postgres-aiops 0.1.1__tar.gz → 0.2.1__tar.gz

postgres_aiops-0.2.1/.github/workflows/mcp-publish.yml

@@ -0,0 +1,23 @@
+name: mcp-publish
+
+on:
+  workflow_dispatch:
+  release:
+    types: [published]
+
+permissions:
+  id-token: write
+  contents: read
+
+jobs:
+  publish-mcp:
+    runs-on: ubuntu-latest
+    steps:
+      - uses: actions/checkout@v4
+      - name: Install mcp-publisher
+        run: |
+          curl -sL "https://github.com/modelcontextprotocol/registry/releases/latest/download/mcp-publisher_$(uname -s | tr '[:upper:]' '[:lower:]')_$(uname -m | sed 's/x86_64/amd64/;s/aarch64/arm64/').tar.gz" | tar xz mcp-publisher
+      - name: Login to MCP Registry (GitHub OIDC)
+        run: ./mcp-publisher login github-oidc
+      - name: Publish server.json
+        run: ./mcp-publisher publish

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/CHANGELOG.md

@@ -1,5 +1,43 @@
 # Changelog
 
+## v0.2.1 — 2026-07-16
+
+### Fixed
+- **`secrets.enc` now follows `POSTGRES_AIOPS_HOME`** (secretstore hardcoded the real
+  home directory; config/audit/undo already relocated — found in live verification).
+- **Audit fidelity**: failures sanitized into `{"error": ...}` results by the MCP error
+  layer are now audited as `status=error` (they previously read as `ok`, hiding failed
+  attempts from exception reports), and no undo is recorded for a call that failed.
+- Undo replay fix: `create_index` accepts a `definition` (captured `pg_get_indexdef` statement, shape-validated), making `drop_index`'s undo descriptor replayable.
+
+### Tests
+- `doctor` and the `init` wizard are now fully covered (previously ~10–20%); plus a
+  regression test for the sanitized-failure audit status.
+
+## v0.2.0 — 2026-07-13
+
+Security-hardening release from a line-wide code review.
+
+### Changed (behavior)
+- **Secure by default**: with no `rules.yaml`, high/critical operations now require a
+  named approver (`POSTGRES_AUDIT_APPROVED_BY`). A fresh install no longer allows
+  destructive writes unattended; `init` seeds a starter `rules.yaml` you can edit,
+  and an operator-authored rules file is honoured as-is.
+- `__version__` is now single-sourced from package metadata (the previous release
+  self-reported a stale version string).
+- Sanitize docs no longer overstate scope: it strips control/format characters and
+  truncates; semantic prompt-injection resistance must come from the consuming agent.
+
+### Fixed
+- CLI `query reset` now executes through the governed MCP twin — the last CLI write that bypassed audit/undo recording.
+
+### Tests
+- Governance persistence is now tested against REAL `audit.db`/`undo.db` files
+  (write → audit row + inverse undo row with captured prior state).
+- The CLI confirmed-write path (dry-run / double-confirm / governed execution) is
+  covered end-to-end.
+- `pytest-cov` added to the dev dependencies.
+
 ## v0.1.1
 
 - Fix: `POSTGRES_AIOPS_HOME` now also relocates `config.yaml` (was hardcoded to `~/.postgres-aiops`).

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.4
 Name: postgres-aiops
-Version: 0.1.1
+Version: 0.2.1
 Summary: Governed AI-ops for PostgreSQL DBA operations: slow-query RCA, bloat/vacuum & blocking-lock analysis with a built-in governance harness (audit, budget, undo, risk tiers)
 Author-email: wei <zhouwei008@gmail.com>
 License-Expression: MIT

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/mcp_server/tools/remediation.py

@@ -162,12 +162,13 @@ def run_analyze(table: str, dry_run: bool = False, target: Optional[str] = None)
 @governed_tool(risk_level="medium", undo=_create_index_undo)
 @tool_errors("dict")
 def create_index(
-    table: str,
-    columns: list[str],
+    table: Optional[str] = None,
+    columns: Optional[list[str]] = None,
     name: Optional[str] = None,
     unique: bool = False,
     concurrently: bool = False,
     method: Optional[str] = None,
+    definition: Optional[str] = None,
     dry_run: bool = False,
     target: Optional[str] = None,
 ) -> dict:
@@ -175,21 +176,34 @@ def create_index(
 
     Supports CONCURRENTLY (non-blocking build). The created name is returned so
     the harness records an undo that drops exactly this index. Pass dry_run=True
-    to preview.
+    to preview. Alternatively pass ``definition`` (a captured pg_get_indexdef
+    statement — this is how drop_index's undo descriptor replays) INSTEAD of
+    table/columns.
 
     Args:
-        table: Table to index (optionally schema-qualified).
-        columns: Column names to index.
+        table: Table to index (optionally schema-qualified). Required unless
+            ``definition`` is given.
+        columns: Column names to index. Required unless ``definition`` is given.
         name: Index name (auto-generated from table+columns when omitted).
         unique: Create a UNIQUE index.
         concurrently: Build with CONCURRENTLY (no table lock).
         method: Index method — btree/hash/gist/gin/brin/spgist (default btree).
+        definition: A full CREATE [UNIQUE] INDEX statement to execute verbatim
+            (shape-validated). Mutually exclusive with table/columns.
         dry_run: If True, preview without creating.
         target: Target name from config; omit for the default.
     """
+    if definition and (table or columns):
+        raise ValueError("Pass either definition OR table+columns, not both.")
+    if not definition and not (table and columns):
+        raise ValueError("create_index requires table+columns (or a definition).")
     conn = _get_connection(target)
     if dry_run:
+        if definition:
+            return {"dryRun": True, "wouldExecute": definition}
         return {"dryRun": True, "wouldCreate": {"table": table, "columns": columns, "name": name}}
+    if definition:
+        return ops.create_index_from_definition(conn, definition)
     return ops.create_index(
         conn, table, columns, name=name, unique=unique,
         concurrently=concurrently, method=method,

postgres_aiops-0.2.1/postgres_aiops/__init__.py

@@ -0,0 +1,14 @@
+"""postgres-aiops — governed PostgreSQL DBA operations for AI agents.
+
+Standalone and self-contained: the governance harness (audit, token budget,
+undo-token recording, graduated risk tiers, output sanitize) is bundled under
+``postgres_aiops.governance`` — this package has no external skill-family
+dependency. Preview: not yet full-coverage.
+"""
+
+from importlib.metadata import PackageNotFoundError, version
+
+try:
+    __version__ = version("postgres-aiops")
+except PackageNotFoundError:  # running from an uninstalled source tree
+    __version__ = "0.0.0+unknown"

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/postgres_aiops/cli/_common.py

@@ -48,7 +48,7 @@ def cli_errors(fn: Callable) -> Callable:
     return wrapper
 
 
-def get_connection(target: str | None, config_path: Path | None = None):
+def get_connection(target: str | None, config_path: Path | None = None) -> tuple[Any, Any]:
     """Return a (conn, config) tuple for the given target."""
     from postgres_aiops.config import load_config
     from postgres_aiops.connection import ConnectionManager

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/postgres_aiops/cli/init.py

@@ -22,8 +22,45 @@ from postgres_aiops.config import (
     DEFAULT_SSLMODE,
     DEFAULT_USER,
 )
+from postgres_aiops.governance.paths import ops_path
 from postgres_aiops.secretstore import SecretStore, resolve_master_password
 
+# Starter policy: keeps the secure-by-default gate (high/critical writes need a
+# named approver) explicit and editable, and shows the other rule kinds.
+DEFAULT_RULES_YAML = """\
+# postgres-aiops policy rules — hot-reloaded on change (no restart needed).
+# Kinds: deny rules, maintenance_window, risk_tiers (graduated autonomy).
+
+risk_tiers:
+  - name: high-risk-requires-approver
+    tier: dual
+    min_risk_level: high
+    reason: >-
+      High/critical writes need a named human approver — set
+      POSTGRES_AUDIT_APPROVED_BY (and POSTGRES_AUDIT_RATIONALE) before the call.
+
+# deny:
+#   - name: no-prod-drops
+#     operations: ["drop_*"]
+#     environments: ["production"]
+#     reason: "Drops in production go through change management."
+
+# maintenance_window:
+#   start: "22:00"
+#   end: "06:00"
+"""
+
+
+def _write_default_rules() -> None:
+    """Seed a starter rules.yaml (only when none exists) so the policy layer
+    is explicit from day one; never overwrites an operator-authored file."""
+    rules_path = ops_path("rules.yaml")
+    if rules_path.exists():
+        return
+    rules_path.parent.mkdir(parents=True, exist_ok=True)
+    rules_path.write_text(DEFAULT_RULES_YAML, "utf-8")
+    console.print(f"[green]✓ Wrote default policy rules:[/] {rules_path}")
+
 
 def _load_existing_targets() -> list[dict]:
     if not CONFIG_FILE.exists():
@@ -101,6 +138,7 @@ def init_cmd() -> None:
         if not typer.confirm("\nAdd another target?", default=False):
             break
 
+    _write_default_rules()
     console.print(f"\n[green]✓ Setup complete.[/] Config: {CONFIG_FILE}")
     console.print(
         "[dim]Tip: export POSTGRES_AIOPS_MASTER_PASSWORD=... in your shell profile "

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/postgres_aiops/cli/query.py

@@ -59,12 +59,15 @@ def query_explain(
 @query_app.command("reset")
 @cli_errors
 def query_reset(target: TargetOption = None, dry_run: DryRunOption = False) -> None:
-    """Reset pg_stat_statements accumulators (irreversible; dry-run + confirm)."""
-    from postgres_aiops.ops import queries as ops
+    """Reset pg_stat_statements accumulators (irreversible; dry-run + confirm).
+
+    Real execution is delegated to the ``@governed_tool``-wrapped MCP function
+    so the reset is audited on the same governance path as MCP calls.
+    """
+    from mcp_server.tools import queries as gov
 
     if dry_run:
         dry_run_print(operation="reset_query_stats", api_call="SELECT pg_stat_statements_reset()")
         return
     double_confirm("reset pg_stat_statements on", "this target")
-    conn, _ = get_connection(target)
-    console.print_json(json.dumps(ops.reset_query_stats(conn)))
+    console.print_json(json.dumps(gov.reset_query_stats(target=target)))

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/postgres_aiops/governance/__init__.py

@@ -8,7 +8,7 @@ any external skill family — this package is its own copy of the harness:
     and undo-token recording.
   - unified SQLite audit log under ``~/.postgres-aiops/`` (override with
     ``POSTGRES_AIOPS_HOME``).
-  - ``sanitize`` — prompt-injection defense for API-returned text.
+  - ``sanitize`` — control-character stripping + truncation for API-returned text.
 
 State lives under ``ops_home()`` (default ``~/.postgres-aiops``).
 """

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/postgres_aiops/governance/audit.py

@@ -1,4 +1,4 @@
-"""Unified audit logging engine — all Endpoint skills write to a single SQLite database.
+"""Unified audit logging engine — all PostgreSQL skills write to a single SQLite database.
 
 Replaces 7 per-skill JSON Lines audit loggers with one shared ``~/.postgres-aiops/audit.db``.
 Framework-agnostic: works with Claude, Codex, local agents, or any MCP client.

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/postgres_aiops/governance/budget.py

@@ -43,7 +43,7 @@ _DEFAULT_RUNAWAY_WINDOW_SEC = 120
 class BudgetExceeded(Exception):
     """Raised when a tool call would exceed a budget / runaway limit.
 
-    Subclasses nothing Endpoint-specific; the decorator wraps it into a
+    Subclasses nothing PostgreSQL-specific; the decorator wraps it into a
     PolicyResult so it shares the existing denial audit path. Kept as its own
     type (not raw PolicyDenied) so callers can catch budget stops distinctly.
     """

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/postgres_aiops/governance/decorators.py

@@ -1,4 +1,4 @@
-"""The ``@governed_tool`` decorator — mandatory wrapper for all Endpoint MCP tool functions.
+"""The ``@governed_tool`` decorator — mandatory wrapper for all PostgreSQL MCP tool functions.
 
 Responsibilities:
   1. Pre-check: evaluate policy rules (deny, maintenance window)
@@ -58,7 +58,7 @@ def governed_tool(
     sensitive_params: list[str] | None = None,
     undo: Any = None,
 ) -> Any:
-    """Decorator for all Endpoint MCP tool functions.
+    """Decorator for all PostgreSQL MCP tool functions.
 
     Can be used with or without arguments::
 
@@ -317,6 +317,8 @@ def _record_undo(state: _CallState, result: Any) -> None:
     """
     if state.undo is None:
         return
+    if isinstance(result, dict) and result.get("error"):
+        return  # sanitized failure — no change happened, so no inverse to record
     try:
         descriptor = state.undo(state.safe_params, result)
     except Exception:  # noqa: BLE001 — undo computation must not fail the call
@@ -356,6 +358,12 @@ def _capture_error(state: _CallState, exc: Exception) -> None:
 
 def _finalize(state: _CallState) -> None:
     """Audit + circuit-breaker bookkeeping. Runs in the wrapper's finally."""
+    # A sanitized failure (@tool_errors converts exceptions into {"error": ...}
+    # dicts BEFORE this harness sees them) must not be audited as success —
+    # compliance exception reports are built from this status.
+    if state.status == "ok" and isinstance(state.result, dict) and state.result.get("error"):
+        state.status = "error"
+
     duration = int((time.time() - state.start) * 1000)
 
     # Accumulate wall-time toward the cumulative time budget (best-effort).
@@ -365,7 +373,7 @@ def _finalize(state: _CallState) -> None:
         pass
 
     # timeout_seconds is advisory: exceeding it logs a warning, no hard
-    # cancellation (cancelling mid-flight Endpoint calls is worse).
+    # cancellation (cancelling mid-flight PostgreSQL calls is worse).
     if state.timeout_seconds and duration > state.timeout_seconds * 1000:
         _log.warning(
             "%s.%s took %dms — exceeded timeout_seconds=%d (advisory, not cancelled)",

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/postgres_aiops/governance/policy.py

@@ -1,4 +1,4 @@
-"""Policy engine — rule-based access control for Endpoint MCP tools.
+"""Policy engine — rule-based access control for PostgreSQL MCP tools.
 
 Rules are loaded from ``~/.postgres-aiops/rules.yaml`` with hot-reload on file change.
 """
@@ -93,7 +93,8 @@ class PolicyEngine:
         self._load_rules()
 
     def _load_rules(self) -> None:
-        """Load rules from YAML file.  Missing file → empty rules (allow all)."""
+        """Load rules from YAML file. Missing file → empty rules (deny rules off;
+        high/critical still require an approver — see required_approval_tier)."""
         if not self._path.exists():
             self._rules = {}
             self._mtime = 0.0
@@ -113,7 +114,7 @@ class PolicyEngine:
         """Hot-reload if file changed."""
         if not self._path.exists():
             if self._rules:
-                _log.warning("Policy rules file deleted: %s — clearing rules (allow all)", self._path)
+                _log.warning("Policy rules file deleted: %s — clearing rules (high/critical fall back to the default approver gate)", self._path)
                 self._rules = {}
                 self._mtime = 0.0
             return
@@ -156,7 +157,8 @@ class PolicyEngine:
 
         self._maybe_reload()
 
-        # No rules file → allow everything
+        # No rules file → no deny rules (destructive ops are still gated by
+        # required_approval_tier's secure-by-default dual tier)
         if not self._rules:
             return PolicyResult(allowed=True, rule="no_rules")
 
@@ -225,11 +227,28 @@ class PolicyEngine:
         on operation glob / environment / resource tag / minimum risk and maps
         to a tier (none/confirm/dual/review). The FIRST matching, HIGHEST tier
         wins so a prod-tagged destructive op can't be down-graded by a looser
-        rule listed earlier. No config → tier ``none`` (backward compatible).
+        rule listed earlier.
+
+        Secure by default: with NO rules file at all, high/critical operations
+        require a named approver (``dual`` tier) — a fresh install must not
+        allow destructive writes unattended. An operator-authored rules file
+        (even one without a ``risk_tiers`` block) is an explicit choice and is
+        honoured as-is (tier ``none``).
         """
+        if os.environ.get("POSTGRES_POLICY_DISABLED") == "1":
+            return TierDecision(tier="none", rule="policy_disabled")
         self._maybe_reload()
         tiers = self._rules.get("risk_tiers") if self._rules else None
         if not tiers:
+            if not self._rules and risk_level in ("high", "critical"):
+                return TierDecision(
+                    tier="dual",
+                    rule="default_high_risk",
+                    reason=(
+                        f"No rules file at {self._path} — high/critical operations require a named approver (POSTGRES_AUDIT_APPROVED_BY) by default. Author rules.yaml "
+                        "(run the init wizard) to customize this."
+                    ),
+                )
             return TierDecision(tier="none", rule="no_tiers")
 
         tags = _extract_tags(params)

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/postgres_aiops/governance/sanitize.py

@@ -1,6 +1,12 @@
-"""Prompt-injection defense: strip control characters and truncate untrusted text.
+"""Output hygiene: strip control/format characters and truncate untrusted text.
 
-Consolidated from 22 duplicate ``_sanitize()`` implementations across 7 Endpoint skills.
+Defense-in-depth against *encoding-level* tricks: control characters,
+zero-width / bidi format characters, and payload-pushing padding. It does NOT
+neutralize natural-language prompt injection — "ignore previous instructions"
+passes through unchanged; semantic injection resistance must come from the
+consuming agent's own prompt boundaries.
+
+Consolidated from 22 duplicate ``_sanitize()`` implementations across the tool line.
 All skills should import from here instead of defining their own copy.
 """
 
@@ -19,14 +25,14 @@ def sanitize(text: str | None, max_len: int = 500) -> str:
     Removes:
     - C0/C1 control characters (except newline/tab)
     - Unicode Format characters (Cf): zero-width spaces, bidi overrides,
-      zero-width joiners — used in prompt injection attacks
+      zero-width joiners — used to smuggle or disguise injected text
 
     Stripping happens BEFORE truncation so an attacker cannot push the real
     payload past the cut-off by padding with junk control characters.
     ``None`` sanitizes to ``""``.
 
     Args:
-        text: Untrusted text from Endpoint SCALE API responses.
+        text: Untrusted text from PostgreSQL server responses.
         max_len: Maximum length after truncation. Default 500.
 
     Returns:

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/postgres_aiops/ops/_util.py

@@ -3,7 +3,7 @@
 Two jobs:
 
   * ``s`` — pass catalog/query text through the governance ``sanitize`` (bounded
-    length, prompt-injection defense) before it reaches an agent.
+    length, control-character stripping) before it reaches an agent.
   * ``qualify`` / ``quote_ident`` — the ONLY sanctioned way to place an
     identifier (schema/table/index/column) into a statement that cannot be
     parameterised (DDL, ``VACUUM``, ``ANALYZE``, ``REINDEX``). Every part is

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/postgres_aiops/ops/remediation.py

@@ -162,6 +162,36 @@ def create_index(
     }
 
 
+# Shape gate for replaying a captured pg_get_indexdef statement. Server-generated
+# (never user-composed), but validated anyway: single statement, CREATE INDEX only.
+_INDEXDEF_RE = re.compile(
+    r"^CREATE\s+(?:UNIQUE\s+)?INDEX\s+(?:CONCURRENTLY\s+)?(?:IF\s+NOT\s+EXISTS\s+)?"
+    r'("?[A-Za-z_][A-Za-z0-9_$]*"?)\s+ON\s+',
+    re.IGNORECASE,
+)
+
+
+def create_index_from_definition(conn: Any, definition: str) -> dict:
+    """[WRITE] Recreate an index from a captured ``pg_get_indexdef`` statement.
+
+    This is the replay path for ``drop_index``'s undo descriptor: the exact
+    definition captured before the drop is executed verbatim after a shape
+    check (single statement, must be CREATE [UNIQUE] INDEX ... ON ...).
+    """
+    stmt = (definition or "").strip().rstrip(";").strip()
+    if not stmt or ";" in stmt:
+        raise ValueError("definition must be a single CREATE INDEX statement.")
+    m = _INDEXDEF_RE.match(stmt)
+    if not m:
+        raise ValueError("definition must start with CREATE [UNIQUE] INDEX ... ON ...")
+    conn.execute(stmt)  # nosec B608 — shape-validated pg_get_indexdef output
+    return {
+        "action": "create_index",
+        "index": m.group(1).strip('"'),
+        "fromDefinition": True,
+    }
+
+
 def drop_index(conn: Any, name: str, concurrently: bool = False) -> dict:
     """[WRITE] Drop an index. Reversible: captures pg_get_indexdef first so undo recreates it."""
     ident = qualify(name)

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/postgres_aiops/secretstore.py

@@ -39,9 +39,11 @@ from cryptography.exceptions import InvalidKey
 from cryptography.fernet import Fernet, InvalidToken
 from cryptography.hazmat.primitives.kdf.scrypt import Scrypt
 
+from postgres_aiops.governance.paths import ops_home
+
 # ─── Tool-specific constants (change these three to vendor for another tool) ──
 APP_NAME = "postgres-aiops"
-CONFIG_DIR = Path.home() / ".postgres-aiops"
+CONFIG_DIR = ops_home()
 MASTER_PASSWORD_ENV = "POSTGRES_AIOPS_MASTER_PASSWORD"  # nosec B105 — env-var name
 # ──────────────────────────────────────────────────────────────────────────────
 

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "postgres-aiops"
-version = "0.1.1"
+version = "0.2.1"
 description = "Governed AI-ops for PostgreSQL DBA operations: slow-query RCA, bloat/vacuum & blocking-lock analysis with a built-in governance harness (audit, budget, undo, risk tiers)"
 readme = "README.md"
 license = "MIT"
@@ -22,6 +22,7 @@ dependencies = [
 [dependency-groups]
 dev = [
     "pytest>=8.0,<10.0",
+    "pytest-cov>=5.0,<8.0",
     "ruff>=0.5,<1.0",
 ]
 

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/AIops-tools/Postgres-AIops",
     "source": "github"
   },
-  "version": "0.1.1",
+  "version": "0.2.1",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "postgres-aiops",
-      "version": "0.1.1",
+      "version": "0.2.1",
       "transport": {
         "type": "stdio"
       }

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/skills/postgres-aiops/SKILL.md

@@ -105,6 +105,7 @@ Pass data straight to the analysis tools — `slow_query_rca(statements=[...])`,
 
 - Every tool is audited to `~/.postgres-aiops/audit.db` (relocatable via `POSTGRES_AIOPS_HOME`).
 - High-risk ops can require a named approver: set `POSTGRES_AUDIT_APPROVED_BY` and `POSTGRES_AUDIT_RATIONALE` (the env-var names the bundled harness reads).
+- **Secure by default (v0.2.0+)**: with no `~/.postgres-aiops/rules.yaml`, high/critical operations are denied unless `POSTGRES_AUDIT_APPROVED_BY` names an approver (set `POSTGRES_AUDIT_RATIONALE` too). `postgres-aiops init` seeds a starter rules.yaml; an operator-authored rules file is honoured as-is.
 - Writes support `--dry-run` / `dry_run=True` and double confirmation at the CLI.
 - Reversible writes fetch the real before-state and record an inverse descriptor; irreversible ops (terminate/cancel, vacuum/analyze, reindex, reset stats) record prior stats only.
 - All values are bound query parameters; identifiers that cannot be parameterised are validated and quoted.

{postgres_aiops-0.1.1 → postgres_aiops-0.2.1}/tests/conftest.py

@@ -13,6 +13,15 @@ from typing import Any
 import pytest
 
 
+@pytest.fixture(autouse=True)
+def _default_approver(monkeypatch):
+    """The policy layer is secure-by-default: with no rules.yaml, high/critical
+    governed calls require a named approver. Tests exercising tool behavior
+    are not about that gate, so record a synthetic approver globally; the
+    governance-persistence tests remove it to test the gate itself."""
+    monkeypatch.setenv("POSTGRES_AUDIT_APPROVED_BY", "pytest")
+
+
 class FakePg:
     def __init__(
         self,

postgres_aiops-0.2.1/tests/test_cli_writes.py

@@ -0,0 +1,83 @@
+"""CLI confirmed-write path — past dry-run, through governance, onto disk.
+
+The CLI write commands delegate real execution to the ``@governed_tool``
+functions in ``mcp_server.tools``. These tests drive a write command PAST the
+dry-run branch and the double-confirm prompts and assert the call really went
+through the governed path (audit row on disk) — the regression test for the
+"CLI writes were unaudited" line-wide fix.
+"""
+
+from __future__ import annotations
+
+import sqlite3
+
+import pytest
+from typer.testing import CliRunner
+
+import postgres_aiops.governance.audit as audit_mod
+import postgres_aiops.governance.policy as policy_mod
+import postgres_aiops.governance.undo as undo_mod
+
+
+@pytest.fixture
+def gov_home(tmp_path, monkeypatch):
+    monkeypatch.setenv("POSTGRES_AIOPS_HOME", str(tmp_path))
+    audit_mod.reset_engine()
+    policy_mod.reset_policy_engine()
+    undo_mod.reset_undo_store()
+    yield tmp_path
+    audit_mod.reset_engine()
+    policy_mod.reset_policy_engine()
+    undo_mod.reset_undo_store()
+
+
+def _audit_tools(db_path) -> list[str]:
+    conn = sqlite3.connect(db_path)
+    try:
+        return [r[0] for r in conn.execute("SELECT tool FROM audit_log ORDER BY id")]
+    finally:
+        conn.close()
+
+
+@pytest.mark.unit
+def test_cli_query_reset_dry_run_makes_no_call_and_no_audit(gov_home, monkeypatch, fake_pg):
+    from postgres_aiops.cli import app
+
+    fake = fake_pg()
+    import mcp_server.tools.queries as gov_queries
+
+    monkeypatch.setattr(gov_queries, "_get_connection", lambda target=None: fake)
+    result = CliRunner().invoke(app, ["query", "reset", "--dry-run"])
+    assert result.exit_code == 0
+    assert "DRY-RUN" in result.output
+    assert fake.executed == [] and fake.queried == []
+    assert not (gov_home / "audit.db").exists()
+
+
+@pytest.mark.unit
+def test_cli_query_reset_confirmed_goes_through_governance(gov_home, monkeypatch, fake_pg):
+    """Confirmed CLI write must execute via the governed twin: the SQL runs
+    AND an audit row lands in audit.db (this is what the reroute fix bought)."""
+    from postgres_aiops.cli import app
+
+    fake = fake_pg(responses={"pg_stat_statements_reset": [{"reset": True}]})
+    import mcp_server.tools.queries as gov_queries
+
+    monkeypatch.setattr(gov_queries, "_get_connection", lambda target=None: fake)
+    result = CliRunner().invoke(app, ["query", "reset"], input="y\ny\n")
+    assert result.exit_code == 0, result.output
+    assert _audit_tools(gov_home / "audit.db") == ["reset_query_stats"]
+
+
+@pytest.mark.unit
+def test_cli_query_reset_aborts_without_double_confirm(gov_home, monkeypatch, fake_pg):
+    from postgres_aiops.cli import app
+
+    fake = fake_pg()
+    import mcp_server.tools.queries as gov_queries
+
+    monkeypatch.setattr(gov_queries, "_get_connection", lambda target=None: fake)
+    result = CliRunner().invoke(app, ["query", "reset"], input="y\nn\n")
+    assert result.exit_code != 0
+    assert fake.executed == [] and fake.queried == []
+    assert not (gov_home / "audit.db").exists()