endpoint-aiops 0.1.0__tar.gz

endpoint_aiops-0.1.0/.gitignore

@@ -0,0 +1,22 @@
+# Python
+__pycache__/
+*.py[cod]
+*.egg-info/
+.pytest_cache/
+.ruff_cache/
+
+# Virtual envs / build
+.venv/
+dist/
+build/
+
+# uv
+uv.lock
+
+# Local config / secrets (never commit)
+*.env
+.env
+config.yaml
+
+# OS
+.DS_Store

endpoint_aiops-0.1.0/CHANGELOG.md

@@ -0,0 +1,45 @@
+# Changelog
+
+All notable changes to endpoint-aiops are documented here. This project adheres
+to [Semantic Versioning](https://semver.org/).
+
+## [0.1.0] — preview
+
+Initial preview release: governed AI-ops for managed-endpoint fleets (thin
+clients / VDI) with a bundled governance harness. **Mock-validated only — not
+yet verified against a live endpoint-management server.**
+
+### Added
+
+- **9 MCP tools** (7 read, 2 write), every one wrapped with the bundled
+  `@governed_tool` harness (audit, policy, token/runaway budget, undo,
+  risk-tiers):
+  - **Overview** — `overview` (fleet health: online/offline, stale endpoints,
+    agent/patch spread).
+  - **Inventory** — `endpoint_list`, `endpoint_get`.
+  - **Sessions** — `session_list`; `login_storm_analysis` — detect login storms
+    (bursts of concurrent logins in a sliding window) and rank the slowest
+    login/boot contributors.
+  - **Drift** — `drift_report` (endpoints deviating from a per-field baseline,
+    fleet-majority derived when none is given); `patch_status` (patch-level
+    distribution + endpoints behind the target).
+  - **Remediation** — `endpoint_assign_profile` (write, high, reversible:
+    captures the prior profile, records an inverse reassign undo descriptor);
+    `endpoint_reboot` (write, medium, no safe inverse, captures before-state).
+- **Pure/offline analysis** — `login_storm_analysis`, `drift_report`, and
+  `patch_status` accept injected records for analysis without a live server.
+- **Encrypted secret store** — the management-server API key is stored encrypted
+  in `~/.endpoint-aiops/secrets.enc` (Fernet + scrypt); never plaintext on disk.
+  Legacy `ENDPOINT_<TARGET>_APIKEY` env var honoured as a fallback.
+- **CLI** (`endpoint-aiops`) — `init` wizard, `secret` management, `doctor`,
+  `overview`, and the `endpoint` / `session` / `drift` sub-commands.
+- **Bearer-auth REST connection layer** over a generic endpoint-management REST
+  API with centralised teaching error translation (`EndpointApiError`).
+
+### Known limitations
+
+- Preview / mock-only: the REST paths (`/endpoints`, `/sessions`, `/version`,
+  `/endpoints/{id}/profile`, `/endpoints/{id}/reboot`) are modelled generically
+  and need live verification against a real management server.
+- Out of scope by design: enrollment/de-enrollment, image/OTA management, and
+  any bulk destructive operation.

endpoint_aiops-0.1.0/LICENSE

@@ -0,0 +1,21 @@
+MIT License
+
+Copyright (c) 2026 wei <zhouwei008@gmail.com>
+
+Permission is hereby granted, free of charge, to any person obtaining a copy
+of this software and associated documentation files (the "Software"), to deal
+in the Software without restriction, including without limitation the rights
+to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
+copies of the Software, and to permit persons to whom the Software is
+furnished to do so, subject to the following conditions:
+
+The above copyright notice and this permission notice shall be included in all
+copies or substantial portions of the Software.
+
+THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
+IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
+FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
+AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
+LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
+OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN THE
+SOFTWARE.

endpoint_aiops-0.1.0/PKG-INFO

@@ -0,0 +1,108 @@
+Metadata-Version: 2.4
+Name: endpoint-aiops
+Version: 0.1.0
+Summary: Governed AI-ops for managed-endpoint fleets (thin clients / VDI): login-storm & drift analysis with a built-in governance harness (audit, budget, undo, risk tiers)
+Author-email: wei <zhouwei008@gmail.com>
+License-Expression: MIT
+License-File: LICENSE
+Requires-Python: >=3.11
+Requires-Dist: cryptography>=42.0
+Requires-Dist: httpx<1.0,>=0.27
+Requires-Dist: mcp[cli]<2.0,>=1.10
+Requires-Dist: pyyaml<7.0,>=6.0
+Requires-Dist: rich<16.0,>=13.0
+Requires-Dist: typer<1.0,>=0.12
+Description-Content-Type: text/markdown
+
+<!-- mcp-name: io.github.AIops-tools/endpoint-aiops -->
+
+# Endpoint AIops (preview)
+
+> **Disclaimer**: Community-maintained open-source project. **Not affiliated with, endorsed by, or sponsored by any endpoint-management vendor.** Product and trademark names belong to their owners. MIT licensed.
+
+Governed AI-ops for **managed-endpoint fleets** — thin clients, VDI endpoints,
+and other centrally-managed devices — with a **built-in governance harness**:
+unified audit log, policy engine, token/runaway budget guard, undo-token
+recording, and graduated-autonomy risk tiers. Vendor-neutral: it talks to an
+endpoint-management server's REST API (Bearer auth). Self-contained: no
+dependencies beyond `httpx` and the MCP SDK. **Preview — mock-validated only,
+not yet verified against a live management server.**
+
+## What it does
+
+Two signature analyses, plus the guarded reads and writes around them:
+
+- **Login-storm analysis** — during a "everyone logs in at 9am" incident,
+  detect the storm (bursts of concurrent logins in a sliding window) and rank
+  the endpoints/users dragging login and boot times. Every flag is reported
+  with its number, not a black-box verdict.
+- **Patch / config drift** — find endpoints that have drifted from the fleet
+  (outdated patch level, stray agent version, divergent OS build or config
+  profile). With no declared baseline it derives one by fleet majority, so it
+  works before a gold image exists.
+
+## What works
+
+- **CLI** (`endpoint-aiops ...`): `init`, `overview`, `endpoint list/get/assign-profile/reboot`, `session list/storm`, `drift report/patch`, `secret set/list/rm/migrate/rotate-password`, `doctor`, `mcp`.
+- **MCP server** (`endpoint-aiops mcp` or `endpoint-aiops-mcp`): **9 tools** (7 read, 2 write), every one wrapped with the bundled `@governed_tool` harness.
+- **Encrypted credentials**: the management-server API key lives in an encrypted store `~/.endpoint-aiops/secrets.enc` (Fernet + scrypt) — **never plaintext on disk**. Unlock with a master password from `ENDPOINT_AIOPS_MASTER_PASSWORD` (MCP/CI) or an interactive prompt (CLI).
+- **Reversibility**: `endpoint_assign_profile` (`high` risk) captures the prior profile and records an inverse "reassign the prior profile" undo descriptor. `endpoint_reboot` (`medium` risk) captures the prior online state for the audit record but declares no undo (a reboot has no safe inverse).
+- **Safety**: state-changing CLI ops (`endpoint assign-profile`, `endpoint reboot`) require double confirmation and support `--dry-run`.
+
+## Capability matrix (9 MCP tools)
+
+| Category | Tools | Count | R/W |
+|----------|-------|:-----:|:---:|
+| **Overview** | `overview` | 1 | read |
+| **Inventory** | `endpoint_list`, `endpoint_get` | 2 | read |
+| **Sessions** | `session_list`, `login_storm_analysis` | 2 | read |
+| **Drift** | `drift_report`, `patch_status` | 2 | read |
+| **Remediation** | `endpoint_assign_profile` | 1 | write (high) |
+| | `endpoint_reboot` | 1 | write (medium) |
+
+The analysis tools (`login_storm_analysis`, `drift_report`, `patch_status`)
+accept injected records for pure/offline analysis, or pull live from a
+configured target.
+
+## Quick start
+
+```bash
+uv tool install endpoint-aiops          # or: pipx install endpoint-aiops
+endpoint-aiops init                     # wizard: add a target + store its API key (encrypted)
+endpoint-aiops doctor                   # verify config, secrets, connectivity
+endpoint-aiops overview                 # one-shot fleet health
+endpoint-aiops session storm            # detect a login storm + slow contributors
+endpoint-aiops drift report             # endpoints drifted from the fleet baseline
+```
+
+Run as an MCP server (stdio):
+
+```bash
+export ENDPOINT_AIOPS_MASTER_PASSWORD=...   # unlock secrets non-interactively
+endpoint-aiops-mcp
+```
+
+## Governance
+
+Every MCP tool passes through the bundled `@governed_tool` harness:
+
+- **Audit** — every call (params, result, status, duration, risk tier,
+  approver, rationale) is logged to `~/.endpoint-aiops/audit.db` (relocatable
+  via `ENDPOINT_AIOPS_HOME`).
+- **Budget / runaway guard** — token and call budgets trip a circuit breaker.
+- **Risk tiers** — graduated autonomy; high-risk ops can require a named
+  approver (`ENDPOINT_AUDIT_APPROVED_BY` / `ENDPOINT_AUDIT_RATIONALE`).
+- **Undo recording** — reversible writes record an inverse descriptor.
+
+## Scope
+
+This is the **IT-endpoint** member of the AIops-tools family (governed AI-ops
+with audit + budget + undo + risk tiers). For **OT / industrial edge**
+(Modbus, OPC-UA, PROFINET, …) see the separate `industrial-aiops` line.
+
+## Status
+
+**Preview — mock-validated only.** The endpoint-management REST paths are
+modelled generically (`/endpoints`, `/sessions`, `/version`) and need live
+verification against a real server. Missing a capability or a server dialect?
+Open an issue or PR — contributions welcome.

endpoint_aiops-0.1.0/README.md

@@ -0,0 +1,92 @@
+<!-- mcp-name: io.github.AIops-tools/endpoint-aiops -->
+
+# Endpoint AIops (preview)
+
+> **Disclaimer**: Community-maintained open-source project. **Not affiliated with, endorsed by, or sponsored by any endpoint-management vendor.** Product and trademark names belong to their owners. MIT licensed.
+
+Governed AI-ops for **managed-endpoint fleets** — thin clients, VDI endpoints,
+and other centrally-managed devices — with a **built-in governance harness**:
+unified audit log, policy engine, token/runaway budget guard, undo-token
+recording, and graduated-autonomy risk tiers. Vendor-neutral: it talks to an
+endpoint-management server's REST API (Bearer auth). Self-contained: no
+dependencies beyond `httpx` and the MCP SDK. **Preview — mock-validated only,
+not yet verified against a live management server.**
+
+## What it does
+
+Two signature analyses, plus the guarded reads and writes around them:
+
+- **Login-storm analysis** — during a "everyone logs in at 9am" incident,
+  detect the storm (bursts of concurrent logins in a sliding window) and rank
+  the endpoints/users dragging login and boot times. Every flag is reported
+  with its number, not a black-box verdict.
+- **Patch / config drift** — find endpoints that have drifted from the fleet
+  (outdated patch level, stray agent version, divergent OS build or config
+  profile). With no declared baseline it derives one by fleet majority, so it
+  works before a gold image exists.
+
+## What works
+
+- **CLI** (`endpoint-aiops ...`): `init`, `overview`, `endpoint list/get/assign-profile/reboot`, `session list/storm`, `drift report/patch`, `secret set/list/rm/migrate/rotate-password`, `doctor`, `mcp`.
+- **MCP server** (`endpoint-aiops mcp` or `endpoint-aiops-mcp`): **9 tools** (7 read, 2 write), every one wrapped with the bundled `@governed_tool` harness.
+- **Encrypted credentials**: the management-server API key lives in an encrypted store `~/.endpoint-aiops/secrets.enc` (Fernet + scrypt) — **never plaintext on disk**. Unlock with a master password from `ENDPOINT_AIOPS_MASTER_PASSWORD` (MCP/CI) or an interactive prompt (CLI).
+- **Reversibility**: `endpoint_assign_profile` (`high` risk) captures the prior profile and records an inverse "reassign the prior profile" undo descriptor. `endpoint_reboot` (`medium` risk) captures the prior online state for the audit record but declares no undo (a reboot has no safe inverse).
+- **Safety**: state-changing CLI ops (`endpoint assign-profile`, `endpoint reboot`) require double confirmation and support `--dry-run`.
+
+## Capability matrix (9 MCP tools)
+
+| Category | Tools | Count | R/W |
+|----------|-------|:-----:|:---:|
+| **Overview** | `overview` | 1 | read |
+| **Inventory** | `endpoint_list`, `endpoint_get` | 2 | read |
+| **Sessions** | `session_list`, `login_storm_analysis` | 2 | read |
+| **Drift** | `drift_report`, `patch_status` | 2 | read |
+| **Remediation** | `endpoint_assign_profile` | 1 | write (high) |
+| | `endpoint_reboot` | 1 | write (medium) |
+
+The analysis tools (`login_storm_analysis`, `drift_report`, `patch_status`)
+accept injected records for pure/offline analysis, or pull live from a
+configured target.
+
+## Quick start
+
+```bash
+uv tool install endpoint-aiops          # or: pipx install endpoint-aiops
+endpoint-aiops init                     # wizard: add a target + store its API key (encrypted)
+endpoint-aiops doctor                   # verify config, secrets, connectivity
+endpoint-aiops overview                 # one-shot fleet health
+endpoint-aiops session storm            # detect a login storm + slow contributors
+endpoint-aiops drift report             # endpoints drifted from the fleet baseline
+```
+
+Run as an MCP server (stdio):
+
+```bash
+export ENDPOINT_AIOPS_MASTER_PASSWORD=...   # unlock secrets non-interactively
+endpoint-aiops-mcp
+```
+
+## Governance
+
+Every MCP tool passes through the bundled `@governed_tool` harness:
+
+- **Audit** — every call (params, result, status, duration, risk tier,
+  approver, rationale) is logged to `~/.endpoint-aiops/audit.db` (relocatable
+  via `ENDPOINT_AIOPS_HOME`).
+- **Budget / runaway guard** — token and call budgets trip a circuit breaker.
+- **Risk tiers** — graduated autonomy; high-risk ops can require a named
+  approver (`ENDPOINT_AUDIT_APPROVED_BY` / `ENDPOINT_AUDIT_RATIONALE`).
+- **Undo recording** — reversible writes record an inverse descriptor.
+
+## Scope
+
+This is the **IT-endpoint** member of the AIops-tools family (governed AI-ops
+with audit + budget + undo + risk tiers). For **OT / industrial edge**
+(Modbus, OPC-UA, PROFINET, …) see the separate `industrial-aiops` line.
+
+## Status
+
+**Preview — mock-validated only.** The endpoint-management REST paths are
+modelled generically (`/endpoints`, `/sessions`, `/version`) and need live
+verification against a real server. Missing a capability or a server dialect?
+Open an issue or PR — contributions welcome.

endpoint_aiops-0.1.0/RELEASE_NOTES.md

@@ -0,0 +1,43 @@
+# Endpoint AIops v0.1.0 — preview
+
+Governed AI-ops for **managed-endpoint fleets** (thin clients / VDI) for AI
+agents, with a built-in governance harness (audit, policy, token/runaway
+budget, undo-token recording, graduated risk tiers) and an encrypted credential
+store. Standalone — no external skill-family dependency.
+
+> **Preview / mock-only.** All behaviour is validated against mocked REST
+> responses; it has not been run against a live endpoint-management server. The
+> fastest live check is `endpoint-aiops doctor`.
+
+## Highlights
+
+- **9 MCP tools** (7 read, 2 write), every one wrapped with `@governed_tool`.
+  - Read: fleet `overview`; inventory (`endpoint_list`, `endpoint_get`);
+    sessions (`session_list`, `login_storm_analysis`); drift (`drift_report`,
+    `patch_status`).
+  - Write: `endpoint_assign_profile` (high, reversible — records an inverse
+    reassign undo), `endpoint_reboot` (medium, no safe inverse, captures
+    before-state).
+- **Two signature analyses** — login-storm detection + slow login/boot ranking,
+  and patch/config drift vs a fleet-majority (or explicit) baseline. Both accept
+  injected records for offline analysis.
+- **Encrypted API key store** (`~/.endpoint-aiops/secrets.enc`, Fernet + scrypt)
+  — never plaintext on disk; legacy `ENDPOINT_<TARGET>_APIKEY` env fallback.
+- **CLI** with an `init` onboarding wizard, `secret` management, and `doctor`.
+- **Bearer-auth REST connection layer** over a generic endpoint-management REST
+  API with teaching error translation (`EndpointApiError`).
+
+## Install
+
+```bash
+uv tool install endpoint-aiops
+endpoint-aiops init
+endpoint-aiops doctor
+```
+
+## Caveats
+
+- The REST paths are modelled generically (`/endpoints`, `/sessions`,
+  `/version`, `/endpoints/{id}/profile|reboot`) and need live verification.
+- Out of scope by design: enrollment/de-enrollment, image/OTA management, and
+  any bulk destructive operation.

endpoint_aiops-0.1.0/SECURITY.md

@@ -0,0 +1,75 @@
+# Security Policy
+
+## Disclaimer
+
+Community-maintained open-source project. **Not affiliated with, endorsed by, or
+sponsored by any endpoint-management vendor.** Product and trademark names
+belong to their owners. Source is publicly auditable under the MIT license.
+
+## Reporting Vulnerabilities
+
+Report privately via a GitHub Security Advisory on
+[github.com/AIops-tools/Endpoint-AIops](https://github.com/AIops-tools/Endpoint-AIops/security/advisories)
+or email zhouwei008@gmail.com. Please do not open public issues for security
+reports.
+
+## Security Design
+
+### Credential Management
+- Per-target Endpoint API keys live **encrypted** in
+  `~/.endpoint-aiops/secrets.enc` (Fernet/AES-128 + scrypt-derived key; chmod
+  600), never in `config.yaml` and never in source. The master password is
+  never stored — only a per-store random salt and the ciphertext are on disk.
+- A legacy plaintext env var `ENDPOINT_<TARGET_NAME_UPPER>_APIKEY` is still
+  honoured as a fallback with a deprecation warning (migrate with
+  `endpoint-aiops secret migrate`).
+- The API key is sent as an `Authorization: Bearer` header at request time and
+  held only in memory. Keys are never logged or echoed; the config file holds
+  only host, port, api_path, and TLS settings.
+
+### Governed Operations
+Every MCP tool runs through the bundled `@governed_tool` harness
+(`endpoint_aiops.governance`):
+- **Audit** — every call logged to a local SQLite DB under `~/.endpoint-aiops/`
+  (relocatable via `ENDPOINT_AIOPS_HOME`), agent-attributed, secret-redacted.
+- **Token/runaway budget** — hard ceilings (`ENDPOINT_MAX_TOOL_CALLS` /
+  `ENDPOINT_MAX_TOOL_SECONDS`) plus an on-by-default guard that trips a tight
+  poll/retry loop, preventing unbounded API consumption (e.g. polling a slow
+  session).
+- **Graduated risk tiers** — `~/.endpoint-aiops/rules.yaml` `risk_tiers` gate
+  writes by environment/tag; the highest tiers require a recorded approver.
+- **Undo-token recording** — `endpoint_assign_profile` captures the prior
+  profile and records an inverse "reassign the prior profile" descriptor so the
+  change can be rolled back.
+
+### State-Changing Operations
+`endpoint assign-profile` and `endpoint reboot` require double confirmation at
+the CLI layer and support `--dry-run`. `endpoint_assign_profile` is
+`risk_level=high` and reversible (captures the prior profile, records an undo
+descriptor); `endpoint_reboot` is `risk_level=medium` and has no safe inverse
+(captures the before-state for the audit record, records no undo token).
+
+### SSL/TLS Verification
+`verify_ssl` defaults to true; disable only for self-signed lab certificates.
+
+### Prompt-Injection Protection
+All server-returned text (hostnames, usernames, profile ids, session fields) is
+passed through a `sanitize()` truncate + control-character strip before reaching
+the agent.
+
+### Network Scope
+No webhooks, no telemetry, no outbound calls beyond the configured
+endpoint-management REST API endpoint. No post-install scripts or background
+services.
+
+## Static Analysis
+
+```bash
+uvx bandit -r endpoint_aiops/ mcp_server/
+uv run ruff check .
+```
+
+## Supported Versions
+
+The latest released version receives security fixes. This is a preview (0.x);
+pin a version in production.

endpoint_aiops-0.1.0/endpoint_aiops/__init__.py

@@ -0,0 +1,9 @@
+"""endpoint-aiops — governed Endpoint SCALE operations for AI agents.
+
+Standalone and self-contained: the governance harness (audit, token budget,
+undo-token recording, graduated risk tiers, prompt-injection sanitize) is
+bundled under ``endpoint_aiops.governance`` — this package has no external
+skill-family dependency. Preview: not yet full-coverage.
+"""
+
+__version__ = "0.1.0"

endpoint_aiops-0.1.0/endpoint_aiops/cli/__init__.py

@@ -0,0 +1,9 @@
+"""CLI package for endpoint-aiops.
+
+Re-exports ``app`` so the pyproject entry point
+``endpoint-aiops = "endpoint_aiops.cli:app"`` works unchanged.
+"""
+
+from endpoint_aiops.cli._root import app
+
+__all__ = ["app"]

endpoint_aiops-0.1.0/endpoint_aiops/cli/_common.py

@@ -0,0 +1,78 @@
+"""Shared helpers for endpoint-aiops CLI sub-modules."""
+
+from __future__ import annotations
+
+import functools
+from collections.abc import Callable
+from pathlib import Path
+from typing import Annotated, Any
+
+import typer
+from rich.console import Console
+
+console = Console()
+
+# ─── Shared Option types ───────────────────────────────────────────────────
+
+TargetOption = Annotated[
+    str | None, typer.Option("--target", "-t", help="Target name from config")
+]
+DryRunOption = Annotated[
+    bool, typer.Option("--dry-run", help="Print the API call without executing")
+]
+
+
+def _cli_error_types() -> tuple[type[BaseException], ...]:
+    """Exceptions translated to a one-line teaching error instead of a traceback."""
+    from endpoint_aiops.connection import EndpointApiError
+
+    return (EndpointApiError, KeyError, OSError, ValueError)
+
+
+def cli_errors(fn: Callable) -> Callable:
+    """Translate known exceptions into one red line + exit code 1."""
+
+    @functools.wraps(fn)
+    def wrapper(*args: Any, **kwargs: Any) -> Any:
+        try:
+            return fn(*args, **kwargs)
+        except (typer.Exit, typer.Abort):
+            raise
+        except _cli_error_types() as e:
+            message = str(e)
+            if isinstance(e, KeyError):
+                message = f"Missing required key or environment variable: {message}"
+            console.print(f"[red]Error: {message}[/]")
+            raise typer.Exit(1) from e
+
+    return wrapper
+
+
+def get_connection(target: str | None, config_path: Path | None = None):
+    """Return a (conn, config) tuple for the given target."""
+    from endpoint_aiops.config import load_config
+    from endpoint_aiops.connection import ConnectionManager
+
+    cfg = load_config(config_path)
+    mgr = ConnectionManager(cfg)
+    return mgr.connect(target), cfg
+
+
+def dry_run_print(*, operation: str, api_call: str, parameters: dict | None = None) -> None:
+    """Print a dry-run preview of the API call that would be made."""
+    console.print("\n[bold magenta][DRY-RUN] No changes will be made.[/]")
+    console.print(f"[magenta]  Operation: {operation}[/]")
+    console.print(f"[magenta]  API Call:  {api_call}[/]")
+    for k, v in (parameters or {}).items():
+        console.print(f"[magenta]  Param:     {k} = {v}[/]")
+    console.print("[magenta]  Run without --dry-run to execute.[/]\n")
+
+
+def double_confirm(action: str, resource: str) -> None:
+    """Require two confirmations for a destructive operation."""
+    console.print(f"[bold yellow]⚠️  About to: {action} '{resource}'[/]")
+    typer.confirm(f"Confirm 1/2: {action} '{resource}'?", abort=True)
+    typer.confirm(
+        f"Confirm 2/2: really {action} '{resource}'? This may be irreversible.",
+        abort=True,
+    )

endpoint_aiops-0.1.0/endpoint_aiops/cli/_root.py

@@ -0,0 +1,58 @@
+"""Top-level Typer app: assembles sub-apps and top-level commands."""
+
+from __future__ import annotations
+
+import typer
+
+from endpoint_aiops.cli._common import cli_errors
+from endpoint_aiops.cli.doctor import doctor_cmd
+from endpoint_aiops.cli.drift import drift_app
+from endpoint_aiops.cli.endpoint import endpoint_app
+from endpoint_aiops.cli.init import init_cmd
+from endpoint_aiops.cli.overview import overview_cmd
+from endpoint_aiops.cli.secret import secret_app
+from endpoint_aiops.cli.session import session_app
+
+app = typer.Typer(
+    name="endpoint-aiops",
+    help="Governed AI-ops for managed-endpoint fleets (thin clients / VDI).",
+    no_args_is_help=True,
+)
+
+app.add_typer(endpoint_app, name="endpoint")
+app.add_typer(session_app, name="session")
+app.add_typer(drift_app, name="drift")
+app.add_typer(secret_app, name="secret")
+app.command("init")(init_cmd)
+app.command("overview")(overview_cmd)
+app.command("doctor")(doctor_cmd)
+
+
+@app.command("mcp")
+@cli_errors
+def mcp_cmd() -> None:
+    """Start the MCP server (stdio transport).
+
+    Single-command entry point for MCP clients (does not go through uvx/PyPI
+    resolution at launch):
+        endpoint-aiops mcp
+    """
+    import sys
+
+    if sys.version_info < (3, 11):
+        typer.echo(
+            f"ERROR: endpoint-aiops requires Python >= 3.11 "
+            f"(got {sys.version_info.major}.{sys.version_info.minor}).\n"
+            f"Fix: uv python install 3.12 && "
+            f"uv tool install --python 3.12 --force endpoint-aiops",
+            err=True,
+        )
+        raise typer.Exit(2)
+
+    from mcp_server.server import main as _mcp_main
+
+    _mcp_main()
+
+
+if __name__ == "__main__":
+    app()

endpoint_aiops-0.1.0/endpoint_aiops/cli/doctor.py

@@ -0,0 +1,21 @@
+"""Doctor top-level command: environment and connectivity check."""
+
+from __future__ import annotations
+
+from typing import Annotated
+
+import typer
+
+from endpoint_aiops.cli._common import cli_errors
+
+
+@cli_errors
+def doctor_cmd(
+    skip_auth: Annotated[
+        bool, typer.Option("--skip-auth", help="Skip connectivity check (faster)")
+    ] = False,
+) -> None:
+    """Check environment, config, secrets, and connectivity."""
+    from endpoint_aiops.doctor import run_doctor
+
+    raise typer.Exit(run_doctor(skip_auth=skip_auth))

endpoint_aiops-0.1.0/endpoint_aiops/cli/drift.py

@@ -0,0 +1,45 @@
+"""``endpoint-aiops drift`` — patch/config drift + patch-level status."""
+
+from __future__ import annotations
+
+import json
+from typing import Annotated
+
+import typer
+
+from endpoint_aiops.cli._common import TargetOption, cli_errors, console, get_connection
+
+drift_app = typer.Typer(
+    name="drift",
+    help="Fleet drift: config/patch deviation vs a baseline, patch-level status.",
+    no_args_is_help=True,
+)
+
+
+@drift_app.command("report")
+@cli_errors
+def drift_report(target: TargetOption = None) -> None:
+    """Report endpoints drifted from the fleet-majority baseline."""
+    from endpoint_aiops.ops import drift as ops
+    from endpoint_aiops.ops import inventory as inv
+
+    conn, _ = get_connection(target)
+    console.print_json(json.dumps(ops.config_drift(inv.list_endpoints(conn))))
+
+
+@drift_app.command("patch")
+@cli_errors
+def drift_patch(
+    target_patch: Annotated[
+        str | None, typer.Option("--target-patch", help="Desired patch level")
+    ] = None,
+    target: TargetOption = None,
+) -> None:
+    """Patch-level distribution + which endpoints are behind the target."""
+    from endpoint_aiops.ops import drift as ops
+    from endpoint_aiops.ops import inventory as inv
+
+    conn, _ = get_connection(target)
+    console.print_json(
+        json.dumps(ops.patch_status(inv.list_endpoints(conn), target_patch=target_patch))
+    )