kubeagent 0.1.48 → 0.1.49

package/dist/diagnoser/index.js

@@ -3,6 +3,7 @@ import readline from "node:readline";
 import { loadAuth } from "../auth.js";
 import { proxyRequest } from "../proxy-client.js";
 import { getLogs, describeResource, restartPod, rolloutRestart, scaleDeployment, getEvents, setResources, kubectlGetLogsSchema, kubectlDescribeSchema, restartPodSchema, rolloutRestartSchema, scaleDeploymentSchema, getEventsSchema, setResourcesSchema, } from "./tools.js";
+import { z } from "zod";
 import { zodToJsonSchema } from "zod-to-json-schema";
 const MAX_TOOL_OUTPUT_CHARS = 8000;
 async function createMessage(params) {
@@ -17,7 +18,7 @@ function truncateOutput(output) {
     if (output.length <= MAX_TOOL_OUTPUT_CHARS)
         return output;
     const half = Math.floor(MAX_TOOL_OUTPUT_CHARS / 2);
-    return output.slice(0, half) + "\n\n... [truncated] ...\n\n" + output.slice(-half);
+    return (output.slice(0, half) + "\n\n... [truncated] ...\n\n" + output.slice(-half));
 }
 /**
  * Decide whether a tool call may execute, given the set of auto-safe actions and
@@ -41,12 +42,65 @@ export async function resolveApprovalDecision(toolName, params, safeActions, onA
     }
     const approved = await onApproval(toolName, params);
     if (!approved) {
-        return { execute: false, reason: "Action denied by user. Propose an alternative." };
+        return {
+            execute: false,
+            reason: "Action denied by user. Propose an alternative.",
+        };
     }
     return { execute: true };
 }
+const askUserQuestionSchema = z.object({
+    question: z.string(),
+    choices: z.array(z.string()).optional(),
+});
+const toolRegistry = [
+    {
+        name: "ask_user_question",
+        description: "Ask the user a clarifying question. Use when context is needed before diagnosing — e.g., a resource doesn't match any known deployment, or you need to know if an issue is intentional. Provide `choices` for multiple-choice questions, or omit for open-ended input.",
+        schema: askUserQuestionSchema,
+    },
+    {
+        name: "get_logs",
+        description: "Get logs from a pod. Use to investigate errors, crashes, OOM kills.",
+        schema: kubectlGetLogsSchema,
+    },
+    {
+        name: "describe_resource",
+        description: "Describe a Kubernetes resource (pod, deployment, service, node). Shows events, conditions, configuration.",
+        schema: kubectlDescribeSchema,
+    },
+    {
+        name: "restart_pod",
+        description: "Delete a pod. If the pod is owned by a Deployment or DaemonSet it will be recreated; orphan pods are permanently deleted. Requires user approval.",
+        schema: restartPodSchema,
+    },
+    {
+        name: "rollout_restart",
+        description: "Rollout restart a deployment. Requires user approval.",
+        schema: rolloutRestartSchema,
+    },
+    {
+        name: "scale_deployment",
+        description: "Scale a deployment to a specific number of replicas. Scaling to 0 requires approval.",
+        schema: scaleDeploymentSchema,
+    },
+    {
+        name: "get_events",
+        description: "Get recent events in a namespace. Useful for understanding what happened.",
+        schema: getEventsSchema,
+    },
+    {
+        name: "set_resources",
+        description: "Change CPU/memory requests and limits on a deployment. Triggers a rolling restart. Requires user approval.",
+        schema: setResourcesSchema,
+    },
+];
+const toolInputSchemas = Object.fromEntries(toolRegistry.map(({ name, schema }) => [name, schema]));
 async function askUserQuestion(question, choices) {
-    const rl = readline.createInterface({ input: process.stdin, output: process.stdout });
+    const rl = readline.createInterface({
+        input: process.stdin,
+        output: process.stdout,
+    });
     return new Promise((resolve) => {
         let prompt = `\n${chalk.cyan("?")} ${chalk.bold(question)}\n`;
         if (choices && choices.length > 0) {
@@ -73,59 +127,11 @@ async function askUserQuestion(question, choices) {
     });
 }
 function makeToolDefs() {
-    return [
-        {
-            name: "ask_user_question",
-            description: "Ask the user a clarifying question. Use when context is needed before diagnosing — e.g., a resource doesn't match any known deployment, or you need to know if an issue is intentional. Provide `choices` for multiple-choice questions, or omit for open-ended input.",
-            input_schema: {
-                type: "object",
-                properties: {
-                    question: { type: "string", description: "The question to ask the user" },
-                    choices: {
-                        type: "array",
-                        items: { type: "string" },
-                        description: "Optional list of choices. If provided, the user picks by number or types a free-form answer.",
-                    },
-                },
-                required: ["question"],
-            },
-        },
-        {
-            name: "get_logs",
-            description: "Get logs from a pod. Use to investigate errors, crashes, OOM kills.",
-            input_schema: zodToJsonSchema(kubectlGetLogsSchema),
-        },
-        {
-            name: "describe_resource",
-            description: "Describe a Kubernetes resource (pod, deployment, service, node). Shows events, conditions, configuration.",
-            input_schema: zodToJsonSchema(kubectlDescribeSchema),
-        },
-        {
-            name: "restart_pod",
-            description: "Delete a pod. If the pod is owned by a Deployment or DaemonSet it will be recreated; orphan pods are permanently deleted. Requires user approval.",
-            input_schema: zodToJsonSchema(restartPodSchema),
-        },
-        {
-            name: "rollout_restart",
-            description: "Rollout restart a deployment. Requires user approval.",
-            input_schema: zodToJsonSchema(rolloutRestartSchema),
-        },
-        {
-            name: "scale_deployment",
-            description: "Scale a deployment to a specific number of replicas. Scaling to 0 requires approval.",
-            input_schema: zodToJsonSchema(scaleDeploymentSchema),
-        },
-        {
-            name: "get_events",
-            description: "Get recent events in a namespace. Useful for understanding what happened.",
-            input_schema: zodToJsonSchema(getEventsSchema),
-        },
-        {
-            name: "set_resources",
-            description: "Change CPU/memory requests and limits on a deployment. Triggers a rolling restart. Requires user approval.",
-            input_schema: zodToJsonSchema(setResourcesSchema),
-        },
-    ];
+    return toolRegistry.map(({ name, description, schema }) => ({
+        name,
+        description,
+        input_schema: zodToJsonSchema(schema),
+    }));
 }
 function makeToolExecutors(noInteractive, onQuestion) {
     return {
@@ -168,7 +174,12 @@ If it requires a risky action (rollback, delete, scale to zero), propose it but
         { role: "user", content: userMessage },
     ];
     const toolExecutors = makeToolExecutors(options?.noInteractive ?? false, options?.onQuestion);
-    const mutatingTools = new Set(["restart_pod", "rollout_restart", "scale_deployment", "set_resources"]);
+    const mutatingTools = new Set([
+        "restart_pod",
+        "rollout_restart",
+        "scale_deployment",
+        "set_resources",
+    ]);
     // Merge hardcoded read-only safe tools with user-configured safe actions
     const effectiveSafeActions = new Set([
         ...["get_logs", "get_events", "describe_resource", "ask_user_question"],
@@ -210,10 +221,24 @@ If it requires a risky action (rollback, delete, scale to zero), propose it but
                         });
                         continue;
                     }
+                    const parsedInput = toolInputSchemas[block.name]?.safeParse(block.input);
+                    if (!parsedInput?.success) {
+                        const details = parsedInput?.error.issues
+                            .map((issue) => `${issue.path.join(".") || "input"}: ${issue.message}`)
+                            .join("; ") ?? "no schema is registered";
+                        toolResults.push({
+                            type: "tool_result",
+                            tool_use_id: block.id,
+                            content: `Invalid input for tool ${block.name}: ${details}`,
+                            is_error: true,
+                        });
+                        continue;
+                    }
+                    const validatedInput = parsedInput.data;
                     // Check if action requires approval. A missing onApproval callback
                     // (non-interactive mode) means DENY for any non-safe action — never
                     // execute destructive remediation unattended.
-                    const decision = await resolveApprovalDecision(block.name, block.input, effectiveSafeActions, options?.onApproval);
+                    const decision = await resolveApprovalDecision(block.name, validatedInput, effectiveSafeActions, options?.onApproval);
                     if (!decision.execute) {
                         toolResults.push({
                             type: "tool_result",
@@ -223,13 +248,15 @@ If it requires a risky action (rollback, delete, scale to zero), propose it but
                         continue;
                     }
                     try {
-                        const result = await executor(block.input, { context: clusterContext });
+                        const result = await executor(validatedInput, {
+                            context: clusterContext,
+                        });
                         // Track mutating actions for the verifier
                         if (mutatingTools.has(block.name)) {
                             appliedAction = {
                                 name: block.name,
                                 safe: effectiveSafeActions.has(block.name),
-                                params: block.input,
+                                params: validatedInput,
                             };
                         }
                         toolResults.push({

package/dist/diagnoser/tools.js

@@ -19,11 +19,37 @@ export function isActionSafe(action) {
     return safeActions.has(action);
 }
 // Tool input schemas for Claude API
+const rfc1123LabelPattern = /^[a-z0-9](?:[-a-z0-9]*[a-z0-9])?$/;
+const namespaceNameSchema = z
+    .string()
+    .min(1)
+    .max(63)
+    .regex(rfc1123LabelPattern, "Must be a Kubernetes RFC 1123 label, not a command-line flag");
+const kubernetesNameSchema = z
+    .string()
+    .min(1)
+    .max(253)
+    .regex(/^[a-z0-9](?:[-a-z0-9.]*[a-z0-9])?$/, "Must be a Kubernetes DNS subdomain, not a command-line flag")
+    .refine((name) => name
+    .split(".")
+    .every((label) => label.length <= 63 && rfc1123LabelPattern.test(label)), "Each Kubernetes DNS-subdomain label must be 1–63 characters");
+const containerNameSchema = namespaceNameSchema;
+const resourceQuantitySchema = z
+    .string()
+    .regex(/^\+?(?:\d+(?:\.\d*)?|\.\d+)(?:[eE][+-]?\d+|[numkMGTPE]|[KMGTPE]i)?$/, "Must be a non-negative Kubernetes resource quantity");
 export const kubectlGetLogsSchema = z.object({
-    namespace: z.string().describe("Kubernetes namespace"),
-    pod: z.string().describe("Pod name"),
-    container: z.string().optional().describe("Container name (if multi-container pod)"),
-    tail: z.number().default(50).describe("Number of log lines to return"),
+    namespace: namespaceNameSchema.describe("Kubernetes namespace"),
+    pod: kubernetesNameSchema.describe("Pod name"),
+    container: containerNameSchema
+        .optional()
+        .describe("Container name (if multi-container pod)"),
+    tail: z
+        .number()
+        .int()
+        .min(1)
+        .max(10_000)
+        .default(50)
+        .describe("Number of log lines to return"),
 });
 const ALLOWED_RESOURCE_TYPES = [
     "pod", "deployment", "service", "statefulset", "daemonset",
@@ -31,34 +57,44 @@ const ALLOWED_RESOURCE_TYPES = [
     "persistentvolumeclaim", "configmap", "endpoints",
 ];
 export const kubectlDescribeSchema = z.object({
-    namespace: z.string().describe("Kubernetes namespace"),
+    namespace: namespaceNameSchema.describe("Kubernetes namespace"),
     resource_type: z.enum(ALLOWED_RESOURCE_TYPES).describe("Resource type to describe"),
-    name: z.string().describe("Resource name"),
+    name: kubernetesNameSchema.describe("Resource name"),
 });
 export const restartPodSchema = z.object({
-    namespace: z.string().describe("Kubernetes namespace"),
-    pod: z.string().describe("Pod name to delete (deployment will recreate it)"),
+    namespace: namespaceNameSchema.describe("Kubernetes namespace"),
+    pod: kubernetesNameSchema.describe("Pod name to delete (deployment will recreate it)"),
 });
 export const rolloutRestartSchema = z.object({
-    namespace: z.string().describe("Kubernetes namespace"),
-    deployment: z.string().describe("Deployment name to rollout restart"),
+    namespace: namespaceNameSchema.describe("Kubernetes namespace"),
+    deployment: kubernetesNameSchema.describe("Deployment name to rollout restart"),
 });
 export const scaleDeploymentSchema = z.object({
-    namespace: z.string().describe("Kubernetes namespace"),
-    deployment: z.string().describe("Deployment name"),
-    replicas: z.number().min(0).max(20).describe("Target replica count"),
+    namespace: namespaceNameSchema.describe("Kubernetes namespace"),
+    deployment: kubernetesNameSchema.describe("Deployment name"),
+    replicas: z.number().int().min(0).max(20).describe("Target replica count"),
 });
 export const getEventsSchema = z.object({
-    namespace: z.string().describe("Kubernetes namespace"),
+    namespace: namespaceNameSchema.describe("Kubernetes namespace"),
 });
 export const setResourcesSchema = z.object({
-    namespace: z.string().describe("Kubernetes namespace"),
-    deployment: z.string().describe("Deployment name"),
-    container: z.string().optional().describe("Container name (omit for single-container pods)"),
-    memory_request: z.string().optional().describe("Memory request e.g. '128Mi'"),
-    memory_limit: z.string().optional().describe("Memory limit e.g. '512Mi'"),
-    cpu_request: z.string().optional().describe("CPU request e.g. '100m'"),
-    cpu_limit: z.string().optional().describe("CPU limit e.g. '500m'"),
+    namespace: namespaceNameSchema.describe("Kubernetes namespace"),
+    deployment: kubernetesNameSchema.describe("Deployment name"),
+    container: containerNameSchema
+        .optional()
+        .describe("Container name (omit for single-container pods)"),
+    memory_request: resourceQuantitySchema
+        .optional()
+        .describe("Memory request e.g. '128Mi'"),
+    memory_limit: resourceQuantitySchema
+        .optional()
+        .describe("Memory limit e.g. '512Mi'"),
+    cpu_request: resourceQuantitySchema
+        .optional()
+        .describe("CPU request e.g. '100m'"),
+    cpu_limit: resourceQuantitySchema
+        .optional()
+        .describe("CPU limit e.g. '500m'"),
 });
 // Tool implementations
 export async function getLogs(input, context) {

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "kubeagent",
-  "version": "0.1.48",
+  "version": "0.1.49",
   "description": "AI-powered Kubernetes management CLI",
   "license": "SEE LICENSE IN LICENSE",
   "homepage": "https://kubeagent.net",