holmesgpt 0.13.0__py3-none-any.whl → 0.13.2__py3-none-any.whl

holmes/plugins/toolsets/bash/argocd/constants.py

@@ -0,0 +1,120 @@
+ALLOWED_ARGOCD_COMMANDS: dict[str, dict] = {
+    # Application management (read-only)
+    "app": {
+        "list": {},
+        "get": {},
+        "resources": {},
+        "diff": {},
+        "history": {},
+        "manifests": {},
+        "logs": {},
+        "wait": {},  # Wait for app to reach desired state (read-only monitoring)
+    },
+    # Cluster management (read-only)
+    "cluster": {
+        "list": {},
+        "get": {},
+    },
+    # Project management (read-only)
+    "proj": {
+        "list": {},
+        "get": {},
+    },
+    # Repository management (read-only)
+    "repo": {
+        "list": {},
+        "get": {},
+    },
+    # Context management (read-only operations)
+    "context": {},
+    # Version information (completely safe)
+    "version": {},
+    # Account information (read-only)
+    "account": {
+        "list": {},
+        "get": {},
+        "get-user-info": {},
+        "can-i": {},
+    },
+    # Administrative commands (limited read-only)
+    "admin": {
+        "dashboard": {},  # Starts read-only web UI
+        "settings": {},  # Shows/validates settings (read-only)
+    },
+}
+
+DENIED_ARGOCD_COMMANDS: dict[str, dict] = {
+    # Authentication operations (sensitive)
+    "login": {},
+    "logout": {},
+    "relogin": {},
+    # Application lifecycle operations (state-modifying)
+    "app": {
+        "create": {},
+        "delete": {},
+        "sync": {},
+        "rollback": {},
+        "edit": {},
+        "set": {},
+        "unset": {},
+        "patch": {},
+        "delete-resource": {},
+        "terminate-op": {},
+        "actions": {},  # Custom resource actions
+    },
+    # Account management (sensitive)
+    "account": {
+        "generate-token": {},
+        "delete-token": {},
+        "update-password": {},
+        "bcrypt": {},
+    },
+    # Cluster management (state-modifying)
+    "cluster": {
+        "add": {},
+        "rm": {},
+        "set": {},
+        "rotate-auth": {},
+    },
+    # Project management (state-modifying)
+    "proj": {
+        "create": {},
+        "delete": {},
+        "edit": {},
+        "add-source": {},
+        "remove-source": {},
+        "add-destination": {},
+        "remove-destination": {},
+        "add-cluster-resource-whitelist": {},
+        "remove-cluster-resource-whitelist": {},
+        "add-namespace-resource-blacklist": {},
+        "remove-namespace-resource-blacklist": {},
+        "add-cluster-resource-blacklist": {},
+        "remove-cluster-resource-blacklist": {},
+        "add-namespace-resource-whitelist": {},
+        "remove-namespace-resource-whitelist": {},
+        "add-orphaned-ignore": {},
+        "remove-orphaned-ignore": {},
+        "add-signature-key": {},
+        "remove-signature-key": {},
+        "set-orphaned-ignore": {},
+        "add-role": {},
+        "remove-role": {},
+        "add-role-token": {},
+        "delete-role-token": {},
+        "set-role": {},
+    },
+    # Repository management (state-modifying)
+    "repo": {
+        "add": {},
+        "rm": {},
+    },
+    # Certificate management
+    "cert": {},
+    # GPG key management
+    "gpg": {},
+    # Application set operations
+    "appset": {},
+    # Notification operations
+    "notifications": {},
+}

holmes/plugins/toolsets/bash/aws/__init__.py

@@ -0,0 +1,66 @@
+import argparse
+from typing import Any, Optional
+
+from holmes.plugins.toolsets.bash.common.bash_command import BashCommand
+from holmes.plugins.toolsets.bash.common.config import BashExecutorConfig
+from holmes.plugins.toolsets.bash.common.stringify import escape_shell_args
+from holmes.plugins.toolsets.bash.common.validators import (
+    validate_command_and_operations,
+)
+from holmes.plugins.toolsets.bash.aws.constants import (
+    ALLOWED_AWS_COMMANDS,
+    DENIED_AWS_COMMANDS,
+)
+
+
+class AWSCommand(BashCommand):
+    def __init__(self):
+        super().__init__("aws")
+
+    def add_parser(self, parent_parser: Any):
+        """Create AWS CLI parser with safe command validation."""
+        aws_parser = parent_parser.add_parser(
+            "aws",
+            help="Amazon Web Services Command Line Interface",
+            exit_on_error=False,
+        )
+
+        aws_parser.add_argument(
+            "service",
+            help="AWS service name (e.g., ec2, s3, lambda)",
+        )
+
+        aws_parser.add_argument("operation", help="AWS operation to perform")
+
+        aws_parser.add_argument(
+            "options",
+            nargs=argparse.REMAINDER,
+            default=[],
+            help="Additional AWS CLI options and parameters",
+        )
+        return aws_parser
+
+    def validate_command(
+        self, command: Any, original_command: str, config: Optional[BashExecutorConfig]
+    ) -> None:
+        # Build options list with operation and remaining arguments
+        options = [command.operation] + (
+            command.options if hasattr(command, "options") else []
+        )
+        validate_command_and_operations(
+            command=command.service,
+            options=options,
+            allowed_commands=ALLOWED_AWS_COMMANDS,
+            denied_commands=DENIED_AWS_COMMANDS,
+        )
+
+    def stringify_command(
+        self, command: Any, original_command: str, config: Optional[BashExecutorConfig]
+    ) -> str:
+        """Convert parsed AWS command back to safe command string."""
+        parts = ["aws", command.service, command.operation]
+
+        if hasattr(command, "options") and command.options:
+            parts.extend(command.options)
+
+        return " ".join(escape_shell_args(parts))