura.
-4. Registre aprovação antes de habilitar qualquer operação de escrita.
-5. Valide redaction, timeout, retry, rate limit e idempotência.

package/templates/.zaip-aios/templates/tools/mcp/observability/prometheus/manifest.yaml

@@ -1,24 +0,0 @@
-schema_version: 1
-id: prometheus
-name: "Prometheus"
-type: mcp
-category: observability
-status: example
-enabled: false
-transport: external
-installation:
-  implementation: required
-  command: null
-  args: []
-authentication:
-  source: environment
-  required_variables:
-    - PROMETHEUS_URL
-capabilities:
-    - metrics.read
-    - promql.query
-security:
-  default_access: read-only
-  write_requires_approval: true
-  redact_secrets: true
-  destructive_operations: blocked

package/templates/.zaip-aios/templates/tools/mcp/observability/sentry/README.md

@@ -1,21 +0,0 @@
-# Sentry
-
-Exemplo MCP desabilitado para `sentry`. Ele documenta descoberta e políticas; escolha e audite uma implementação real antes de ativar.
-
-## Capacidades
-
-- `issues.read`
-- `traces.read`
-- `releases.write`
-
-## Configuração
-
-1. Revise o manifest e limite as capacidades necessárias.
-2. Configure as variáveis fora do Git:
-
-- `SENTRY_AUTH_TOKEN`
-- `SENTRY_ORG`
-
-3. Teste em sandbox usando somente leitura.
-4. Registre aprovação antes de habilitar qualquer operação de escrita.
-5. Valide redaction, timeout, retry, rate limit e idempotência.

package/templates/.zaip-aios/templates/tools/mcp/observability/sentry/manifest.yaml

@@ -1,26 +0,0 @@
-schema_version: 1
-id: sentry
-name: "Sentry"
-type: mcp
-category: observability
-status: example
-enabled: false
-transport: external
-installation:
-  implementation: required
-  command: null
-  args: []
-authentication:
-  source: environment
-  required_variables:
-    - SENTRY_AUTH_TOKEN
-    - SENTRY_ORG
-capabilities:
-    - issues.read
-    - traces.read
-    - releases.write
-security:
-  default_access: read-only
-  write_requires_approval: true
-  redact_secrets: true
-  destructive_operations: blocked

package/templates/.zaip-aios/templates/tools/policies/approval-rules.yaml

@@ -1,8 +0,0 @@
-schema_version: 1
-approvals:
-  infrastructure_apply: required
-  production_deploy: required
-  campaign_publish: required
-  budget_change: required
-  payment_create: required
-  bulk_message_send: required

package/templates/.zaip-aios/templates/tools/policies/financial-limits.yaml

@@ -1,6 +0,0 @@
-schema_version: 1
-default_currency: BRL
-limits:
-  advertising_daily_change: null
-  payment_amount: null
-behavior_when_missing: block

package/templates/.zaip-aios/templates/tools/policies/permissions.yaml

@@ -1,8 +0,0 @@
-schema_version: 1
-default_access: read-only
-deny_by_default: true
-write_operations:
-  requires_explicit_scope: true
-  requires_approval: true
-destructive_operations:
-  allowed: false

package/templates/.zaip-aios/templates/tools/policies/secret-handling.md

@@ -1,7 +0,0 @@
-# Tratamento de segredos
-
-1. Registre somente nomes de variáveis no manifest.
-2. Armazene valores em secret manager ou ambiente local ignorado pelo Git.
-3. Nunca inclua tokens em prompts, logs, evidências ou arquivos de exemplo.
-4. Redija headers, query strings e payloads antes de persistir telemetria.
-5. Faça rotação imediata se um valor for exposto.

package/templates/.zaip-aios/templates/tools/profiles/business.yaml

@@ -1,8 +0,0 @@
-schema_version: 1
-id: business
-extends: default
-tools:
-  - { id: asaas, type: api, enabled: false }
-  - { id: kommo-crm, type: api, enabled: false }
-  - { id: stripe, type: api, enabled: false }
-  - { id: shopify, type: api, enabled: false }

package/templates/.zaip-aios/templates/tools/profiles/default.yaml

@@ -1,8 +0,0 @@
-schema_version: 1
-id: default
-description: Ferramentas publicas, sem credencial e read-only.
-tools:
-  - id: openai-docs
-    type: mcp
-    enabled: true
-    approval_mode: approve

package/templates/.zaip-aios/templates/tools/profiles/development.yaml

@@ -1,13 +0,0 @@
-schema_version: 1
-id: development
-extends: default
-tools:
-  - id: browser
-    type: mcp
-    enabled: false
-  - id: github
-    type: mcp
-    enabled: false
-  - id: postgresql
-    type: mcp
-    enabled: false

package/templates/.zaip-aios/templates/tools/profiles/infrastructure.yaml

@@ -1,8 +0,0 @@
-schema_version: 1
-id: infrastructure
-extends: default
-tools:
-  - { id: hostinger, type: mcp, enabled: false }
-  - { id: aws, type: mcp, enabled: false }
-  - { id: gcp, type: mcp, enabled: false }
-  - { id: azure, type: mcp, enabled: false }

package/templates/.zaip-aios/templates/tools/profiles/marketing.yaml

@@ -1,9 +0,0 @@
-schema_version: 1
-id: marketing
-extends: default
-tools:
-  - { id: google-analytics, type: mcp, enabled: false }
-  - { id: google-ads, type: mcp, enabled: false }
-  - { id: meta-ads, type: mcp, enabled: false }
-  - { id: tiktok-ads, type: mcp, enabled: false }
-  - { id: linkedin-ads, type: mcp, enabled: false }

package/templates/.zaip-aios/templates/tools/profiles/observability.yaml

@@ -1,8 +0,0 @@
-schema_version: 1
-id: observability
-extends: default
-tools:
-  - { id: datadog, type: mcp, enabled: false }
-  - { id: grafana, type: mcp, enabled: false }
-  - { id: sentry, type: mcp, enabled: false }
-  - { id: prometheus, type: mcp, enabled: false }

package/templates/.zaip-aios/templates/tools/runtime/README.md

@@ -1,3 +0,0 @@
-# Runtime local API MCP
-
-Runtime sem dependencias e sem deploy para adaptadores declarativos. O Codex inicia `runner.mjs` por STDIO. `doctor` valida estrutura e nomes de variaveis sem revelar valores; `call` permite smoke tests pelo terminal. Escritas exigem `ZAIP_ALLOW_MCP_WRITES=1` depois de aprovacao.

package/templates/.zaip-aios/templates/tools/runtime/api-mcp-runtime.mjs

@@ -1,217 +0,0 @@
-import { createInterface } from "node:readline";
-
-const MAX_OUTPUT_CHARS = 100_000;
-
-export async function runServer(definition) {
-  validateDefinition(definition);
-  const lines = createInterface({ input: process.stdin, crlfDelay: Infinity });
-  for await (const line of lines) {
-    if (!line.trim()) continue;
-    let message;
-    try {
-      message = JSON.parse(line);
-    } catch {
-      continue;
-    }
-    if (message.id === undefined) continue;
-    try {
-      write(await dispatch(definition, message));
-    } catch (error) {
-      write({ jsonrpc: "2.0", id: message.id, error: { code: -32603, message: safeError(error) } });
-    }
-  }
-}
-
-export async function callTool(definition, name, input = {}, fetchImpl = fetch) {
-  validateDefinition(definition);
-  const tool = definition.tools.find((candidate) => candidate.name === name);
-  if (!tool) throw new Error(`Unknown tool: ${name}`);
-  validateInput(tool.inputSchema, input);
-  if (tool.access !== "read" && process.env.ZAIP_ALLOW_MCP_WRITES !== "1") {
-    throw new Error(
-      `Tool ${name} is ${tool.access}; set ZAIP_ALLOW_MCP_WRITES=1 only after approval`,
-    );
-  }
-  const base = new URL(definition.baseUrl);
-  if (
-    base.protocol !== "https:" &&
-    !(base.protocol === "http:" && ["localhost", "127.0.0.1"].includes(base.hostname))
-  ) {
-    throw new Error("Only HTTPS or local HTTP APIs are allowed");
-  }
-  if (!definition.allowedHosts.includes(base.hostname))
-    throw new Error("API host is not allowlisted");
-  const path = interpolate(tool.path, input);
-  const target = new URL(path, base);
-  if (target.hostname !== base.hostname || !target.pathname.startsWith("/"))
-    throw new Error("Unsafe API target");
-  for (const [key, value] of Object.entries(input)) {
-    if (!tool.path.includes(`{${key}}`) && tool.method === "GET")
-      target.searchParams.set(key, String(value));
-  }
-  const headers = { accept: "application/json", ...authHeaders(definition.auth) };
-  const body = tool.method === "GET" ? undefined : JSON.stringify(input);
-  if (body) headers["content-type"] = "application/json";
-  const controller = new AbortController();
-  const timeout = setTimeout(() => controller.abort(), definition.timeoutMs ?? 15_000);
-  let response;
-  try {
-    response = await fetchImpl(target, {
-      method: tool.method,
-      headers,
-      body,
-      redirect: "error",
-      signal: controller.signal,
-    });
-  } finally {
-    clearTimeout(timeout);
-  }
-  const text = (await response.text()).slice(0, MAX_OUTPUT_CHARS);
-  if (!response.ok) throw new Error(`API request failed with status ${response.status}`);
-  return text.length ? parseResponse(text) : null;
-}
-
-export function doctor(definition) {
-  const findings = [];
-  try {
-    validateDefinition(definition);
-  } catch (error) {
-    findings.push(safeError(error));
-  }
-  for (const name of definition.auth?.env ?? [])
-    if (!process.env[name]) findings.push(`missing environment variable: ${name}`);
-  return {
-    id: definition.id,
-    ready: findings.length === 0,
-    transport: "stdio",
-    tools: definition.tools.length,
-    findings,
-  };
-}
-
-async function dispatch(definition, message) {
-  const base = { jsonrpc: "2.0", id: message.id };
-  if (message.method === "initialize")
-    return {
-      ...base,
-      result: {
-        protocolVersion: message.params?.protocolVersion ?? "2025-06-18",
-        capabilities: { tools: { listChanged: false } },
-        serverInfo: { name: definition.id, version: definition.version ?? "0.1.0" },
-        instructions: definition.instructions,
-      },
-    };
-  if (message.method === "ping") return { ...base, result: {} };
-  if (message.method === "tools/list")
-    return {
-      ...base,
-      result: {
-        tools: definition.tools.map((tool) => ({
-          name: tool.name,
-          description: tool.description,
-          inputSchema: tool.inputSchema,
-          annotations: {
-            readOnlyHint: tool.access === "read",
-            destructiveHint: tool.access === "destructive",
-          },
-        })),
-      },
-    };
-  if (message.method === "tools/call") {
-    const result = await callTool(
-      definition,
-      message.params?.name,
-      message.params?.arguments ?? {},
-    );
-    return {
-      ...base,
-      result: { content: [{ type: "text", text: JSON.stringify(result, null, 2) }] },
-    };
-  }
-  return { ...base, error: { code: -32601, message: "Method not found" } };
-}
-
-function validateDefinition(definition) {
-  if (
-    !definition?.id ||
-    !definition?.baseUrl ||
-    !Array.isArray(definition.allowedHosts) ||
-    !Array.isArray(definition.tools)
-  )
-    throw new Error("Invalid MCP definition");
-  for (const tool of definition.tools) {
-    if (
-      !tool.name ||
-      !["GET", "POST", "PUT", "PATCH", "DELETE"].includes(tool.method) ||
-      !["read", "write", "destructive"].includes(tool.access) ||
-      !tool.path.startsWith("/")
-    )
-      throw new Error(`Invalid tool definition: ${tool.name ?? "unknown"}`);
-  }
-}
-function validateInput(schema, input) {
-  if (
-    schema?.type !== "object" ||
-    typeof input !== "object" ||
-    input === null ||
-    Array.isArray(input)
-  )
-    throw new Error("Tool input must be an object");
-  if (schema.additionalProperties === false)
-    for (const key of Object.keys(input))
-      if (!schema.properties?.[key]) throw new Error(`Unknown input property: ${key}`);
-  for (const key of schema.required ?? [])
-    if (input[key] === undefined) throw new Error(`Missing required input: ${key}`);
-  for (const [key, value] of Object.entries(input)) {
-    const property = schema.properties?.[key];
-    if (!property) continue;
-    if (property.type === "string" && typeof value !== "string")
-      throw new Error(`Invalid string input: ${key}`);
-    if (property.type === "integer" && !Number.isInteger(value))
-      throw new Error(`Invalid integer input: ${key}`);
-    if (property.type === "number" && typeof value !== "number")
-      throw new Error(`Invalid number input: ${key}`);
-    if (property.type === "boolean" && typeof value !== "boolean")
-      throw new Error(`Invalid boolean input: ${key}`);
-    if (typeof value === "number" && property.minimum !== undefined && value < property.minimum)
-      throw new Error(`Input below minimum: ${key}`);
-    if (typeof value === "number" && property.maximum !== undefined && value > property.maximum)
-      throw new Error(`Input above maximum: ${key}`);
-    if (
-      typeof value === "string" &&
-      property.maxLength !== undefined &&
-      value.length > property.maxLength
-    )
-      throw new Error(`Input too long: ${key}`);
-  }
-}
-function interpolate(path, input) {
-  return path.replace(/\{([^}]+)\}/g, (_, key) => {
-    if (input[key] === undefined) throw new Error(`Missing path input: ${key}`);
-    return encodeURIComponent(String(input[key]));
-  });
-}
-function authHeaders(auth) {
-  const headers = {};
-  for (const item of auth?.headers ?? []) {
-    const value = process.env[item.env];
-    if (!value) throw new Error(`Missing environment variable: ${item.env}`);
-    headers[item.name] = `${item.prefix ?? ""}${value}`;
-  }
-  return headers;
-}
-function parseResponse(text) {
-  try {
-    return JSON.parse(text);
-  } catch {
-    return text;
-  }
-}
-function safeError(error) {
-  return error instanceof Error
-    ? error.message.replace(/(bearer|token|key)\s+[^\s]+/gi, "$1 [REDACTED]")
-    : "Unknown error";
-}
-function write(message) {
-  process.stdout.write(`${JSON.stringify(message)}\n`);
-}