vmware-aiops 2.3.1__tar.gz → 2.3.2__tar.gz

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-aiops",
   "displayName": "VMware AIops",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "AI-powered VMware vCenter/ESXi VM lifecycle and deployment with 61 MCP tools.",
   "author": {
     "name": "Wei Zhou",

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-aiops==2.3.1",
+        "vmware-aiops==2.3.2",
         "vmware-aiops-mcp"
       ]
     }

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-aiops
-Version: 2.3.1
+Version: 2.3.2
 Summary: VMware vCenter/ESXi AI-powered VM lifecycle and deployment tool
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-AIops
 Project-URL: Repository, https://github.com/vmware-skills/VMware-AIops
@@ -19,7 +19,7 @@ Requires-Dist: pyvmomi<10.0,>=8.0.3.0
 Requires-Dist: rich<16.0,>=13.0
 Requires-Dist: typer<1.0,>=0.12
 Requires-Dist: vmware-monitor<3.0,>=2.3.1
-Requires-Dist: vmware-policy<2.0,>=1.23.0
+Requires-Dist: vmware-policy<2.0,>=1.23.1
 Description-Content-Type: text/markdown
 
 <!-- mcp-name: io.github.vmware-skills/vmware-aiops -->
@@ -1197,6 +1197,9 @@ claude mcp add --transport http vmware-aiops https://mcp.example.com:8443/mcp \
   (vmware-policy ≥ 1.23.0).
 - Send `traceparent` or `X-Request-ID` with each request to have it stored on the audit row;
   `vmware-audit log --correlation-id ID` then finds the calls behind one platform request.
+- Tools that read or write files on this server (here: guest file upload/download, OVA and deployment-spec files) never touch its configuration, tokens, audit log or
+  TLS key, and over the network they are off unless `VMWARE_MCP_FILE_ROOT` names a directory for them
+  (vmware-policy ≥ 1.23.1).
 - The audit log records each caller as `token:<name>`. Calls run side by side, with up to `VMWARE_MCP_POOL_SIZE`
   (default 2) sessions per target; each session is a login on the target, and a call waits at most 300 s for one.
 - **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/README-CN.md

@@ -837,6 +837,8 @@ claude mcp add --transport http vmware-aiops https://mcp.example.com:8443/mcp \
   `{"status": "ok"}`（需 vmware-policy ≥ 1.23.0）。
 - 每个请求带上 `traceparent` 或 `X-Request-ID`，它会记进审计记录；用 `vmware-audit log --correlation-id ID`
   就能查到平台上某一次请求对应的调用。
+- 会读写本机文件的工具（这里是：虚拟机文件上传/下载、OVA 和部署 spec 文件）永远碰不到本机的配置、token、审计日志和 TLS 私钥；通过网络访问时，
+  除非用 `VMWARE_MCP_FILE_ROOT` 指定一个目录，否则这些工具不能访问本机文件（需 vmware-policy ≥ 1.23.1）。
 - 审计日志把每个调用者记为 `token:<名字>`。调用并行执行，每个 target 最多 `VMWARE_MCP_POOL_SIZE`（默认 2）
   个会话；每个会话都是在该 target 上的一次登录，一个调用最多等待 300 秒拿到会话。
 - **能连到这个端点的人，都以该 server 配置的账号操作。** token 只用来识别调用者，不在平台上授予任何权限。

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/README.md

@@ -1173,6 +1173,9 @@ claude mcp add --transport http vmware-aiops https://mcp.example.com:8443/mcp \
   (vmware-policy ≥ 1.23.0).
 - Send `traceparent` or `X-Request-ID` with each request to have it stored on the audit row;
   `vmware-audit log --correlation-id ID` then finds the calls behind one platform request.
+- Tools that read or write files on this server (here: guest file upload/download, OVA and deployment-spec files) never touch its configuration, tokens, audit log or
+  TLS key, and over the network they are off unless `VMWARE_MCP_FILE_ROOT` names a directory for them
+  (vmware-policy ≥ 1.23.1).
 - The audit log records each caller as `token:<name>`. Calls run side by side, with up to `VMWARE_MCP_POOL_SIZE`
   (default 2) sessions per target; each session is a login on the target, and a call waits at most 300 s for one.
 - **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/RELEASE_NOTES.md

@@ -1,3 +1,19 @@
+## v2.3.2 — tools may not touch this server's own control files
+
+* **Security fix (HLD §18 step 0).** guest file download/upload, OVA and deployment-spec paths could name this server's own files, so over HTTPS a token holder could
+  overwrite `$OPS_HOME/mcp-tokens` or `rules.yaml`, or read a skill's `.env`. A path that resolves into `$OPS_HOME`,
+  a `~/.vmware-*` directory, a `VMWARE_*_CONFIG` directory, or the server's token file or TLS key/certificate is now
+  refused before anything is read or written. Over a network transport these tools read and write host files only
+  inside `VMWARE_MCP_FILE_ROOT` (unset: refused). Needs vmware-policy 1.23.1.
+* `download_vm_guest_file` writes without following a link swapped in during the transfer (`O_NOFOLLOW`, a
+  re-check after the transfer) and refuses a hard-linked destination; the `provision_vm_guest` preview no longer
+  reports the size of a file the run would refuse. Uploads read the source the same way, and a FIFO no longer
+  blocks either direction.
+* **`plan_id` can no longer name a path.** `apply_vm_plan` / `rollback_vm_plan` / `list`/`delete` built the plan file
+  name from the caller's `plan_id`, and saving used the id stored in the file, so a crafted plan could be written to
+  any `*.json` on the host. Plan ids are now `plan-` plus letters, digits and hyphens, and a plan file whose stored id
+  differs from its name is refused.
+
 ## v2.3.1 — an account with no vSphere role is named, not passed (AIops#47)
 
 Needs vmware-policy 1.23.0, and the vmware-monitor release with the same fix for the `attention` part.

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/openclaw.plugin.json

@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-aiops==2.3.1",
+        "vmware-aiops==2.3.2",
         "vmware-aiops-mcp"
       ]
     }

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zw008/vmware-aiops",
-  "version": "2.3.1",
+  "version": "2.3.2",
   "description": "AI-powered VMware vCenter/ESXi VM lifecycle and deployment with 61 MCP tools.",
   "private": true,
   "license": "MIT",

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-aiops"
-version = "2.3.1"
+version = "2.3.2"
 description = "VMware vCenter/ESXi AI-powered VM lifecycle and deployment tool"
 readme = "README.md"
 license = "MIT"
@@ -19,7 +19,7 @@ dependencies = [
     "httpx>=0.27,<1.0",
     "python-dotenv>=1.0,<2.0",
     "mcp[cli]>=1.28,<2.0",
-    "vmware-policy>=1.23.0,<2.0",
+    "vmware-policy>=1.23.1,<2.0",
     # Read-only cluster-health triage (summary + HTML snapshot) is owned by
     # vmware-monitor; AIops delegates to it so a conversation with the AIops
     # entry point can produce the same report without duplicating the code.

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/vmware-skills/VMware-AIops",
     "source": "github"
   },
-  "version": "2.3.1",
+  "version": "2.3.2",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-aiops",
-      "version": "2.3.1",
+      "version": "2.3.2",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/skills/vmware-aiops/SKILL.md

@@ -63,7 +63,7 @@ Read before connecting an agent. Per-tool inventory: `references/capabilities.md
 ## Quick Install
 
 ```bash
-uv tool install vmware-aiops==2.3.1
+uv tool install vmware-aiops==2.3.2
 vmware-aiops doctor
 vmware-aiops hub status   # see which family members are installed
 ```
@@ -303,7 +303,7 @@ The account has no vSphere role. Assign one (Read-Only or higher) on the vCenter
 ## Setup
 
 ```bash
-uv tool install vmware-aiops==2.3.1
+uv tool install vmware-aiops==2.3.2
 mkdir -p ~/.vmware-aiops
 vmware-aiops init  # generates config.yaml and .env templates
 chmod 600 ~/.vmware-aiops/.env

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/skills/vmware-aiops/references/setup-guide.md

@@ -6,13 +6,13 @@ All install methods fetch from the same source: [github.com/vmware-skills/VMware
 
 ```bash
 # Via PyPI (recommended for version pinning)
-uv tool install vmware-aiops==2.3.1
+uv tool install vmware-aiops==2.3.2
 
 # Via Skills.sh (fetches from GitHub)
-npx skills add vmware-skills/VMware-AIops#v2.3.1
+npx skills add vmware-skills/VMware-AIops#v2.3.2
 
 # Via ClawHub (fetches from ClawHub registry snapshot of GitHub)
-clawhub install @zw008/vmware-aiops --version 2.3.1
+clawhub install @zw008/vmware-aiops --version 2.3.2
 ```
 
 ### Claude Code
@@ -35,7 +35,7 @@ claude mcp add vmware-aiops -- vmware-aiops mcp
 
 ```bash
 # 1. Install from PyPI (source: github.com/vmware-skills/VMware-AIops)
-uv tool install vmware-aiops==2.3.1
+uv tool install vmware-aiops==2.3.2
 
 # 2. Verify installation source
 vmware-aiops --version  # confirms installed version
@@ -73,7 +73,7 @@ The `vmware-aiops` package installs a Python CLI binary and its dependencies (py
 ## Development Install
 
 ```bash
-git clone --branch v2.3.1 https://github.com/vmware-skills/VMware-AIops.git
+git clone --branch v2.3.2 https://github.com/vmware-skills/VMware-AIops.git
 cd VMware-AIops
 uv venv && source .venv/bin/activate
 # --no-sources: pyproject's [tool.uv.sources] points vmware-monitor at a sibling
@@ -233,6 +233,9 @@ vmware-aiops mcp --transport https --host 0.0.0.0 --port 8443 \
 - Correlation: each audit row stores the caller's `traceparent` trace-id, else its `X-Request-ID` /
   `X-Correlation-ID`. Have the agent platform send one, and `vmware-audit log --correlation-id ID` lists the calls
   behind one platform request.
+- Tools that read or write files on this server (here: guest file upload/download, OVA and deployment-spec files) never touch its configuration, tokens, audit log or
+  TLS key, and over the network they are off unless `VMWARE_MCP_FILE_ROOT` names a directory for them
+  (vmware-policy ≥ 1.23.1).
 - `vmware-audit token list` / `token revoke NAME` manage callers; a revoked token is refused from its next request.
   Replace a leaked token under a new name.
 - The server will not start without at least one token, and checks before it binds that unauthenticated requests

vmware_aiops-2.3.2/tests/eval/regression/test_host_paths_protected.py

@@ -0,0 +1,239 @@
+"""Regression: tools could read or write this server's own control files (HLD §18 step 0).
+
+Over HTTPS any token holder could call ``download_vm_guest_file(local_path=
+"~/.vmware/mcp-tokens", overwrite=True)`` and replace the token file, or upload
+a skill's ``.env`` into a VM. Every place that opens a caller-supplied host path
+now refuses one that resolves into ``$OPS_HOME`` or a ``~/.vmware-*`` directory,
+before anything is read, written or transferred.
+"""
+
+from __future__ import annotations
+
+import os
+from pathlib import Path
+from unittest.mock import MagicMock, patch
+
+import pytest
+from vmware_policy.hostpaths import HostPathRefusedError
+
+from vmware_aiops.ops import guest_ops, ova_deploy, vm_deploy
+
+
+@pytest.fixture
+def ops_home() -> Path:
+    home = Path(os.environ["OPS_HOME"])  # the sandbox conftest set
+    home.mkdir(parents=True, exist_ok=True)
+    tokens = home / "mcp-tokens"
+    tokens.write_text("alice:abc\n", encoding="utf-8")
+    return home
+
+
+def test_download_cannot_overwrite_the_token_file(ops_home):
+    si = MagicMock()
+    with pytest.raises(HostPathRefusedError):
+        guest_ops.guest_download(
+            si, "vm1", "/etc/hosts", str(ops_home / "mcp-tokens"), "u", "p", overwrite=True
+        )
+    assert (ops_home / "mcp-tokens").read_text(encoding="utf-8") == "alice:abc\n"
+    si.RetrieveContent.assert_not_called()
+
+
+def test_upload_cannot_send_a_control_file_into_a_vm(ops_home):
+    si = MagicMock()
+    with patch.object(guest_ops, "_require_vm_with_tools", return_value=MagicMock()), \
+         patch("urllib.request.urlopen") as urlopen:
+        with pytest.raises(HostPathRefusedError):
+            guest_ops.guest_upload(
+                si, "vm1", str(ops_home / "mcp-tokens"), "/tmp/x", "u", "p"
+            )
+        urlopen.assert_not_called()
+    fm = si.RetrieveContent.return_value.guestOperationsManager.fileManager
+    fm.InitiateFileTransferToGuest.assert_not_called()
+
+
+def test_a_deploy_spec_inside_ops_home_is_not_read(ops_home):
+    with pytest.raises(HostPathRefusedError):
+        vm_deploy.load_deploy_spec(str(ops_home / "rules.yaml"))
+
+
+def test_an_ova_inside_ops_home_is_not_read(ops_home):
+    with pytest.raises(HostPathRefusedError):
+        ova_deploy._read_ovf_from_ova(str(ops_home / "audit.db"))
+
+
+def test_the_mcp_tool_refuses_before_running(ops_home):
+    from vmware_aiops.mcp_server.tools import guest as guest_tools
+
+    with patch.object(guest_tools, "_get_connection") as connect:
+        with pytest.raises(HostPathRefusedError):
+            guest_tools.download_vm_guest_file(
+                vm_name="vm1",
+                guest_path="/etc/hosts",
+                local_path=str(ops_home / "mcp-tokens"),
+                username="u",
+                password="p",
+                overwrite=True,
+            )
+        connect.assert_not_called()
+
+
+def test_ordinary_paths_still_work(tmp_path):
+    spec = tmp_path / "spec.yaml"
+    spec.write_text("vms: []\n", encoding="utf-8")
+    assert vm_deploy.load_deploy_spec(str(spec)) is not None
+
+
+# ── review 2026-10-16: hard links, symlink swapped in after the check, preview ──
+
+
+def _download_with_fake_transfer(local: str, overwrite: bool, before_write=None):
+    """Run guest_download with the guest transfer faked; call before_write after the check."""
+    si = MagicMock()
+    vm = MagicMock()
+    resp = MagicMock()
+    resp.__enter__.return_value.read.return_value = b"payload"
+
+    def urlopen(*a, **k):
+        if before_write:
+            before_write()
+        return resp
+
+    with patch.object(guest_ops, "_require_vm_with_tools", return_value=vm), \
+         patch("urllib.request.urlopen", side_effect=urlopen), \
+         patch.object(guest_ops, "get_verify_ssl", return_value=True):
+        return guest_ops.guest_download(
+            si, "vm1", "/etc/motd", local, "u", "p", overwrite=overwrite
+        )
+
+
+def test_a_hard_link_to_a_protected_file_is_not_written_through(ops_home, tmp_path):
+    outside = tmp_path / "innocent.txt"
+    os.link(ops_home / "mcp-tokens", outside)
+    with pytest.raises(ValueError, match="hard link"):
+        _download_with_fake_transfer(str(outside), overwrite=True)
+    assert (ops_home / "mcp-tokens").read_text(encoding="utf-8") == "alice:abc\n"
+
+
+def test_a_symlink_swapped_in_during_the_transfer_is_not_followed(ops_home, tmp_path):
+    dest = tmp_path / "out.txt"
+
+    def swap():
+        dest.symlink_to(ops_home / "mcp-tokens")
+
+    with pytest.raises((HostPathRefusedError, OSError)):
+        _download_with_fake_transfer(str(dest), overwrite=True, before_write=swap)
+    assert (ops_home / "mcp-tokens").read_text(encoding="utf-8") == "alice:abc\n"
+
+
+def test_an_ordinary_download_is_written(tmp_path):
+    dest = tmp_path / "out.txt"
+    _download_with_fake_transfer(str(dest), overwrite=False)
+    assert dest.read_bytes() == b"payload"
+
+
+def test_the_provision_preview_does_not_reveal_a_protected_file(ops_home):
+    from vmware_aiops.ops import guest_gate
+
+    info, blocker = guest_gate._local_file(str(ops_home / "mcp-tokens"))
+    assert info["local_size_bytes"] is None
+    assert blocker and "configuration, tokens and audit log" in blocker
+
+
+def test_a_parent_dir_swapped_for_a_link_during_the_transfer_is_caught(ops_home, tmp_path):
+    # O_NOFOLLOW guards only the last component; the re-check after the transfer
+    # catches a parent directory replaced by a link into OPS_HOME.
+    sub = tmp_path / "sub"
+    sub.mkdir()
+
+    def swap():
+        sub.rmdir()
+        sub.symlink_to(ops_home, target_is_directory=True)
+
+    with pytest.raises(HostPathRefusedError):
+        _download_with_fake_transfer(str(sub / "rules.yaml"), overwrite=False, before_write=swap)
+    assert not (ops_home / "rules.yaml").exists()
+
+
+# ── second review 2026-10-16: plan_id was an unchecked host path ──────────────
+
+
+@pytest.mark.parametrize(
+    "bad",
+    ["/tmp/evil", "../../.cursor/mcp", "plan-x/../../evil", "plan-..", "", "plan-a.b", "x" * 300],
+)
+def test_a_plan_id_cannot_name_a_path(bad, tmp_path, monkeypatch):
+    from vmware_aiops.ops import planner
+
+    monkeypatch.setattr(planner, "_PLANS_DIR", tmp_path / "plans")
+    with pytest.raises(ValueError, match="plan id"):
+        planner.load_plan(bad)
+    with pytest.raises(ValueError, match="plan id"):
+        planner.delete_plan(bad)
+    with pytest.raises(ValueError, match="plan id"):
+        planner.save_plan({"plan_id": bad, "steps": []})
+
+
+def test_a_plan_file_naming_another_plan_id_is_refused(tmp_path, monkeypatch):
+    import json
+
+    from vmware_aiops.ops import planner
+
+    plans = tmp_path / "plans"
+    plans.mkdir()
+    monkeypatch.setattr(planner, "_PLANS_DIR", plans)
+    (plans / "plan-20261016-000000-abcd.json").write_text(
+        json.dumps({"plan_id": "../../.cursor/mcp", "steps": []}), encoding="utf-8"
+    )
+    with pytest.raises(ValueError, match="plan id"):
+        planner.load_plan("plan-20261016-000000-abcd")
+
+
+def test_a_generated_plan_id_round_trips(tmp_path, monkeypatch):
+    from vmware_aiops.ops import planner
+
+    monkeypatch.setattr(planner, "_PLANS_DIR", tmp_path / "plans")
+    (tmp_path / "plans").mkdir()
+    pid = planner._generate_plan_id()
+    planner.save_plan({"plan_id": pid, "steps": []})
+    assert planner.load_plan(pid)["plan_id"] == pid
+    planner.delete_plan(pid)
+    assert planner.load_plan(pid) is None
+
+
+def test_download_onto_a_fifo_does_not_hang(tmp_path):
+    fifo = tmp_path / "pipe"
+    os.mkfifo(fifo)
+    with pytest.raises((ValueError, OSError)):
+        _download_with_fake_transfer(str(fifo), overwrite=True)
+
+
+def test_upload_reads_a_regular_file_without_following_a_swapped_link(ops_home, tmp_path):
+    src = tmp_path / "src.txt"
+    src.write_text("data", encoding="utf-8")
+    assert guest_ops._read_upload_source(src) == b"data"
+    link = tmp_path / "link.txt"
+    link.symlink_to(ops_home / "mcp-tokens")
+    with pytest.raises(OSError):
+        guest_ops._read_upload_source(link)
+
+
+def test_upload_source_swapped_for_a_fifo_is_refused_not_hung(tmp_path):
+    fifo = tmp_path / "pipe"
+    os.mkfifo(fifo)
+    with pytest.raises(ValueError, match="regular file"):
+        guest_ops._read_upload_source(fifo)
+
+
+def test_a_plan_id_with_a_trailing_newline_is_refused(tmp_path, monkeypatch):
+    from vmware_aiops.ops import planner
+
+    monkeypatch.setattr(planner, "_PLANS_DIR", tmp_path / "plans")
+    with pytest.raises(ValueError, match="plan id"):
+        planner.load_plan("plan-abc\n")
+
+
+def test_an_upload_source_that_is_a_hard_link_is_refused(ops_home, tmp_path):
+    link = tmp_path / "innocent.txt"
+    os.link(ops_home / "mcp-tokens", link)
+    with pytest.raises(ValueError, match="hard link"):
+        guest_ops._read_upload_source(link)

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/tests/test_guest_tools_gate.py

@@ -37,7 +37,9 @@ GATED = ("run_vm_guest_command", "run_vm_guest_command_with_output", "upload_vm_
 
 @pytest.fixture(autouse=True)
 def harness(tmp_path, monkeypatch):
-    monkeypatch.setenv("OPS_HOME", str(tmp_path))
+    # OPS_HOME in its own subdirectory: the files these tests upload live in
+    # tmp_path, and a file inside OPS_HOME is refused (HLD §18 step 0).
+    monkeypatch.setenv("OPS_HOME", str(tmp_path / "ops"))
     reset_policy_engine()
     reset_budget()
     reset_undo_store()

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/uv.lock

@@ -1195,7 +1195,7 @@ wheels = [
 
 [[package]]
 name = "vmware-aiops"
-version = "2.3.1"
+version = "2.3.2"
 source = { editable = "." }
 dependencies = [
     { name = "apscheduler" },
@@ -1228,7 +1228,7 @@ requires-dist = [
     { name = "rich", specifier = ">=13.0,<16.0" },
     { name = "typer", specifier = ">=0.12,<1.0" },
     { name = "vmware-monitor", editable = "../VMware-Monitor" },
-    { name = "vmware-policy", specifier = ">=1.23.0,<2.0" },
+    { name = "vmware-policy", specifier = ">=1.23.1,<2.0" },
 ]
 
 [package.metadata.requires-dev]
@@ -1276,14 +1276,14 @@ dev = [
 
 [[package]]
 name = "vmware-policy"
-version = "1.23.0"
+version = "1.23.1"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "pyyaml" },
     { name = "rich" },
     { name = "typer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/1b/ef/2c56cc93e0744d7e68b75f7a288f580215865b4685a07b9d58e49773819b/vmware_policy-1.23.0.tar.gz", hash = "sha256:70a682fa44e36fadee7ca09c7c5411fff51c9e25ad9d638f9877737361e2ae31", size = 325401, upload-time = "2026-10-16T00:10:32.297Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ec/2c/03d2327478838ed3d407c7fc30ebbd6a2cf3b3d2c58285ba6653697224b0/vmware_policy-1.23.1.tar.gz", hash = "sha256:6fe55a99fc71f9591bedd3c5dcc00042559953f02a7bf7da9d2b9b4638877c08", size = 332522, upload-time = "2026-10-16T02:55:48.081Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e3/ca/bdfc9e50cedf6684ed7d34348177f7688323617ce26d492f55b3d80cd45c/vmware_policy-1.23.0-py3-none-any.whl", hash = "sha256:2f35a97f7d0997dd49ab5a0d8d0fd5f4eae11ef66ca8ed26bc9e4b395cb0d45c", size = 110836, upload-time = "2026-10-16T00:10:30.55Z" },
+    { url = "https://files.pythonhosted.org/packages/b7/22/94fc30b3e273fd0e9739fb11ac0bfa8232352cefcaf95ee25229bb277733/vmware_policy-1.23.1-py3-none-any.whl", hash = "sha256:4afe95894e8a05556dfeb9e2c6a37186cf8c4bf3017131dedfb8c23478514cec", size = 114484, upload-time = "2026-10-16T02:55:46.591Z" },
 ]

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/vmware_aiops/__init__.py

@@ -1,3 +1,3 @@
 """VMware AIops - AI-powered vCenter/ESXi monitoring and operations."""
 
-__version__ = "2.3.1"
+__version__ = "2.3.2"

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/vmware_aiops/ops/guest_gate.py

@@ -25,6 +25,7 @@ from typing import TYPE_CHECKING, Any
 
 from pyVmomi import vim, vmodl
 from vmware_policy import sanitize
+from vmware_policy.hostpaths import HostPathRefusedError, check_host_path
 
 from vmware_aiops.ops import vm_lifecycle
 from vmware_aiops.ops.guest_ops import _FAMILY_WINDOWS, _detect_shell
@@ -148,6 +149,10 @@ def _local_file(path: str) -> tuple[dict[str, Any], str | None]:
     """
     local = Path(path).expanduser()
     info: dict[str, Any] = {"local_path": _text(path, MAX_PATH_CHARS), "local_size_bytes": None}
+    try:
+        check_host_path(path)  # the preview must not reveal what the run refuses
+    except HostPathRefusedError as exc:
+        return info, _text(str(exc), 300)
     if not local.is_file():
         return info, (
             f"Local upload source is not an existing regular file: {_text(local, MAX_PATH_CHARS)}. "

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/vmware_aiops/ops/guest_ops.py

@@ -9,6 +9,7 @@ from __future__ import annotations
 import logging
 import os
 import shlex
+import stat
 import tempfile
 import time
 import uuid
@@ -18,6 +19,7 @@ from typing import TYPE_CHECKING
 from pyVmomi import vim
 
 from vmware_policy import sanitize
+from vmware_policy.hostpaths import check_host_path
 
 from vmware_aiops.connection import get_verify_ssl
 from vmware_aiops.ops.inventory import find_vm_by_name
@@ -412,6 +414,8 @@ def guest_upload(
 
     auth = _guest_auth(username, password)
 
+    # Never this server's own config, tokens or audit log (HLD §18 step 0).
+    check_host_path(local_path)
     # Read local file — must be an existing regular file (not a dir/device/fifo).
     local = Path(local_path).expanduser()
     if not local.is_file():
@@ -426,8 +430,7 @@ def guest_upload(
             f"(chmod +r) to the user running vmware-aiops, or pass a readable "
             f"path to --local."
         )
-    with open(local, "rb") as f:
-        file_data = f.read()
+    file_data = _read_upload_source(local)
 
     file_size = len(file_data)
 
@@ -462,6 +465,61 @@ def guest_upload(
     return f"Uploaded {file_size} bytes to {guest_path} on VM '{vm_name}'"
 
 
+def _read_upload_source(local: Path) -> bytes:
+    """Read the upload source without following a link swapped in after the checks.
+
+    ``O_NOFOLLOW`` refuses a final symlink and ``O_NONBLOCK`` keeps a FIFO from
+    blocking the worker; anything but a regular file is refused after opening.
+    """
+    flags = os.O_RDONLY | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0)
+    fd = os.open(local, flags)
+    try:
+        st = os.fstat(fd)
+        if not stat.S_ISREG(st.st_mode):
+            raise ValueError(
+                f"Local upload source is not a regular file: {local}. Pass a regular file."
+            )
+        if st.st_nlink > 1:  # another path shares it, possibly a protected one
+            raise ValueError(
+                f"Local upload source is a hard link: {local}. Copy the file and upload the copy."
+            )
+        with os.fdopen(fd, "rb") as f:
+            fd = -1
+            return f.read()
+    finally:
+        if fd != -1:
+            os.close(fd)
+
+
+def _write_download(local: Path, data: bytes, *, overwrite: bool) -> None:
+    """Write a downloaded file without following a link swapped in after the checks.
+
+    ``O_NOFOLLOW`` refuses a final symlink; ``O_EXCL`` keeps the no-overwrite
+    promise even if a file appeared meanwhile; and a destination that is not a
+    single regular file (a hard link shares its inode with another path, which
+    may be a protected one) is refused before anything is truncated.
+    """
+    # O_NONBLOCK: an existing FIFO must not block the worker in open().
+    flags = os.O_WRONLY | os.O_CREAT | getattr(os, "O_NOFOLLOW", 0) | getattr(os, "O_NONBLOCK", 0)
+    if not overwrite:
+        flags |= os.O_EXCL
+    fd = os.open(local, flags, 0o666)
+    try:
+        st = os.fstat(fd)
+        if not stat.S_ISREG(st.st_mode) or st.st_nlink > 1:
+            raise ValueError(
+                "Choose a new local path: the destination is a hard link or not a regular "
+                f"file, so writing it would change another file too. Path: {local}"
+            )
+        os.ftruncate(fd, 0)
+        with os.fdopen(fd, "wb") as f:
+            fd = -1
+            f.write(data)
+    finally:
+        if fd != -1:
+            os.close(fd)
+
+
 def _check_download_destination(local_path: str, overwrite: bool) -> None:
     """Refuse a download destination that is not free to write.
 
@@ -487,6 +545,8 @@ def _check_download_destination(local_path: str, overwrite: bool) -> None:
     is caller-supplied and unbounded, so a message that closed with its remedy
     would lose exactly the part the agent needs.
     """
+    # Never this server's own config, tokens or audit log (HLD §18 step 0).
+    check_host_path(local_path)
     local = Path(local_path).expanduser()
     if local.is_symlink():
         raise ValueError(
@@ -566,8 +626,9 @@ def guest_download(
 
     local = Path(local_path).expanduser()
     local.parent.mkdir(parents=True, exist_ok=True)
-    with open(local, "wb") as f:
-        f.write(file_data)
+    # The transfer took time: check again, then write without following a link.
+    check_host_path(local_path)
+    _write_download(local, file_data, overwrite=overwrite)
 
     logger.info(
         "Downloaded %d bytes from '%s:%s' to '%s'",

{vmware_aiops-2.3.1 → vmware_aiops-2.3.2}/vmware_aiops/ops/ova_deploy.py

@@ -17,6 +17,7 @@ from urllib.request import Request, urlopen
 
 from pyVmomi import vim
 from vmware_policy import sanitize
+from vmware_policy.hostpaths import check_host_path
 
 from vmware_aiops.connection import get_verify_ssl
 from vmware_aiops.ops.inventory import (
@@ -101,6 +102,7 @@ def _read_ovf_from_ova(ova_path: str) -> tuple[str, dict[str, int]]:
     Returns:
         Tuple of (ovf_xml_string, {vmdk_filename: file_size_bytes})
     """
+    check_host_path(ova_path)  # never this server's own files (HLD §18 step 0)
     disks: dict[str, int] = {}
     ovf_content = ""
 
@@ -158,6 +160,7 @@ def _upload_disk(
     if not upload_url.lower().startswith("https://"):
         raise ValueError(f"Refusing non-HTTPS upload URL: {upload_url}")
 
+    check_host_path(ova_path)  # opened again here; check again (HLD §18 step 0)
     with tarfile.open(ova_path, "r", encoding="utf-8") as tar:
         member = tar.getmember(disk_name)
         if not _safe_tar_member(member):