harness-mcp-v2 3.2.19 → 3.2.21

package/build/registry/toolsets/chaos.js

@@ -1,17 +1,17 @@
 import { randomUUID } from "node:crypto";
 import YAML from "yaml";
-import { passthrough, ngExtract, chaosPageExtract, chaosHeatmapExtract, chaosScannedRiskGetExtract, chaosExperimentListExtract, chaosInputSetListExtract, chaosAppMapPageExtract, chaosProbeListExtract, chaosInfraListExtract, chaosK8sInfraListExtract, chaosLoadTestListExtract, chaosLoadTestExtract, chaosHubListExtract, chaosDRTestListExtract, sdPageExtract, chaosRunTimeInputsExtract, chaosActionExtract, } from "../extractors.js";
+import { passthrough, ngExtract, chaosPageExtract, chaosHeatmapExtract, chaosScannedRiskGetExtract, chaosExperimentListExtract, chaosInputSetListExtract, chaosAppMapPageExtract, chaosProbeListExtract, chaosInfraListExtract, chaosK8sInfraListExtract, chaosLoadTestListExtract, chaosLoadTestExtract, chaosServiceListExtract, chaosHubListExtract, chaosDRTestListExtract, sdPageExtract, chaosRunTimeInputsExtract, chaosActionExtract, } from "../extractors.js";
 import { descToolsetChaos, 
 // Resource descriptions
-descChaosExperiment, descChaosExperimentRun, descChaosProbe, descChaosExperimentTemplate, descChaosExperimentVariable, descChaosInfrastructure, descChaosLoadtest, descChaosK8sInfrastructure, descChaosEnabledInfrastructure, descChaosHub, descChaosFault, descChaosFaultExperimentRun, descChaosFaultTemplate, descChaosProbeTemplate, descChaosActionTemplate, descChaosHubFault, descChaosEnvironment, descChaosApplicationMap, descDiscoveredNetworkMap, descChaosGuardCondition, descChaosGuardRule, descChaosRecommendation, descChaosRisk, descChaosAction, descChaosProbeInRun, descChaosDRTest, descChaosComponentVariable, 
+descChaosExperiment, descChaosExperimentRun, descChaosProbe, descChaosExperimentTemplate, descChaosExperimentVariable, descChaosInfrastructure, descChaosLoadtest, descChaosService, descChaosK8sInfrastructure, descChaosEnabledInfrastructure, descChaosHub, descChaosFault, descChaosFaultExperimentRun, descChaosFaultTemplate, descChaosProbeTemplate, descChaosActionTemplate, descChaosHubFault, descChaosEnvironment, descChaosApplicationMap, descDiscoveredNetworkMap, descChaosGuardCondition, descChaosGuardRule, descChaosRecommendation, descChaosRisk, descChaosAction, descChaosProbeInRun, descChaosDRTest, descChaosComponentVariable, 
 // Operation descriptions
-descListExperiments, descGetExperiment, descGetExperimentRun, descListProbes, descGetProbe, descCreateProbe, descListExperimentTemplates, descGetExperimentTemplate, descDeleteExperimentTemplate, descListExperimentVariables, descGetComponentVariable, descCreateExperiment, descListLinuxInfra, descListLoadtests, descGetLoadtest, descCreateLoadtest, descDeleteLoadtest, descListK8sInfra, descGetK8sInfra, descListChaosEnabledInfra, descListHubs, descGetHub, descCreateHub, descUpdateHub, descDeleteHub, descListFaults, descGetFault, descListFaultTemplates, descGetFaultTemplate, descDeleteFaultTemplate, descListProbeTemplates, descGetProbeTemplate, descDeleteProbeTemplate, descListActionTemplates, descGetActionTemplate, descDeleteActionTemplate, descListHubFaults, descListChaosEnvironments, descListApplicationMaps, descGetApplicationMap, descAppMapSearch, descAppMapEnvironmentId, descAppMapInfraId, descAppMapAll, descAppMapMinimal, descListDiscoveredNetworkMaps, descSDNetworkMapSearch, descListGuardConditions, descGetGuardCondition, descDeleteGuardCondition, descListGuardRules, descGetGuardRule, descDeleteGuardRule, descListRecommendations, descGetRecommendation, descListRisks, descGetRisk, descListDRTests, descDeleteProbe, descGetProbeManifest, descListProbesInRun, descGetFaultVariables, descGetFaultYaml, descListFaultExperimentRuns, descDeleteFault, descListActions, descGetAction, descGetActionManifest, descDeleteAction, descCreateAction, descBodyActionCreate, descActionName, descActionIdentityCreate, descActionEntityTypeCreate, descActionInfraTypeCreate, descActionPropertiesBody, descActionDurationShorthand, descActionDescriptionCreate, descActionTagsCreate, descActionVariablesBody, descActionRunPropertiesBody, descActionInputsBody, 
+descListExperiments, descGetExperiment, descGetExperimentRun, descListProbes, descGetProbe, descCreateProbe, descListExperimentTemplates, descGetExperimentTemplate, descDeleteExperimentTemplate, descListExperimentVariables, descGetComponentVariable, descCreateExperiment, descListLinuxInfra, descListLoadtests, descGetLoadtest, descCreateLoadtest, descUpdateLoadtest, descDeleteLoadtest, descListChaosServices, descGetChaosService, descDeleteChaosService, descCreateChaosService, descUpdateChaosService, descChaosServiceEnvironmentIds, descChaosServiceInfrastructureIds, descChaosServiceTags, descChaosServiceIncludeAllScope, descChaosServiceProbeIds, descChaosServiceOnboardingIdFilter, descListChaosServiceExperimentRuns, descListChaosServiceLoadTests, descChaosServiceSearch, descChaosServiceIdentity, descBodyChaosServiceCreate, descBodyChaosServiceUpdate, descChaosServiceName, descChaosServiceDescription, descChaosServiceTagsBody, descChaosServiceExternalServiceId, descChaosServiceAgentId, descChaosServiceEnvironmentId, descChaosServiceInfrastructureId, descChaosServiceInfrastructureType, descChaosServiceOnboardingId, descChaosServiceProbes, descChaosServiceProbesUpdate, descListK8sInfra, descGetK8sInfra, descCreateK8sInfra, descListChaosEnabledInfra, descBodyK8sInfraCreate, descK8sInfraIdentityCreate, descK8sInfraNameCreate, descK8sInfraEnvironmentIdCreate, descK8sInfraInfraIdCreate, descK8sInfraConnectorIdCreate, descK8sInfraNamespaceCreate, descK8sInfraServiceAccountCreate, descK8sInfraScopeCreate, descK8sInfraTypeCreate, descK8sInfraAiEnabledCreate, descListHubs, descGetHub, descCreateHub, descUpdateHub, descDeleteHub, descListFaults, descGetFault, descListFaultTemplates, descGetFaultTemplate, descDeleteFaultTemplate, descListProbeTemplates, descGetProbeTemplate, descDeleteProbeTemplate, descListActionTemplates, descGetActionTemplate, descDeleteActionTemplate, descListHubFaults, descListChaosEnvironments, descListApplicationMaps, descGetApplicationMap, descAppMapSearch, descAppMapEnvironmentId, descAppMapInfraId, descAppMapAll, descAppMapMinimal, descListDiscoveredNetworkMaps, descSDNetworkMapSearch, descListGuardConditions, descGetGuardCondition, descDeleteGuardCondition, descListGuardRules, descGetGuardRule, descDeleteGuardRule, descListRecommendations, descGetRecommendation, descListRisks, descGetRisk, descListDRTests, descDeleteProbe, descGetProbeManifest, descListProbesInRun, descGetFaultVariables, descGetFaultYaml, descListFaultExperimentRuns, descDeleteFault, descListActions, descGetAction, descGetActionManifest, descDeleteAction, descCreateAction, descBodyActionCreate, descActionName, descActionIdentityCreate, descActionEntityTypeCreate, descActionInfraTypeCreate, descActionPropertiesBody, descActionDurationShorthand, descActionDescriptionCreate, descActionTagsCreate, descActionVariablesBody, descActionRunPropertiesBody, descActionInputsBody, 
 // Action descriptions
 descRunExperiment, descStopExperiment, descDeleteExperiment, descEnableProbe, descVerifyProbe, descCreateFromTemplate, descListRevisions, descGetVariables, descGetYaml, descCompareRevisions, descRunLoadtest, descStopLoadtest, descCheckK8sHealth, descEnableGuardRule, descGetProbeTemplateVariables, descListActionTemplateRevisions, descGetActionTemplateVariables, descCompareActionTemplateRevisions, 
 // Body schema descriptions
 descBodyExperimentRun, descBodyNoBody, descBodyExperimentCreate, descBodyCreateFromTemplate, descBodyLoadtestDefinition, descBodyProbeEnable, descBodyProbeVerify, descBodyProbesInRun, descBodyProbeCreate, 
 // Field descriptions
-descInputsetIdentity, descRuntimeInputs, descHubIdentity, descInfraType, descExperimentName, descExperimentIdentity, descInfraRef, descExperimentId, descInfraStatus, descLoadtestName, descLoadtestType, descLoadtestIdentity, descLoadtestDescription, descLoadtestTags, descLoadtestEnvId, descLoadtestInfraId, descLoadtestTargetType, descLoadtestTargetUrl, descLoadtestScript, descLoadtestUsers, descLoadtestDurationSec, descLoadtestRampUpSec, descLoadtestWorkerCount, descLoadtestScriptSource, descLoadtestScriptImage, descLoadtestScriptEntrypoint, descLoadtestLoadArgs, descLoadtestHostUrl, descLoadtestRpsLimit, descLoadtestIterations, descLoadtestEnvVars, descHubIdentityExact, descHubName, descHubNameUpdate, descHubDescription, descHubDescriptionUpdate, descHubTags, descHubTagsReplace, descConnectorRef, descRepoName, descRepoBranch, descHubSearch, descIncludeAllScope, descTemplateSearch, descSortField, descSortAsc, descTags, descInfrastructure, descTemplateIdentity, descRevision, descRevision1, descRevision2, descRevisionToCompare, descFaultType, descFaultCategory, descFaultPermissions, descFaultIsEnterprise, descImportType, descExperimentDescription, descExperimentTags, descEntityTypeProbe, descEntityTypeAction, descEntityTypeFault, descPermissionsRequiredEnum, descOnlyTemplatisedFaults, descEnvironmentId, descK8sInfraStatus, descIncludeLegacyInfra, descSearchK8sInfra, descChaosEnabledInfraType, descInfraScope, descInfraAiEnabled, descSearchTermEnv, descSortEnv, descEnvironmentType, descGuardSearch, descGuardInfraType, descGuardTags, descGuardEnabled, descExperimentRunIdStop, descNotifyId, descForce, descIsEnabledFlag, descIsBulkUpdate, descVerifyFlag, descExperimentRunIds, descNotifyIds, descFaultIdentityParam, descIsEnterpriseFilter, descFaultSearch, descFaultListType, descFaultListInfraType, descFaultListInfrastructure, descFaultListTags, descFaultListCategory, descFaultListSortField, descFaultListSortAscending, descIsEnterpriseYaml, descIsEnterpriseVars, descIsEnterpriseRuns, descActionIdentityParam, descSearchActionsParam, descHubIdentityActions, descExperimentVariablesParam, descTasksParam, descEnvironmentIdCreate, descInfraIdCreate, descAccountIdBody, descOrgIdBody, descProjectIdBody, descSearchExperiments, descExperimentInfraId, descExperimentEnvironmentId, descExperimentIds, descExperimentStartDate, descExperimentEndDate, descExperimentTargetNetworkMapIds, descExperimentMyExperiments, descExperimentExcludeAutomation, descSearchProbes, descProbeIds, descProbeSortField, descProbeIdField, descProbeNameField, descProbePropertiesField, descRunPropertiesField, descDRTestSort, descCreateDRTest, descBodyDRTestCreate, descDRTestName, descDRTestIdentifier, descDRTestDescription, descDRTestObjective, descDRTestTags, 
+descInputsetIdentity, descRuntimeInputs, descHubIdentity, descInfraType, descExperimentName, descExperimentIdentity, descInfraRef, descExperimentId, descInfraStatus, descLoadtestName, descLoadtestType, descLoadtestIdentity, descLoadtestDescription, descLoadtestTags, descLoadtestEnvId, descLoadtestInfraId, descLoadtestTargetType, descLoadtestTargetUrl, descLoadtestScript, descLoadtestUsers, descLoadtestDurationSec, descLoadtestRampUpSec, descLoadtestWorkerCount, descLoadtestScriptSource, descLoadtestScriptImage, descLoadtestScriptEntrypoint, descLoadtestLoadArgs, descLoadtestImagePullSecret, descLoadtestHostUrl, descLoadtestRpsLimit, descLoadtestIterations, descLoadtestEnvVars, descLoadtestProperties, descLoadtestThresholds, descLoadtestCleanupPolicy, descLoadtestResources, descHubIdentityExact, descHubName, descHubNameUpdate, descHubDescription, descHubDescriptionUpdate, descHubTags, descHubTagsReplace, descConnectorRef, descRepoName, descRepoBranch, descHubSearch, descIncludeAllScope, descTemplateSearch, descSortField, descSortAsc, descTags, descInfrastructure, descTemplateIdentity, descRevision, descRevision1, descRevision2, descRevisionToCompare, descFaultType, descFaultCategory, descFaultPermissions, descFaultIsEnterprise, descImportType, descExperimentDescription, descExperimentTags, descEntityTypeProbe, descEntityTypeAction, descEntityTypeFault, descPermissionsRequiredEnum, descOnlyTemplatisedFaults, descEnvironmentId, descK8sInfraStatus, descIncludeLegacyInfra, descSearchK8sInfra, descChaosEnabledInfraType, descInfraScope, descInfraAiEnabled, descSearchTermEnv, descSortEnv, descEnvironmentType, descGuardSearch, descGuardInfraType, descGuardTags, descGuardEnabled, descExperimentRunIdStop, descNotifyId, descForce, descIsEnabledFlag, descIsBulkUpdate, descVerifyFlag, descExperimentRunIds, descNotifyIds, descFaultIdentityParam, descIsEnterpriseFilter, descFaultSearch, descFaultListType, descFaultListInfraType, descFaultListInfrastructure, descFaultListTags, descFaultListCategory, descFaultListSortField, descFaultListSortAscending, descIsEnterpriseYaml, descIsEnterpriseVars, descIsEnterpriseRuns, descActionIdentityParam, descSearchActionsParam, descHubIdentityActions, descExperimentVariablesParam, descTasksParam, descEnvironmentIdCreate, descInfraIdCreate, descAccountIdBody, descOrgIdBody, descProjectIdBody, descSearchExperiments, descExperimentInfraId, descExperimentEnvironmentId, descExperimentIds, descExperimentStartDate, descExperimentEndDate, descExperimentTargetNetworkMapIds, descExperimentMyExperiments, descExperimentExcludeAutomation, descSearchProbes, descProbeIds, descProbeSortField, descProbeIdField, descProbeNameField, descProbePropertiesField, descRunPropertiesField, descDRTestSort, descCreateDRTest, descBodyDRTestCreate, descDRTestName, descDRTestIdentifier, descDRTestDescription, descDRTestObjective, descDRTestTags, 
 // Input set descriptions
 descChaosInputSet, descListInputSets, descGetInputSet, descCreateInputSet, descUpdateInputSet, descDeleteInputSet, descInputSetIdentityField, descInputSetName, descInputSetDescription, descInputSetSpec, descIsIdentity, 
 // Component variable descriptions
@@ -19,7 +19,7 @@ descComponentType, descComponentIdentifier, descComponentHubReference,
 // Experiment create field descriptions
 descExperimentManifest, descExperimentInfraType, descExperimentInfraIdCreate, descExperimentCronSyntax, descExperimentIdUUID, 
 // Service Discovery
-descSDAgentIdentity, descSDEnvironmentId, descSDFetchAll, descSDAgentDiagnostic, descDiscoveredNamespace, descListDiscoveredNamespaces, descSDNamespaceNameFilter, descDiscoveredService, descListDiscoveredServices, descSDNamespaceFilter, descSDSearchFilter, 
+descSDAgentIdentity, descSDEnvironmentId, descSDAgentListEnvironmentId, descSDFetchAll, descSDAgentDiagnostic, descDiscoveredAgent, descListDiscoveredAgents, descDiscoveredAgentSearch, descDiscoveredNamespace, descListDiscoveredNamespaces, descSDNamespaceNameFilter, descDiscoveredService, descListDiscoveredServices, descSDNamespaceFilter, descSDSearchFilter, 
 // Scanned Risks / Risk Rules / Risk Scans (chaos-manager v3)
 descScannedRisk, descChaosRiskRule, descChaosRiskScan, descListScannedRisks, descGetScannedRisk, descListScannedRiskOccurrences, descSummarizeScannedRisksByService, descListRiskRules, descGetRiskRule, descListRiskScans, descGetRiskScan, descCreateRiskScan, descUpdateRiskScan, descDeleteRiskScan, descRetryRiskScan, descAbortRiskScan, descGetRiskScanReport, descGetRiskScanReportDownload, descGetRiskScanHeatmap, descBodyRiskScanCreate, descBodyRiskScanUpdate, descRiskScanIdentity, descRiskScanName, descRiskScanDescription, descRiskScanTags, descRiskScanType, descRiskScanSource, descScannedRiskSeverity, descScannedRiskRuleId, descScannedRiskValidationType, descScannedRiskServiceIdentity, descScannedRiskScanType, descRiskEnvironmentIdentity, descRiskAgentIdentity, descRiskPipelineIdentity, descRiskScanStatus, descRiskSearch, descRiskSortField, descRiskSortAscending, descRiskTags, descRiskIncludeAllScope, descRiskStartTime, descRiskEndTime, descRiskRuleDataSource, descRiskRuleIsSystem, descHeatmapSearch, } from "./chaos-descriptions.js";
 /**
@@ -44,6 +44,39 @@ const chaosComponentVarExtract = (raw) => {
     const r = raw;
     return r.items?.[0] ?? raw;
 };
+/** Compact projection for chaos_loadtest list items — keeps cheap discriminator
+ * scalars (toolType/targetType/scriptSource/infraType/cleanupPolicy) that the
+ * generic compactItems() whitelist in utils/compact.ts would otherwise drop
+ * (it only matches the literal key "type", not "toolType"/"targetType"), while
+ * still excluding heavy fields (toolConfig, yaml, variables, envVars, recentRuns). */
+function compactLoadTest(item) {
+    const slim = {};
+    for (const key of [
+        "loadtestId", "uniqueId", "identity", "name", "description", "tags",
+        "environmentIdentifier", "infraIdentifier", "infraType", "targetType",
+        "toolType", "scriptSource", "cleanupPolicy", "latestRevisionIdentifier",
+        "createdAt", "updatedAt", "openInHarness",
+    ]) {
+        if (item[key] !== undefined)
+            slim[key] = item[key];
+    }
+    return slim;
+}
+/** Compact projection for discovered_agent list items — keeps serviceCount/
+ * networkMapCount (STEP 1 of chaos_service create shows these) which the
+ * generic compactItems() whitelist in utils/compact.ts would otherwise drop. */
+function compactDiscoveredAgent(item) {
+    const slim = {};
+    for (const key of [
+        "identity", "name", "description", "tags", "environmentIdentifier",
+        "serviceCount", "networkMapCount", "installationType",
+        "createdAt", "updatedAt", "openInHarness",
+    ]) {
+        if (item[key] !== undefined)
+            slim[key] = item[key];
+    }
+    return slim;
+}
 /**
  * Parse input.body when LLMs double-serialize it as a JSON string instead of an object.
  * Fails loudly on malformed JSON so callers' defaults can never silently produce a
@@ -62,56 +95,19 @@ function coerceBody(input) {
     }
     return raw;
 }
-/**
- * Map ergonomic snake_case scalars to the canonical TemplateInput[] array the
- * load-test backend expects. Only emits entries for values the caller provided
- * (plus the three always-present run params and the K8s-only workerCount).
- */
-function buildLoadtestInputs(b, opts) {
-    const inputs = [];
-    // Run params: always emitted (backend treats targetUsers as required).
-    const users = b.users != null ? b.users : 100;
-    const duration = b.duration_sec != null ? b.duration_sec : 600;
-    const rampUp = b.ramp_up_sec != null ? b.ramp_up_sec : 120;
-    inputs.push({ name: "targetUsers", value: users, type: "Integer", required: true });
-    inputs.push({ name: "durationSeconds", value: duration, type: "Integer" });
-    inputs.push({ name: "rampUpTimeSec", value: rampUp, type: "Integer" });
-    // workerCount is Kubernetes-only (0 = standalone, N > 0 = distributed).
-    if (opts.targetType === "kubernetes") {
-        const workerCount = b.worker_count != null ? b.worker_count : 0;
-        inputs.push({ name: "workerCount", value: workerCount, type: "Integer" });
-    }
-    // Target URL: present on every load test (backend treats it as the host under test).
-    const targetUrl = (b.target_url ?? b.targetUrl);
-    if (targetUrl != null) {
-        inputs.push({ name: "targetUrl", value: targetUrl, type: "String" });
-    }
-    // Image-mode tunables (Custom Image): scriptImage/scriptEntrypoint are
-    // mandatory in image mode (marked required), loadArgs is optional.
-    if (opts.scriptSource === "image") {
-        const scriptImage = (b.script_image ?? b.scriptImage);
-        if (scriptImage != null) {
-            inputs.push({ name: "scriptImage", value: scriptImage, type: "String", required: true });
-        }
-        const entrypoint = (b.script_entrypoint ?? b.scriptEntrypoint);
-        if (entrypoint != null) {
-            inputs.push({ name: "scriptEntrypoint", value: entrypoint, type: "String", required: true });
-        }
-        const loadArgs = (b.load_args ?? b.loadArgs);
-        if (loadArgs != null) {
-            inputs.push({ name: "loadArgs", value: loadArgs, type: "String" });
-        }
-    }
-    return inputs;
-}
-// ── K6-specific helpers ──────────────────────────────────────────────
-// K6 is a Kubernetes-only load test runner. Script mode wraps the K6 JS source
-// in a `toolConfig` object (rather than top-level `scriptContent` like Locust).
-// Env vars and secret references live exclusively in `toolConfig.envVars`.
-// Reserved K6 env-var names (case-insensitive). Mirrors
-// loadTestManager/internal/domain/ReservedEnvVarNames; the frontend list is at
+// ── Load test helpers ────────────────────────────────────────────────
+// Since the loadTestManager variables migration, all tunables and custom env
+// vars live under toolConfig.<tool>.tunables / toolConfig.<tool>.variables. The
+// MCP keeps its LLM surface as ergonomic snake_case scalars and translates
+// them into the nested toolConfig shape here, so agents never construct the
+// nested map, base64, or YAML themselves.
+// ── Shared env-var helper (K6 + JMeter) ──────────────────────────────
+// Env vars and secret references live in `toolConfig.<tool>.envVars`.
+// Reserved env-var names (case-insensitive). Mirrors
+// loadTestManager/internal/domain/ReservedEnvVarNames (shared base set, all
+// tools) + K6ReservedEnvVarNames (K6-only extras). The frontend list is at
 // hce-saas/web/src/services/loadTest/loadTestVariables.ts:337-372.
-const RESERVED_K6_ENV_VAR_NAMES = new Set([
+const BASE_RESERVED_ENV_VAR_NAMES = new Set([
     "RUN_ID", "LOAD_TEST_ID", "TARGET_USERS", "SPAWN_RATE", "SCRIPT_CONTENT_BASE64",
     "TARGET_URL", "ACCOUNT_ID", "ORG_ID", "PROJECT_ID", "ENV_ID", "DURATION_SECONDS",
     "CONTROL_PLANE_URL", "CONTROL_PLANE_TOKEN", "HARNESS_CUSTOM_VAR_NAMES",
@@ -119,18 +115,21 @@ const RESERVED_K6_ENV_VAR_NAMES = new Set([
     "PYTHONPATH", "PATH", "HOME", "USER", "SHELL", "LANG", "TERM", "HOSTNAME",
     "PWD", "LD_LIBRARY_PATH", "LD_PRELOAD", "TMPDIR", "TMP", "TEMP",
 ]);
-const K6_ENV_VAR_KEY_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
+const K6_EXTRA_RESERVED_ENV_VAR_NAMES = new Set([
+    "HOST_URL", "K6_VUS", "K6_DURATION", "K6_ITERATIONS", "K6_STAGES", "K6_RPS",
+]);
+const ENV_VAR_KEY_REGEX = /^[A-Za-z_][A-Za-z0-9_]*$/;
 // Build the HSM secret reference: account → "account.<id>", org → "org.<id>", project → "<id>".
 // Matches the Harness UI convention (scope prefix encodes which secret manager the value lives in).
 function buildSecretReference(secretId, scope) {
     const prefix = scope === "account" ? "account." : scope === "org" ? "org." : "";
     return `secrets.getValue("${prefix}${secretId}")`;
 }
-// Validate + project the structured env_vars input into the wire shape K6 expects.
+// Validate + project the structured env_vars input into the wire shape K6/JMeter expect.
 // Each entry sets exactly one of:
 //   - { key, value }                              → literal env var
 //   - { key, secret_id, secret_scope?: "..." }    → MCP builds the secrets.getValue(...) string
-function buildK6EnvVars(raw) {
+function buildEnvVars(raw, tool) {
     if (raw == null)
         return [];
     if (!Array.isArray(raw)) {
@@ -143,10 +142,11 @@ function buildK6EnvVars(raw) {
         if (!key || typeof key !== "string") {
             throw new Error(`env_vars[${idx}].key is required.`);
         }
-        if (!K6_ENV_VAR_KEY_REGEX.test(key)) {
+        if (!ENV_VAR_KEY_REGEX.test(key)) {
             throw new Error(`env_vars[${idx}].key '${key}' is invalid: must match /^[A-Za-z_][A-Za-z0-9_]*$/.`);
         }
-        if (RESERVED_K6_ENV_VAR_NAMES.has(key.toUpperCase())) {
+        const upper = key.toUpperCase();
+        if (BASE_RESERVED_ENV_VAR_NAMES.has(upper) || (tool === "K6" && K6_EXTRA_RESERVED_ENV_VAR_NAMES.has(upper))) {
             throw new Error(`env_vars[${idx}].key '${key}' is a reserved name and cannot be used as a custom env var.`);
         }
         if (seen.has(key)) {
@@ -181,108 +181,319 @@ function parseHostOrigin(rawUrl) {
         return rawUrl;
     }
 }
-// Build the K6 `toolConfig` object for script or image mode (UI mode is deferred).
-// Script mode: enforces the mandatory `export default function` rule client-side so the
-// agent gets a clear error before the API trip. Image mode: wires the prebuilt container
-// image (+ optional entrypoint) into customImage. hostUrl / options / envVars are shared.
+// Build the K6 `toolConfig.k6` block for script or image mode (UI mode deferred).
+// Matches K6Spec + ScriptSpec in loadTestManager: mode +
+// script{content|image|entrypoint|loadArgs|imagePullSecret} +
+// tunables{targetUrl, targetUsers, durationSeconds, rampUpTimeSec, workerCount, hostUrl,
+// iterations, rpsLimit} + envVars.
 function buildK6ToolConfig(b, args) {
     const hostUrl = b.host_url ??
         b.hostUrl ??
         parseHostOrigin(args.targetUrl);
     const rpsLimit = b.rps_limit != null ? b.rps_limit : undefined;
-    const envVars = buildK6EnvVars(b.env_vars);
-    const options = {};
-    if (rpsLimit != null && rpsLimit > 0)
-        options.rpsLimit = rpsLimit;
-    // Build the mode-specific payload first; shared keys (hostUrl, options, envVars,
-    // iterations) are appended after so we get a stable key order matching the studio.
-    let toolConfig;
+    const iterations = b.iterations != null ? b.iterations : undefined;
+    const envVars = buildEnvVars(b.env_vars, "K6");
+    // Script/image artifact lives under `script`, not `scriptContent`/`customImage`.
+    let mode;
+    const script = {};
     if (args.scriptSource === "image") {
-        // Custom Image: image + optional entrypoint live in toolConfig.customImage.
-        // Note: load_args is NOT part of customImage for K6 — it rides only in inputs[]
-        // (matches K6LoadTestService.ts:487-495 where customImage only has image/entrypoint).
         const scriptImage = (b.script_image ?? b.scriptImage);
         if (scriptImage == null) {
-            // Defensive — the early image-mode gate in bodyBuilder already throws this.
             throw new Error("K6 image mode requires 'script_image'.");
         }
-        const customImage = { image: scriptImage };
+        mode = "image";
+        script.image = scriptImage;
         const entrypoint = (b.script_entrypoint ?? b.scriptEntrypoint);
         if (entrypoint != null)
-            customImage.entrypoint = entrypoint;
-        toolConfig = { mode: "image", customImage };
+            script.entrypoint = entrypoint;
+        const loadArgs = (b.load_args ?? b.loadArgs);
+        if (loadArgs != null && loadArgs !== "") {
+            validateLoadArgs(loadArgs);
+            script.loadArgs = loadArgs;
+        }
+        const imagePullSecret = (b.image_pull_secret ?? b.imagePullSecret);
+        if (imagePullSecret != null && imagePullSecret !== "") {
+            script.imagePullSecret = imagePullSecret;
+        }
     }
     else {
-        // Script mode: base64 JS source. Mandatory client-side rule (matches Harness UI:
-        // validateScriptContent at K6LoadTestService.ts:767-774). Substring check (not
-        // full AST) matches the UI exactly.
         if (args.script == null) {
             throw new Error("K6 script mode requires 'script' (the raw JavaScript K6 source).");
         }
+        // Mandatory client-side rule (matches Harness UI validateScriptContent).
         if (!args.script.includes("export default")) {
             throw new Error("K6 script must export a default function (export default function ...).");
         }
-        toolConfig = {
-            mode: "script",
-            scriptContent: Buffer.from(args.script, "utf8").toString("base64"),
-        };
-        // iterations is K6 script-mode-only (matches K6LoadTestService.ts:483-484).
-        const iterations = b.iterations != null ? b.iterations : undefined;
-        if (iterations != null && iterations > 0)
-            toolConfig.iterations = iterations;
+        mode = "script";
+        script.content = Buffer.from(args.script, "utf8").toString("base64");
     }
+    // Tunables live under `tunables`, not flat on the toolConfig object.
+    const tunables = {};
+    if (args.targetUrl != null)
+        tunables.targetUrl = args.targetUrl;
+    if (b.users != null)
+        tunables.targetUsers = b.users;
+    if (b.duration_sec != null)
+        tunables.durationSeconds = b.duration_sec;
+    if (b.ramp_up_sec != null)
+        tunables.rampUpTimeSec = b.ramp_up_sec;
+    if (b.worker_count != null)
+        tunables.workerCount = b.worker_count;
     if (hostUrl)
-        toolConfig.hostUrl = hostUrl;
-    if (Object.keys(options).length > 0)
-        toolConfig.options = options;
+        tunables.hostUrl = hostUrl;
+    if (iterations != null && iterations > 0)
+        tunables.iterations = iterations;
+    // rpsLimit's sole authoring surface is tunables (loadTestManager k6.go);
+    // options.rpsLimit is a legacy run-dispatch fallback only, never written here.
+    if (rpsLimit != null && rpsLimit > 0)
+        tunables.rpsLimit = rpsLimit;
+    const toolConfig = { mode, script };
+    if (Object.keys(tunables).length > 0)
+        toolConfig.tunables = tunables;
     if (envVars.length > 0)
         toolConfig.envVars = envVars;
     return toolConfig;
 }
+// Reject known legacy/mistaken field names on chaos_loadtest create/update instead
+// of silently ignoring them (Fail Loudly — see coerceBody above). 'scriptContent' /
+// 'customImage' are old wire-shape names superseded by 'script' / 'script_image';
+// 'inputs' belongs to chaos_probe, not chaos_loadtest.
+const LEGACY_LOADTEST_KEYS = ["scriptContent", "customImage", "inputs"];
+function rejectLegacyLoadtestFields(b) {
+    for (const key of LEGACY_LOADTEST_KEYS) {
+        if (b[key] !== undefined) {
+            throw new Error(`'${key}' is not a supported chaos_loadtest field. Use 'script'/'script_image' instead of 'scriptContent'/'customImage'; 'inputs' is a chaos_probe field, not chaos_loadtest.`);
+        }
+    }
+}
+const JMETER_THRESHOLD_METRICS = new Set(["response_time_ms", "error_rate_pct", "throughput_rps", "latency_ms"]);
+const JMETER_THRESHOLD_OPERATORS = new Set(["<", "<=", ">", ">=", "==", "!="]);
+const JMETER_STAT_REQUIRED_METRICS = new Set(["response_time_ms", "latency_ms"]);
+// Validate + project the structured properties input into toolConfig.jmeter.properties[].
+function buildJMeterProperties(raw) {
+    if (raw == null)
+        return [];
+    if (!Array.isArray(raw)) {
+        throw new Error("properties must be an array of {key, value, send_to_engines?} entries.");
+    }
+    return raw.map((entry, idx) => {
+        const p = entry;
+        const key = p.key;
+        if (!key) {
+            throw new Error(`properties[${idx}].key is required.`);
+        }
+        const out = { key, value: String(p.value ?? "") };
+        if (typeof p.send_to_engines === "boolean")
+            out.sendToEngines = p.send_to_engines;
+        return out;
+    });
+}
+// Validate + project the structured thresholds input into toolConfig.jmeter.thresholds[].
+// Mirrors JMeterThreshold.validate() in loadTestManager/internal/domain/jmeter.go:245-256.
+function buildJMeterThresholds(raw) {
+    if (raw == null)
+        return [];
+    if (!Array.isArray(raw)) {
+        throw new Error("thresholds must be an array of {metric, stat?, operator, value, abort_on_fail?} entries.");
+    }
+    return raw.map((entry, idx) => {
+        const t = entry;
+        const metric = t.metric;
+        if (!metric || !JMETER_THRESHOLD_METRICS.has(metric)) {
+            throw new Error(`thresholds[${idx}].metric must be one of ${[...JMETER_THRESHOLD_METRICS].join(", ")}.`);
+        }
+        const operator = t.operator;
+        if (!operator || !JMETER_THRESHOLD_OPERATORS.has(operator)) {
+            throw new Error(`thresholds[${idx}].operator must be one of ${[...JMETER_THRESHOLD_OPERATORS].join(", ")}.`);
+        }
+        const stat = t.stat;
+        if (JMETER_STAT_REQUIRED_METRICS.has(metric) && !stat) {
+            throw new Error(`thresholds[${idx}]: metric '${metric}' requires 'stat' (e.g. p95, p99, avg, median, max).`);
+        }
+        if (t.value == null) {
+            throw new Error(`thresholds[${idx}].value is required.`);
+        }
+        const out = { metric, operator, value: t.value };
+        if (stat)
+            out.stat = stat;
+        if (typeof t.abort_on_fail === "boolean")
+            out.abortOnFail = t.abort_on_fail;
+        return out;
+    });
+}
+// Build the JMeter `toolConfig.jmeter` block for script or image mode.
+// Matches JMeterSpec in loadTestManager/internal/domain/jmeter.go: mode + script{content|image|entrypoint}
+// + tunables{workerCount} + properties[] + envVars[] + thresholds[].
+function buildJMeterToolConfig(b, args) {
+    let mode;
+    const script = {};
+    if (args.scriptSource === "image") {
+        const scriptImage = (b.script_image ?? b.scriptImage);
+        if (scriptImage == null) {
+            throw new Error("JMeter image mode requires 'script_image'.");
+        }
+        mode = "image";
+        script.image = scriptImage;
+        const entrypoint = (b.script_entrypoint ?? b.scriptEntrypoint);
+        if (entrypoint != null)
+            script.entrypoint = entrypoint;
+        const loadArgs = (b.load_args ?? b.loadArgs);
+        if (loadArgs != null && loadArgs !== "") {
+            validateLoadArgs(loadArgs);
+            script.loadArgs = loadArgs;
+        }
+        const imagePullSecret = (b.image_pull_secret ?? b.imagePullSecret);
+        if (imagePullSecret != null && imagePullSecret !== "") {
+            script.imagePullSecret = imagePullSecret;
+        }
+    }
+    else {
+        if (args.script == null) {
+            throw new Error("JMeter script mode requires 'script' (the raw .jmx/.xml plan text).");
+        }
+        mode = "script";
+        script.content = Buffer.from(args.script, "utf8").toString("base64");
+    }
+    const toolConfig = { mode, script };
+    if (b.worker_count != null)
+        toolConfig.tunables = { workerCount: b.worker_count };
+    const properties = buildJMeterProperties(b.properties);
+    if (properties.length > 0)
+        toolConfig.properties = properties;
+    const envVars = buildEnvVars(b.env_vars, "JMeter");
+    if (envVars.length > 0)
+        toolConfig.envVars = envVars;
+    const thresholds = buildJMeterThresholds(b.thresholds);
+    if (thresholds.length > 0)
+        toolConfig.thresholds = thresholds;
+    return toolConfig;
+}
+// Validate the Locust/K6/JMeter load_args string. Mirrors ValidateLoadArgs in
+// loadTestManager/internal/api/dto.go: semicolon-separated k=v pairs; keys
+// must be non-empty, contain no whitespace, and not start with '-'.
+function validateLoadArgs(loadArgs) {
+    for (const raw of loadArgs.split(";")) {
+        const pair = raw.trim();
+        if (!pair)
+            continue;
+        const eq = pair.indexOf("=");
+        const key = (eq >= 0 ? pair.slice(0, eq) : pair).trim();
+        if (!key)
+            throw new Error(`load_args: empty key in pair ${JSON.stringify(pair)}`);
+        if (/[ \t]/.test(key)) {
+            throw new Error(`load_args: key ${JSON.stringify(key)} must not contain spaces`);
+        }
+        if (key.startsWith("-")) {
+            throw new Error(`load_args: key ${JSON.stringify(key)} must not start with '-'`);
+        }
+    }
+}
+// Build the Locust `toolConfig.locust` block for script or image mode. Matches
+// LocustSpec + ScriptSpec in loadTestManager: mode +
+// script{content|image|entrypoint|loadArgs|imagePullSecret} +
+// tunables{targetUrl, targetUsers, spawnRate, rampUpTimeSec, durationSeconds, workerCount}.
+// NOTE: Locust intentionally has no target_type guard (unlike K6/JMeter) —
+// loadTestManager supports Locust script AND image mode on both Linux VM and
+// Kubernetes infra (loadtest_handlers.go has no Locust kubernetes-only check).
+// Do not add one here.
+function buildLocustToolConfig(b, args) {
+    let mode;
+    const script = {};
+    if (args.scriptSource === "image") {
+        const scriptImage = (b.script_image ?? b.scriptImage);
+        if (scriptImage == null) {
+            throw new Error("Locust image mode requires 'script_image'.");
+        }
+        mode = "image";
+        script.image = scriptImage;
+        const entrypoint = (b.script_entrypoint ?? b.scriptEntrypoint);
+        if (entrypoint != null)
+            script.entrypoint = entrypoint;
+        const loadArgs = (b.load_args ?? b.loadArgs);
+        if (loadArgs != null && loadArgs !== "") {
+            validateLoadArgs(loadArgs);
+            script.loadArgs = loadArgs;
+        }
+        const imagePullSecret = (b.image_pull_secret ?? b.imagePullSecret);
+        if (imagePullSecret != null && imagePullSecret !== "") {
+            script.imagePullSecret = imagePullSecret;
+        }
+    }
+    else {
+        if (args.script == null) {
+            throw new Error("Locust script mode requires 'script' (the raw Python locustfile).");
+        }
+        mode = "script";
+        script.content = Buffer.from(args.script, "utf8").toString("base64");
+    }
+    const tunables = {};
+    if (args.targetUrl != null)
+        tunables.targetUrl = args.targetUrl;
+    if (b.users != null)
+        tunables.targetUsers = b.users;
+    if (b.spawn_rate != null)
+        tunables.spawnRate = b.spawn_rate;
+    if (b.duration_sec != null)
+        tunables.durationSeconds = b.duration_sec;
+    if (b.ramp_up_sec != null)
+        tunables.rampUpTimeSec = b.ramp_up_sec;
+    if (b.worker_count != null)
+        tunables.workerCount = b.worker_count;
+    const toolConfig = { mode, script };
+    if (Object.keys(tunables).length > 0)
+        toolConfig.tunables = tunables;
+    return toolConfig;
+}
 /**
  * Build the canonical LoadTest YAML manifest. Mirrors the studio's
  * formDataToManifest shape (kind: LoadTest, apiVersion: v1alpha1, spec.{...}).
  *
- * scriptContent inside the YAML is PLAIN TEXT (so the manifest is human-
- * readable); only the JSON request body's top-level scriptContent is base64.
- * Caller base64-encodes the returned string into the `yaml` request field.
+ * The wire toolBlock carries base64 script.content; for readability the YAML
+ * view carries plain-text script.content instead. Caller base64-encodes the
+ * returned string into the `yaml` request field.
  */
 function buildLoadtestYamlManifest(args) {
     const infraType = args.targetType === "kubernetes" ? "kubernetes" : "linux";
+    const metadata = { name: args.name };
+    if (args.description)
+        metadata.description = args.description;
+    if (args.tags && args.tags.length)
+        metadata.tags = args.tags;
+    if (args.serviceReferences && args.serviceReferences.length) {
+        metadata.serviceReferences = args.serviceReferences;
+    }
     const manifest = {
         kind: "LoadTest",
         apiVersion: "v1alpha1",
-        name: args.name,
+        metadata,
     };
-    if (args.description)
-        manifest.description = args.description;
-    if (args.tags && args.tags.length)
-        manifest.tags = args.tags;
+    // In the YAML view we want plain-text script content for readability; the
+    // wire toolConfig carries it base64. Decode a copy for the manifest.
+    const yamlToolBlock = { ...args.toolBlock };
+    const s = yamlToolBlock.script;
+    if (s?.content && typeof s.content === "string") {
+        try {
+            yamlToolBlock.script = {
+                ...s,
+                content: Buffer.from(s.content, "base64").toString("utf8"),
+            };
+        }
+        catch {
+            // If the content isn't valid base64 for any reason, keep as-is.
+        }
+    }
     const spec = {
         identity: args.identity,
         toolType: args.toolType,
         infraType,
         targetType: args.targetType,
-        scriptSource: args.scriptSource,
+        cleanupPolicy: args.cleanupPolicy ?? "delete",
     };
-    // Locust inline only: readable scriptContent at the manifest root (plain text).
-    // K6 keeps the script inside spec.toolConfig instead.
-    if (args.toolType === "Locust" && args.scriptSource === "inline" && args.script) {
-        spec.scriptContent = args.script;
-    }
+    if (args.resources != null)
+        spec.resources = args.resources;
     spec.infraId = args.infraIdentifier;
     spec.envId = args.environmentIdentifier;
-    spec.inputs = args.inputs;
-    // K6: emit spec.toolConfig with PLAIN TEXT scriptContent (decode the base64 from
-    // the wire-shape toolConfig so the YAML view is human-readable). Other
-    // toolConfig keys (mode, hostUrl, options, envVars, iterations) pass through.
-    if (args.toolType === "K6" && args.k6ToolConfig) {
-        const tc = { ...args.k6ToolConfig };
-        if (typeof tc.scriptContent === "string" && args.script) {
-            tc.scriptContent = args.script; // plain text for YAML readability
-        }
-        spec.toolConfig = tc;
-    }
+    spec.toolConfig = { [args.toolType.toLowerCase()]: yamlToolBlock };
     manifest.spec = spec;
     return YAML.stringify(manifest);
 }
@@ -1516,7 +1727,34 @@ export const chaosToolset = {
             scope: "project",
             scopeParams: CHAOS_SCOPE,
             identifierFields: ["loadtest_id"],
+            compactItem: compactLoadTest,
             deepLinkTemplate: "/ng/account/{accountId}/module/chaos/orgs/{orgIdentifier}/projects/{projectIdentifier}/load-tests/{loadtestId}",
+            listFilterFields: [
+                { name: "environment_id", description: descEnvironmentId },
+                { name: "tool_type", description: descLoadtestType, enum: ["Locust", "K6", "JMeter"] },
+                { name: "tags", description: descLoadtestTags },
+                { name: "search", description: "Free-text search. NOTE: backend currently matches only the load test's display name (substring, case-insensitive) -- it does not match identity/slug and is not fuzzy or prefix-tolerant." },
+                { name: "sort_field", description: "Field to sort by (e.g. createdAt, updatedAt, name)." },
+                { name: "sort_ascending", description: "Sort ascending when true, descending when false.", type: "boolean" },
+            ],
+            diagnosticHint: "Load tests are looked up by their identity slug (e.g. 'mcplocustscript001'), not the uniqueId UUID. If you only have a uniqueId, call harness_list resource_type=chaos_loadtest (optionally with search_term) and use the matching item's 'identity'/'loadtestId' field instead.",
+            relatedResources: [
+                {
+                    resourceType: "chaos_infrastructure",
+                    relationship: "prerequisite",
+                    description: "Linux VM load-runner infrastructure. When the load test targets Linux VM (target_type='machine-chaos-linux', the default), its 'environmentID' supplies environment_id and its 'infraID' supplies infra_id. Only loadEnabled + ACTIVE infras are usable. In MCP, Linux VM supports tool_type Locust only -- K6 (a genuine backend restriction) and JMeter (an MCP/UI-parity restriction; the backend itself allows Linux JMeter) with a Linux target_type are rejected by MCP.",
+                },
+                {
+                    resourceType: "chaos_enabled_infrastructure",
+                    relationship: "prerequisite",
+                    description: "Kubernetes load-runner infrastructure. When the load test targets Kubernetes, filter this list by infra_type='KubernetesV2'; its 'environmentID' supplies environment_id and its 'infraID' supplies infra_id. Kubernetes infra supports tool_type Locust, K6, or JMeter. IMPORTANT: target_type MUST be explicitly set to 'kubernetes' -- it is not auto-derived from which infra list you picked from; omitting it defaults to Linux naming and dispatches wrong.",
+                },
+                {
+                    resourceType: "chaos_service",
+                    relationship: "prerequisite",
+                    description: "Resilience Testing Services attached to a load test. List with infrastructure_ids='<environment_id>/<infra_id>' to see services already onboarded on the chosen load-runner infra. A user may pick one or more identities from the list, OR onboard a brand-new service via chaos_service's create flow (see chaos_service.relatedResources for the discovered_agent/discovered_service chain) regardless of whether the list is empty -- creating a new service is a user-intent decision, not gated on list length. The chosen identity/identities are passed on the load test as service_references (required when the account has CHAOS_RISK_SERVICES_ENABLED on).",
+                },
+            ],
             operations: {
                 list: {
                     method: "GET",
@@ -1529,6 +1767,10 @@ export const chaosToolset = {
                         search: "search",
                         search_term: "search",
                         environment_id: "environmentIdentifier",
+                        tool_type: "toolType",
+                        tags: "tags",
+                        sort_field: "sortField",
+                        sort_ascending: "sortAscending",
                     },
                     responseExtractor: chaosLoadTestListExtract,
                     description: descListLoadtests,
@@ -1548,45 +1790,33 @@ export const chaosToolset = {
                     skipScopeBodyInjection: true,
                     bodyBuilder: (input) => {
                         const b = coerceBody(input);
+                        rejectLegacyLoadtestFields(b);
                         const name = b.name ?? "";
                         if (!name) {
                             throw new Error("name is required.");
                         }
                         // identity is the slug-constrained key; auto-derive from name when omitted.
-                        // The display name is permissive (any non-empty string) — only the identity
-                        // must be a slug. We strip non-alphanumerics from name as a sensible default;
-                        // a fully-blank slug falls back to a UUID so we never write an empty id.
                         const slug = (s) => s.replace(/[^a-zA-Z0-9]/g, "");
                         const identity = b.identity || slug(name) || randomUUID();
                         if (!/^[a-zA-Z0-9_]+$/.test(identity)) {
                             throw new Error(`Invalid identity '${identity}': only letters, numbers and underscores are allowed (derived from name when omitted).`);
                         }
+                        // Tool type: Locust (default), K6, or JMeter. Gatling/Custom are deprecated
+                        // and the backend now rejects them with a 400.
+                        const toolType = (b.tool_type ?? "Locust");
+                        if (toolType !== "Locust" && toolType !== "K6" && toolType !== "JMeter") {
+                            throw new Error(`tool_type '${toolType}' must be 'Locust', 'K6', or 'JMeter'.`);
+                        }
                         const targetType = b.target_type ?? "machine-chaos-linux";
+                        if ((toolType === "K6" || toolType === "JMeter") && targetType !== "kubernetes") {
+                            throw new Error(`${toolType} load tests require target_type='kubernetes'.`);
+                        }
                         const environmentIdentifier = (b.environment_id ?? b.environmentIdentifier);
                         const infraIdentifier = (b.infra_id ?? b.infraIdentifier);
                         const targetUrl = (b.target_url ?? b.targetUrl);
                         const script = b.script;
                         const scriptImage = (b.script_image ?? b.scriptImage);
-                        // Explicit script_source wins, else infer "image" when an image is supplied.
                         const scriptSource = b.script_source ?? (scriptImage != null ? "image" : "inline");
-                        // Mode-specific required fields (fail loudly before we touch the wire).
-                        // Tool-agnostic message: Locust = Python locust source, K6 = JavaScript with 'export default'.
-                        // The K6-specific 'export default' rule is enforced later in buildK6ToolConfig.
-                        if (scriptSource === "inline" && script == null) {
-                            throw new Error("script is required when script_source='inline'.");
-                        }
-                        if (scriptSource === "image" && scriptImage == null) {
-                            throw new Error("script_image is required when script_source='image'.");
-                        }
-                        // Tool type: Locust (default) or K6. K6 is Kubernetes-only and supports
-                        // script and image modes (UI mode is deferred).
-                        const toolType = (b.tool_type ?? "Locust");
-                        if (toolType !== "Locust" && toolType !== "K6") {
-                            throw new Error(`tool_type '${toolType}' must be 'Locust' or 'K6'.`);
-                        }
-                        if (toolType === "K6" && targetType !== "kubernetes") {
-                            throw new Error("K6 load tests require target_type='kubernetes' (LinuxVM is not supported).");
-                        }
                         // Normalise tags (accept array or comma-separated string; default []).
                         const rawTags = b.tags;
                         const tags = Array.isArray(rawTags)
@@ -1594,33 +1824,28 @@ export const chaosToolset = {
                             : typeof rawTags === "string"
                                 ? rawTags.split(",").map((t) => t.trim()).filter(Boolean)
                                 : [];
-                        // Build the canonical inputs[] array (well-known tunables → TemplateInput[]).
-                        // inputs[] is identical between Locust and K6 script/image modes.
-                        const inputs = buildLoadtestInputs(b, { targetType, scriptSource });
-                        // K6 wraps the script in a toolConfig object (no top-level scriptContent).
-                        // Built up-front so the same value drives both the JSON body and the YAML view.
-                        let k6ToolConfig;
+                        // Build toolConfig.<tool>. JMeter builds from scalars by default;
+                        // 'tool_config' remains an escape hatch for advanced/back-compat callers
+                        // (e.g. .zip bundles) who want to hand-construct the object.
+                        let toolBlock;
                         if (toolType === "K6") {
-                            k6ToolConfig = buildK6ToolConfig(b, { scriptSource, script, targetUrl });
+                            toolBlock = buildK6ToolConfig(b, { scriptSource, script, targetUrl });
+                        }
+                        else if (toolType === "Locust") {
+                            toolBlock = buildLocustToolConfig(b, { scriptSource, script, targetUrl });
+                        }
+                        else {
+                            const supplied = b.tool_config;
+                            toolBlock = supplied != null
+                                ? (supplied.jmeter ?? supplied)
+                                : buildJMeterToolConfig(b, { scriptSource, script });
+                        }
+                        const toolKey = toolType.toLowerCase();
+                        const toolConfig = { [toolKey]: toolBlock };
+                        // Variables live under toolConfig.<tool>.variables.
+                        if (Array.isArray(b.variables)) {
+                            toolBlock.variables = b.variables;
                         }
-                        // Build the canonical LoadTest YAML manifest, then base64-encode for the wire.
-                        // The manifest carries plain-text scriptContent (Locust inline) OR plain-text
-                        // toolConfig.scriptContent (K6), so the YAML view is human-readable; the JSON
-                        // body's base64 lives only on the wire.
-                        const yamlManifest = buildLoadtestYamlManifest({
-                            name,
-                            description: b.description,
-                            tags,
-                            identity,
-                            toolType,
-                            targetType,
-                            scriptSource,
-                            script,
-                            k6ToolConfig,
-                            environmentIdentifier: environmentIdentifier,
-                            infraIdentifier: infraIdentifier,
-                            inputs,
-                        });
                         const body = {
                             identity,
                             name,
@@ -1628,35 +1853,42 @@ export const chaosToolset = {
                             tags,
                             environmentIdentifier,
                             infraIdentifier,
-                            scriptSource,
                             targetType,
                             toolType,
-                            inputs,
-                            yaml: Buffer.from(yamlManifest, "utf8").toString("base64"),
+                            toolConfig,
                         };
-                        // Top-level scriptContent rules:
-                        //   - Locust inline: base64 of the raw Python script.
-                        //   - Locust image:  omitted (script_image rides in inputs[]).
-                        //   - K6 script:     OMITTED at top level — the K6 script lives in
-                        //                    toolConfig.scriptContent only (top-level would be
-                        //                    treated as a Locust-style script and double-encoded).
-                        //   - K6 image:      not yet supported (rejected earlier).
-                        if (toolType === "Locust" && scriptSource === "inline") {
-                            body.scriptContent = Buffer.from(script, "utf8").toString("base64");
-                        }
-                        if (toolType === "K6" && k6ToolConfig) {
-                            body.toolConfig = k6ToolConfig;
-                        }
-                        // Emit snake_case aliases for the registry's required-field validator (which
-                        // checks the built body against the snake_case bodySchema field names). The
-                        // load-test backend reads the camelCase / inputs[] keys and ignores extras
-                        // (same pattern as chaos_action create).
+                        // Optional pass-through fields.
+                        if (b.service_references != null)
+                            body.serviceReferences = b.service_references;
+                        if (b.cleanup_policy != null)
+                            body.cleanupPolicy = b.cleanup_policy;
+                        if (b.max_duration_sec != null)
+                            body.maxDurationSec = b.max_duration_sec;
+                        if (b.resources != null)
+                            body.resources = b.resources;
+                        // Optional canonical YAML manifest (backend accepts it as an alternative
+                        // source; MCP still sends toolConfig authoritatively).
+                        const yamlManifest = buildLoadtestYamlManifest({
+                            name,
+                            description: b.description,
+                            tags,
+                            serviceReferences: body.serviceReferences,
+                            identity,
+                            toolType,
+                            targetType,
+                            toolBlock,
+                            environmentIdentifier: environmentIdentifier,
+                            infraIdentifier: infraIdentifier,
+                            cleanupPolicy: body.cleanupPolicy,
+                            resources: body.resources,
+                        });
+                        body.yaml = Buffer.from(yamlManifest, "utf8").toString("base64");
+                        // Snake-case aliases for the registry's required-field validator (which
+                        // checks the built body against the snake_case bodySchema field names).
                         if (environmentIdentifier != null)
                             body.environment_id = environmentIdentifier;
                         if (infraIdentifier != null)
                             body.infra_id = infraIdentifier;
-                        if (targetUrl != null)
-                            body.target_url = targetUrl;
                         return body;
                     },
                     responseExtractor: chaosLoadTestExtract,
@@ -1667,18 +1899,158 @@ export const chaosToolset = {
                             { name: "name", type: "string", required: true, description: descLoadtestName },
                             { name: "environment_id", type: "string", required: true, description: descLoadtestEnvId },
                             { name: "infra_id", type: "string", required: true, description: descLoadtestInfraId },
-                            { name: "target_url", type: "string", required: true, description: descLoadtestTargetUrl },
-                            { name: "script", type: "string", required: false, description: descLoadtestScript },
+                            { name: "identity", type: "string", required: false, description: descLoadtestIdentity },
+                            { name: "description", type: "string", required: false, description: descLoadtestDescription },
+                            { name: "tags", type: "array", required: false, description: descLoadtestTags },
+                            { name: "target_type", type: "string", required: false, description: descLoadtestTargetType },
+                            { name: "tool_type", type: "string", required: false, description: descLoadtestType },
+                            { name: "target_url", type: "string", required: false, description: descLoadtestTargetUrl },
                             { name: "script_source", type: "string", required: false, description: descLoadtestScriptSource },
+                            { name: "script", type: "string", required: false, description: descLoadtestScript },
                             { name: "script_image", type: "string", required: false, description: descLoadtestScriptImage },
                             { name: "script_entrypoint", type: "string", required: false, description: descLoadtestScriptEntrypoint },
                             { name: "load_args", type: "string", required: false, description: descLoadtestLoadArgs },
-                            { name: "identity", type: "string", required: false, description: descLoadtestIdentity },
+                            { name: "image_pull_secret", type: "string", required: false, description: descLoadtestImagePullSecret },
+                            { name: "users", type: "number", required: false, description: descLoadtestUsers },
+                            { name: "spawn_rate", type: "number", required: false, description: "Locust spawn rate (users/sec)." },
+                            { name: "duration_sec", type: "number", required: false, description: descLoadtestDurationSec },
+                            { name: "ramp_up_sec", type: "number", required: false, description: descLoadtestRampUpSec },
+                            { name: "worker_count", type: "number", required: false, description: descLoadtestWorkerCount },
+                            { name: "host_url", type: "string", required: false, description: descLoadtestHostUrl },
+                            { name: "rps_limit", type: "number", required: false, description: descLoadtestRpsLimit },
+                            { name: "iterations", type: "number", required: false, description: descLoadtestIterations },
+                            { name: "env_vars", type: "array", required: false, description: descLoadtestEnvVars },
+                            { name: "properties", type: "array", required: false, description: descLoadtestProperties },
+                            { name: "thresholds", type: "array", required: false, description: descLoadtestThresholds },
+                            { name: "variables", type: "array", required: false, description: "Custom template.Variable entries stored under toolConfig.<tool>.variables." },
+                            { name: "tool_config", type: "object", required: false, description: "JMeter-only pass-through toolConfig.jmeter object -- escape hatch for advanced/back-compat use (e.g. .zip test-plan bundles). Ignored for K6/Locust on create (use the scalar fields for those); not required for JMeter either -- prefer script/script_image/properties/env_vars/thresholds/worker_count unless you need this override." },
+                            { name: "service_references", type: "array", required: false, description: "chaosService identity strings; required when CHAOS_RISK_SERVICES_ENABLED is on." },
+                            { name: "cleanup_policy", type: "string", required: false, description: descLoadtestCleanupPolicy },
+                            { name: "max_duration_sec", type: "number", required: false, description: "Per-load-test hard cap on any run." },
+                            { name: "resources", type: "object", required: false, description: descLoadtestResources },
+                        ],
+                    },
+                },
+                update: {
+                    method: "PUT",
+                    path: `${CHAOS_LOADTEST}/v1/load-tests/{loadtestId}`,
+                    operationPolicy: { risk: "low_write", retryPolicy: "do_not_retry" },
+                    pathParams: { loadtest_id: "loadtestId" },
+                    skipScopeBodyInjection: true,
+                    bodyBuilder: (input) => {
+                        const b = coerceBody(input);
+                        rejectLegacyLoadtestFields(b);
+                        const body = {};
+                        if (b.name != null)
+                            body.name = b.name;
+                        if (b.description != null)
+                            body.description = b.description;
+                        if (b.tags != null)
+                            body.tags = b.tags;
+                        if (b.service_references != null)
+                            body.serviceReferences = b.service_references;
+                        if (b.environment_id != null)
+                            body.environmentIdentifier = b.environment_id;
+                        if (b.infra_id != null)
+                            body.infraIdentifier = b.infra_id;
+                        if (b.target_type != null)
+                            body.targetType = b.target_type;
+                        if (b.max_duration_sec != null)
+                            body.maxDurationSec = b.max_duration_sec;
+                        if (b.cleanup_policy != null)
+                            body.cleanupPolicy = b.cleanup_policy;
+                        if (b.resources != null)
+                            body.resources = b.resources;
+                        // tool_type is never sent to the API (immutable after creation) --
+                        // used only internally to pick the right scalar builder / wrap key.
+                        const toolType = b.tool_type;
+                        const toolConfigEscapeHatch = b.tool_config;
+                        // Same scalar surface as create -- if any of these are present,
+                        // toolConfig.<tool> must be rebuilt wholesale (server does a full
+                        // overwrite; see UpdateLoadTestRequest.ToolConfig in loadTestManager).
+                        const SCALAR_TOOL_FIELDS = [
+                            "target_url", "script_source", "script", "script_image", "script_entrypoint",
+                            "load_args", "image_pull_secret", "users", "spawn_rate", "duration_sec",
+                            "ramp_up_sec", "worker_count", "host_url", "rps_limit", "iterations",
+                            "env_vars", "properties", "thresholds",
+                        ];
+                        const hasScalarToolField = SCALAR_TOOL_FIELDS.some((f) => b[f] != null);
+                        if (hasScalarToolField) {
+                            if (toolType == null) {
+                                throw new Error("tool_type is required to edit script/tunables/properties/thresholds/env_vars on update -- call harness_get first if you don't know the existing tool_type.");
+                            }
+                            if (toolType !== "Locust" && toolType !== "K6" && toolType !== "JMeter") {
+                                throw new Error(`tool_type '${toolType}' must be 'Locust', 'K6', or 'JMeter'.`);
+                            }
+                            const targetUrl = (b.target_url ?? b.targetUrl);
+                            const script = b.script;
+                            const scriptImage = (b.script_image ?? b.scriptImage);
+                            const scriptSource = b.script_source ?? (scriptImage != null ? "image" : "inline");
+                            let toolBlock;
+                            if (toolType === "K6") {
+                                toolBlock = buildK6ToolConfig(b, { scriptSource, script, targetUrl });
+                            }
+                            else if (toolType === "Locust") {
+                                toolBlock = buildLocustToolConfig(b, { scriptSource, script, targetUrl });
+                            }
+                            else {
+                                toolBlock = buildJMeterToolConfig(b, { scriptSource, script });
+                            }
+                            // Mirrors create: variables live under toolConfig.<tool>.variables,
+                            // which ReconcileToolConfigVariables prefers over the top-level
+                            // field -- do not also set body.variables to avoid two sources.
+                            if (Array.isArray(b.variables)) {
+                                toolBlock.variables = b.variables;
+                            }
+                            body.toolConfig = { [toolType.toLowerCase()]: toolBlock };
+                        }
+                        else if (toolConfigEscapeHatch != null) {
+                            if (toolType != null) {
+                                const toolKey = toolType.toLowerCase();
+                                const inner = toolConfigEscapeHatch[toolKey] ??
+                                    toolConfigEscapeHatch;
+                                body.toolConfig = { [toolKey]: inner };
+                            }
+                            else {
+                                // Back-compat: caller already sends the fully-wired { <tool>: {...} } shape.
+                                body.toolConfig = toolConfigEscapeHatch;
+                            }
+                            if (b.variables != null)
+                                body.variables = b.variables;
+                        }
+                        else if (b.variables != null) {
+                            // No toolConfig rebuild in this call -- variables-only update,
+                            // top-level field (server falls back to it when
+                            // toolConfig.<tool>.variables is empty).
+                            body.variables = b.variables;
+                        }
+                        return body;
+                    },
+                    responseExtractor: chaosLoadTestExtract,
+                    description: descUpdateLoadtest,
+                    bodySchema: {
+                        description: descUpdateLoadtest,
+                        fields: [
+                            { name: "name", type: "string", required: false, description: descLoadtestName },
                             { name: "description", type: "string", required: false, description: descLoadtestDescription },
                             { name: "tags", type: "array", required: false, description: descLoadtestTags },
+                            { name: "service_references", type: "array", required: false, description: "chaosService identity strings; a non-null slice must be non-empty." },
+                            { name: "environment_id", type: "string", required: false, description: descLoadtestEnvId },
+                            { name: "infra_id", type: "string", required: false, description: descLoadtestInfraId },
                             { name: "target_type", type: "string", required: false, description: descLoadtestTargetType },
+                            { name: "max_duration_sec", type: "number", required: false, description: "Per-load-test hard cap on any run." },
+                            { name: "cleanup_policy", type: "string", required: false, description: descLoadtestCleanupPolicy },
+                            { name: "resources", type: "object", required: false, description: descLoadtestResources },
                             { name: "tool_type", type: "string", required: false, description: descLoadtestType },
+                            { name: "target_url", type: "string", required: false, description: descLoadtestTargetUrl },
+                            { name: "script_source", type: "string", required: false, description: descLoadtestScriptSource },
+                            { name: "script", type: "string", required: false, description: descLoadtestScript },
+                            { name: "script_image", type: "string", required: false, description: descLoadtestScriptImage },
+                            { name: "script_entrypoint", type: "string", required: false, description: descLoadtestScriptEntrypoint },
+                            { name: "load_args", type: "string", required: false, description: descLoadtestLoadArgs },
+                            { name: "image_pull_secret", type: "string", required: false, description: descLoadtestImagePullSecret },
                             { name: "users", type: "number", required: false, description: descLoadtestUsers },
+                            { name: "spawn_rate", type: "number", required: false, description: "Locust spawn rate (users/sec)." },
                             { name: "duration_sec", type: "number", required: false, description: descLoadtestDurationSec },
                             { name: "ramp_up_sec", type: "number", required: false, description: descLoadtestRampUpSec },
                             { name: "worker_count", type: "number", required: false, description: descLoadtestWorkerCount },
@@ -1686,6 +2058,10 @@ export const chaosToolset = {
                             { name: "rps_limit", type: "number", required: false, description: descLoadtestRpsLimit },
                             { name: "iterations", type: "number", required: false, description: descLoadtestIterations },
                             { name: "env_vars", type: "array", required: false, description: descLoadtestEnvVars },
+                            { name: "properties", type: "array", required: false, description: descLoadtestProperties },
+                            { name: "thresholds", type: "array", required: false, description: descLoadtestThresholds },
+                            { name: "tool_config", type: "object", required: false, description: "Advanced escape hatch to hand-construct toolConfig.<tool> directly (e.g. JMeter .zip bundles) instead of the scalar fields above. Pass 'tool_type' alongside it so MCP wraps/unwraps it consistently with create; without 'tool_type' it is sent to the API exactly as given (must already be the full '{ <tool>: {...} }' wire shape). Full replacement of toolConfig.<tool> either way -- null/omit to keep existing." },
+                            { name: "variables", type: "array", required: false, description: "Full replacement variables list; null to keep existing. When also editing script/tunables via the scalar fields above, this is nested into toolConfig.<tool>.variables instead of sent top-level (mirrors create)." },
                         ],
                     },
                 },
@@ -1704,13 +2080,32 @@ export const chaosToolset = {
                     path: `${CHAOS_LOADTEST}/v1/load-tests/{loadtestId}/runs`,
                     operationPolicy: { risk: "high_write", retryPolicy: "do_not_retry" },
                     pathParams: { loadtest_id: "loadtestId" },
-                    // TODO(runtime-inputs): accept { values: TemplateInputMinimum[] } when runtime
-                    // inputs ('<+input>' sentinel) are added (see deferred follow-up plan). The empty
-                    // body is correct while runtime inputs are unsupported on the create side.
-                    bodyBuilder: () => ({}),
+                    // CreateLoadTestRunRequest.Identity is binding:"required" — send a UUID
+                    // when the caller doesn't supply one so ShouldBindJSON succeeds.
+                    bodyBuilder: (input) => {
+                        const b = coerceBody(input);
+                        const body = {
+                            identity: b.run_identity ?? randomUUID(),
+                        };
+                        if (b.run_name != null)
+                            body.name = b.run_name;
+                        if (b.values != null)
+                            body.values = b.values;
+                        if (b.runtime_values != null)
+                            body.runtimeValues = b.runtime_values;
+                        return body;
+                    },
                     responseExtractor: passthrough,
                     actionDescription: descRunLoadtest,
-                    bodySchema: { description: descBodyNoBody, fields: [] },
+                    bodySchema: {
+                        description: "Run parameters (all optional).",
+                        fields: [
+                            { name: "run_identity", type: "string", required: false, description: "Client-supplied identity for the run; a UUID is generated when omitted." },
+                            { name: "run_name", type: "string", required: false, description: "Optional display name for the run." },
+                            { name: "values", type: "array", required: false, description: "Runtime override values for load-test Variables (template.InputMinimum entries)." },
+                            { name: "runtime_values", type: "object", required: false, description: "Path-keyed runtime overrides for toolConfig '<+input>' leaves." },
+                        ],
+                    },
                 },
                 stop: {
                     method: "POST",
@@ -1724,6 +2119,259 @@ export const chaosToolset = {
                 },
             },
         },
+        // ── Chaos Service (Service Management) ────────────────────────────
+        // v3 REST endpoints under the chaos manager:
+        //   GET    /v3/chaos-services
+        //   GET    /v3/chaos-services/{identity}
+        //   POST   /v3/chaos-services
+        //   PUT    /v3/chaos-services/{identity}
+        //   DELETE /v3/chaos-services/{identity}
+        // List response envelope is
+        //   { data: [...], correlationID, pagination: { totalItems, ... } }
+        // (distinct from the load-test v1 envelope of { items, pagination }).
+        // Create and update return the full ChaosServiceResponse. Update is a
+        // full-replace on mutable fields plus desired-state reconcile of probes.
+        // Delete soft-deletes the service and purges its probe mappings, returning
+        //   { success, correlationID }.
+        {
+            resourceType: "chaos_service",
+            displayName: "Chaos Service",
+            description: descChaosService,
+            toolset: "chaos",
+            scope: "project",
+            scopeParams: CHAOS_SCOPE,
+            identifierFields: ["identity"],
+            deepLinkTemplate: "/ng/account/{accountId}/module/chaos/orgs/{orgIdentifier}/projects/{projectIdentifier}/risks/services/{identity}",
+            listFilterFields: [
+                { name: "environment_ids", description: descChaosServiceEnvironmentIds },
+                { name: "infrastructure_ids", description: descChaosServiceInfrastructureIds },
+                { name: "tags", description: descChaosServiceTags },
+                { name: "include_all_scope", description: descChaosServiceIncludeAllScope, type: "boolean" },
+                { name: "search", description: descChaosServiceSearch },
+                { name: "probe_ids", description: descChaosServiceProbeIds },
+                { name: "onboarding_id", description: descChaosServiceOnboardingIdFilter },
+            ],
+            relatedResources: [
+                { resourceType: "discovered_agent", relationship: "prerequisite", description: "STEP 1 of create: pick the Service Discovery agent. Its 'identity' becomes agent_id, its environmentIdentifier becomes environment_id, and (for SD K8s) its identity is also the bare infrastructure_id." },
+                { resourceType: "discovered_namespace", relationship: "filters", description: "Optional STEP 2a: list namespaces for the chosen agent to narrow the discovered_service list before picking a service." },
+                { resourceType: "discovered_service", relationship: "prerequisite", description: "STEP 2b of create: pick the service to onboard. Its 'id' becomes external_service_id (the server derives serviceType/namespace from it)." },
+                { resourceType: "chaos_probe", relationship: "associates", description: "STEP 4 of create: optional health-check probes to attach. Source probe identities and their inputs[] schema here; fill each input value before adding to the create body's probes array." },
+            ],
+            operations: {
+                list: {
+                    method: "GET",
+                    path: `${CHAOS}/v3/chaos-services`,
+                    operationPolicy: { risk: "read", retryPolicy: "safe" },
+                    queryParams: {
+                        page: "page",
+                        limit: "limit",
+                        size: "limit",
+                        search: "search",
+                        search_term: "search",
+                        environment_ids: "environmentIds",
+                        infrastructure_ids: "infrastructureIds",
+                        tags: "tags",
+                        include_all_scope: "includeAllScope",
+                        sort_field: "sortField",
+                        sort_ascending: "sortAscending",
+                        probe_ids: "probeIds",
+                        onboarding_id: "onboardingId",
+                    },
+                    responseExtractor: chaosServiceListExtract,
+                    description: descListChaosServices,
+                },
+                get: {
+                    method: "GET",
+                    path: `${CHAOS}/v3/chaos-services/{identity}`,
+                    operationPolicy: { risk: "read", retryPolicy: "safe" },
+                    pathParams: { identity: "identity" },
+                    responseExtractor: passthrough,
+                    description: descGetChaosService,
+                },
+                delete: {
+                    method: "DELETE",
+                    path: `${CHAOS}/v3/chaos-services/{identity}`,
+                    operationPolicy: { risk: "destructive", retryPolicy: "do_not_retry" },
+                    pathParams: { identity: "identity" },
+                    responseExtractor: passthrough,
+                    description: descDeleteChaosService,
+                },
+                create: {
+                    method: "POST",
+                    path: `${CHAOS}/v3/chaos-services`,
+                    operationPolicy: { risk: "medium_write", retryPolicy: "do_not_retry" },
+                    bodyBuilder: (input) => {
+                        const b = coerceBody(input);
+                        const externalServiceId = b.external_service_id ?? b.externalServiceId;
+                        const agentId = b.agent_id ?? b.agentId;
+                        const environmentId = b.environment_id ?? b.environmentId;
+                        const infrastructureId = b.infrastructure_id ?? b.infrastructureId;
+                        const infrastructureType = b.infrastructure_type ?? b.infrastructureType;
+                        const onboardingId = b.onboarding_id ?? b.onboardingId;
+                        const tags = b.tags;
+                        const probes = b.probes?.map((p) => ({
+                            probeId: p.probeId ?? p.probe_id,
+                            ...(p.inputs ? { inputs: p.inputs } : {}),
+                        }));
+                        return {
+                            identity: b.identity,
+                            name: b.name,
+                            ...(b.description ? { description: b.description } : {}),
+                            ...(tags
+                                ? {
+                                    tags: Array.isArray(tags)
+                                        ? tags
+                                        : String(tags)
+                                            .split(",")
+                                            .map((t) => t.trim())
+                                            .filter(Boolean),
+                                }
+                                : {}),
+                            externalServiceId,
+                            agentId,
+                            environmentId,
+                            infrastructureId,
+                            // Dual-write snake_case keys so registry required-field validation
+                            // (which checks bodySchema.fields names against this transformed
+                            // payload) sees the fields it expects. See getBodySchemaValidationPayload
+                            // in registry/index.ts.
+                            external_service_id: externalServiceId,
+                            agent_id: agentId,
+                            environment_id: environmentId,
+                            infrastructure_id: infrastructureId,
+                            ...(infrastructureType ? { infrastructureType } : {}),
+                            ...(onboardingId ? { onboardingId } : {}),
+                            ...(probes && probes.length > 0 ? { probes } : {}),
+                        };
+                    },
+                    responseExtractor: passthrough,
+                    description: descCreateChaosService,
+                    bodySchema: {
+                        description: descBodyChaosServiceCreate,
+                        fields: [
+                            { name: "identity", type: "string", required: true, description: descChaosServiceIdentity },
+                            { name: "name", type: "string", required: true, description: descChaosServiceName },
+                            { name: "external_service_id", type: "string", required: true, description: descChaosServiceExternalServiceId },
+                            { name: "agent_id", type: "string", required: true, description: descChaosServiceAgentId },
+                            { name: "environment_id", type: "string", required: true, description: descChaosServiceEnvironmentId },
+                            { name: "infrastructure_id", type: "string", required: true, description: descChaosServiceInfrastructureId },
+                            { name: "infrastructure_type", type: "string", required: false, description: descChaosServiceInfrastructureType },
+                            { name: "description", type: "string", required: false, description: descChaosServiceDescription },
+                            { name: "tags", type: "array", required: false, description: descChaosServiceTagsBody },
+                            { name: "onboarding_id", type: "string", required: false, description: descChaosServiceOnboardingId },
+                            { name: "probes", type: "array", required: false, description: descChaosServiceProbes },
+                        ],
+                    },
+                },
+                update: {
+                    method: "PUT",
+                    path: `${CHAOS}/v3/chaos-services/{identity}`,
+                    operationPolicy: { risk: "medium_write", retryPolicy: "do_not_retry" },
+                    pathParams: { identity: "identity" },
+                    bodyBuilder: (input) => {
+                        const b = coerceBody(input);
+                        const externalServiceId = b.external_service_id ?? b.externalServiceId;
+                        const agentId = b.agent_id ?? b.agentId;
+                        const environmentId = b.environment_id ?? b.environmentId;
+                        const infrastructureId = b.infrastructure_id ?? b.infrastructureId;
+                        const tags = b.tags;
+                        const probes = b.probes?.map((p) => ({
+                            probeId: p.probeId ?? p.probe_id,
+                            ...(p.inputs ? { inputs: p.inputs } : {}),
+                        }));
+                        return {
+                            name: b.name,
+                            ...(b.description !== undefined ? { description: b.description } : {}),
+                            ...(tags
+                                ? {
+                                    tags: Array.isArray(tags)
+                                        ? tags
+                                        : String(tags)
+                                            .split(",")
+                                            .map((t) => t.trim())
+                                            .filter(Boolean),
+                                }
+                                : {}),
+                            externalServiceId,
+                            agentId,
+                            environmentId,
+                            infrastructureId,
+                            // Dual-write snake_case keys — see comment in create bodyBuilder above.
+                            external_service_id: externalServiceId,
+                            agent_id: agentId,
+                            environment_id: environmentId,
+                            infrastructure_id: infrastructureId,
+                            // Full desired-state replace (hce-saas reconcileProbeMappings):
+                            // pass an explicit [] straight through (detach all) rather than
+                            // dropping it, but leave the key absent when the caller omitted it
+                            // so the required-field validation below rejects the request
+                            // instead of silently clearing every probe.
+                            ...(probes !== undefined ? { probes } : {}),
+                        };
+                    },
+                    responseExtractor: passthrough,
+                    description: descUpdateChaosService,
+                    bodySchema: {
+                        description: descBodyChaosServiceUpdate,
+                        fields: [
+                            { name: "name", type: "string", required: true, description: descChaosServiceName },
+                            { name: "external_service_id", type: "string", required: true, description: descChaosServiceExternalServiceId },
+                            { name: "agent_id", type: "string", required: true, description: descChaosServiceAgentId },
+                            { name: "environment_id", type: "string", required: true, description: descChaosServiceEnvironmentId },
+                            { name: "infrastructure_id", type: "string", required: true, description: descChaosServiceInfrastructureId },
+                            { name: "description", type: "string", required: false, description: descChaosServiceDescription },
+                            { name: "tags", type: "array", required: false, description: descChaosServiceTagsBody },
+                            { name: "probes", type: "array", required: true, description: descChaosServiceProbesUpdate },
+                        ],
+                    },
+                },
+            },
+            executeActions: {
+                list_experiment_runs: {
+                    method: "GET",
+                    path: `${CHAOS}/v3/chaos-services/{identity}/experiment-runs`,
+                    operationPolicy: { risk: "read", retryPolicy: "safe" },
+                    pathParams: { identity: "identity" },
+                    queryParams: {
+                        page: "page",
+                        limit: "limit",
+                        size: "limit",
+                        search: "search",
+                        sort_field: "sortField",
+                        sort_ascending: "sortAscending",
+                        include_all_scope: "includeAllScope",
+                        infra_ids: "infraIds",
+                        statuses: "statuses",
+                        step_types: "stepTypes",
+                    },
+                    responseExtractor: passthrough,
+                    actionDescription: descListChaosServiceExperimentRuns,
+                    bodySchema: { description: descBodyNoBody, fields: [] },
+                },
+                list_load_tests: {
+                    method: "GET",
+                    path: `${CHAOS}/v3/chaos-services/{identity}/load-tests`,
+                    operationPolicy: { risk: "read", retryPolicy: "safe" },
+                    pathParams: { identity: "identity" },
+                    queryParams: {
+                        page: "page",
+                        limit: "limit",
+                        size: "limit",
+                        search: "search",
+                        sort_field: "sortField",
+                        sort_ascending: "sortAscending",
+                        include_all_scope: "includeAllScope",
+                        tool_type: "toolType",
+                        environment_ids: "environmentIds",
+                        infra_ids: "infraIds",
+                        tags: "tags",
+                    },
+                    responseExtractor: passthrough,
+                    actionDescription: descListChaosServiceLoadTests,
+                    bodySchema: { description: descBodyNoBody, fields: [] },
+                },
+            },
+        },
         // ── Chaos Kubernetes Infrastructure ──────────────────────────────
         {
             resourceType: "chaos_k8s_infrastructure",
@@ -1733,7 +2381,13 @@ export const chaosToolset = {
             scope: "project",
             scopeParams: CHAOS_SCOPE,
             identifierFields: ["infra_id"],
+            deepLinkTemplate: "/ng/account/{accountId}/module/chaos/orgs/{orgIdentifier}/projects/{projectIdentifier}/settings/chaos/infrastructures/{infraId}",
             diagnosticHint: "An infrastructure can only create chaos experiments when status is ACTIVE and isChaosEnabled is true. Filter out any infrastructure that does not meet both conditions.",
+            relatedResources: [
+                { resourceType: "chaos_environment", relationship: "scoped_by", description: "STEP 1 of create: pick the Harness environment. Its identifier becomes environment_id." },
+                { resourceType: "infrastructure", relationship: "prerequisite", description: "STEP 2 of create: pick the backing CD Kubernetes infrastructure definition in that environment. Its identifier becomes infra_id (defaults to chaos identity when omitted)." },
+                { resourceType: "chaos_enabled_infrastructure", relationship: "child", description: "After install completes, the registered infra appears here once status=ACTIVE and isChaosEnabled=true." },
+            ],
             listFilterFields: [
                 { name: "environment_id", description: descEnvironmentId },
                 { name: "status", description: descK8sInfraStatus, enum: ["ACTIVE", "INACTIVE", "PENDING", "All"] },
@@ -1776,6 +2430,72 @@ export const chaosToolset = {
                     responseExtractor: passthrough,
                     description: descGetK8sInfra,
                 },
+                create: {
+                    method: "POST",
+                    path: `${CHAOS}/rest/v2/infrastructure`,
+                    operationPolicy: { risk: "medium_write", retryPolicy: "do_not_retry" },
+                    bodyBuilder: (input) => {
+                        const b = coerceBody(input);
+                        const identity = b.identity;
+                        const name = b.name;
+                        const environmentId = (b.environment_id ?? b.environmentId);
+                        if (!identity)
+                            throw new Error("identity is required.");
+                        if (!name)
+                            throw new Error("name is required.");
+                        if (!environmentId)
+                            throw new Error("environment_id is required.");
+                        const infraId = (b.infra_id ?? b.infraId ?? identity);
+                        const infraNamespace = (b.infra_namespace ?? b.infraNamespace ?? "hce");
+                        const serviceAccount = (b.service_account ?? b.serviceAccount ?? "litmus");
+                        const infraScope = (b.infra_scope ?? b.infraScope ?? "CLUSTER").toUpperCase();
+                        const infraType = (b.infra_type ?? b.infraType ?? "KUBERNETES").toUpperCase();
+                        const k8sConnectorId = (b.k8s_connector_id ?? b.k8sConnectorID ?? b.k8sConnectorId);
+                        const discoveryAgentId = (b.discovery_agent_id ?? b.discoveryAgentID ?? b.discoveryAgentId);
+                        const aiEnabled = Boolean(b.ai_enabled ?? b.aiEnabled ?? false);
+                        const rawTags = b.tags;
+                        const tags = Array.isArray(rawTags)
+                            ? rawTags
+                            : typeof rawTags === "string"
+                                ? rawTags.split(",").map((t) => t.trim()).filter(Boolean)
+                                : [];
+                        return {
+                            identity,
+                            name,
+                            environmentID: environmentId,
+                            infraID: infraId,
+                            infraNamespace,
+                            serviceAccount,
+                            infraScope,
+                            infraType,
+                            ...(b.description ? { description: b.description } : {}),
+                            ...(tags.length > 0 ? { tags } : {}),
+                            ...(k8sConnectorId ? { k8sConnectorID: k8sConnectorId } : {}),
+                            ...(discoveryAgentId ? { discoveryAgentID: discoveryAgentId } : {}),
+                            aiEnabled,
+                            insecureSkipVerify: Boolean(b.insecure_skip_verify ?? b.insecureSkipVerify ?? false),
+                        };
+                    },
+                    responseExtractor: passthrough,
+                    description: descCreateK8sInfra,
+                    bodySchema: {
+                        description: descBodyK8sInfraCreate,
+                        fields: [
+                            { name: "identity", type: "string", required: true, description: descK8sInfraIdentityCreate },
+                            { name: "name", type: "string", required: true, description: descK8sInfraNameCreate },
+                            { name: "environment_id", type: "string", required: true, description: descK8sInfraEnvironmentIdCreate },
+                            { name: "infra_id", type: "string", required: false, description: descK8sInfraInfraIdCreate },
+                            { name: "k8s_connector_id", type: "string", required: false, description: descK8sInfraConnectorIdCreate },
+                            { name: "infra_namespace", type: "string", required: false, description: descK8sInfraNamespaceCreate },
+                            { name: "service_account", type: "string", required: false, description: descK8sInfraServiceAccountCreate },
+                            { name: "infra_scope", type: "string", required: false, description: descK8sInfraScopeCreate },
+                            { name: "infra_type", type: "string", required: false, description: descK8sInfraTypeCreate },
+                            { name: "description", type: "string", required: false, description: "Optional description for the chaos server." },
+                            { name: "tags", type: "array", required: false, description: "Optional tags (array of strings or comma-separated string)." },
+                            { name: "ai_enabled", type: "boolean", required: false, description: descK8sInfraAiEnabledCreate },
+                        ],
+                    },
+                },
             },
             executeActions: {
                 check_health: {
@@ -3032,6 +3752,60 @@ export const chaosToolset = {
                 },
             },
         },
+        // ── Service Discovery: Agents ──────────────────────────────────────
+        // GET /gateway/servicediscovery/api/v1/agents (service-discovery repo).
+        // Envelope matches the other SD list endpoints:
+        //   { items, page: { totalItems, ... }, correlationID }
+        // so we reuse sdPageExtract. The Go handler treats environmentIdentifier
+        // as an optional narrowing filter even though swagger marks it required —
+        // omit to enumerate agents across every environment in the current scope.
+        {
+            resourceType: "discovered_agent",
+            displayName: "Discovered Agent",
+            description: descDiscoveredAgent,
+            toolset: "chaos",
+            scope: "project",
+            scopeParams: CHAOS_SCOPE,
+            identifierFields: ["identity"],
+            compactItem: compactDiscoveredAgent,
+            searchAliases: [
+                "service discovery agent", "sd agent", "discovery agent",
+                "chaos discovery agent",
+            ],
+            listFilterFields: [
+                { name: "environment_id", description: descSDAgentListEnvironmentId },
+                { name: "search", description: descDiscoveredAgentSearch },
+                { name: "all", type: "boolean", description: descSDFetchAll },
+            ],
+            relatedResources: [
+                {
+                    resourceType: "discovered_namespace",
+                    relationship: "produces",
+                    description: "The 'identity' field returned here is the value discovered_namespace / discovered_service / discovered_network_map take as agent_identity.",
+                },
+                {
+                    resourceType: "chaos_service",
+                    relationship: "referenced_by",
+                    description: "Use an agent's 'identity' as the agent_id field when creating or updating a chaos_service.",
+                },
+            ],
+            operations: {
+                list: {
+                    method: "GET",
+                    path: `${SD}/agents`,
+                    operationPolicy: { risk: "read", retryPolicy: "safe" },
+                    queryParams: {
+                        environment_id: "environmentIdentifier",
+                        search: "search",
+                        page: "page",
+                        size: "limit", // SD uses `limit`, not `size`
+                        all: "all",
+                    },
+                    responseExtractor: sdPageExtract,
+                    description: descListDiscoveredAgents,
+                },
+            },
+        },
         // ── Service Discovery: Namespaces ──────────────────────────────────
         {
             resourceType: "discovered_namespace",