vmware-aiops 2.4.2__tar.gz → 2.4.4__tar.gz

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-aiops",
   "displayName": "VMware AIops",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "description": "AI-powered VMware vCenter/ESXi VM lifecycle and deployment with 61 MCP tools.",
   "author": {
     "name": "Wei Zhou",

vmware_aiops-2.4.4/.github/workflows/windows-file-lock.yml

@@ -0,0 +1,32 @@
+name: Windows file lock
+
+on:
+  pull_request:
+    paths:
+      - 'vmware_aiops/_filelock.py'
+      - 'tests/windows_lock_check.py'
+      - '.github/workflows/windows-file-lock.yml'
+  push:
+    branches: [main]
+    paths:
+      - 'vmware_aiops/_filelock.py'
+      - 'tests/windows_lock_check.py'
+      - '.github/workflows/windows-file-lock.yml'
+  workflow_dispatch:
+
+permissions:
+  contents: read
+
+jobs:
+  real-msvcrt:
+    runs-on: windows-latest
+    timeout-minutes: 10
+    steps:
+      - uses: actions/checkout@v7
+        with:
+          persist-credentials: false
+      - uses: actions/setup-python@v7
+        with:
+          python-version: '3.12'
+      - name: Check four-process serialization, bounded timeout, and release
+        run: python tests/windows_lock_check.py vmware_aiops/_filelock.py

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-aiops==2.4.2",
+        "vmware-aiops==2.4.4",
         "vmware-aiops-mcp"
       ]
     }

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/PKG-INFO

@@ -1,16 +1,17 @@
 Metadata-Version: 2.5
 Name: vmware-aiops
-Version: 2.4.2
+Version: 2.4.4
 Summary: VMware vCenter/ESXi AI-powered VM lifecycle and deployment tool
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-AIops
 Project-URL: Repository, https://github.com/vmware-skills/VMware-AIops
 Project-URL: Issues, https://github.com/vmware-skills/VMware-AIops/issues
 Project-URL: Changelog, https://github.com/vmware-skills/VMware-AIops/blob/main/RELEASE_NOTES.md
-Author-email: Wei Zhou <wei-wz.zhou@broadcom.com>
+Author-email: Wei Zhou <zhouwei008@gmail.com>
 License-Expression: MIT
 License-File: LICENSE
 Requires-Python: >=3.10
 Requires-Dist: apscheduler<4.0,>=3.10
+Requires-Dist: certifi>=2026.10.19
 Requires-Dist: httpx<1.0,>=0.27
 Requires-Dist: mcp[cli]<2.0,>=1.30
 Requires-Dist: pyaml<27.0,>=24.0
@@ -25,7 +26,9 @@ Description-Content-Type: text/markdown
 <!-- mcp-name: io.github.vmware-skills/vmware-aiops -->
 # VMware AIops
 
-> **Author**: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com
+For a read-only check of this skill with your model and agent host, use the shared [model-fit self-test](https://github.com/vmware-skills/marketplace/blob/main/MODEL_FIT_SELF_TEST.md) in the marketplace root.
+
+> **Author**: Wei Zhou, VMware by Broadcom — zhouwei008@gmail.com
 > This is a community-driven project by a VMware engineer, not an official VMware product.
 > For official VMware developer tools see [developer.broadcom.com](https://developer.broadcom.com).
 
@@ -33,6 +36,8 @@ English | [中文](README-CN.md)
 
 AI-powered VMware vCenter/ESXi VM lifecycle and deployment tool — 61 tools.
 
+Scope also includes datastore file browsing and deployment image discovery, alarm acknowledgment and reset, and an explicitly started scanning/TTL daemon with optional configured webhooks. Alarm reset can clear multiple matching alarms; guest commands and file transfers retain the account and file-access boundaries documented in the [capabilities reference](skills/vmware-aiops/references/capabilities.md).
+
 > **Companion skills** handle everything else:
 >
 > | Skill | Scope | Install |
@@ -365,7 +370,7 @@ Plans stored in `~/.vmware-aiops/plans/`, auto-deleted on success, auto-cleaned
 | **Password Protection** | `.env` file loading with permission check; never in shell history |
 | **SSL Self-signed Support** | `verify_ssl: false` — only for ESXi with self-signed certs in isolated labs; production should use CA-signed certificates |
 | **Prompt Injection Protection** | vSphere event messages and host logs are truncated, stripped of control characters, and wrapped in boundary markers before output |
-| **Webhook Data Scope** | Disabled by default. When configured, the daemon posts to your URL only: every critical issue (alarms, events, ESXi log lines matching critical/panic/corrupt, targets it could not connect to) and every alarm/event warning — host-log warnings stay in the scan log, and `info` rows are never sent. Each issue carries its entity name and message: sanitized alarm, event, or ESXi log text, or the connection error, which can include host names, IP addresses, and user names. No credentials from the skill's config or `.env` are sent |
+| **Webhook Data Scope** | Disabled by default. When configured, the daemon posts to your URL only: every critical issue (alarms, events, ESXi log lines matching critical/panic/corrupt, targets it could not connect to) and every alarm/event warning — host-log warnings stay in the scan log, and `info` rows are never sent. Each issue carries its entity name and message: sanitized alarm, event, or ESXi log text, or a generic connection failure class; operational text can include host names, IP addresses, and user names. No credentials from the skill's config or `.env` are sent |
 | **Task Waiting** | All async operations wait for completion and report result |
 | **State Validation** | Pre-operation checks (VM exists, power state correct) |
 
@@ -571,6 +576,8 @@ VMWARE_{TARGET_NAME_UPPER}_PASSWORD
 
 ### Security Best Practices
 
+Scanner notification failures report an HTTP status or exception class. Raw webhook response bodies, transport errors and connection exceptions are excluded from notification diagnostics and audit summaries to keep endpoint tokens out of them.
+
 - **NEVER** hardcode passwords in scripts or config files
 - **NEVER** pass passwords as command-line arguments (visible in `ps`)
 - **ALWAYS** use `~/.vmware-aiops/.env` with `chmod 600`

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/README-CN.md

@@ -1,7 +1,9 @@
 <!-- mcp-name: io.github.vmware-skills/vmware-aiops -->
 # VMware AIops
 
-> **作者**: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com
+要用自己的模型和 Agent 平台进行只读自测，请看 marketplace 根目录的[共享模型适配自测任务](https://github.com/vmware-skills/marketplace/blob/main/MODEL_FIT_SELF_TEST.md)。
+
+> **作者**: Wei Zhou, VMware by Broadcom — zhouwei008@gmail.com
 > 本项目由 VMware 工程师维护的社区项目，非 VMware 官方产品。
 > VMware 官方开发者工具请访问 [developer.broadcom.com](https://developer.broadcom.com)。
 
@@ -9,6 +11,8 @@
 
 AI 驱动的 VMware vCenter/ESXi VM 生命周期管理与部署工具 — 61 个工具。
 
+范围还包括数据存储文件浏览与部署镜像发现、告警确认与重置，以及需显式启动的扫描/TTL daemon（可选配置 webhook）。告警重置可能清除多个匹配告警；guest 命令与文件传输仍受[能力参考](skills/vmware-aiops/references/capabilities.md)所述的账户和文件访问边界约束。
+
 > **配套技能**负责其他领域：
 >
 > | 技能 | 范围 | 安装 |
@@ -287,6 +291,8 @@ Plan 存储在 `~/.vmware-aiops/plans/`，成功后自动删除，超过 24 小
 
 ## 安全特性
 
+扫描通知失败只报告 HTTP 状态或异常类型。通知诊断与审计摘要不引用原始 webhook 响应、传输错误或连接异常，避免写入其中可能包含的端点令牌。
+
 | 功能 | 说明 |
 |------|------|
 | 预演模式（Dry-Run，**仅 CLI**） | 加 `--dry-run` 只打印将要发出的 API 调用而不执行；除 `deploy iso`、`deploy mark-template`、`vm cancel-ttl`、`vm guest-download` 外，每个 CLI 写操作都支持 |
@@ -300,7 +306,7 @@ Plan 存储在 `~/.vmware-aiops/plans/`，成功后自动删除，超过 24 小
 | 配置文件内容 | `config.yaml` 仅存储主机名、端口和 `.env` 引用路径，**不含密码或 Token** |
 | SSL 自签名 | 仅用于 ESXi 自签名证书的隔离实验环境；生产环境应使用 CA 签名证书 |
 | Prompt 注入防护 | vSphere 事件消息和主机日志在输出前进行截断、控制字符清理和边界标记包裹 |
-| Webhook 数据范围 | **默认禁用**。配置后，daemon 只向你配置的 URL 发送：所有 critical 问题（告警、事件、匹配 critical/panic/corrupt 的 ESXi 日志行、连不上的目标）和所有告警/事件类 warning——主机日志的 warning 只写入扫描日志，`info` 记录从不发送。每条问题带实体名和消息：经过清洗的告警、事件或 ESXi 日志文本，或连接错误信息，其中可能含主机名、IP 地址和用户名。不会发送 skill 配置或 `.env` 里的任何凭据 |
+| Webhook 数据范围 | **默认禁用**。配置后，daemon 只向你配置的 URL 发送：所有 critical 问题（告警、事件、匹配 critical/panic/corrupt 的 ESXi 日志行、连不上的目标）和所有告警/事件类 warning——主机日志的 warning 只写入扫描日志，`info` 记录从不发送。每条问题带实体名和消息：经过清洗的告警、事件或 ESXi 日志文本，或不含原始异常的连接失败类型；运维文本可能含主机名、IP 地址和用户名。不会发送 skill 配置或 `.env` 里的任何凭据 |
 | 最小权限 | 推荐使用专用 vCenter 服务账户，仅授予所需最小权限。仅需监控时使用 [VMware-Monitor](https://github.com/vmware-skills/VMware-Monitor) |
 | 任务等待 | 所有异步操作等待完成并报告结果 |
 

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/README.md

@@ -1,7 +1,9 @@
 <!-- mcp-name: io.github.vmware-skills/vmware-aiops -->
 # VMware AIops
 
-> **Author**: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com
+For a read-only check of this skill with your model and agent host, use the shared [model-fit self-test](https://github.com/vmware-skills/marketplace/blob/main/MODEL_FIT_SELF_TEST.md) in the marketplace root.
+
+> **Author**: Wei Zhou, VMware by Broadcom — zhouwei008@gmail.com
 > This is a community-driven project by a VMware engineer, not an official VMware product.
 > For official VMware developer tools see [developer.broadcom.com](https://developer.broadcom.com).
 
@@ -9,6 +11,8 @@ English | [中文](README-CN.md)
 
 AI-powered VMware vCenter/ESXi VM lifecycle and deployment tool — 61 tools.
 
+Scope also includes datastore file browsing and deployment image discovery, alarm acknowledgment and reset, and an explicitly started scanning/TTL daemon with optional configured webhooks. Alarm reset can clear multiple matching alarms; guest commands and file transfers retain the account and file-access boundaries documented in the [capabilities reference](skills/vmware-aiops/references/capabilities.md).
+
 > **Companion skills** handle everything else:
 >
 > | Skill | Scope | Install |
@@ -341,7 +345,7 @@ Plans stored in `~/.vmware-aiops/plans/`, auto-deleted on success, auto-cleaned
 | **Password Protection** | `.env` file loading with permission check; never in shell history |
 | **SSL Self-signed Support** | `verify_ssl: false` — only for ESXi with self-signed certs in isolated labs; production should use CA-signed certificates |
 | **Prompt Injection Protection** | vSphere event messages and host logs are truncated, stripped of control characters, and wrapped in boundary markers before output |
-| **Webhook Data Scope** | Disabled by default. When configured, the daemon posts to your URL only: every critical issue (alarms, events, ESXi log lines matching critical/panic/corrupt, targets it could not connect to) and every alarm/event warning — host-log warnings stay in the scan log, and `info` rows are never sent. Each issue carries its entity name and message: sanitized alarm, event, or ESXi log text, or the connection error, which can include host names, IP addresses, and user names. No credentials from the skill's config or `.env` are sent |
+| **Webhook Data Scope** | Disabled by default. When configured, the daemon posts to your URL only: every critical issue (alarms, events, ESXi log lines matching critical/panic/corrupt, targets it could not connect to) and every alarm/event warning — host-log warnings stay in the scan log, and `info` rows are never sent. Each issue carries its entity name and message: sanitized alarm, event, or ESXi log text, or a generic connection failure class; operational text can include host names, IP addresses, and user names. No credentials from the skill's config or `.env` are sent |
 | **Task Waiting** | All async operations wait for completion and report result |
 | **State Validation** | Pre-operation checks (VM exists, power state correct) |
 
@@ -547,6 +551,8 @@ VMWARE_{TARGET_NAME_UPPER}_PASSWORD
 
 ### Security Best Practices
 
+Scanner notification failures report an HTTP status or exception class. Raw webhook response bodies, transport errors and connection exceptions are excluded from notification diagnostics and audit summaries to keep endpoint tokens out of them.
+
 - **NEVER** hardcode passwords in scripts or config files
 - **NEVER** pass passwords as command-line arguments (visible in `ps`)
 - **ALWAYS** use `~/.vmware-aiops/.env` with `chmod 600`

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/RELEASE_NOTES.md

@@ -1,3 +1,21 @@
+## v2.4.4 — minimize notification and audit secrets (2026-11-08)
+
+* Update public author/project contact metadata to `zhouwei008@gmail.com`.
+
+### notification secret minimization
+* Webhook status/transport logs and unexpected scan/send audit failures retain HTTP status or exception class without raw response/exception text. Connection-failure notifications no longer forward raw exceptions that can contain credential-bearing URLs or opaque tokens.
+
+### scope declaration
+* Explicitly declare the existing datastore browsing/image discovery, multi-alarm reset and user-started scanning/TTL daemon capabilities in the canonical skill description and both READMEs. Runtime behavior, permission boundaries and risk disclosures are unchanged.
+
+## v2.4.3 — bind confirmed writes to measured identities; reject ambiguous inventory names (2026-11-08)
+
+* **Confirmed MCP writes re-check the identities measured during that call.** The eight confirm-gated VM and snapshot tools pass the current blast-radius measurement's VM instance UUID and snapshot id into execution, refusing a replacement object found by the executor. Each `confirm=True` invocation measures afresh; the separate earlier preview supplies no identity token. The existing `delete_vm` acknowledgement requirement is unchanged, as are the CLI and plan-executor paths (AIops#49).
+* **Missing objects in delegated investigation tools keep their remedy.** VM, host and datastore lookup errors from vmware-monitor retain the exact-name/listing guidance through AIops MCP and are classified as request errors; unexpected delegate failures remain reduced to their type.
+* **Ambiguous host, cluster, datastore and datacenter names are refused.** A lookup that finds more than one match raises `AmbiguousNameError` with the matching managed-object ids; plan prechecks and CLI output expose the ambiguity instead of selecting the first result (AIops#48).
+* The image-cache and TTL cross-process file lock is exercised on a real Windows GitHub Actions runner: four concurrent writers retain every row, a held lock times out with the lock path, and the lock is released after the holder exits (AIops#51).
+* Require certifi 2026.10.19 or later to exclude the compromised emSign root CA from the TLS trust bundle (GHSA-6q48-6c7w-9gw2). The development lock resolves 2026.10.23 (AIops#53).
+
 ## v2.4.2 — a login refused for lack of a role says so; an unreadable host is not called unreachable (2026-10-19)
 
 Needs vmware-monitor 2.4.2 (now the floor). Found on a vCenter 8.0.3 lab with two restricted SSO accounts
@@ -1944,7 +1962,7 @@ This release tracks vmware-pilot v1.5.17 (new `investigate_alert` template + `re
 - **[READ]/[WRITE] tool prefixes**: All MCP tool descriptions now start with [READ] or [WRITE] to clearly indicate operation type
 - **Read/write split counts**: SKILL.md MCP Tools section header shows exact read vs write tool counts
 - **Negative routing**: Description frontmatter includes "Do NOT use when..." clause to prevent misrouting
-- **Broadcom author attestation**: README.md, README-CN.md, and pyproject.toml include VMware by Broadcom author identity (wei-wz.zhou@broadcom.com) to resolve Snyk E005 brand warnings
+- **Broadcom author attestation**: README.md, README-CN.md, and pyproject.toml include VMware by Broadcom author identity (zhouwei008@gmail.com) to resolve Snyk E005 brand warnings
 
 ### AIops-specific
 
@@ -2642,4 +2660,4 @@ vmware-aiops vks clusters|health|scale|nodes
   多目标配置。
 
 - Environment variable password management.
-  环境变量密码管理。
+  环境变量密码管理。

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/SECURITY.md

@@ -4,13 +4,13 @@
 
 This is a community-maintained open-source project and is **not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom Inc.** "VMware" and "vSphere" are trademarks of Broadcom Inc.
 
-**Author**: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com
+**Author**: Wei Zhou, VMware by Broadcom — zhouwei008@gmail.com
 
 ## Reporting Vulnerabilities
 
 If you discover a security vulnerability, please report it privately:
 
-- **Email**: wei-wz.zhou@broadcom.com
+- **Email**: zhouwei008@gmail.com
 - **GitHub**: Open a [private security advisory](https://github.com/vmware-skills/VMware-AIops/security/advisories/new)
 
 Do **not** open a public GitHub issue for security vulnerabilities.

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/openclaw.plugin.json

@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-aiops==2.4.2",
+        "vmware-aiops==2.4.4",
         "vmware-aiops-mcp"
       ]
     }

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zw008/vmware-aiops",
-  "version": "2.4.2",
+  "version": "2.4.4",
   "description": "AI-powered VMware vCenter/ESXi VM lifecycle and deployment with 61 MCP tools.",
   "private": true,
   "license": "MIT",

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/pyproject.toml

@@ -4,12 +4,12 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-aiops"
-version = "2.4.2"
+version = "2.4.4"
 description = "VMware vCenter/ESXi AI-powered VM lifecycle and deployment tool"
 readme = "README.md"
 license = "MIT"
 requires-python = ">=3.10"
-authors = [{ name = "Wei Zhou", email = "wei-wz.zhou@broadcom.com" }]
+authors = [{ name = "Wei Zhou", email = "zhouwei008@gmail.com" }]
 dependencies = [
     "pyvmomi>=8.0.3.0,<10.0",
     "pyaml>=24.0,<27.0",
@@ -17,6 +17,7 @@ dependencies = [
     "rich>=13.0,<16.0",
     "apscheduler>=3.10,<4.0",
     "httpx>=0.27,<1.0",
+    "certifi>=2026.10.19",  # GHSA-6q48-6c7w-9gw2: exclude compromised emSign root
     "python-dotenv>=1.0,<2.0",
     "mcp[cli]>=1.30,<2.0",
     "vmware-policy>=1.23.1,<2.0",

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/vmware-skills/VMware-AIops",
     "source": "github"
   },
-  "version": "2.4.2",
+  "version": "2.4.4",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-aiops",
-      "version": "2.4.2",
+      "version": "2.4.4",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/skills/vmware-aiops/SKILL.md

@@ -1,11 +1,15 @@
 ---
 name: vmware-aiops
 description: >
-  Use this skill whenever the user needs to manage VMs in VMware/vSphere/ESXi — it's the entry point for all VM operations.
-  Directly handles: power on/off, clone, snapshot, migrate, deploy from OVA or templates, run commands inside VMs, batch operations, cluster management, vCenter alarm acknowledgment, a one-glance cluster-health triage ("is anything on fire?"), and VM/host/datastore investigation drill-downs.
-  Always use this skill for any "power on", "clone", "deploy", "migrate", "batch", "guest exec", "alarm", or VM lifecycle task, and for triage like "is anything on fire" / "what needs attention now" / "investigate this VM", when the context is explicitly VMware, vSphere, or ESXi.
-  Do NOT use for general read-only queries (inventory/events/VM details — use vmware-monitor), NSX networking (use vmware-nsx), storage/iSCSI/vSAN (use vmware-storage), or Kubernetes cluster lifecycle (use vmware-vks).
-  For multi-step workflows use vmware-pilot. For load balancing/AVI/AKO use vmware-avi.
+  Use for VMware/vSphere/ESXi VM lifecycle: power on/off, clone, snapshot, migrate,
+  OVA/template deployment, guest commands and file transfer, batch operations, plans and clusters.
+  Also handles datastore file browsing and deployment image scanning; alarm acknowledgment
+  and reset (which can clear multiple matching alarms); read-only cluster/VM/host/datastore
+  triage; and a user-started scanning/TTL daemon with optional configured webhooks.
+  Always use for power on, clone, deploy, migrate, guest exec, batch, alarms or VM investigation
+  in VMware. Use vmware-monitor for general read-only inventory/events/VM details;
+  vmware-storage for iSCSI/vSAN/storage configuration; vmware-nsx for NSX;
+  vmware-vks for Kubernetes; vmware-pilot for workflows; vmware-avi for load balancing.
 installer:
   kind: uv
   package: vmware-aiops
@@ -25,6 +29,8 @@ compatibility: >
 
 # VMware AIops
 
+> Self-test: [guide](https://github.com/vmware-skills/marketplace/blob/main/MODEL_FIT_SELF_TEST.md).
+
 > **Disclaimer**: This is a community-maintained open-source project and is **not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom Inc.** "VMware" and "vSphere" are trademarks of Broadcom. Source code is publicly auditable at [github.com/vmware-skills/VMware-AIops](https://github.com/vmware-skills/VMware-AIops) under the MIT license.
 
 VMware family entry point — AI-powered VM lifecycle, deployment, and alarm management — 61 MCP tools.
@@ -63,7 +69,7 @@ Read before connecting an agent. Per-tool inventory: `references/capabilities.md
 ## Quick Install
 
 ```bash
-uv tool install vmware-aiops==2.4.2
+uv tool install vmware-aiops==2.4.4
 vmware-aiops doctor
 vmware-aiops hub status   # see which family members are installed
 ```
@@ -303,7 +309,7 @@ The account has no vSphere role. Assign one (Read-Only or higher) on the vCenter
 ## Setup
 
 ```bash
-uv tool install vmware-aiops==2.4.2
+uv tool install vmware-aiops==2.4.4
 mkdir -p ~/.vmware-aiops
 vmware-aiops init  # generates config.yaml and .env templates
 chmod 600 ~/.vmware-aiops/.env

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/skills/vmware-aiops/references/capabilities.md

@@ -59,6 +59,8 @@ well-meaning agents, not a replacement for RBAC.
   - **Cluster** (`delete_cluster`, `remove_cluster_host`): member hosts, VMs, datastores. Refused while hosts or VMs are still in the cluster, or when the host is not in maintenance mode or still runs powered-on VMs.
   - **Clean Slate / TTL** (`restore_vm_clean_slate`, `set_vm_ttl`): the snapshot and what the revert discards; for a TTL, the VM that will be deleted unattended and when. Clean Slate is refused when the baseline snapshot is missing or its name is ambiguous — before anything is powered off — and reports an error, not `reverted`, if the revert did not happen. The TTL entry records the VM's target and instance UUID; at expiry the daemon deletes only a VM that still has that UUID (another VM under the same name is left alone, the entry dropped and the refusal audited). A TTL is refused on every `delete_vm` blocker except the power state (the daemon powers off first).
   - **Snapshot names** (`revert_vm_snapshot`, `delete_vm_snapshot`, `restore_vm_clean_slate`): a name matches a snapshot's raw name or the name `list_vm_snapshots` shows (control/invisible characters stripped). Two snapshots matching the same name — duplicates, or names that differ only by stripped characters — are refused by the gate and by the executors, which no longer take the first.
+  - **Object names**: looking up a VM, host, cluster, datastore or datacenter by name across the vCenter refuses a name that matches more than one object of that kind, and lists the matches' managed-object ids, instead of taking the first. Cluster and datastore names are unique only within a datacenter, so two datacenters can each have a `Cluster01`.
+  - **What a confirmed call acts on** (`power_off_vm`, `migrate_vm`, `revert_vm_snapshot`, `delete_vm_snapshot`, `run_vm_guest_command`, `run_vm_guest_command_with_output`, `upload_vm_guest_file`, `provision_vm_guest`): the VM measured within that invocation, checked by instance UUID, and for snapshots the snapshot measured then, checked by id. Replacement between that measurement and the executor's lookup is refused ("not the VM that was previewed") before it changes anything. Each `confirm=True` invocation measures afresh; an earlier separate preview supplies no identity token. The `delete_vm` acknowledgement below remains the explicit check against a prior preview.
   - **Plans** (`apply_vm_plan`, `rollback_vm_plan`): every step with its full parameters (passwords and other secret-looking keys redacted), which are destructive and which cannot be rolled back. Each destructive step is measured as its own tool measures it, and that tool's `blockers` / `unmeasured` become the plan's, prefixed `Step N (action):`. A step on an object an earlier step creates or changes (power off, then delete; a VM a step creates) is shown `check: "deferred"` and measured immediately before it runs; every destructive step is re-checked then, and a failed check stops the plan with a teaching error in that step's result. Refused when `target` does not match the plan's (no target is a target of its own), a step would be refused by its tool, or a plan step with action delete_vm carries no `acknowledge_blast_radius`. Every action the executor can run is classified: measured by its tool's gate (including `migrate`, measured as `migrate_vm`), refused, or non-destructive with a stated reason; anything else is refused rather than run unchecked. The plan actions `iscsi_enable`, `iscsi_add_target`, `iscsi_remove_target` and `storage_rescan` (plan-file action names, not tools) are gated in vmware-storage and cannot be measured here, so a plan containing one is refused at preview, apply and rollback — use `enable_iscsi`, `add_iscsi_target`, `remove_iscsi_target` / `rescan_storage` instead. Rollback steps get the same checks: each destructive rollback step (power off, delete snapshot, cluster delete, host removal) is measured in the `rollback_vm_plan` preview and again just before it runs; a refused check stops the rollback with a teaching error for that step, and the plan stays `failed` so rollback can be run again. A step that creates a VM records its instance UUID; rollback deletes the VM only if it still has that UUID, and refuses that rollback step otherwise. Plan responses never echo step passwords; secret keys are matched as whole name tokens (`password`, `passwd`, `pwd`, `secret`, `token`, `api_key`, `auth`, `credential(s)`, `private_key`).
   - **Refusal messages** lead with the first blocker (problem and remedy) and count the rest ("…and 2 more blockers"), and stay within 480 characters; the preview lists every blocker.
   - **Network / DRS** (`add_host_vmk`, `remove_host_vmk`, `set_vmk_service`, `create_dvs_portgroup`, `create_drs_rule`, `delete_drs_rule`, `set_drs_rule_enabled`): what would be created, changed or removed, with `blockers` and `unmeasured`; `remove_host_vmk` and `set_vmk_service` fail closed on an unreadable service map. Their refusals (a protected or the only management vmk, a VM-Host DRS rule) are reported as blockers in the preview and still raise on `confirm=True`.

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/skills/vmware-aiops/references/setup-guide.md

@@ -6,13 +6,13 @@ All install methods fetch from the same source: [github.com/vmware-skills/VMware
 
 ```bash
 # Via PyPI (recommended for version pinning)
-uv tool install vmware-aiops==2.4.2
+uv tool install vmware-aiops==2.4.4
 
 # Via Skills.sh (fetches from GitHub)
-npx skills add vmware-skills/VMware-AIops#v2.4.2
+npx skills add vmware-skills/VMware-AIops#v2.4.4
 
 # Via ClawHub (fetches from ClawHub registry snapshot of GitHub)
-clawhub install @zw008/vmware-aiops --version 2.4.2
+clawhub install @zw008/vmware-aiops --version 2.4.4
 ```
 
 ### Claude Code
@@ -35,7 +35,7 @@ claude mcp add vmware-aiops -- vmware-aiops mcp
 
 ```bash
 # 1. Install from PyPI (source: github.com/vmware-skills/VMware-AIops)
-uv tool install vmware-aiops==2.4.2
+uv tool install vmware-aiops==2.4.4
 
 # 2. Verify installation source
 vmware-aiops --version  # confirms installed version
@@ -73,7 +73,7 @@ The `vmware-aiops` package installs a Python CLI binary and its dependencies (py
 ## Development Install
 
 ```bash
-git clone --branch v2.4.2 https://github.com/vmware-skills/VMware-AIops.git
+git clone --branch v2.4.4 https://github.com/vmware-skills/VMware-AIops.git
 cd VMware-AIops
 uv venv && source .venv/bin/activate
 # --no-sources: pyproject's [tool.uv.sources] points vmware-monitor at a sibling

vmware_aiops-2.4.4/tests/eval/regression/test_delegated_lookup_errors.py

@@ -0,0 +1,70 @@
+"""Monitor's missing-object remedies must survive the AIops MCP error wrapper.
+
+Found on real vCenter, 2026-11-08: investigate_vm reduced Monitor's authored
+VMNotFoundError to a generic failure and incorrectly suggested checking login.
+The host and datastore delegates use different authored exception classes too.
+"""
+from __future__ import annotations
+
+import asyncio
+import importlib
+import json
+
+import mcp.types as mcp_types
+import pytest
+from vmware_policy.policy import reset_policy_engine
+
+from vmware_aiops.mcp_server.server import mcp
+from vmware_aiops.mcp_server.tools import summary
+
+
+@pytest.fixture(autouse=True)
+def policy_home(tmp_path, monkeypatch):
+    monkeypatch.setenv("OPS_HOME", str(tmp_path))
+    reset_policy_engine()
+    yield
+    reset_policy_engine()
+
+
+def call(tool, arguments):
+    handler = mcp._mcp_server.request_handlers[mcp_types.CallToolRequest]
+    request = mcp_types.CallToolRequest(
+        method="tools/call",
+        params=mcp_types.CallToolRequestParams(name=tool, arguments=arguments),
+    )
+    result = asyncio.run(handler(request)).root
+    text = "".join(b.text for b in result.content if isinstance(b, mcp_types.TextContent))
+    return result, json.loads(text)
+
+
+@pytest.mark.parametrize(("kind", "lookup", "listing"), [
+    ("vm", "find_vm_by_name", "list_virtual_machines"),
+    ("host", "find_host_by_name", "list_esxi_hosts"),
+    ("datastore", "find_datastore_by_name", "list_all_datastores"),
+])
+def test_missing_delegate_object_keeps_its_real_remedy(monkeypatch, kind, lookup, listing):
+    # Exercise the real Monitor raise site, not a reconstructed exception.
+    module = importlib.import_module(f"vmware_monitor.ops.investigate_{kind}")
+    monkeypatch.setattr(module, lookup, lambda *_args: None)
+    monkeypatch.setattr(summary, "_get_connection", lambda *_args: object())
+    result, payload = call(f"investigate_{kind}", {f"{kind}_name": "missing-\x00object"})
+    assert result.isError is True
+    assert "not found" in payload["error"]
+    assert listing in payload["error"]
+    assert "missing-object" in payload["error"]
+    assert "\x00" not in payload["error"]
+    assert "doctor" not in payload["hint"]
+
+
+@pytest.mark.parametrize("error_type", [RuntimeError, type("VMNotFoundError", (Exception,), {})])
+def test_unplanned_delegate_errors_are_still_reduced(monkeypatch, error_type):
+    def fail(*_args, **_kwargs):
+        raise error_type("https://svc:secret-example@internal.invalid/api")
+
+    monkeypatch.setattr(summary, "_get_connection", lambda *_args: object())
+    monkeypatch.setattr(summary, "get_vm_investigation_bundle", fail)
+    result, payload = call("investigate_vm", {"vm_name": "missing-object"})
+    assert result.isError is True
+    assert payload["error"] == f"{error_type.__name__}: operation failed."
+    assert "secret-example" not in str(payload)
+    assert "doctor" in payload["hint"]

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/tests/eval/regression/test_mcp_frame_marks_failures.py

@@ -226,7 +226,7 @@ def test_falsy_error_key_is_not_a_failure(monkeypatch) -> None:
     # stubbed clean so this stays about the falsy error key.
     monkeypatch.setattr(
         "vmware_aiops.mcp_server.tools.guest.measure_guest_provision",
-        lambda *a, **k: {"blockers": [], "unmeasured": []},
+        lambda *a, **k: {"instance_uuid": "uuid-1", "blockers": [], "unmeasured": []},
     )
 
     result = call(

{vmware_aiops-2.4.2 → vmware_aiops-2.4.4}/tests/eval/regression/test_write_round_low_findings.py

@@ -89,7 +89,7 @@ def test_a_cpu_feature_refusal_leads_with_the_remedy(monkeypatch) -> None:
     vm.datastore = []
     host = MagicMock()
     host.parent.resourcePool = vim.ResourcePool("resgroup-1", None)
-    monkeypatch.setattr(vm_lifecycle, "_require_vm", lambda si, n: vm)
+    monkeypatch.setattr(vm_lifecycle, "_require_vm", lambda si, n, **k: vm)
     monkeypatch.setattr(vm_lifecycle, "find_host_by_name", lambda si, n: host)
     monkeypatch.setattr(vm_lifecycle.vim.vm, "RelocateSpec", lambda **k: MagicMock())
 

vmware_aiops-2.4.4/tests/test_ambiguous_inventory_names.py

@@ -0,0 +1,127 @@
+"""Host, cluster, datastore and datacenter lookups refuse a duplicated name.
+
+VMs already do (``AmbiguousVMError``, 2026-09-16). The other finders still
+returned whichever object the property collector listed first. Cluster and
+datastore names are unique only within a datacenter, so on a vCenter with two
+datacenters ``add_cluster_host("Cluster01", …)`` could move a host into the
+other datacenter's cluster, and the result reads exactly like a success.
+"""
+
+from __future__ import annotations
+
+from unittest.mock import MagicMock
+
+import pytest
+from pyVmomi import vim
+from vmware_policy.budget import reset_budget
+from vmware_policy.policy import reset_policy_engine
+from vmware_policy.undo import reset_undo_store
+
+import vmware_aiops.mcp_server.tools.cluster as cluster_tools
+from vmware_aiops.ops import inventory
+from vmware_aiops.ops.inventory import AmbiguousNameError, AmbiguousVMError, InventoryError
+
+
+@pytest.fixture(autouse=True)
+def harness(tmp_path, monkeypatch):
+    monkeypatch.setenv("OPS_HOME", str(tmp_path))
+    reset_policy_engine()
+    reset_budget()
+    reset_undo_store()
+    yield
+    reset_policy_engine()
+    reset_budget()
+    reset_undo_store()
+
+
+def _obj(name: str, moid: str) -> MagicMock:
+    obj = MagicMock(name=f"obj:{name}:{moid}")
+    obj.name = name
+    obj._moId = moid
+    return obj
+
+
+@pytest.fixture
+def inventory_of(monkeypatch):
+    """Serve ``_collect`` per managed-object type from a fixed inventory."""
+    def install(by_type: dict):
+        monkeypatch.setattr(
+            inventory, "_collect",
+            lambda _si, types, _props: [(o, {"name": o.name}) for o in by_type.get(types[0], [])],
+        )
+        return by_type
+    return install
+
+
+FINDERS = [
+    (inventory.find_host_by_name, vim.HostSystem, "host"),
+    (inventory.find_cluster_by_name, vim.ClusterComputeResource, "cluster"),
+    (inventory.find_datastore_by_name, vim.Datastore, "datastore"),
+    (inventory.find_datacenter_by_name, vim.Datacenter, "datacenter"),
+]
+
+
+@pytest.mark.parametrize(("finder", "kind", "label"), FINDERS)
+def test_a_duplicated_name_is_refused_and_names_both_objects(inventory_of, finder, kind, label):
+    inventory_of({kind: [_obj("X", "obj-1"), _obj("X", "obj-2"), _obj("Y", "obj-3")]})
+
+    with pytest.raises(AmbiguousNameError) as raised:
+        finder(MagicMock(), "X")
+
+    message = str(raised.value)
+    assert f"2 {label}s are named 'X'" in message
+    assert "obj-1" in message and "obj-2" in message
+
+
+@pytest.mark.parametrize(("finder", "kind", "label"), FINDERS)
+def test_a_unique_name_still_resolves_and_a_missing_one_is_none(inventory_of, finder, kind, label):
+    only = _obj("X", "obj-1")
+    inventory_of({kind: [only, _obj("Y", "obj-2")]})
+
+    assert finder(MagicMock(), "X") is only
+    assert finder(MagicMock(), "nope") is None
+
+
+def test_the_vm_error_is_one_kind_of_ambiguous_name():
+    # Callers that catch AmbiguousVMError keep working; new ones catch the base.
+    assert issubclass(AmbiguousVMError, AmbiguousNameError)
+    assert issubclass(AmbiguousNameError, InventoryError)
+
+
+def test_add_cluster_host_refuses_a_duplicated_cluster_and_moves_nothing(inventory_of, monkeypatch):
+    dc1, dc2 = _obj("Cluster01", "domain-c1"), _obj("Cluster01", "domain-c2")
+    inventory_of({vim.ClusterComputeResource: [dc1, dc2], vim.HostSystem: [_obj("esx-01", "host-1")]})
+    monkeypatch.setattr(cluster_tools, "_get_connection", lambda _t=None: MagicMock())
+
+    out = cluster_tools.add_cluster_host("Cluster01", "esx-01")
+
+    assert "2 clusters are named 'Cluster01'" in out
+    dc1.MoveInto_Task.assert_not_called()
+    dc2.MoveInto_Task.assert_not_called()
+
+
+def test_a_plan_that_migrates_to_a_duplicated_host_fails_validation_not_the_planner(inventory_of):
+    from vmware_aiops.ops.planner import precheck_targets
+
+    inventory_of({
+        vim.VirtualMachine: [_obj("web-01", "vm-1")],
+        vim.HostSystem: [_obj("esx-01", "host-1"), _obj("esx-01", "host-2")],
+    })
+
+    errors = precheck_targets(
+        MagicMock(), [{"action": "migrate", "vm_name": "web-01", "target_host": "esx-01"}]
+    )
+
+    assert any("2 hosts are named 'esx-01'" in e for e in errors), errors
+
+
+def test_many_matches_list_a_few_ids_and_count_the_rest(inventory_of):
+    inventory_of({vim.Datastore: [_obj("ds", f"datastore-{i}") for i in range(8)]})
+
+    with pytest.raises(AmbiguousNameError) as raised:
+        inventory.find_datastore_by_name(MagicMock(), "ds")
+
+    message = str(raised.value)
+    assert "8 datastores are named 'ds'" in message
+    assert "datastore-4" in message and "datastore-5" not in message
+    assert "and 3 more" in message