postgres-aiops 0.5.0__tar.gz → 0.7.0__tar.gz

{postgres_aiops-0.5.0 → postgres_aiops-0.7.0}/CHANGELOG.md

@@ -1,5 +1,24 @@
 # Changelog
 
+## v0.7.0 — 2026-08-02
+
+### Changed (BREAKING)
+- **Requires MCP SDK 2.0** (`mcp[cli]>=2.0,<3.0`). `mcp.server.fastmcp` no longer exists in 2.0; the server is now built with `MCPServer` and reports its package version in the stdio handshake.
+
+### Fixed
+- **`undo apply` works from the CLI.** Every write tool is imported lazily inside its own CLI command, so a CLI-driven undo ran in a process where the inverse tool was never registered and failed with "inverse tool is not registered" — for every write tool. Only the MCP entry point, which imports the whole server, worked. Found while live-verifying against a real cluster.
+- **An undetermined outcome is audited `unknown`, not `ok`.** The harness only classified a result as undetermined when the payload *also* carried an `error` key, so a write that looked successful but had not been confirmed was recorded as a success.
+
+
+## v0.6.0 — 2026-07-21
+
+### Changed (BREAKING)
+- **Removed the authorization layer** — read-only mode, the approver gate, and rules.yaml deny are gone. The skill no longer decides read vs write; that is the agent's judgement or the connecting account's permissions. `<PREFIX>_READ_ONLY` now has no effect (a startup warning is logged); `<PREFIX>_AUDIT_APPROVED_BY`/`_RATIONALE` are optional audit annotations.
+- The retained guarantee is **unbypassable audit over MCP and CLI alike** — no unaudited entry point. Harness = audit + runaway safety guard + undo + sanitize; `risk_level` is a descriptive audit label, not a gate.
+
+See RELEASE_NOTES.md for tool-specific changes.
+
+
 ## v0.5.0 — 2026-07-20
 
 ### Fixed

postgres_aiops-0.7.0/Dockerfile

@@ -0,0 +1,9 @@
+# syntax=docker/dockerfile:1
+# Minimal image for Glama introspection: starts the MCP server over stdio.
+# The tools/list introspection handshake needs no live PostgreSQL credentials.
+FROM python:3.12-slim
+
+RUN pip install --no-cache-dir postgres-aiops
+
+# MCP server speaks JSON-RPC over stdio.
+ENTRYPOINT ["postgres-aiops-mcp"]

{postgres_aiops-0.5.0 → postgres_aiops-0.7.0}/PKG-INFO

@@ -1,13 +1,13 @@
 Metadata-Version: 2.4
 Name: postgres-aiops
-Version: 0.5.0
+Version: 0.7.0
 Summary: Governed AI-ops for PostgreSQL DBA operations: slow-query RCA, bloat/vacuum & blocking-lock analysis with a built-in governance harness (audit, budget, undo, risk tiers)
 Author-email: Wei Zhou <zhouwei008@gmail.com>
 License-Expression: MIT
 License-File: LICENSE
 Requires-Python: >=3.11
 Requires-Dist: cryptography>=42.0
-Requires-Dist: mcp[cli]<2.0,>=1.10
+Requires-Dist: mcp[cli]<3.0,>=2.0
 Requires-Dist: psycopg[binary]<4.0,>=3.1
 Requires-Dist: pyyaml<7.0,>=6.0
 Requires-Dist: rich<16.0,>=13.0
@@ -22,8 +22,8 @@ Description-Content-Type: text/markdown
 
 Governed AI-ops for **PostgreSQL DBA operations** — connecting to a server with
 **psycopg 3** and reading the system catalogs and `pg_stat_*` views — with a
-**built-in governance harness**: unified audit log, policy engine, token/runaway
-budget guard, undo-token recording, and graduated-autonomy risk tiers.
+**built-in governance harness**: unified audit log, token/runaway
+budget guard, undo-token recording, and descriptive risk-tier labels.
 Beyond the mock test suite, the reads, a governed write, and its undo have been
 exercised against a live PostgreSQL 16.14 instance — see [`docs/VERIFICATION.md`](docs/VERIFICATION.md).
 
@@ -70,40 +70,25 @@ The flagship analyses accept injected records for pure/offline analysis, or pull
 live from a configured target. `top_queries`/`slow_query_rca` require the
 `pg_stat_statements` extension; the read role should have `pg_monitor`.
 
-## Security: read-only mode
+## What this tool does, and does not, decide
 
-This tool is meant to be handed to an AI agent, so its safety story is enforced
-by the server rather than requested in a prompt:
+It delivers PostgreSQL DBA operations — reads and writes — accurately and
+efficiently, and records every one of them. It does **not** decide whether a
+write is allowed to happen. That is the agent's judgement, or the permission of
+the account you connect it with: connect with a PostgreSQL role that has no
+write privileges (a read-only role, or one without INSERT/UPDATE/DELETE/DDL),
+and the writes fail at the server — the place that actually owns the
+permission.
 
-```bash
-export POSTGRES_READ_ONLY=1
-```
-
-With that set, the **10 write tools are never registered**. An MCP client
-lists **25 tools instead of 35** — the writes are not hidden, not
-gated behind a flag, and not merely refused when called. They are absent from
-the session. A model cannot invoke a tool it was never offered, and cannot be
-argued into one.
-
-That distinction is the whole point. A tool that exists but refuses still invites
-retry loops and "I'll describe the call instead" behaviour from smaller models,
-and it leaves a reviewer trusting a promise. An absent tool is a fact you can
-check: connect, list the tools, and see that the writes are not there.
-
-Enforcement is two layers deep, so the switch cannot be sidestepped by changing
-entry point:
-
-| Layer | What it does | Covers |
-|---|---|---|
-| `@governed_tool` harness | refuses every non-read operation outright | MCP, CLI, and in-process callers |
-| MCP registration | write tools are removed from `list_tools()` | anything speaking MCP |
-
-Read operations are unaffected, and every call is still audited to
-`~/.postgres-aiops/audit.db`.
+So there is no read-only switch, no policy file, no approval gate to configure.
+The one thing the tool guarantees is that nothing is silent: **every call, over
+MCP and over the CLI alike, lands an audit row** in `~/.postgres-aiops/audit.db`,
+and destructive writes still capture their before-state and record an inverse
+where one exists.
 
-> The read/write split is derived from each tool's declared `risk_level`, and a
-> test asserts that this never disagrees with the `[READ]`/`[WRITE]` tag in the
-> tool's own documentation — so a write can't quietly present itself as a read.
+> Each tool declares a `risk_level`, carried into the audit row as a descriptive
+> tier (none/confirm/review) — so a reviewer can see at a glance that a row was
+> a high-risk delete. It is a label, not a gate.
 
 Running a smaller / local model? See
 [agent-guardrails.md](skills/postgres-aiops/references/agent-guardrails.md) — it lists
@@ -132,15 +117,18 @@ postgres-aiops-mcp
 
 Every MCP tool passes through the bundled `@governed_tool` harness:
 
-- **Audit** — every call (params, result, status, duration, risk tier, approver,
-  rationale) is logged to `~/.postgres-aiops/audit.db` (relocatable via
-  `POSTGRES_AIOPS_HOME`).
-- **Budget / runaway guard** — token and call budgets trip a circuit breaker.
-- **Risk tiers** — graduated autonomy; high-risk ops can require a named approver
-  (`POSTGRES_AUDIT_APPROVED_BY` / `POSTGRES_AUDIT_RATIONALE` — the env-var names
-  the bundled harness reads).
+- **Audit** — every call (params, result, status, duration, risk tier, and any
+  operator-supplied approver/rationale) is logged to `~/.postgres-aiops/audit.db`
+  (relocatable via `POSTGRES_AIOPS_HOME`). The CLI writes the same row the MCP
+  path does — there is no unaudited entry point.
+- **Runaway guard** — a safety backstop, not an authorization gate: the same call
+  hammered in a tight loop trips a circuit breaker. Disable with
+  `POSTGRES_RUNAWAY_MAX=0`; optional hard ceilings via `POSTGRES_MAX_TOOL_CALLS` /
+  `POSTGRES_MAX_TOOL_SECONDS`.
 - **Undo recording** — reversible writes record an inverse descriptor built from
   the fetched before-state.
+- **Risk tier** — a descriptive label on the audit row derived from `risk_level`;
+  it gates nothing.
 
 ## Scope
 

{postgres_aiops-0.5.0 → postgres_aiops-0.7.0}/README.md

@@ -6,8 +6,8 @@
 
 Governed AI-ops for **PostgreSQL DBA operations** — connecting to a server with
 **psycopg 3** and reading the system catalogs and `pg_stat_*` views — with a
-**built-in governance harness**: unified audit log, policy engine, token/runaway
-budget guard, undo-token recording, and graduated-autonomy risk tiers.
+**built-in governance harness**: unified audit log, token/runaway
+budget guard, undo-token recording, and descriptive risk-tier labels.
 Beyond the mock test suite, the reads, a governed write, and its undo have been
 exercised against a live PostgreSQL 16.14 instance — see [`docs/VERIFICATION.md`](docs/VERIFICATION.md).
 
@@ -54,40 +54,25 @@ The flagship analyses accept injected records for pure/offline analysis, or pull
 live from a configured target. `top_queries`/`slow_query_rca` require the
 `pg_stat_statements` extension; the read role should have `pg_monitor`.
 
-## Security: read-only mode
+## What this tool does, and does not, decide
 
-This tool is meant to be handed to an AI agent, so its safety story is enforced
-by the server rather than requested in a prompt:
+It delivers PostgreSQL DBA operations — reads and writes — accurately and
+efficiently, and records every one of them. It does **not** decide whether a
+write is allowed to happen. That is the agent's judgement, or the permission of
+the account you connect it with: connect with a PostgreSQL role that has no
+write privileges (a read-only role, or one without INSERT/UPDATE/DELETE/DDL),
+and the writes fail at the server — the place that actually owns the
+permission.
 
-```bash
-export POSTGRES_READ_ONLY=1
-```
-
-With that set, the **10 write tools are never registered**. An MCP client
-lists **25 tools instead of 35** — the writes are not hidden, not
-gated behind a flag, and not merely refused when called. They are absent from
-the session. A model cannot invoke a tool it was never offered, and cannot be
-argued into one.
-
-That distinction is the whole point. A tool that exists but refuses still invites
-retry loops and "I'll describe the call instead" behaviour from smaller models,
-and it leaves a reviewer trusting a promise. An absent tool is a fact you can
-check: connect, list the tools, and see that the writes are not there.
-
-Enforcement is two layers deep, so the switch cannot be sidestepped by changing
-entry point:
-
-| Layer | What it does | Covers |
-|---|---|---|
-| `@governed_tool` harness | refuses every non-read operation outright | MCP, CLI, and in-process callers |
-| MCP registration | write tools are removed from `list_tools()` | anything speaking MCP |
-
-Read operations are unaffected, and every call is still audited to
-`~/.postgres-aiops/audit.db`.
+So there is no read-only switch, no policy file, no approval gate to configure.
+The one thing the tool guarantees is that nothing is silent: **every call, over
+MCP and over the CLI alike, lands an audit row** in `~/.postgres-aiops/audit.db`,
+and destructive writes still capture their before-state and record an inverse
+where one exists.
 
-> The read/write split is derived from each tool's declared `risk_level`, and a
-> test asserts that this never disagrees with the `[READ]`/`[WRITE]` tag in the
-> tool's own documentation — so a write can't quietly present itself as a read.
+> Each tool declares a `risk_level`, carried into the audit row as a descriptive
+> tier (none/confirm/review) — so a reviewer can see at a glance that a row was
+> a high-risk delete. It is a label, not a gate.
 
 Running a smaller / local model? See
 [agent-guardrails.md](skills/postgres-aiops/references/agent-guardrails.md) — it lists
@@ -116,15 +101,18 @@ postgres-aiops-mcp
 
 Every MCP tool passes through the bundled `@governed_tool` harness:
 
-- **Audit** — every call (params, result, status, duration, risk tier, approver,
-  rationale) is logged to `~/.postgres-aiops/audit.db` (relocatable via
-  `POSTGRES_AIOPS_HOME`).
-- **Budget / runaway guard** — token and call budgets trip a circuit breaker.
-- **Risk tiers** — graduated autonomy; high-risk ops can require a named approver
-  (`POSTGRES_AUDIT_APPROVED_BY` / `POSTGRES_AUDIT_RATIONALE` — the env-var names
-  the bundled harness reads).
+- **Audit** — every call (params, result, status, duration, risk tier, and any
+  operator-supplied approver/rationale) is logged to `~/.postgres-aiops/audit.db`
+  (relocatable via `POSTGRES_AIOPS_HOME`). The CLI writes the same row the MCP
+  path does — there is no unaudited entry point.
+- **Runaway guard** — a safety backstop, not an authorization gate: the same call
+  hammered in a tight loop trips a circuit breaker. Disable with
+  `POSTGRES_RUNAWAY_MAX=0`; optional hard ceilings via `POSTGRES_MAX_TOOL_CALLS` /
+  `POSTGRES_MAX_TOOL_SECONDS`.
 - **Undo recording** — reversible writes record an inverse descriptor built from
   the fetched before-state.
+- **Risk tier** — a descriptive label on the audit row derived from `risk_level`;
+  it gates nothing.
 
 ## Scope
 

postgres_aiops-0.7.0/RELEASE_NOTES.md

@@ -0,0 +1,33 @@
+# Release notes — postgres-aiops 0.6.0
+
+Previous release: 0.5.0.
+
+## BREAKING — the authorization layer is removed
+
+This tool no longer decides whether a write is permitted. Read-only mode
+(`<PREFIX>_READ_ONLY`), the graduated-approval / approver gate, and the
+`rules.yaml` deny engine are **all gone**. Whether an operation runs is the
+agent's judgement, or the permission of the account you connect it with — point
+it at a read-only credential and the write fails at the server, the place that
+actually owns the permission.
+
+What the tool guarantees instead is that **nothing is silent**: every operation,
+over MCP **and** the CLI alike, lands a row in the audit log — there is no
+unaudited entry point. Destructive writes still capture their before-state and
+record an undo token where a clean inverse exists.
+
+- If you set `<PREFIX>_READ_ONLY=1`, it now has **no effect** and the MCP server
+  logs a warning at startup. Restrict writes via the connecting account instead.
+- `<PREFIX>_AUDIT_APPROVED_BY` / `<PREFIX>_AUDIT_RATIONALE` still work, but are now
+  **optional audit annotations** — recorded on the row when set, never required.
+- The declared `risk_level` is carried into the audit row as a descriptive tier
+  (a label, not a gate).
+
+The governance harness is now: **audit (MCP+CLI, unbypassable) · runaway/budget
+safety guard · undo recording · output sanitize**. `policy.py` is a small
+risk-tier classifier; `governance/readonly.py` is deleted.
+
+
+## Also in this tool
+
+- **`explain --analyze` is now genuinely read-only.** ANALYZE executes the statement, so a `SELECT ... INTO` could create a table; it now runs inside a rolled-back transaction, so no side effect can persist.

{postgres_aiops-0.5.0 → postgres_aiops-0.7.0}/SECURITY.md

@@ -46,9 +46,12 @@ Every MCP tool runs through the bundled `@governed_tool` harness
 - **Token/runaway budget** — hard ceilings (`POSTGRES_MAX_TOOL_CALLS` /
   `POSTGRES_MAX_TOOL_SECONDS` — the env-var names the bundled harness reads) plus
   an on-by-default guard that trips a tight poll/retry loop.
-- **Graduated risk tiers** — `~/.postgres-aiops/rules.yaml` `risk_tiers` gate
-  writes by environment/tag; the highest tiers require a recorded approver
-  (`POSTGRES_AUDIT_APPROVED_BY` / `POSTGRES_AUDIT_RATIONALE`).
+- **Risk tiers** — a descriptive label (`none`/`confirm`/`review`) carried into
+  the audit row from each tool's declared `risk_level`; it gates nothing. The
+  harness does not decide whether a write is permitted — that is the agent's
+  judgement or the connecting account's permissions. `POSTGRES_AUDIT_APPROVED_BY`
+  / `POSTGRES_AUDIT_RATIONALE` are optional annotations recorded on the audit
+  row, never required, never blocking.
 - **Undo-token recording** — reversible writes fetch the **real before-state
   first** and record a faithful inverse (`create_index`↔`drop_index`, where drop
   captures `pg_get_indexdef`; `update_setting` restores the prior value).

{postgres_aiops-0.5.0 → postgres_aiops-0.7.0}/docs/VERIFICATION.md

@@ -28,9 +28,10 @@ suite predicts. Sections left open below are **not** claimed.
   (with `drop_index` capturing `pg_get_indexdef` **before** dropping), and
   `update_setting` capturing the prior value. Irreversible ops (terminate,
   cancel, vacuum, analyze, reindex, reset stats) declare no undo.
-- Governance persistence: audited rows land in the SQLite audit DB, and the
-  secure-by-default approver gate refuses high-risk writes with no `rules.yaml`
-  and no `POSTGRES_AUDIT_APPROVED_BY`.
+- Governance persistence: audited rows land in the SQLite audit DB. The harness
+  authorizes nothing — there is no read-only, deny-rule, or approver gate to
+  test; an approver, when supplied, is recorded on the audit row as an optional
+  annotation.
 
 ## Prerequisites for a live run
 
@@ -113,10 +114,12 @@ are open — record them as gaps rather than silently passing.
       long-running backend (**open gap** — not exercised live).
 - [ ] `remediate reindex` on a real index (**open gap**).
 
-### 6. Governance actually gates
-- [x] ✅ With no `~/.postgres-aiops/rules.yaml`, a high-risk write was refused
-      until `POSTGRES_AUDIT_APPROVED_BY` named an approver (secure-by-default);
-      the approver and `POSTGRES_AUDIT_RATIONALE` appear in the audit row.
+### 6. Governance records, it does not gate
+- [x] ✅ The harness authorizes nothing — there is no read-only, deny-rule, or
+      approver gate to test. A high-risk write ran with no approver set and
+      landed an `ok` audit row; when `POSTGRES_AUDIT_APPROVED_BY` and
+      `POSTGRES_AUDIT_RATIONALE` were set, they appeared in the audit row as
+      optional annotations.
 - [x] ✅ Relocation: with `POSTGRES_AIOPS_HOME` set, `audit.db`, the undo store,
       and `secrets.enc` all land under that directory.
 - [ ] A tight poll loop trips the runaway budget guard rather than hammering the

postgres_aiops-0.7.0/glama.json

@@ -0,0 +1,6 @@
+{
+  "$schema": "https://glama.ai/mcp/schemas/server.json",
+  "maintainers": [
+    "zw008"
+  ]
+}

{postgres_aiops-0.5.0 → postgres_aiops-0.7.0}/mcp_server/_shared.py

@@ -1,13 +1,15 @@
-"""Shared MCP server primitives: the FastMCP instance, connection helper,
+"""Shared MCP server primitives: the MCPServer instance, connection helper,
 error sanitisation, and the ``@tool_errors`` decorator.
 
 Tool modules under ``mcp_server/tools/`` import ``mcp`` from here and register
 their ``@mcp.tool()`` functions onto it. ``mcp_server/server.py`` then imports
 those modules and runs the server.
 
-Keep ``Optional[X]`` (never PEP 604 ``X | None``) in any FastMCP-reflected
-tool signature — on older mcp/pydantic the union eval'd to ``types.UnionType``
-crashes FastMCP's ``issubclass`` check.
+Keep ``Optional[X]`` (never PEP 604 ``X | None``) in any reflected tool
+signature. mcp>=2.0 accepts the union, but the legacy form is retained for
+consistency and to stay safe under any pydantic reflection path (踩坑 #33 —
+older mcp/pydantic eval'd the union to ``types.UnionType`` and crashed the
+``issubclass`` check).
 """
 
 import functools
@@ -17,8 +19,9 @@ from collections.abc import Callable
 from pathlib import Path
 from typing import Any, Optional
 
-from mcp.server.fastmcp import FastMCP
+from mcp.server import MCPServer
 
+from postgres_aiops import __version__
 from postgres_aiops.config import load_config
 from postgres_aiops.connection import ConnectionManager, PgConnectionLostError, PgError
 from postgres_aiops.governance import mark_unknown, sanitize
@@ -65,7 +68,7 @@ def tool_errors(shape: str = "dict") -> Callable:
     """Wrap a tool body in the canonical try/except → ``_safe_error`` pattern.
 
     Place this *between* ``@governed_tool`` and the function so the audit
-    decorator and FastMCP still see the original signature.
+    decorator and MCPServer still see the original signature.
     """
 
     def decorator(func: Callable) -> Callable:
@@ -94,8 +97,9 @@ def tool_errors(shape: str = "dict") -> Callable:
     return decorator
 
 
-mcp = FastMCP(
+mcp = MCPServer(
     "postgres-aiops",
+    version=__version__,
     instructions=(
         "Governed PostgreSQL DBA operations: a one-shot cluster "
         "'overview'; server reads (version/settings/extensions/databases/roles); "

postgres_aiops-0.7.0/mcp_server/server.py

@@ -0,0 +1,51 @@
+"""MCP server wrapping postgres-aiops operations (stdio transport).
+
+Thin adapter layer: each ``@mcp.tool()`` function (in ``mcp_server/tools/``)
+delegates to the ``postgres_aiops`` ops package and is wrapped with the
+postgres-aiops ``@governed_tool`` harness (audit / budget / undo / risk-tier).
+
+Standalone, self-governed PostgreSQL DBA operations (preview).
+For PostgreSQL servers/clusters via psycopg 3.
+
+Source: https://github.com/AIops-tools/Postgres-AIops
+License: MIT
+"""
+
+import logging
+import os
+
+from mcp_server._shared import _safe_error, mcp, tool_errors
+
+# Importing the tool modules registers every @mcp.tool() onto the shared
+# `mcp` instance. Order does not matter; each module is self-contained.
+from mcp_server.tools import (  # noqa: F401 — side effects
+    activity,
+    analysis,
+    indexes,
+    queries,
+    remediation,
+    replication,
+    server,
+    tables,
+    undo,
+)
+
+__all__ = ["mcp", "main", "_safe_error", "tool_errors"]
+
+logger = logging.getLogger(__name__)
+
+
+
+def main() -> None:
+    """Run the MCP server over stdio."""
+    logging.basicConfig(level=logging.INFO)
+    # Read-only mode was removed. Warn a deployment that still exports the old
+    # switch so it gets one audible signal instead of silently gaining writes.
+    if os.environ.get("POSTGRES_READ_ONLY"):
+        logger.warning(
+            "POSTGRES_READ_ONLY is set but no longer has any effect — "
+            "read-only mode was removed. Writes ARE enabled. Restrict them via "
+            "the connecting account's permissions instead (a read-only socket / "
+            "scope-limited token)."
+        )
+    mcp.run(transport="stdio")

{postgres_aiops-0.5.0 → postgres_aiops-0.7.0}/mcp_server/tools/remediation.py

@@ -1,7 +1,7 @@
 """PostgreSQL maintenance MCP tools (guarded writes).
 
 The state-changing tools. Every one is wrapped with the governance harness
-(audit + graduated approval tier) and takes a ``dry_run`` preview. Reversible
+(audit + risk-tier tagging) and takes a ``dry_run`` preview. Reversible
 writes pass an ``undo=`` callback that turns the fetched before-state into an
 inverse descriptor the harness records; irreversible ones record none.
 

{postgres_aiops-0.5.0 → postgres_aiops-0.7.0}/mcp_server/tools/undo.py

@@ -3,10 +3,9 @@
 Every governed write records a replayable inverse descriptor (tool + params) to
 ``undo.db``. This module closes the loop: ``undo_apply`` looks up a recorded
 descriptor and dispatches it to the named governed tool, so the inverse runs on
-the SAME governance path as any other call (audited, budget-checked, and — if
-the inverse itself is destructive — re-gated by its own risk tier / approver
-requirement). ``undo_apply`` is itself governed; the real risk is enforced by
-the inner tool it calls.
+the SAME governance path as any other call (audited, budget-checked, and
+tagged with its own risk tier). ``undo_apply`` is itself governed; audit and
+risk-tier labeling for the inverse are handled by the inner tool it calls.
 
 Note: recorded ``undo_params`` are the redacted safe-params captured at record
 time, so an inverse that would need a secret value cannot be replayed here — by
@@ -22,8 +21,22 @@ from postgres_aiops.governance.undo import get_undo_store
 
 
 def _resolve_tool(name: str) -> Any:
-    """Return the governed callable registered under ``name`` (or None)."""
+    """Return the governed callable registered under ``name`` (or None).
+
+    The CLI reaches this through ``undo apply``, whose process only imports
+    ``mcp_server.tools.undo`` — every other tool module is imported lazily inside
+    its own CLI command and so is absent here. Without forcing a full load,
+    ``undo_apply`` would fail with "inverse tool not registered" for every write
+    tool when driven from the CLI (the MCP entry point loads all modules, so it
+    never hit this). If the first lookup misses, import ``mcp_server.server`` —
+    which registers every ``@mcp.tool()`` as an import side effect — and retry.
+    Imported lazily to avoid the undo↔server cycle.
+    """
     tool = mcp._tool_manager._tools.get(name)
+    if tool is None:
+        import mcp_server.server  # noqa: F401 — registers all tools as a side effect
+
+        tool = mcp._tool_manager._tools.get(name)
     return getattr(tool, "fn", None) if tool else None
 
 
@@ -73,9 +86,9 @@ def undo_list(limit: int = 50, target: Optional[str] = None) -> dict:
 def undo_apply(undo_id: str, dry_run: bool = False, target: Optional[str] = None) -> dict:
     """[WRITE][risk=medium] Apply a recorded undo by dispatching its inverse tool.
 
-    The inverse runs through its own governed tool, so its real risk tier and
-    any approver requirement are enforced there. Pass dry_run=True to preview
-    the inverse call without executing it. A token can only be applied once.
+    The inverse runs through its own governed tool, so its risk tier and audit
+    row are recorded there. Pass dry_run=True to preview the inverse call
+    without executing it. A token can only be applied once.
 
     Args:
         undo_id: The undoId from undo_list (or an ``_undo_id`` in a write result).
@@ -92,12 +105,27 @@ def undo_apply(undo_id: str, dry_run: bool = False, target: Optional[str] = None
         )
 
     inverse_tool = rec["undo_tool"]
+    # Unreadable parameters must stop the replay, not be replaced with {}.
+    # Defaulting dispatched the inverse tool with NO ARGUMENTS: for a tool whose
+    # parameters all have defaults that runs a real, unintended operation, and
+    # dry_run previewed it as a legitimate no-arg inverse. Refusing is the only
+    # honest answer — the recorded intent is gone, so there is nothing to apply.
+    raw = rec["undo_params"]
     try:
-        params = json.loads(rec["undo_params"]) if rec["undo_params"] else {}
-    except (ValueError, TypeError):
-        params = {}
+        params = json.loads(raw) if raw else {}
+    except (ValueError, TypeError) as exc:
+        raise ValueError(
+            f"Undo '{undo_id}' has unreadable recorded parameters, so its inverse "
+            f"cannot be replayed. Inspect the row in undo.db and re-run the "
+            f"inverse tool '{inverse_tool}' by hand if the change still needs "
+            f"reversing."
+        ) from exc
     if not isinstance(params, dict):
-        params = {}
+        raise ValueError(
+            f"Undo '{undo_id}' recorded parameters of type "
+            f"'{type(params).__name__}' rather than an object, so its inverse "
+            f"cannot be replayed. Re-run the inverse tool '{inverse_tool}' by hand."
+        )
 
     fn = _resolve_tool(inverse_tool)
     if fn is None:

{postgres_aiops-0.5.0 → postgres_aiops-0.7.0}/postgres_aiops/cli/_common.py

@@ -27,10 +27,18 @@ DryRunOption = Annotated[
 
 
 def _cli_error_types() -> tuple[type[BaseException], ...]:
-    """Exceptions translated to a one-line teaching error instead of a traceback."""
+    """Exceptions translated to a one-line teaching error instead of a traceback.
+
+    ``PolicyDenied``/``BudgetExceeded`` are raised by ``@governed_tool`` OUTSIDE
+    the tool body, so ``tool_errors`` never sees them and they never arrive as
+    an ``{"error": ...}`` dict. Their message is the teaching text (which
+    approver to set, which budget was hit) — without them here a refusal
+    reaches the CLI as a traceback instead.
+    """
     from postgres_aiops.connection import PgError
+    from postgres_aiops.governance import BudgetExceeded, PolicyDenied
 
-    return (PgError, KeyError, OSError, ValueError)
+    return (PgError, PolicyDenied, BudgetExceeded, KeyError, OSError, ValueError)
 
 
 def cli_errors(fn: Callable) -> Callable:

{postgres_aiops-0.5.0 → postgres_aiops-0.7.0}/postgres_aiops/cli/init.py

@@ -22,45 +22,8 @@ from postgres_aiops.config import (
     DEFAULT_SSLMODE,
     DEFAULT_USER,
 )
-from postgres_aiops.governance.paths import ops_path
 from postgres_aiops.secretstore import SecretStore, resolve_master_password
 
-# Starter policy: keeps the secure-by-default gate (high/critical writes need a
-# named approver) explicit and editable, and shows the other rule kinds.
-DEFAULT_RULES_YAML = """\
-# postgres-aiops policy rules — hot-reloaded on change (no restart needed).
-# Kinds: deny rules, maintenance_window, risk_tiers (graduated autonomy).
-
-risk_tiers:
-  - name: high-risk-requires-approver
-    tier: dual
-    min_risk_level: high
-    reason: >-
-      High/critical writes need a named human approver — set
-      POSTGRES_AUDIT_APPROVED_BY (and POSTGRES_AUDIT_RATIONALE) before the call.
-
-# deny:
-#   - name: no-prod-drops
-#     operations: ["drop_*"]
-#     environments: ["production"]
-#     reason: "Drops in production go through change management."
-
-# maintenance_window:
-#   start: "22:00"
-#   end: "06:00"
-"""
-
-
-def _write_default_rules() -> None:
-    """Seed a starter rules.yaml (only when none exists) so the policy layer
-    is explicit from day one; never overwrites an operator-authored file."""
-    rules_path = ops_path("rules.yaml")
-    if rules_path.exists():
-        return
-    rules_path.parent.mkdir(parents=True, exist_ok=True)
-    rules_path.write_text(DEFAULT_RULES_YAML, "utf-8")
-    console.print(f"[green]✓ Wrote default policy rules:[/] {rules_path}")
-
 
 def _load_existing_targets() -> list[dict]:
     if not CONFIG_FILE.exists():
@@ -138,7 +101,6 @@ def init_cmd() -> None:
         if not typer.confirm("\nAdd another target?", default=False):
             break
 
-    _write_default_rules()
     console.print(f"\n[green]✓ Setup complete.[/] Config: {CONFIG_FILE}")
     console.print(
         "[dim]Tip: export POSTGRES_AIOPS_MASTER_PASSWORD=... in your shell profile "

{postgres_aiops-0.5.0 → postgres_aiops-0.7.0}/postgres_aiops/cli/query.py

@@ -13,7 +13,7 @@ from postgres_aiops.cli._common import (
     cli_errors,
     console,
     double_confirm,
-    dry_run_print,
+    dry_run_preview,
     get_connection,
     print_result,
 )
@@ -62,13 +62,16 @@ def query_explain(
 def query_reset(target: TargetOption = None, dry_run: DryRunOption = False) -> None:
     """Reset pg_stat_statements accumulators (irreversible; dry-run + confirm).
 
-    Real execution is delegated to the ``@governed_tool``-wrapped MCP function
-    so the reset is audited on the same governance path as MCP calls.
+    Both the preview and the real execution are delegated to the
+    ``@governed_tool``-wrapped MCP function, so each is audited on the same
+    governance path as MCP calls.
     """
     from mcp_server.tools import queries as gov
 
     if dry_run:
-        dry_run_print(operation="reset_query_stats", api_call="SELECT pg_stat_statements_reset()")
+        dry_run_preview(
+            gov.reset_query_stats(dry_run=True, target=target),
+            operation="reset_query_stats", api_call="SELECT pg_stat_statements_reset()")
         return
     double_confirm("reset pg_stat_statements on", "this target")
     console.print_json(json.dumps(gov.reset_query_stats(target=target)))