vmware-aiops 2.4.1__tar.gz → 2.4.2__tar.gz

{vmware_aiops-2.4.1 → vmware_aiops-2.4.2}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-aiops",
   "displayName": "VMware AIops",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "description": "AI-powered VMware vCenter/ESXi VM lifecycle and deployment with 61 MCP tools.",
   "author": {
     "name": "Wei Zhou",

{vmware_aiops-2.4.1 → vmware_aiops-2.4.2}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-aiops==2.4.1",
+        "vmware-aiops==2.4.2",
         "vmware-aiops-mcp"
       ]
     }

{vmware_aiops-2.4.1 → vmware_aiops-2.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-aiops
-Version: 2.4.1
+Version: 2.4.2
 Summary: VMware vCenter/ESXi AI-powered VM lifecycle and deployment tool
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-AIops
 Project-URL: Repository, https://github.com/vmware-skills/VMware-AIops
@@ -12,13 +12,13 @@ License-File: LICENSE
 Requires-Python: >=3.10
 Requires-Dist: apscheduler<4.0,>=3.10
 Requires-Dist: httpx<1.0,>=0.27
-Requires-Dist: mcp[cli]<2.0,>=1.28
+Requires-Dist: mcp[cli]<2.0,>=1.30
 Requires-Dist: pyaml<27.0,>=24.0
 Requires-Dist: python-dotenv<2.0,>=1.0
 Requires-Dist: pyvmomi<10.0,>=8.0.3.0
 Requires-Dist: rich<16.0,>=13.0
 Requires-Dist: typer<1.0,>=0.12
-Requires-Dist: vmware-monitor<3.0,>=2.3.1
+Requires-Dist: vmware-monitor<3.0,>=2.4.2
 Requires-Dist: vmware-policy<2.0,>=1.23.1
 Description-Content-Type: text/markdown
 

{vmware_aiops-2.4.1 → vmware_aiops-2.4.2}/RELEASE_NOTES.md

@@ -1,3 +1,50 @@
+## v2.4.2 — a login refused for lack of a role says so; an unreadable host is not called unreachable (2026-10-19)
+
+Needs vmware-monitor 2.4.2 (now the floor). Found on a vCenter 8.0.3 lab with two restricted SSO accounts
+(follow-up to AIops#47).
+
+* **A login vCenter refuses with `NoPermission` gets the role error, not the raw fault.** For an account with no
+  permission anywhere, vCenter refuses the login itself (`System.View` on the root folder), so the post-login
+  no-role check never ran and `doctor` and every tool showed the raw fault with a connectivity hint. It now raises
+  the no-role error: the "no vSphere role / Global Permissions" remedy only for a vCenter target and `System.View`;
+  an ESXi target or another privilege gets a neutral text naming the (sanitized) privilege. A wrong password
+  (`InvalidLogin`) is unchanged. Same text as vmware-monitor.
+* **vmk tools and `cluster info` no longer call an unreadable host unreachable.** When the account cannot read a
+  host's connection state, `list_host_vmks` rows and the vmk write tools' refusal say the account cannot read the
+  host (`reachable: false` means "not read"), instead of advising a reconnect. `cluster info` colours the state
+  yellow, not red.
+* **From vmware-monitor 2.4.2 (through `get_cluster_health_summary` / `get_cross_vcenter_attention`):** a host this
+  account cannot read is counted `hosts_unreadable` with a warning issue `host_unreadable`, not ranked as a
+  critical `host_down`.
+
+## Unreleased — follow-ups to the 2.4.1 review
+
+* **Previews show policy refusals.** `restore_vm_clean_slate`, `provision_vm_guest` and
+  `run_vm_guest_command_with_output` were refused by `rules.yaml` only at `confirm=True`; the preview now lists that
+  refusal in `blast_radius.blockers`, so the user sees it before agreeing.
+* **A delete that powers the VM off first is checked as `power_off_vm` too:** the CLI `vm delete`, the TTL daemon,
+  and a plan rollback deleting the VM it created (checked when the VM is running or its state cannot be read). The
+  TTL daemon records one `delete_vm` row per change of outcome, as for a deny on `delete_vm`, and keeps the entry.
+  **Behaviour change for custom network roles:** a role that allows `set_vm_ttl` must also allow `power_off_vm`.
+* **Image cache:** writes take a lock across processes (a CLI and an MCP scan at the same time lost one side's
+  rows); a scan keeps rows on datastores it failed to browse (its own or legacy ones) and drops this target's rows
+  on datastores that no longer exist. A cache that cannot be written no longer fails the scan: the images come back
+  with a `cache_note`, as in vmware-storage.
+* **Each call is checked for what it will do, at the moment it does it.** `restore_vm_clean_slate` asks about
+  `power_off_vm` only when it actually powers the VM off; `provision_vm_guest` asks about the guest tools its step
+  types use (an exec-only provision is not refused by a deny on `upload_vm_guest_file`); a plan rollback asks about
+  the power-off after confirming it is the VM the plan created, just before powering it off.
+* **`set_vm_ttl` is checked as the deletion it schedules:** the preview lists a deny on `delete_vm` (and on
+  `power_off_vm` for a running VM), and `confirm=True` refuses it, instead of scheduling a TTL the daemon can never
+  act on. The daemon still asks again at expiry.
+* **`migrate_vm` previews run vCenter's own vMotion compatibility check** (`CheckMigrate_Task`, read-only): its
+  errors (CPU features, devices, networks, datastores) become blockers, with the CPU-feature remedy where it applies,
+  so a move vCenter would refuse is refused in the preview and before the CLI asks for confirmation; warnings are
+  shown and do not block. On a standalone ESXi host, or when the check cannot run, the preview says "not checked"
+  and does not block (vCenter checks again when the move starts). Plan migrate steps get the same check.
+* The TTL store takes the same cross-process lock as the image cache (`set_vm_ttl` and the daemon run in separate
+  processes).
+
 ## v2.4.1 — fixes from the 2026-10-17 real-hardware read and write rounds
 
 * **Tools that run other tools' operations obey `rules.yaml` for those tools**, on the MCP and CLI surfaces.

{vmware_aiops-2.4.1 → vmware_aiops-2.4.2}/openclaw.plugin.json

@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-aiops==2.4.1",
+        "vmware-aiops==2.4.2",
         "vmware-aiops-mcp"
       ]
     }

{vmware_aiops-2.4.1 → vmware_aiops-2.4.2}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zw008/vmware-aiops",
-  "version": "2.4.1",
+  "version": "2.4.2",
   "description": "AI-powered VMware vCenter/ESXi VM lifecycle and deployment with 61 MCP tools.",
   "private": true,
   "license": "MIT",

{vmware_aiops-2.4.1 → vmware_aiops-2.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-aiops"
-version = "2.4.1"
+version = "2.4.2"
 description = "VMware vCenter/ESXi AI-powered VM lifecycle and deployment tool"
 readme = "README.md"
 license = "MIT"
@@ -18,12 +18,12 @@ dependencies = [
     "apscheduler>=3.10,<4.0",
     "httpx>=0.27,<1.0",
     "python-dotenv>=1.0,<2.0",
-    "mcp[cli]>=1.28,<2.0",
+    "mcp[cli]>=1.30,<2.0",
     "vmware-policy>=1.23.1,<2.0",
     # Read-only cluster-health triage (summary + HTML snapshot) is owned by
     # vmware-monitor; AIops delegates to it so a conversation with the AIops
     # entry point can produce the same report without duplicating the code.
-    "vmware-monitor>=2.3.1,<3.0",  # attention status floor + role-less login (AIops#47)
+    "vmware-monitor>=2.4.2,<3.0",  # unreadable host != down, login refused -> role error
 ]
 
 

{vmware_aiops-2.4.1 → vmware_aiops-2.4.2}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/vmware-skills/VMware-AIops",
     "source": "github"
   },
-  "version": "2.4.1",
+  "version": "2.4.2",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-aiops",
-      "version": "2.4.1",
+      "version": "2.4.2",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_aiops-2.4.1 → vmware_aiops-2.4.2}/skills/vmware-aiops/SKILL.md

@@ -63,7 +63,7 @@ Read before connecting an agent. Per-tool inventory: `references/capabilities.md
 ## Quick Install
 
 ```bash
-uv tool install vmware-aiops==2.4.1
+uv tool install vmware-aiops==2.4.2
 vmware-aiops doctor
 vmware-aiops hub status   # see which family members are installed
 ```
@@ -303,7 +303,7 @@ The account has no vSphere role. Assign one (Read-Only or higher) on the vCenter
 ## Setup
 
 ```bash
-uv tool install vmware-aiops==2.4.1
+uv tool install vmware-aiops==2.4.2
 mkdir -p ~/.vmware-aiops
 vmware-aiops init  # generates config.yaml and .env templates
 chmod 600 ~/.vmware-aiops/.env

{vmware_aiops-2.4.1 → vmware_aiops-2.4.2}/skills/vmware-aiops/references/setup-guide.md

@@ -6,13 +6,13 @@ All install methods fetch from the same source: [github.com/vmware-skills/VMware
 
 ```bash
 # Via PyPI (recommended for version pinning)
-uv tool install vmware-aiops==2.4.1
+uv tool install vmware-aiops==2.4.2
 
 # Via Skills.sh (fetches from GitHub)
-npx skills add vmware-skills/VMware-AIops#v2.4.1
+npx skills add vmware-skills/VMware-AIops#v2.4.2
 
 # Via ClawHub (fetches from ClawHub registry snapshot of GitHub)
-clawhub install @zw008/vmware-aiops --version 2.4.1
+clawhub install @zw008/vmware-aiops --version 2.4.2
 ```
 
 ### Claude Code
@@ -35,7 +35,7 @@ claude mcp add vmware-aiops -- vmware-aiops mcp
 
 ```bash
 # 1. Install from PyPI (source: github.com/vmware-skills/VMware-AIops)
-uv tool install vmware-aiops==2.4.1
+uv tool install vmware-aiops==2.4.2
 
 # 2. Verify installation source
 vmware-aiops --version  # confirms installed version
@@ -73,7 +73,7 @@ The `vmware-aiops` package installs a Python CLI binary and its dependencies (py
 ## Development Install
 
 ```bash
-git clone --branch v2.4.1 https://github.com/vmware-skills/VMware-AIops.git
+git clone --branch v2.4.2 https://github.com/vmware-skills/VMware-AIops.git
 cd VMware-AIops
 uv venv && source .venv/bin/activate
 # --no-sources: pyproject's [tool.uv.sources] points vmware-monitor at a sibling

{vmware_aiops-2.4.1 → vmware_aiops-2.4.2}/tests/eval/regression/test_code_review_fixes.py

@@ -127,7 +127,7 @@ def test_ttl_entry_kept_on_transient_failure(monkeypatch: pytest.MonkeyPatch) ->
     monkeypatch.setattr(scheduler, "remove_entry", removed.append)
     monkeypatch.setattr(
         scheduler, "delete_vm",
-        lambda si, name: (_ for _ in ()).throw(RuntimeError("vCenter task timeout")),
+        lambda si, name, **k: (_ for _ in ()).throw(RuntimeError("vCenter task timeout")),
     )
 
     scheduler._run_ttl_check(MagicMock())
@@ -143,7 +143,7 @@ def test_ttl_entry_removed_when_vm_already_gone(monkeypatch: pytest.MonkeyPatch)
     monkeypatch.setattr(scheduler, "remove_entry", removed.append)
     monkeypatch.setattr(
         scheduler, "delete_vm",
-        lambda si, name: (_ for _ in ()).throw(VMNotFoundError("VM 'ttl-vm' not found")),
+        lambda si, name, **k: (_ for _ in ()).throw(VMNotFoundError("VM 'ttl-vm' not found")),
     )
 
     scheduler._run_ttl_check(MagicMock())
@@ -156,7 +156,7 @@ def test_ttl_entry_removed_on_success(monkeypatch: pytest.MonkeyPatch) -> None:
     removed: list[str] = []
     monkeypatch.setattr(scheduler, "get_expired_entries", lambda: [_ttl_entry()])
     monkeypatch.setattr(scheduler, "remove_entry", removed.append)
-    monkeypatch.setattr(scheduler, "delete_vm", lambda si, name: f"VM '{name}' deleted")
+    monkeypatch.setattr(scheduler, "delete_vm", lambda si, name, **k: f"VM '{name}' deleted")
 
     scheduler._run_ttl_check(MagicMock())
     assert removed == ["ttl-vm"]

{vmware_aiops-2.4.1 → vmware_aiops-2.4.2}/tests/eval/regression/test_daemon_calls_are_audited.py

@@ -71,7 +71,7 @@ def ttl(monkeypatch):
 
 def test_a_ttl_delete_writes_one_vm_delete_row(ttl, monkeypatch):
     scheduler, removed = ttl
-    monkeypatch.setattr(scheduler, "delete_vm", lambda si, name: f"VM '{name}' deleted")
+    monkeypatch.setattr(scheduler, "delete_vm", lambda si, name, **k: f"VM '{name}' deleted")
 
     scheduler._run_ttl_check(MagicMock())
 
@@ -88,7 +88,7 @@ def test_a_ttl_delete_writes_one_vm_delete_row(ttl, monkeypatch):
 def test_a_failed_ttl_delete_is_recorded_as_error_and_the_entry_kept(ttl, monkeypatch):
     scheduler, removed = ttl
 
-    def boom(si, name):
+    def boom(si, name, **k):
         raise RuntimeError("vCenter task timeout")
 
     monkeypatch.setattr(scheduler, "delete_vm", boom)
@@ -106,7 +106,7 @@ def test_a_ttl_vm_already_gone_is_recorded_and_the_stale_entry_dropped(ttl, monk
 
     scheduler, removed = ttl
 
-    def gone(si, name):
+    def gone(si, name, **k):
         raise VMNotFoundError(f"VM '{name}' not found")
 
     monkeypatch.setattr(scheduler, "delete_vm", gone)
@@ -122,7 +122,7 @@ def test_a_ttl_vm_already_gone_is_recorded_and_the_stale_entry_dropped(ttl, monk
 def test_a_ttl_delete_refused_by_policy_never_runs(ttl, monkeypatch):
     scheduler, removed = ttl
     deleted: list[str] = []
-    monkeypatch.setattr(scheduler, "delete_vm", lambda si, name: deleted.append(name))
+    monkeypatch.setattr(scheduler, "delete_vm", lambda si, name, **k: deleted.append(name))
 
     def deny(skill, tool, params=None, *, risk_level="low", target=""):
         raise PolicyDenied(
@@ -144,7 +144,7 @@ def test_a_refused_ttl_entry_writes_one_row_per_outcome_not_one_per_minute(ttl,
     failing entry wrote a delete_vm row on every run — 1,440 a day per entry, on
     this lab whose rules.yaml denies delete_vm — burying real calls."""
     scheduler, removed = ttl
-    monkeypatch.setattr(scheduler, "delete_vm", lambda si, name: None)
+    monkeypatch.setattr(scheduler, "delete_vm", lambda si, name, **k: None)
 
     def deny(skill, tool, params=None, *, risk_level="low", target=""):
         raise PolicyDenied(
@@ -165,7 +165,7 @@ def test_a_failing_ttl_delete_writes_again_only_when_its_outcome_changes(ttl, mo
     scheduler, removed = ttl
     attempts: list[str] = []
 
-    def flaky(si, name):
+    def flaky(si, name, **k):
         attempts.append(name)
         if len(attempts) <= 3:
             raise RuntimeError("vCenter task timeout")
@@ -315,7 +315,7 @@ def test_a_ttl_vm_whose_name_is_ambiguous_is_not_deleted_and_the_entry_dropped(t
 
     scheduler, removed = ttl
 
-    def ambiguous(si, name):
+    def ambiguous(si, name, **k):
         raise AmbiguousVMError(f"2 VMs are named '{name}'.")
 
     monkeypatch.setattr(scheduler, "delete_vm", ambiguous)
@@ -332,7 +332,7 @@ def test_daemon_rows_say_daemon_not_mcp(ttl, monkeypatch):
     """HLD §16 D-14: a TTL delete made by the daemon is not an MCP call. Without
     an explicit surface the row read `mcp-stdio` — non-empty, and wrong."""
     scheduler, _removed = ttl
-    monkeypatch.setattr(scheduler, "delete_vm", lambda si, name: f"VM '{name}' deleted")
+    monkeypatch.setattr(scheduler, "delete_vm", lambda si, name, **k: f"VM '{name}' deleted")
 
     scheduler._run_ttl_check(MagicMock())
 

vmware_aiops-2.4.2/tests/eval/regression/test_image_registry_cross_process.py

@@ -0,0 +1,134 @@
+"""Two processes scanning at once must not drop each other's cached images.
+
+Review 2026-10-18: the registry's read-modify-write was guarded by a
+``threading.Lock``, which only serialises one process. A CLI scan and an MCP
+server scan running side by side each read the old file, and the last
+``os.replace`` wrote the other's rows away. The atomic replace stops a reader
+seeing half a file; it does nothing for a lost update.
+"""
+
+from __future__ import annotations
+
+import json
+import os
+import subprocess
+import sys
+import textwrap
+import time
+from pathlib import Path
+
+import pytest
+
+from vmware_aiops.ops import datastore_browser as dsb
+
+_WRITERS = 4
+
+_CHILD = textwrap.dedent(
+    """
+    import sys, time
+    from pathlib import Path
+    from vmware_aiops.ops import datastore_browser as dsb
+
+    reg, target = Path(sys.argv[1]), sys.argv[2]
+    dsb.IMAGE_REGISTRY_FILE = reg
+    dsb.CONFIG_DIR = reg.parent
+    real_load = dsb._load_registry
+
+    def slow_load():
+        # Widen the read-modify-write window so the race is not left to luck.
+        data = real_load()
+        time.sleep(0.3)
+        return data
+
+    dsb._load_registry = slow_load
+    (reg.parent / f"ready-{target}").touch()
+    go = reg.parent / "go"
+    deadline = time.monotonic() + 60
+    while not go.exists():
+        if time.monotonic() > deadline:
+            sys.exit("parent never said go")
+        time.sleep(0.01)
+    img = {"name": f"{target}.iso", "ds_path": f"[datastore1] {target}.iso",
+           "size_mb": 1.0, "type": "File", "modified": ""}
+    dsb.scan_all_datastores = lambda si: {"datastore1": [img]}
+    dsb.update_registry(object(), target=target)
+    """
+)
+
+
+def _child_env() -> dict[str, str]:
+    env = dict(os.environ)
+    # The children must import exactly the code this test process imported.
+    env["PYTHONPATH"] = os.pathsep.join(p for p in sys.path if p)
+    return env
+
+
+def _run_writers(reg: Path, script: str, targets: list[str]) -> None:
+    procs = [
+        subprocess.Popen([sys.executable, "-c", script, str(reg), t], env=_child_env())
+        for t in targets
+    ]
+    try:
+        deadline = time.monotonic() + 60
+        while not all((reg.parent / f"ready-{t}").exists() for t in targets):
+            assert time.monotonic() < deadline, "writers never became ready"
+            assert all(p.poll() is None for p in procs), "a writer exited early"
+            time.sleep(0.02)
+        (reg.parent / "go").touch()
+        for p in procs:
+            assert p.wait(timeout=60) == 0
+    finally:
+        for p in procs:
+            if p.poll() is None:
+                p.kill()
+
+
+@pytest.mark.unit
+def test_concurrent_scans_in_separate_processes_keep_every_row(tmp_path) -> None:
+    reg = tmp_path / "image_registry.json"
+    targets = [f"t{i}" for i in range(_WRITERS)]
+
+    _run_writers(reg, _CHILD, targets)
+
+    rows = json.loads(reg.read_text(encoding="utf-8"))["images"]
+    assert sorted(r["target"] for r in rows) == targets
+
+
+@pytest.fixture
+def registry(tmp_path, monkeypatch):
+    path = tmp_path / "image_registry.json"
+    monkeypatch.setattr(dsb, "IMAGE_REGISTRY_FILE", path)
+    monkeypatch.setattr(dsb, "CONFIG_DIR", tmp_path)
+    img = {"name": "x.iso", "ds_path": "[ds1] x.iso", "size_mb": 1.0,
+           "type": "File", "modified": ""}
+    monkeypatch.setattr(dsb, "scan_all_datastores", lambda si: {"ds1": [img]})
+    return path
+
+
+def _hold_lock(reg: Path):
+    fcntl = pytest.importorskip("fcntl")
+    fh = open(reg.with_name(reg.name + ".lock"), "a+b")  # noqa: SIM115
+    fcntl.flock(fh.fileno(), fcntl.LOCK_EX | fcntl.LOCK_NB)
+    return fh
+
+
+@pytest.mark.unit
+def test_a_held_lock_is_a_bounded_wait_that_names_the_lock_file(registry, monkeypatch) -> None:
+    monkeypatch.setattr(dsb, "REGISTRY_LOCK_TIMEOUT_S", 0.3, raising=False)
+    holder = _hold_lock(registry)
+    try:
+        started = time.monotonic()
+        # The scan is returned; the note says the cache was not updated and why.
+        out = dsb.update_registry(object(), target="vc")
+        assert "image_registry.json.lock" in out["cache_note"]
+        assert time.monotonic() - started < 5
+    finally:
+        holder.close()
+    assert not registry.exists(), "nothing may be written without the lock"
+
+
+@pytest.mark.unit
+def test_the_lock_is_released_after_a_write(registry) -> None:
+    dsb.update_registry(object(), target="vc")
+    holder = _hold_lock(registry)  # would raise BlockingIOError if still held
+    holder.close()

vmware_aiops-2.4.2/tests/eval/regression/test_image_registry_legacy_rows.py

@@ -0,0 +1,150 @@
+"""A scan replaces only the legacy rows it can attribute (review 2026-10-18).
+
+Legacy rows are the ones written before rows carried ``target``. A scan of one
+target deleted every legacy row in the file, including rows for datastores that
+target does not have — the cache lost images no scan had looked at again.
+VMware-Storage's ``_record_scan`` replaces a legacy row only when the scan
+covered its datastore (and folder); this follows the same rule. A whole-target
+scan covers each datastore it browsed successfully, whether or not it found
+images there.
+"""
+
+from __future__ import annotations
+
+import json
+
+import pytest
+
+from vmware_aiops.ops import datastore_browser as dsb
+from vmware_aiops.ops import inventory
+
+
+def _legacy(ds: str, name: str) -> dict:
+    return {"datastore": ds, "name": name, "ds_path": f"[{ds}] {name}",
+            "size_mb": 1.0, "type": "File", "modified": ""}
+
+
+def _img(ds: str, name: str) -> dict:
+    return {"name": name, "ds_path": f"[{ds}] {name}", "size_mb": 1.0,
+            "type": "File", "modified": ""}
+
+
+@pytest.fixture
+def registry(tmp_path, monkeypatch):
+    path = tmp_path / "image_registry.json"
+    monkeypatch.setattr(dsb, "IMAGE_REGISTRY_FILE", path)
+    monkeypatch.setattr(dsb, "CONFIG_DIR", tmp_path)
+    return path
+
+
+def _seed(path, rows: list[dict]) -> None:
+    path.write_text(json.dumps({"images": rows, "last_scan": None}), encoding="utf-8")
+
+
+def _names() -> list[str]:
+    return sorted(i["name"] for i in dsb.list_images())
+
+
+@pytest.mark.unit
+def test_legacy_rows_on_datastores_the_scan_did_not_cover_survive(registry, monkeypatch) -> None:
+    _seed(registry, [_legacy("datastore1", "old.iso"), _legacy("nfs-b", "keep.iso")])
+    monkeypatch.setattr(dsb, "scan_all_datastores",
+                        lambda si: {"datastore1": [_img("datastore1", "new.iso")]})
+
+    dsb.update_registry(object(), target="vc")
+
+    assert _names() == ["keep.iso", "new.iso"]
+
+
+@pytest.mark.unit
+def test_other_targets_rows_survive(registry, monkeypatch) -> None:
+    other = dict(_legacy("datastore1", "b.iso"), target="esx")
+    _seed(registry, [other])
+    monkeypatch.setattr(dsb, "scan_all_datastores",
+                        lambda si: {"datastore1": [_img("datastore1", "a.iso")]})
+
+    dsb.update_registry(object(), target="vc")
+
+    assert _names() == ["a.iso", "b.iso"]
+
+
+def _datastores(monkeypatch, names: list[str], found: dict[str, list[dict] | Exception]) -> None:
+    monkeypatch.setattr(inventory, "list_datastores",
+                        lambda si: [{"name": n, "accessible": True} for n in names])
+
+    def fake_scan(si, ds_name, path=""):
+        res = found.get(ds_name, [])
+        if isinstance(res, Exception):
+            raise res
+        return res
+
+    monkeypatch.setattr(dsb, "scan_images", fake_scan)
+
+
+@pytest.mark.unit
+def test_a_datastore_scanned_empty_still_replaces_its_legacy_rows(registry, monkeypatch) -> None:
+    _seed(registry, [_legacy("empty-ds", "gone.iso")])
+    _datastores(monkeypatch, ["empty-ds"], {})
+
+    dsb.update_registry(object(), target="vc")
+
+    assert _names() == []
+
+
+@pytest.mark.unit
+def test_a_datastore_whose_scan_failed_keeps_its_legacy_rows(registry, monkeypatch) -> None:
+    _seed(registry, [_legacy("flaky-ds", "keep.iso")])
+    _datastores(monkeypatch, ["flaky-ds", "ok-ds"],
+                {"flaky-ds": RuntimeError("browse failed"), "ok-ds": [_img("ok-ds", "n.iso")]})
+
+    dsb.update_registry(object(), target="vc")
+
+    assert _names() == ["keep.iso", "n.iso"]
+
+
+@pytest.mark.unit
+def test_this_targets_rows_on_a_datastore_it_did_not_browse_survive(registry, monkeypatch) -> None:
+    """Review 2026-10-18: a failed or skipped browse is not "no images there"."""
+    _seed(registry, [dict(_legacy("ds2", "mine.iso"), target="vc"),
+                     dict(_legacy("datastore1", "stale.iso"), target="vc")])
+    monkeypatch.setattr(dsb, "scan_all_datastores",
+                        lambda si: {"datastore1": [_img("datastore1", "new.iso")], "ds2": None})
+
+    dsb.update_registry(object(), target="vc")
+
+    assert _names() == ["mine.iso", "new.iso"]
+
+
+@pytest.mark.unit
+def test_this_targets_rows_on_a_datastore_that_is_gone_are_dropped(registry, monkeypatch) -> None:
+    """Narrow review 2026-10-18: not listed at all is not "failed to browse"."""
+    _seed(registry, [dict(_legacy("removed-ds", "ghost.iso"), target="vc"),
+                     dict(_legacy("flaky-ds", "kept.iso"), target="vc")])
+    _datastores(monkeypatch, ["ds1", "flaky-ds"],
+                {"ds1": [_img("ds1", "new.iso")], "flaky-ds": RuntimeError("browse failed")})
+
+    dsb.update_registry(object(), target="vc")
+
+    assert _names() == ["kept.iso", "new.iso"]
+
+
+@pytest.mark.unit
+def test_a_scan_whose_cache_cannot_be_locked_still_returns_its_images(registry, monkeypatch) -> None:
+    """Narrow review 2026-10-18: Storage returns the scan with a cache_note; so does AIops."""
+    import errno
+
+    from vmware_aiops import _filelock
+
+    monkeypatch.setattr(dsb, "scan_all_datastores",
+                        lambda si: {"ds1": [_img("ds1", "new.iso")]})
+    if _filelock.fcntl is None:
+        pytest.skip("POSIX branch")
+
+    def no_locks(fd, op):
+        raise OSError(errno.ENOLCK, "No locks available")
+
+    monkeypatch.setattr(_filelock.fcntl, "flock", no_locks)
+    out = dsb.update_registry(object(), target="vc")
+
+    assert [i["name"] for i in out["images"]] == ["new.iso"]
+    assert "cache" in out["cache_note"].lower()

{vmware_aiops-2.4.1 → vmware_aiops-2.4.2}/tests/eval/regression/test_login_without_vsphere_role.py

@@ -223,3 +223,59 @@ def test_mcp_not_authenticated_names_both_causes() -> None:
     assert "credentials" not in payload["hint"]
     text = _mcp_payload(vim.fault.NotAuthenticated(), shape="str")
     assert "vSphere role" in text and "verify connectivity and credentials" not in text
+
+
+# 2026-10-18, lab vCenter 8.0.3, SSO account with no permission anywhere:
+# vCenter refuses the *login itself* with NoPermission (System.View on the root
+# folder). Before the fix that raw fault reached doctor and every tool.
+def _login_refused(exc: Exception):
+    mgr = ConnectionManager(_config("vc1"))
+    with patch("pyVim.connect.SmartConnect", side_effect=exc):
+        try:
+            mgr.connect("vc1")
+        except Exception as e:  # noqa: BLE001 — the test inspects whatever is raised
+            return e
+    raise AssertionError("connect did not raise")
+
+
+def test_login_refused_with_no_permission_names_the_missing_role() -> None:
+    fault = vim.fault.NoPermission(
+        privilegeId="System.View", msg="Permission to perform this operation was denied."
+    )
+    err = _login_refused(fault)
+    assert isinstance(err, NoVSphereRoleError)
+    msg = str(err)
+    assert "no vSphere role" in msg and "Read-Only" in msg and "'vc1'" in msg
+    assert "dynamicType" not in msg and "operation failed" not in msg
+    assert len(msg) <= 300
+    assert err.__cause__ is fault
+
+
+def test_wrong_password_is_not_reported_as_a_missing_role() -> None:
+    err = _login_refused(vim.fault.InvalidLogin())
+    assert not isinstance(err, NoVSphereRoleError)
+    assert isinstance(err, vim.fault.InvalidLogin)
+
+
+@pytest.mark.parametrize(
+    ("privilege", "esxi"),
+    [("System.View", True), ("Sessions.ValidateSession", False), (None, False)],
+)
+def test_other_login_refusals_get_a_neutral_remedy(privilege, esxi) -> None:
+    # Review 2026-10-18 (M3): an ESXi host (lockdown mode, host permissions) or
+    # another privilege must not be sent to vCenter Global Permissions.
+    from dataclasses import replace
+
+    fault = vim.fault.NoPermission(privilegeId=privilege)
+    mgr = ConnectionManager(_config("vc1"))
+    if esxi:
+        esxi_targets = tuple(replace(t, type="esxi") for t in mgr._config.targets)
+        mgr._config = replace(mgr._config, targets=esxi_targets)
+    with patch("pyVim.connect.SmartConnect", side_effect=fault):
+        with pytest.raises(Exception) as info:
+            mgr.connect("vc1")
+    msg = str(info.value)
+    assert "Global Permissions" not in msg and "lockdown mode" in msg
+    if privilege:
+        assert f"({privilege})" in msg
+    assert info.value.__cause__ is fault and len(msg) <= 300