holmesgpt 0.12.6__py3-none-any.whl → 0.13.1__py3-none-any.whl

holmes/plugins/toolsets/__init__.py

@@ -20,7 +20,12 @@ from holmes.plugins.toolsets.datadog.toolset_datadog_logs import DatadogLogsTool
 from holmes.plugins.toolsets.datadog.toolset_datadog_metrics import (
     DatadogMetricsToolset,
 )
-from holmes.plugins.toolsets.datadog.toolset_datadog_traces import DatadogTracesToolset
+from holmes.plugins.toolsets.datadog.toolset_datadog_traces import (
+    DatadogTracesToolset,
+)
+from holmes.plugins.toolsets.datadog.toolset_datadog_rds import (
+    DatadogRDSToolset,
+)
 from holmes.plugins.toolsets.git import GitToolset
 from holmes.plugins.toolsets.grafana.toolset_grafana import GrafanaToolset
 from holmes.plugins.toolsets.grafana.toolset_grafana_loki import GrafanaLokiToolset
@@ -39,6 +44,9 @@ from holmes.plugins.toolsets.rabbitmq.toolset_rabbitmq import RabbitMQToolset
 from holmes.plugins.toolsets.robusta.robusta import RobustaToolset
 from holmes.plugins.toolsets.runbook.runbook_fetcher import RunbookToolset
 from holmes.plugins.toolsets.servicenow.servicenow import ServiceNowToolset
+from holmes.plugins.toolsets.investigator.core_investigation import (
+    CoreInvestigationToolset,
+)
 
 THIS_DIR = os.path.abspath(os.path.dirname(__file__))
 
@@ -63,6 +71,7 @@ def load_toolsets_from_file(
 def load_python_toolsets(dal: Optional[SupabaseDal]) -> List[Toolset]:
     logging.debug("loading python toolsets")
     toolsets: list[Toolset] = [
+        CoreInvestigationToolset(),  # Load first for higher priority
         InternetToolset(),
         RobustaToolset(dal),
         OpenSearchToolset(),
@@ -75,6 +84,7 @@ def load_python_toolsets(dal: Optional[SupabaseDal]) -> List[Toolset]:
         DatadogLogsToolset(),
         DatadogMetricsToolset(),
         DatadogTracesToolset(),
+        DatadogRDSToolset(),
         PrometheusToolset(),
         OpenSearchLogsToolset(),
         OpenSearchTracesToolset(),
@@ -152,8 +162,15 @@ def load_toolsets_from_config(
     for name, config in toolsets.items():
         try:
             toolset_type = config.get("type", ToolsetType.BUILTIN.value)
-            # MCP server is not a built-in toolset, so we need to set the type explicitly
+
+            # Resolve env var placeholders before creating the Toolset.
+            # If done after, .override_with() will overwrite resolved values with placeholders
+            # because model_dump() returns the original, unprocessed config from YAML.
+            if config:
+                config = env_utils.replace_env_vars_values(config)
+
             validated_toolset: Optional[Toolset] = None
+            # MCP server is not a built-in toolset, so we need to set the type explicitly
             if toolset_type == ToolsetType.MCP.value:
                 validated_toolset = RemoteMCPToolset(**config, name=name)
             elif strict_check:
@@ -163,10 +180,6 @@ def load_toolsets_from_config(
                     **config, name=name
                 )
 
-            if validated_toolset.config:
-                validated_toolset.config = env_utils.replace_env_vars_values(
-                    validated_toolset.config
-                )
             loaded_toolsets.append(validated_toolset)
         except ValidationError as e:
             logging.warning(f"Toolset '{name}' is invalid: {e}")

holmes/plugins/toolsets/atlas_mongodb/mongodb_atlas.py

@@ -18,6 +18,8 @@ from datetime import datetime, timedelta, timezone
 import os
 from collections import Counter
 
+from holmes.plugins.toolsets.utils import toolset_name_for_one_liner
+
 
 class MongoDBConfig(BaseModel):
     public_key: str
@@ -103,6 +105,7 @@ class MongoDBAtlasBaseTool(Tool):
             )
 
     def get_parameterized_one_liner(self, params) -> str:
+        # Default implementation - will be overridden by subclasses
         return f"MongoDB {self.name} project {self.toolset.config.get('project_id')} {params}"
 
 
@@ -111,6 +114,10 @@ class ReturnProjectAlerts(MongoDBAtlasBaseTool):
     name: str = "atlas_return_project_alerts"
     description: str = "Returns all project alerts. These alerts apply to all components in one project. You receive an alert when a monitored component meets or exceeds a value you set."
 
+    def get_parameterized_one_liner(self, params) -> str:
+        project_id = self.toolset.config.get("project_id", "")
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Get Project Alerts ({project_id})"
+
     def _invoke(self, params: Any) -> StructuredToolResult:
         try:
             url = "https://cloud.mongodb.com/api/atlas/v2/groups/{project_id}/alerts".format(
@@ -132,6 +139,10 @@ class ReturnProjectProcesses(MongoDBAtlasBaseTool):
     name: str = "atlas_return_project_processes"
     description: str = "Returns details of all processes for the specified project. Useful for getting logs and data for specific project"
 
+    def get_parameterized_one_liner(self, params) -> str:
+        project_id = self.toolset.config.get("project_id", "")
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Get Project Processes ({project_id})"
+
     def _invoke(self, params: Any) -> StructuredToolResult:
         try:
             url = "https://cloud.mongodb.com/api/atlas/v2/groups/{project_id}/processes".format(
@@ -161,6 +172,10 @@ class ReturnProjectSlowQueries(MongoDBAtlasBaseTool):
         ),
     }
 
+    def get_parameterized_one_liner(self, params) -> str:
+        process_id = params.get("process_id", "")
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Get Slow Queries ({process_id})"
+
     def _invoke(self, params: Any) -> StructuredToolResult:
         try:
             url = self.url.format(
@@ -184,6 +199,10 @@ class ReturnEventsFromProject(MongoDBAtlasBaseTool):
     description: str = "Returns all events occurrences for the specified project. Events identify significant database, security activities or status changes. can only query the last 4 hours."
     url: str = "https://cloud.mongodb.com/api/atlas/v2/groups/{projectId}/events"
 
+    def get_parameterized_one_liner(self, params) -> str:
+        project_id = self.toolset.config.get("project_id", "")
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Get Project Events ({project_id})"
+
     def _invoke(self, params: Any) -> StructuredToolResult:
         params.update({"itemsPerPage": 500})
         try:
@@ -237,6 +256,10 @@ class ReturnLogsForProcessInProject(MongoDBAtlasBaseTool):
         ),
     }
 
+    def get_parameterized_one_liner(self, params) -> str:
+        hostname = params.get("hostName", "")
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Get Host Logs ({hostname})"
+
     def _invoke(self, params: Any) -> StructuredToolResult:
         one_hour_ago = datetime.now(timezone.utc) - timedelta(hours=1)
         try:
@@ -285,6 +308,10 @@ class ReturnEventTypeFromProject(MongoDBAtlasBaseTool):
         ),
     }
 
+    def get_parameterized_one_liner(self, params) -> str:
+        event_type = params.get("eventType", "")
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Get Event Details ({event_type})"
+
     def _invoke(self, params: Any) -> StructuredToolResult:
         try:
             url = self.url.format(projectId=self.toolset.config.get("project_id"))

holmes/plugins/toolsets/azure_sql/tools/analyze_connection_failures.py

@@ -12,6 +12,7 @@ from holmes.plugins.toolsets.azure_sql.apis.azure_sql_api import AzureSQLAPIClie
 from holmes.plugins.toolsets.azure_sql.apis.connection_failure_api import (
     ConnectionFailureAPI,
 )
+from holmes.plugins.toolsets.utils import toolset_name_for_one_liner
 
 
 class AnalyzeConnectionFailures(BaseAzureSQLTool):
@@ -267,8 +268,7 @@ class AnalyzeConnectionFailures(BaseAzureSQLTool):
 
     def get_parameterized_one_liner(self, params: Dict) -> str:
         db_config = self.toolset.database_config()
-        hours_back = params.get("hours_back", 24)
-        return f"Analyze connection failures for {db_config.server_name}/{db_config.database_name} over {hours_back} hours"
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Analyze Connection Failures ({db_config.server_name}/{db_config.database_name})"
 
     @staticmethod
     def validate_config(

holmes/plugins/toolsets/azure_sql/tools/analyze_database_connections.py

@@ -12,6 +12,7 @@ from holmes.plugins.toolsets.azure_sql.apis.connection_monitoring_api import (
     ConnectionMonitoringAPI,
 )
 from holmes.plugins.toolsets.azure_sql.apis.azure_sql_api import AzureSQLAPIClient
+from holmes.plugins.toolsets.utils import toolset_name_for_one_liner
 
 
 class AnalyzeDatabaseConnections(BaseAzureSQLTool):
@@ -212,7 +213,7 @@ class AnalyzeDatabaseConnections(BaseAzureSQLTool):
 
     def get_parameterized_one_liner(self, params: Dict) -> str:
         db_config = self.toolset.database_config()
-        return f"Analyze database connections for {db_config.server_name}/{db_config.database_name}"
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Analyze Database Connections ({db_config.server_name}/{db_config.database_name})"
 
     @staticmethod
     def validate_config(

holmes/plugins/toolsets/azure_sql/tools/analyze_database_health_status.py

@@ -11,6 +11,8 @@ from holmes.plugins.toolsets.azure_sql.azure_base_toolset import (
 from holmes.plugins.toolsets.azure_sql.apis.azure_sql_api import AzureSQLAPIClient
 from typing import Tuple
 
+from holmes.plugins.toolsets.utils import toolset_name_for_one_liner
+
 
 class AnalyzeDatabaseHealthStatus(BaseAzureSQLTool):
     def __init__(self, toolset: "BaseAzureSQLToolset"):
@@ -156,7 +158,7 @@ class AnalyzeDatabaseHealthStatus(BaseAzureSQLTool):
 
     def get_parameterized_one_liner(self, params: Dict) -> str:
         db_config = self.toolset.database_config()
-        return f"Analyze health status for database {db_config.server_name}/{db_config.database_name}"
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Analyze Health Status ({db_config.server_name}/{db_config.database_name})"
 
     @staticmethod
     def validate_config(

holmes/plugins/toolsets/azure_sql/tools/analyze_database_performance.py

@@ -9,6 +9,7 @@ from holmes.plugins.toolsets.azure_sql.azure_base_toolset import (
     AzureSQLDatabaseConfig,
 )
 from holmes.plugins.toolsets.azure_sql.apis.azure_sql_api import AzureSQLAPIClient
+from holmes.plugins.toolsets.utils import toolset_name_for_one_liner
 
 
 class AnalyzeDatabasePerformance(BaseAzureSQLTool):
@@ -218,7 +219,7 @@ class AnalyzeDatabasePerformance(BaseAzureSQLTool):
 
     def get_parameterized_one_liner(self, params: Dict) -> str:
         db_config = self.toolset.database_config()
-        return f"Analyze performance for database {db_config.server_name}/{db_config.database_name}"
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Analyze Database Performance ({db_config.server_name}/{db_config.database_name})"
 
     @staticmethod
     def validate_config(

holmes/plugins/toolsets/azure_sql/tools/analyze_database_storage.py

@@ -12,6 +12,7 @@ from holmes.plugins.toolsets.azure_sql.apis.storage_analysis_api import (
     StorageAnalysisAPI,
 )
 from holmes.plugins.toolsets.azure_sql.apis.azure_sql_api import AzureSQLAPIClient
+from holmes.plugins.toolsets.utils import toolset_name_for_one_liner
 
 
 class AnalyzeDatabaseStorage(BaseAzureSQLTool):
@@ -319,7 +320,7 @@ class AnalyzeDatabaseStorage(BaseAzureSQLTool):
 
     def get_parameterized_one_liner(self, params: Dict) -> str:
         db_config = self.toolset.database_config()
-        return f"Analyzed database storage for database {db_config.server_name}/{db_config.database_name}"
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Analyze Database Storage ({db_config.server_name}/{db_config.database_name})"
 
     @staticmethod
     def validate_config(

holmes/plugins/toolsets/azure_sql/tools/get_active_alerts.py

@@ -14,6 +14,8 @@ from holmes.plugins.toolsets.azure_sql.apis.alert_monitoring_api import (
 )
 from typing import Tuple
 
+from holmes.plugins.toolsets.utils import toolset_name_for_one_liner
+
 
 class GetActiveAlerts(BaseAzureSQLTool):
     def __init__(self, toolset: "BaseAzureSQLToolset"):
@@ -190,7 +192,7 @@ class GetActiveAlerts(BaseAzureSQLTool):
 
     def get_parameterized_one_liner(self, params: Dict) -> str:
         db_config = self.toolset.database_config()
-        return f"Fetch active alerts for database {db_config.server_name}/{db_config.database_name}"
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Get Active Alerts ({db_config.server_name}/{db_config.database_name})"
 
     @staticmethod
     def validate_config(

holmes/plugins/toolsets/azure_sql/tools/get_slow_queries.py

@@ -9,6 +9,7 @@ from holmes.plugins.toolsets.azure_sql.azure_base_toolset import (
 )
 from holmes.plugins.toolsets.azure_sql.apis.azure_sql_api import AzureSQLAPIClient
 from holmes.plugins.toolsets.azure_sql.utils import format_timing
+from holmes.plugins.toolsets.utils import toolset_name_for_one_liner
 
 
 class GetSlowQueries(BaseAzureSQLTool):
@@ -137,7 +138,7 @@ class GetSlowQueries(BaseAzureSQLTool):
 
     def get_parameterized_one_liner(self, params: Dict) -> str:
         db_config = self.toolset.database_config()
-        return f"Fetch slowest queries for database {db_config.server_name}/{db_config.database_name}"
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Get Slow Queries ({db_config.server_name}/{db_config.database_name})"
 
     @staticmethod
     def validate_config(

holmes/plugins/toolsets/azure_sql/tools/get_top_cpu_queries.py

@@ -9,6 +9,7 @@ from holmes.plugins.toolsets.azure_sql.azure_base_toolset import (
 )
 from holmes.plugins.toolsets.azure_sql.apis.azure_sql_api import AzureSQLAPIClient
 from holmes.plugins.toolsets.azure_sql.utils import format_timing
+from holmes.plugins.toolsets.utils import toolset_name_for_one_liner
 
 
 class GetTopCPUQueries(BaseAzureSQLTool):
@@ -135,7 +136,7 @@ class GetTopCPUQueries(BaseAzureSQLTool):
 
     def get_parameterized_one_liner(self, params: Dict) -> str:
         db_config = self.toolset.database_config()
-        return f"Fetch top CPU consuming queries for database {db_config.server_name}/{db_config.database_name}"
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Get Top CPU Queries ({db_config.server_name}/{db_config.database_name})"
 
     @staticmethod
     def validate_config(

holmes/plugins/toolsets/azure_sql/tools/get_top_data_io_queries.py

@@ -9,6 +9,7 @@ from holmes.plugins.toolsets.azure_sql.azure_base_toolset import (
 )
 from holmes.plugins.toolsets.azure_sql.apis.azure_sql_api import AzureSQLAPIClient
 from holmes.plugins.toolsets.azure_sql.utils import format_timing
+from holmes.plugins.toolsets.utils import toolset_name_for_one_liner
 
 
 class GetTopDataIOQueries(BaseAzureSQLTool):
@@ -153,7 +154,7 @@ class GetTopDataIOQueries(BaseAzureSQLTool):
 
     def get_parameterized_one_liner(self, params: Dict) -> str:
         db_config = self.toolset.database_config()
-        return f"Fetch top data I/O consuming queries for database {db_config.server_name}/{db_config.database_name}"
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Get Top Data I/O Queries ({db_config.server_name}/{db_config.database_name})"
 
     @staticmethod
     def validate_config(

holmes/plugins/toolsets/azure_sql/tools/get_top_log_io_queries.py

@@ -9,6 +9,7 @@ from holmes.plugins.toolsets.azure_sql.azure_base_toolset import (
 )
 from holmes.plugins.toolsets.azure_sql.apis.azure_sql_api import AzureSQLAPIClient
 from holmes.plugins.toolsets.azure_sql.utils import format_timing
+from holmes.plugins.toolsets.utils import toolset_name_for_one_liner
 
 
 class GetTopLogIOQueries(BaseAzureSQLTool):
@@ -145,7 +146,7 @@ class GetTopLogIOQueries(BaseAzureSQLTool):
 
     def get_parameterized_one_liner(self, params: Dict) -> str:
         db_config = self.toolset.database_config()
-        return f"Fetch top log I/O consuming queries for database {db_config.server_name}/{db_config.database_name}"
+        return f"{toolset_name_for_one_liner(self.toolset.name)}: Get Top Log I/O Queries ({db_config.server_name}/{db_config.database_name})"
 
     @staticmethod
     def validate_config(

holmes/plugins/toolsets/bash/argocd/__init__.py

@@ -0,0 +1,65 @@
+import argparse
+from typing import Any, Optional
+
+from holmes.plugins.toolsets.bash.common.bash_command import BashCommand
+from holmes.plugins.toolsets.bash.common.config import BashExecutorConfig
+from holmes.plugins.toolsets.bash.common.stringify import escape_shell_args
+from holmes.plugins.toolsets.bash.argocd.constants import (
+    ALLOWED_ARGOCD_COMMANDS,
+    DENIED_ARGOCD_COMMANDS,
+)
+from holmes.plugins.toolsets.bash.common.validators import (
+    validate_command_and_operations,
+)
+
+
+class ArgocdCommand(BashCommand):
+    def __init__(self):
+        super().__init__("argocd")
+
+    def add_parser(self, parent_parser: Any):
+        """Create Argo CD CLI parser with safe command validation."""
+        argocd_parser = parent_parser.add_parser(
+            "argocd", help="Argo CD Command Line Interface", exit_on_error=False
+        )
+
+        # Add command subparser
+        argocd_parser.add_argument(
+            "command", help="Argo CD command (e.g., app, cluster, proj, repo)"
+        )
+
+        # Capture remaining arguments
+        argocd_parser.add_argument(
+            "options",
+            nargs=argparse.REMAINDER,
+            default=[],
+            help="Argo CD CLI subcommands, operations, and options",
+        )
+        return argocd_parser
+
+    def validate_command(
+        self, command: Any, original_command: str, config: Optional[BashExecutorConfig]
+    ) -> None:
+        if hasattr(command, "options"):
+            validate_command_and_operations(
+                command.command,
+                command.options,
+                ALLOWED_ARGOCD_COMMANDS,
+                DENIED_ARGOCD_COMMANDS,
+            )
+
+    def stringify_command(
+        self, command: Any, original_command: str, config: Optional[BashExecutorConfig]
+    ) -> str:
+        """Convert parsed Argo CD command back to safe command string."""
+        parts = ["argocd", command.command]
+
+        if hasattr(command, "options") and command.options:
+            parts.extend(command.options)
+
+        return " ".join(escape_shell_args(parts))
+
+
+def create_argocd_parser(parent_parser: Any):
+    argocd_command = ArgocdCommand()
+    return argocd_command.add_parser(parent_parser)

holmes/plugins/toolsets/bash/argocd/constants.py

@@ -0,0 +1,120 @@
+ALLOWED_ARGOCD_COMMANDS: dict[str, dict] = {
+    # Application management (read-only)
+    "app": {
+        "list": {},
+        "get": {},
+        "resources": {},
+        "diff": {},
+        "history": {},
+        "manifests": {},
+        "logs": {},
+        "wait": {},  # Wait for app to reach desired state (read-only monitoring)
+    },
+    # Cluster management (read-only)
+    "cluster": {
+        "list": {},
+        "get": {},
+    },
+    # Project management (read-only)
+    "proj": {
+        "list": {},
+        "get": {},
+    },
+    # Repository management (read-only)
+    "repo": {
+        "list": {},
+        "get": {},
+    },
+    # Context management (read-only operations)
+    "context": {},
+    # Version information (completely safe)
+    "version": {},
+    # Account information (read-only)
+    "account": {
+        "list": {},
+        "get": {},
+        "get-user-info": {},
+        "can-i": {},
+    },
+    # Administrative commands (limited read-only)
+    "admin": {
+        "dashboard": {},  # Starts read-only web UI
+        "settings": {},  # Shows/validates settings (read-only)
+    },
+}
+
+DENIED_ARGOCD_COMMANDS: dict[str, dict] = {
+    # Authentication operations (sensitive)
+    "login": {},
+    "logout": {},
+    "relogin": {},
+    # Application lifecycle operations (state-modifying)
+    "app": {
+        "create": {},
+        "delete": {},
+        "sync": {},
+        "rollback": {},
+        "edit": {},
+        "set": {},
+        "unset": {},
+        "patch": {},
+        "delete-resource": {},
+        "terminate-op": {},
+        "actions": {},  # Custom resource actions
+    },
+    # Account management (sensitive)
+    "account": {
+        "generate-token": {},
+        "delete-token": {},
+        "update-password": {},
+        "bcrypt": {},
+    },
+    # Cluster management (state-modifying)
+    "cluster": {
+        "add": {},
+        "rm": {},
+        "set": {},
+        "rotate-auth": {},
+    },
+    # Project management (state-modifying)
+    "proj": {
+        "create": {},
+        "delete": {},
+        "edit": {},
+        "add-source": {},
+        "remove-source": {},
+        "add-destination": {},
+        "remove-destination": {},
+        "add-cluster-resource-whitelist": {},
+        "remove-cluster-resource-whitelist": {},
+        "add-namespace-resource-blacklist": {},
+        "remove-namespace-resource-blacklist": {},
+        "add-cluster-resource-blacklist": {},
+        "remove-cluster-resource-blacklist": {},
+        "add-namespace-resource-whitelist": {},
+        "remove-namespace-resource-whitelist": {},
+        "add-orphaned-ignore": {},
+        "remove-orphaned-ignore": {},
+        "add-signature-key": {},
+        "remove-signature-key": {},
+        "set-orphaned-ignore": {},
+        "add-role": {},
+        "remove-role": {},
+        "add-role-token": {},
+        "delete-role-token": {},
+        "set-role": {},
+    },
+    # Repository management (state-modifying)
+    "repo": {
+        "add": {},
+        "rm": {},
+    },
+    # Certificate management
+    "cert": {},
+    # GPG key management
+    "gpg": {},
+    # Application set operations
+    "appset": {},
+    # Notification operations
+    "notifications": {},
+}

holmes/plugins/toolsets/bash/aws/__init__.py

@@ -0,0 +1,66 @@
+import argparse
+from typing import Any, Optional
+
+from holmes.plugins.toolsets.bash.common.bash_command import BashCommand
+from holmes.plugins.toolsets.bash.common.config import BashExecutorConfig
+from holmes.plugins.toolsets.bash.common.stringify import escape_shell_args
+from holmes.plugins.toolsets.bash.common.validators import (
+    validate_command_and_operations,
+)
+from holmes.plugins.toolsets.bash.aws.constants import (
+    ALLOWED_AWS_COMMANDS,
+    DENIED_AWS_COMMANDS,
+)
+
+
+class AWSCommand(BashCommand):
+    def __init__(self):
+        super().__init__("aws")
+
+    def add_parser(self, parent_parser: Any):
+        """Create AWS CLI parser with safe command validation."""
+        aws_parser = parent_parser.add_parser(
+            "aws",
+            help="Amazon Web Services Command Line Interface",
+            exit_on_error=False,
+        )
+
+        aws_parser.add_argument(
+            "service",
+            help="AWS service name (e.g., ec2, s3, lambda)",
+        )
+
+        aws_parser.add_argument("operation", help="AWS operation to perform")
+
+        aws_parser.add_argument(
+            "options",
+            nargs=argparse.REMAINDER,
+            default=[],
+            help="Additional AWS CLI options and parameters",
+        )
+        return aws_parser
+
+    def validate_command(
+        self, command: Any, original_command: str, config: Optional[BashExecutorConfig]
+    ) -> None:
+        # Build options list with operation and remaining arguments
+        options = [command.operation] + (
+            command.options if hasattr(command, "options") else []
+        )
+        validate_command_and_operations(
+            command=command.service,
+            options=options,
+            allowed_commands=ALLOWED_AWS_COMMANDS,
+            denied_commands=DENIED_AWS_COMMANDS,
+        )
+
+    def stringify_command(
+        self, command: Any, original_command: str, config: Optional[BashExecutorConfig]
+    ) -> str:
+        """Convert parsed AWS command back to safe command string."""
+        parts = ["aws", command.service, command.operation]
+
+        if hasattr(command, "options") and command.options:
+            parts.extend(command.options)
+
+        return " ".join(escape_shell_args(parts))