holmesgpt 0.13.0__tar.gz → 0.13.1__tar.gz

{holmesgpt-0.13.0 → holmesgpt-0.13.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.1
 Name: holmesgpt
-Version: 0.13.0
+Version: 0.13.1
 Summary: 
 Author: Natan Yellin
 Author-email: natan@robusta.dev

{holmesgpt-0.13.0 → holmesgpt-0.13.1}/holmes/__init__.py

@@ -1,5 +1,5 @@
 # This is patched by github actions during release
-__version__ = "0.13.0"
+__version__ = "0.13.1"
 
 # Re-export version functions from version module for backward compatibility
 from .version import (

{holmesgpt-0.13.0 → holmesgpt-0.13.1}/holmes/common/env_vars.py

@@ -34,6 +34,7 @@ LOG_PERFORMANCE = os.environ.get("LOG_PERFORMANCE", None)
 
 
 ENABLE_TELEMETRY = load_bool("ENABLE_TELEMETRY", False)
+DEVELOPMENT_MODE = load_bool("DEVELOPMENT_MODE", False)
 SENTRY_DSN = os.environ.get("SENTRY_DSN", "")
 SENTRY_TRACES_SAMPLE_RATE = float(os.environ.get("SENTRY_TRACES_SAMPLE_RATE", "0.0"))
 
@@ -63,3 +64,6 @@ TOOL_SCHEMA_NO_PARAM_OBJECT_IF_NO_PARAMS = load_bool(
 MAX_OUTPUT_TOKEN_RESERVATION = int(
     os.environ.get("MAX_OUTPUT_TOKEN_RESERVATION", 16384)
 )  ## 16k
+
+# When using the bash tool, setting BASH_TOOL_UNSAFE_ALLOW_ALL will skip any command validation and run any command requested by the LLM
+BASH_TOOL_UNSAFE_ALLOW_ALL = load_bool("BASH_TOOL_UNSAFE_ALLOW_ALL", False)

{holmesgpt-0.13.0 → holmesgpt-0.13.1}/holmes/core/llm.py

@@ -119,7 +119,9 @@ class DefaultLLM(LLM):
                     "environment variable for proper functionality. For more information, refer to the documentation: "
                     "https://docs.litellm.ai/docs/providers/watsonx#usage---models-in-deployment-spaces"
                 )
-        elif provider == "bedrock" and os.environ.get("AWS_PROFILE"):
+        elif provider == "bedrock" and (
+            os.environ.get("AWS_PROFILE") or os.environ.get("AWS_BEARER_TOKEN_BEDROCK")
+        ):
             model_requirements = {"keys_in_environment": True, "missing_keys": []}
         else:
             #

{holmesgpt-0.13.0 → holmesgpt-0.13.1}/holmes/core/tool_calling_llm.py

@@ -10,7 +10,7 @@ from openai import BadRequestError
 from openai.types.chat.chat_completion_message_tool_call import (
     ChatCompletionMessageToolCall,
 )
-from pydantic import BaseModel
+from pydantic import BaseModel, Field
 from rich.console import Console
 
 from holmes.common.env_vars import TEMPERATURE, MAX_OUTPUT_TOKEN_RESERVATION
@@ -43,6 +43,78 @@ from holmes.core.todo_manager import (
     get_todo_manager,
 )
 
+# Create a named logger for cost tracking
+cost_logger = logging.getLogger("holmes.costs")
+
+
+class LLMCosts(BaseModel):
+    """Tracks cost and token usage for LLM calls."""
+
+    total_cost: float = 0.0
+    total_tokens: int = 0
+    prompt_tokens: int = 0
+    completion_tokens: int = 0
+
+
+def _extract_cost_from_response(full_response) -> float:
+    """Extract cost value from LLM response.
+
+    Args:
+        full_response: The raw LLM response object
+
+    Returns:
+        The cost as a float, or 0.0 if not available
+    """
+    try:
+        cost_value = (
+            full_response._hidden_params.get("response_cost", 0)
+            if hasattr(full_response, "_hidden_params")
+            else 0
+        )
+        # Ensure cost is a float
+        return float(cost_value) if cost_value is not None else 0.0
+    except Exception:
+        return 0.0
+
+
+def _process_cost_info(
+    full_response, costs: Optional[LLMCosts] = None, log_prefix: str = "LLM call"
+) -> None:
+    """Process cost and token information from LLM response.
+
+    Logs the cost information and optionally accumulates it into a costs object.
+
+    Args:
+        full_response: The raw LLM response object
+        costs: Optional LLMCosts object to accumulate costs into
+        log_prefix: Prefix for logging messages (e.g., "LLM call", "Post-processing")
+    """
+    try:
+        cost = _extract_cost_from_response(full_response)
+        usage = getattr(full_response, "usage", {})
+
+        if usage:
+            prompt_toks = usage.get("prompt_tokens", 0)
+            completion_toks = usage.get("completion_tokens", 0)
+            total_toks = usage.get("total_tokens", 0)
+            cost_logger.debug(
+                f"{log_prefix} cost: ${cost:.6f} | Tokens: {prompt_toks} prompt + {completion_toks} completion = {total_toks} total"
+            )
+            # Accumulate costs and tokens if costs object provided
+            if costs:
+                costs.total_cost += cost
+                costs.prompt_tokens += prompt_toks
+                costs.completion_tokens += completion_toks
+                costs.total_tokens += total_toks
+        elif cost > 0:
+            cost_logger.debug(
+                f"{log_prefix} cost: ${cost:.6f} | Token usage not available"
+            )
+            if costs:
+                costs.total_cost += cost
+    except Exception as e:
+        logging.debug(f"Could not extract cost information: {e}")
+
 
 def format_tool_result_data(tool_result: StructuredToolResult) -> str:
     tool_response = tool_result.data
@@ -186,11 +258,11 @@ class ToolCallResult(BaseModel):
         }
 
 
-class LLMResult(BaseModel):
+class LLMResult(LLMCosts):
     tool_calls: Optional[List[ToolCallResult]] = None
     result: Optional[str] = None
     unprocessed_result: Optional[str] = None
-    instructions: List[str] = []
+    instructions: List[str] = Field(default_factory=list)
     # TODO: clean up these two
     prompt: Optional[str] = None
     messages: Optional[List[dict]] = None
@@ -259,6 +331,8 @@ class ToolCallingLLM:
     ) -> LLMResult:
         perf_timing = PerformanceTiming("tool_calling_llm.call")
         tool_calls = []  # type: ignore
+        costs = LLMCosts()
+
         tools = self.tool_executor.get_all_tools_openai_format(
             target_model=self.llm.model
         )
@@ -299,6 +373,9 @@ class ToolCallingLLM:
                 )
                 logging.debug(f"got response {full_response.to_json()}")  # type: ignore
 
+                # Extract and accumulate cost information
+                _process_cost_info(full_response, costs, "LLM call")
+
                 perf_timing.measure("llm.completion")
             # catch a known error that occurs with Azure and replace the error message with something more obvious to the user
             except BadRequestError as e:
@@ -352,11 +429,14 @@ class ToolCallingLLM:
                 if post_process_prompt and user_prompt:
                     logging.info("Running post processing on investigation.")
                     raw_response = text_response
-                    post_processed_response = self._post_processing_call(
-                        prompt=user_prompt,
-                        investigation=raw_response,
-                        user_prompt=post_process_prompt,
+                    post_processed_response, post_processing_cost = (
+                        self._post_processing_call(
+                            prompt=user_prompt,
+                            investigation=raw_response,
+                            user_prompt=post_process_prompt,
+                        )
                     )
+                    costs.total_cost += post_processing_cost
 
                     perf_timing.end(f"- completed in {i} iterations -")
                     return LLMResult(
@@ -365,6 +445,7 @@ class ToolCallingLLM:
                         tool_calls=tool_calls,
                         prompt=json.dumps(messages, indent=2),
                         messages=messages,
+                        **costs.model_dump(),  # Include all cost fields
                     )
 
                 perf_timing.end(f"- completed in {i} iterations -")
@@ -373,6 +454,7 @@ class ToolCallingLLM:
                     tool_calls=tool_calls,
                     prompt=json.dumps(messages, indent=2),
                     messages=messages,
+                    **costs.model_dump(),  # Include all cost fields
                 )
 
             if text_response and text_response.strip():
@@ -403,6 +485,9 @@ class ToolCallingLLM:
 
                     perf_timing.measure(f"tool completed {tool_call_result.tool_name}")
 
+                # Update the tool number offset for the next iteration
+                tool_number_offset += len(tools_to_call)
+
                 # Add a blank line after all tools in this batch complete
                 if tools_to_call:
                     logging.info("")
@@ -540,7 +625,7 @@ class ToolCallingLLM:
         investigation,
         user_prompt: Optional[str] = None,
         system_prompt: str = "You are an AI assistant summarizing Kubernetes issues.",
-    ) -> Optional[str]:
+    ) -> tuple[Optional[str], float]:
         try:
             user_prompt = ToolCallingLLM.__load_post_processing_user_prompt(
                 prompt, investigation, user_prompt
@@ -559,10 +644,18 @@ class ToolCallingLLM:
             ]
             full_response = self.llm.completion(messages=messages, temperature=0)
             logging.debug(f"Post processing response {full_response}")
-            return full_response.choices[0].message.content  # type: ignore
+
+            # Extract and log cost information for post-processing
+            post_processing_cost = _extract_cost_from_response(full_response)
+            if post_processing_cost > 0:
+                cost_logger.debug(
+                    f"Post-processing LLM cost: ${post_processing_cost:.6f}"
+                )
+
+            return full_response.choices[0].message.content, post_processing_cost  # type: ignore
         except Exception:
             logging.exception("Failed to run post processing", exc_info=True)
-            return investigation
+            return investigation, 0.0
 
     @sentry_sdk.trace
     def truncate_messages_to_fit_context(
@@ -602,6 +695,7 @@ class ToolCallingLLM:
         perf_timing.measure("get_all_tools_openai_format")
         max_steps = self.max_steps
         i = 0
+        tool_number_offset = 0
 
         while i < max_steps:
             i += 1
@@ -634,6 +728,10 @@ class ToolCallingLLM:
                     stream=False,
                     drop_params=True,
                 )
+
+                # Log cost information for this iteration (no accumulation in streaming)
+                _process_cost_info(full_response, log_prefix="LLM iteration")
+
                 perf_timing.measure("llm.completion")
             # catch a known error that occurs with Azure and replace the error message with something more obvious to the user
             except BadRequestError as e:
@@ -695,7 +793,7 @@ class ToolCallingLLM:
                             tool_to_call=t,  # type: ignore
                             previous_tool_calls=tool_calls,
                             trace_span=DummySpan(),  # Streaming mode doesn't support tracing yet
-                            tool_number=tool_index,
+                            tool_number=tool_number_offset + tool_index,
                         )
                     )
                     yield StreamMessage(
@@ -716,6 +814,9 @@ class ToolCallingLLM:
                         data=tool_call_result.as_streaming_tool_result_response(),
                     )
 
+                # Update the tool number offset for the next iteration
+                tool_number_offset += len(tools_to_call)
+
         raise Exception(
             f"Too many LLM calls - exceeded max_steps: {i}/{self.max_steps}"
         )

{holmesgpt-0.13.0 → holmesgpt-0.13.1}/holmes/core/toolset_manager.py

@@ -266,11 +266,7 @@ class ToolsetManager:
                 toolset.path = cached_status.get("path", None)
             # check prerequisites for only enabled toolset when the toolset is loaded from cache. When the toolset is
             # not loaded from cache, the prerequisites are checked in the refresh_toolset_status method.
-            if (
-                toolset.enabled
-                and toolset.status == ToolsetStatusEnum.ENABLED
-                and using_cached
-            ):
+            if toolset.enabled and toolset.status == ToolsetStatusEnum.ENABLED:
                 enabled_toolsets_from_cache.append(toolset)
         self.check_toolset_prerequisites(enabled_toolsets_from_cache)
 

{holmesgpt-0.13.0 → holmesgpt-0.13.1}/holmes/core/tracing.py

@@ -120,7 +120,7 @@ class DummySpan:
 class DummyTracer:
     """A no-op tracer implementation for when tracing is disabled."""
 
-    def start_experiment(self, experiment_name=None, metadata=None):
+    def start_experiment(self, experiment_name=None, additional_metadata=None):
         """No-op experiment creation."""
         return None
 

{holmesgpt-0.13.0 → holmesgpt-0.13.1}/holmes/main.py

@@ -104,6 +104,11 @@ opt_verbose: Optional[List[bool]] = typer.Option(
     "-v",
     help="Verbose output. You can pass multiple times to increase the verbosity. e.g. -v or -vv or -vvv",
 )
+opt_log_costs: bool = typer.Option(
+    False,
+    "--log-costs",
+    help="Show LLM cost information in the output",
+)
 opt_echo_request: bool = typer.Option(
     True,
     "--echo/--no-echo",
@@ -176,6 +181,7 @@ def ask(
     custom_toolsets: Optional[List[Path]] = opt_custom_toolsets,
     max_steps: Optional[int] = opt_max_steps,
     verbose: Optional[List[bool]] = opt_verbose,
+    log_costs: bool = opt_log_costs,
     # semi-common options
     destination: Optional[DestinationType] = opt_destination,
     slack_token: Optional[str] = opt_slack_token,
@@ -219,7 +225,7 @@ def ask(
     """
     Ask any question and answer using available tools
     """
-    console = init_logging(verbose)  # type: ignore
+    console = init_logging(verbose, log_costs)  # type: ignore
     # Detect and read piped input
     piped_data = None
 

{holmesgpt-0.13.0 → holmesgpt-0.13.1}/holmes/plugins/prompts/_fetch_logs.jinja2

@@ -4,6 +4,7 @@
 {%- set k8s_yaml_ts = toolsets | selectattr("name", "equalto", "kubernetes/logs") | rejectattr("fetch_pod_logs", "defined") | first -%}
 {%- set opensearch_ts = toolsets | selectattr("name", "equalto", "opensearch/logs") | first -%}
 {%- set datadog_ts = toolsets | selectattr("name", "equalto", "datadog/logs") | first -%}
+{%- set bash_ts = toolsets | selectattr("name", "equalto", "bash") | first -%}
 
 ## Logs
 
@@ -44,6 +45,9 @@ Tools to search and fetch logs from Kubernetes.
 * Check both kubectl_logs and kubectl_previous_logs because a pod restart mean kubectl_logs may not have relevant logs
 {%- elif opensearch_ts and opensearch_ts.status == "enabled" -%}
 {% include '_default_log_prompt.jinja2' %}
+{%- elif bash_ts and bash_ts.status == "enabled" -%}
+Use the tool `run_bash_command` to run `kubectl logs` commands and fetch any relevant pod logs.
+DO NOT use `--tail` or `| tail` when calling `kubectl logs` because you may miss critical information.
 {%- else -%}
 * You have not been given access to tools to fetch kubernetes logs for nodes, pods, services or apps. This is likely a misconfiguration.
 * If you need logs to answer questions or investigate issues, tell the user to configure the documentation and enable one of these toolsets:

holmesgpt-0.13.1/holmes/plugins/runbooks/CLAUDE.md

@@ -0,0 +1,85 @@
+You are an expert in automated diagnostics and runbook creation for an AI-driven troubleshooting agents. I will provide you with one or more issue descriptions or test scenarios.
+
+Your task is to generate a strictly executable runbook for AI Agent to follow. The runbook should be machine-readable but human-understandable, and must include the following sections:
+
+# Runbook Content Structure
+
+## 1. Goal
+- **Primary Objective:** Clearly define the specific category of issues this runbook addresses (e.g., "diagnose network connectivity problems", "troubleshoot pod startup failures", "investigate performance degradation").
+- **Scope:** Specify the environment, technology stack, or system components covered by this runbook.
+- **Agent Mandate:** Explicitly state that the AI agent must follow the workflow steps sequentially and systematically without deviation to ensure consistent, thorough troubleshooting.
+- **Expected Outcome:** Define what successful completion of this runbook should achieve (root cause identification, issue resolution, or escalation criteria).
+
+## 2. Workflow for [Issue Category] Diagnosis
+- Provide numbered, sequential steps the AI agent must execute in order.
+- Each step should specify:
+  - **Action:** Describe the diagnostic function conceptually (e.g., "retrieve container logs from specified pod", "check service connectivity between components", "examine resource utilization metrics")
+  - **Function Description:** Explain what the function should accomplish rather than naming specific tools (e.g., "query the cluster to list all pods in a namespace and their current status" instead of "kubectl_get_pods()")
+  - **Parameters:** What data/arguments to pass to the function (namespace, pod name, time range, etc.)
+  - **Expected Output:** What information to gather from the result (status codes, error messages, metrics, configurations)
+  - **Success/Failure Criteria:** How to interpret the output and what indicates normal vs. problematic conditions
+- Use conditional logic (IF/ELSE) when branching is required based on findings.
+- Describe functions generically so they can be mapped to available tools (e.g., "execute a command to test network connectivity" rather than "ping_host()")
+- Include verification steps to confirm each diagnostic action was successful.
+
+## 3. Synthesize Findings
+- **Data Correlation:** Describe how the AI agent should combine outputs from multiple workflow steps.
+- **Pattern Recognition:** Specify what patterns, error messages, or metrics indicate specific root causes.
+- **Prioritization Logic:** Provide criteria for ranking potential causes by likelihood or severity.
+- **Evidence Requirements:** Define what evidence is needed to confidently identify each potential root cause.
+- **Example Scenarios:** Include sample synthesis statements showing how findings should be summarized.
+
+## 4. Recommended Remediation Steps
+- **Immediate Actions:** List temporary workarounds or urgent fixes for critical issues.
+- **Permanent Solutions:** Provide step-by-step permanent remediation procedures.
+- **Verification Steps:** Define how to confirm each remediation action was successful.
+- **Documentation References:** Include links to official documentation, best practices, or vendor guidance.
+- **Escalation Criteria:** Specify when and how to escalate if remediation steps fail.
+- **Post-Remediation Monitoring:** Describe what to monitor to prevent recurrence.
+
+# File Organization Guidelines
+
+## Folder Structure
+*Category folders are used to distinguish and categorize different runbooks based on their focus area or technology domain. Each runbook must be placed into a specific category folder under `holmes/plugins/runbooks/` for better organization and discoverability. Create a new category folder if your runbook doesn't fit into existing categories.*
+
+## File Naming
+*Use consistent naming conventions for runbook files:*
+
+- Use descriptive, lowercase names with hyphens: `dns-resolution-troubleshooting.md`
+- Include the issue type or technology: `redis-connection-issues.md`
+- Avoid generic names like `troubleshooting.md` or `debug.md`
+
+### Catalog Registration
+After creating your runbook, you must add an entry to `catalog.json` in the runbooks directory to make it discoverable by AI agents.
+
+**Steps to add a new catalog entry:**
+
+1. **Open** `holmes/plugins/runbooks/catalog.json`
+2. **Add your entry** to the JSON array following this structure:
+   ```json
+   {
+     "name": "Brief, descriptive name of the runbook",
+     "path": "category-folder/your-runbook-filename.md",
+     "description": "Clear description of what issues this runbook addresses",
+     "tags": ["relevant", "tags", "for", "search"]
+   }
+   ```
+
+3. **Ensure proper JSON formatting** - add a comma after the previous entry if needed
+4. **Validate the JSON** is properly formatted before committing
+
+**Field Guidelines:**
+- `name`: Keep concise but descriptive (e.g., "Redis Connection Issues")
+- `path`: Always include the category folder (e.g., "database/redis-connection-issues.md")
+- `description`: Explain what specific problems this runbook solves
+- `tags`: Include technology names, issue types, and relevant keywords
+
+Example catalog entry:
+```json
+{
+  "name": "DNS Resolution Troubleshooting",
+  "path": "networking/dns-resolution-troubleshooting.md",
+  "description": "Comprehensive guide for diagnosing and resolving DNS resolution issues in Kubernetes clusters",
+  "tags": ["dns", "networking", "kubernetes", "troubleshooting"]
+}
+```

holmesgpt-0.13.1/holmes/plugins/runbooks/README.md

@@ -0,0 +1,46 @@
+# Runbooks
+
+Runbooks folder contains operational runbooks for the HolmesGPT project. Runbooks provide step-by-step instructions for common tasks, troubleshooting, and maintenance procedures related to the plugins in this directory.
+
+## Purpose
+
+- Standardize operational processes
+- Enable quick onboarding for new team members
+- Reduce downtime by providing clear troubleshooting steps
+
+## Structure
+
+### Structured Runbook
+
+Structured runbooks are designed for specific issues when conditions like issue name, id or source match, the corresponding instructions will be returned for investigation.
+For example, the investigation in [kube-prometheus-stack.yaml](kube-prometheus-stack.yaml) will be returned when the issue to be investigated match either KubeSchedulerDown or KubeControllerManagerDown.
+This runbook is mainly used for `holmes investigate`
+
+### Catalog
+
+Catalog specified in [catalog.json](catalog.json) contains a collection of runbooks written in markdown.
+During runtime, LLM will compare the runbook description with the user question and return the most matched runbook for investigation. It's possible no runbook is returned for no match.
+
+## Generating Runbooks
+
+To ensure all runbooks follow a consistent format and improve troubleshooting accuracy, contributors should use the standardized [runbook format prompt](runbook-format.prompt.md) when creating new runbooks.
+
+### Using the Runbook Format Prompt
+
+1. **Start with the Template**: Use `prompt.md` as your guide when creating new runbooks
+2. **Follow the Structure**: Ensure your runbook includes all required sections:
+   - **Goal**: Clear definition of issues addressed and agent mandate
+   - **Workflow**: Sequential diagnostic steps with detailed function descriptions
+   - **Synthesize Findings**: Logic for combining outputs and identifying root causes
+   - **Recommended Remediation Steps**: Both immediate and permanent solutions
+
+### Benefits of Using the Standard Format
+
+- **Consistency**: All runbooks follow the same structure and terminology
+- **AI Agent Compatibility**: Ensures runbooks are machine-readable and executable by AI agents
+- **Improved Accuracy**: Standardized format reduces ambiguity and improves diagnostic success rates
+- **Maintainability**: Easier to update and maintain runbooks across the project
+
+### Example Usage
+
+When creating a runbook for a new issue category (e.g., storage problems, authentication failures), provide the issue description to an LLM along with the prompt template to generate a properly formatted runbook that follows the established patterns.

holmesgpt-0.13.1/holmes/plugins/toolsets/bash/argocd/__init__.py

@@ -0,0 +1,65 @@
+import argparse
+from typing import Any, Optional
+
+from holmes.plugins.toolsets.bash.common.bash_command import BashCommand
+from holmes.plugins.toolsets.bash.common.config import BashExecutorConfig
+from holmes.plugins.toolsets.bash.common.stringify import escape_shell_args
+from holmes.plugins.toolsets.bash.argocd.constants import (
+    ALLOWED_ARGOCD_COMMANDS,
+    DENIED_ARGOCD_COMMANDS,
+)
+from holmes.plugins.toolsets.bash.common.validators import (
+    validate_command_and_operations,
+)
+
+
+class ArgocdCommand(BashCommand):
+    def __init__(self):
+        super().__init__("argocd")
+
+    def add_parser(self, parent_parser: Any):
+        """Create Argo CD CLI parser with safe command validation."""
+        argocd_parser = parent_parser.add_parser(
+            "argocd", help="Argo CD Command Line Interface", exit_on_error=False
+        )
+
+        # Add command subparser
+        argocd_parser.add_argument(
+            "command", help="Argo CD command (e.g., app, cluster, proj, repo)"
+        )
+
+        # Capture remaining arguments
+        argocd_parser.add_argument(
+            "options",
+            nargs=argparse.REMAINDER,
+            default=[],
+            help="Argo CD CLI subcommands, operations, and options",
+        )
+        return argocd_parser
+
+    def validate_command(
+        self, command: Any, original_command: str, config: Optional[BashExecutorConfig]
+    ) -> None:
+        if hasattr(command, "options"):
+            validate_command_and_operations(
+                command.command,
+                command.options,
+                ALLOWED_ARGOCD_COMMANDS,
+                DENIED_ARGOCD_COMMANDS,
+            )
+
+    def stringify_command(
+        self, command: Any, original_command: str, config: Optional[BashExecutorConfig]
+    ) -> str:
+        """Convert parsed Argo CD command back to safe command string."""
+        parts = ["argocd", command.command]
+
+        if hasattr(command, "options") and command.options:
+            parts.extend(command.options)
+
+        return " ".join(escape_shell_args(parts))
+
+
+def create_argocd_parser(parent_parser: Any):
+    argocd_command = ArgocdCommand()
+    return argocd_command.add_parser(parent_parser)

holmesgpt-0.13.1/holmes/plugins/toolsets/bash/argocd/constants.py

@@ -0,0 +1,120 @@
+ALLOWED_ARGOCD_COMMANDS: dict[str, dict] = {
+    # Application management (read-only)
+    "app": {
+        "list": {},
+        "get": {},
+        "resources": {},
+        "diff": {},
+        "history": {},
+        "manifests": {},
+        "logs": {},
+        "wait": {},  # Wait for app to reach desired state (read-only monitoring)
+    },
+    # Cluster management (read-only)
+    "cluster": {
+        "list": {},
+        "get": {},
+    },
+    # Project management (read-only)
+    "proj": {
+        "list": {},
+        "get": {},
+    },
+    # Repository management (read-only)
+    "repo": {
+        "list": {},
+        "get": {},
+    },
+    # Context management (read-only operations)
+    "context": {},
+    # Version information (completely safe)
+    "version": {},
+    # Account information (read-only)
+    "account": {
+        "list": {},
+        "get": {},
+        "get-user-info": {},
+        "can-i": {},
+    },
+    # Administrative commands (limited read-only)
+    "admin": {
+        "dashboard": {},  # Starts read-only web UI
+        "settings": {},  # Shows/validates settings (read-only)
+    },
+}
+
+DENIED_ARGOCD_COMMANDS: dict[str, dict] = {
+    # Authentication operations (sensitive)
+    "login": {},
+    "logout": {},
+    "relogin": {},
+    # Application lifecycle operations (state-modifying)
+    "app": {
+        "create": {},
+        "delete": {},
+        "sync": {},
+        "rollback": {},
+        "edit": {},
+        "set": {},
+        "unset": {},
+        "patch": {},
+        "delete-resource": {},
+        "terminate-op": {},
+        "actions": {},  # Custom resource actions
+    },
+    # Account management (sensitive)
+    "account": {
+        "generate-token": {},
+        "delete-token": {},
+        "update-password": {},
+        "bcrypt": {},
+    },
+    # Cluster management (state-modifying)
+    "cluster": {
+        "add": {},
+        "rm": {},
+        "set": {},
+        "rotate-auth": {},
+    },
+    # Project management (state-modifying)
+    "proj": {
+        "create": {},
+        "delete": {},
+        "edit": {},
+        "add-source": {},
+        "remove-source": {},
+        "add-destination": {},
+        "remove-destination": {},
+        "add-cluster-resource-whitelist": {},
+        "remove-cluster-resource-whitelist": {},
+        "add-namespace-resource-blacklist": {},
+        "remove-namespace-resource-blacklist": {},
+        "add-cluster-resource-blacklist": {},
+        "remove-cluster-resource-blacklist": {},
+        "add-namespace-resource-whitelist": {},
+        "remove-namespace-resource-whitelist": {},
+        "add-orphaned-ignore": {},
+        "remove-orphaned-ignore": {},
+        "add-signature-key": {},
+        "remove-signature-key": {},
+        "set-orphaned-ignore": {},
+        "add-role": {},
+        "remove-role": {},
+        "add-role-token": {},
+        "delete-role-token": {},
+        "set-role": {},
+    },
+    # Repository management (state-modifying)
+    "repo": {
+        "add": {},
+        "rm": {},
+    },
+    # Certificate management
+    "cert": {},
+    # GPG key management
+    "gpg": {},
+    # Application set operations
+    "appset": {},
+    # Notification operations
+    "notifications": {},
+}