vmware-avi 2.2.0__tar.gz → 2.3.0__tar.gz

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-avi",
   "displayName": "VMware AVI",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "VMware AVI (NSX ALB) load balancer plus AKO Kubernetes ops — 28 MCP tools.",
   "author": {
     "name": "Wei Zhou",

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-avi==2.2.0",
+        "vmware-avi==2.3.0",
         "vmware-avi-mcp"
       ]
     }

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-avi
-Version: 2.2.0
+Version: 2.3.0
 Summary: AVI (NSX Advanced Load Balancer) management and AKO Kubernetes operations tool
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-AVI
 Project-URL: Repository, https://github.com/vmware-skills/VMware-AVI
@@ -17,7 +17,7 @@ Requires-Dist: pyaml<27.0,>=24.0
 Requires-Dist: python-dotenv<2.0,>=1.0
 Requires-Dist: rich<15.0,>=13.0
 Requires-Dist: typer<1.0,>=0.12
-Requires-Dist: vmware-policy<2.0,>=1.21.0
+Requires-Dist: vmware-policy<2.0,>=1.22.0
 Description-Content-Type: text/markdown
 
 <!-- mcp-name: io.github.vmware-skills/vmware-avi -->
@@ -573,6 +573,65 @@ Force resync triggers AKO to re-reconcile all K8s objects. If the drift persists
 
 If you encounter any errors or issues, please send the error message, logs, or screenshots to **zhouwei008@gmail.com**. Contributions are welcome -- feel free to join us in maintaining and improving this project!
 
+<!-- usage: remote-and-exposure -->
+## Remote access (HTTPS) and limiting tools
+
+By default `vmware-avi mcp` speaks stdio to one local client and offers every tool. Two options change that
+(vmware-policy ≥ 1.21.0).
+
+**Serve over HTTPS** so clients on other machines can connect. Every caller needs a bearer token:
+
+```bash
+vmware-audit token create alice          # prints the token once; give it to alice
+vmware-audit token list                  # names only
+vmware-audit token revoke alice          # refused from its next request, no restart
+vmware-avi mcp --transport https --host 0.0.0.0 --port 8443 \
+    --cert /etc/vmware-mcp/server.pem --key /etc/vmware-mcp/server-key.pem \
+    --public-name mcp.example.com
+```
+
+Connect a client (Claude Code shown; any MCP client that supports streamable HTTP and custom headers works):
+
+```bash
+claude mcp add --transport http vmware-avi https://mcp.example.com:8443/mcp \
+    --header "Authorization: Bearer $VMWARE_MCP_TOKEN"
+```
+
+```json
+{
+  "mcpServers": {
+    "vmware-avi": {
+      "type": "http",
+      "url": "https://mcp.example.com:8443/mcp",
+      "headers": { "Authorization": "Bearer ${VMWARE_MCP_TOKEN}" }
+    }
+  }
+}
+```
+
+- The server will not start without a token, refuses Host/Origin values outside `--public-name`, and checks
+  before it binds that unauthenticated requests get 401. Use a certificate your clients trust for those names.
+- Behind a TLS-terminating reverse proxy on the same machine use `--transport http --host 127.0.0.1
+  --public-name mcp.example.com` and pass the `Authorization` header through.
+- The audit log records each caller as `token:<name>`. Calls run side by side: each holds its own session to a
+  Controller (or Kubernetes context), up to `VMWARE_MCP_POOL_SIZE` (default 2) sessions per target. Each Controller
+  session is a login on the Controller; a call waits at most 300 s for a free one.
+- **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant
+  nothing on the platform. Run one endpoint per privilege level.
+
+**Offer only read tools, plus the writes you choose:**
+
+```bash
+vmware-avi mcp --expose read --allow-write disable_lb_pool_member
+# or: VMWARE_AVI_MCP_EXPOSE=read VMWARE_AVI_MCP_ALLOW_WRITE=disable_lb_pool_member vmware-avi mcp
+```
+
+Tools not offered do not appear in the client's tool list. A bad value or an unknown write tool stops the server
+(exit 2). This limits what clients are offered; it is not authorization, so the account itself should be
+least-privilege.
+
+Details: `skills/vmware-avi/references/setup-guide.md` ("Serving MCP over HTTPS", "Limiting which tools are offered").
+
 ## License
 
 MIT

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/README-CN.md

@@ -531,6 +531,64 @@ vmware-avi-mcp
 
 如果遇到任何错误或问题，请将错误信息、日志或截图发送至 **zhouwei008@gmail.com**。欢迎参与贡献，一起维护和改进本项目！
 
+<!-- usage: remote-and-exposure -->
+## 远程访问（HTTPS）与限制工具
+
+默认情况下 `vmware-avi mcp` 通过 stdio 服务一个本地客户端，并提供全部工具。以下两个选项可以改变这一点
+（需 vmware-policy ≥ 1.21.0）。
+
+**通过 HTTPS 提供服务**，让其他机器上的客户端连接。每个调用者都需要一个 bearer token：
+
+```bash
+vmware-audit token create alice          # 只显示一次，交给 alice
+vmware-audit token list                  # 只列名字
+vmware-audit token revoke alice          # 下一个请求起即拒绝，无需重启
+vmware-avi mcp --transport https --host 0.0.0.0 --port 8443 \
+    --cert /etc/vmware-mcp/server.pem --key /etc/vmware-mcp/server-key.pem \
+    --public-name mcp.example.com
+```
+
+连接客户端（以 Claude Code 为例；任何支持 streamable HTTP 和自定义请求头的 MCP 客户端都可以）：
+
+```bash
+claude mcp add --transport http vmware-avi https://mcp.example.com:8443/mcp \
+    --header "Authorization: Bearer $VMWARE_MCP_TOKEN"
+```
+
+```json
+{
+  "mcpServers": {
+    "vmware-avi": {
+      "type": "http",
+      "url": "https://mcp.example.com:8443/mcp",
+      "headers": { "Authorization": "Bearer ${VMWARE_MCP_TOKEN}" }
+    }
+  }
+}
+```
+
+- 没有 token 时服务不会启动；`--public-name` 之外的 Host/Origin 一律拒绝；绑定端口前会自检，确认未认证请求得到 401。
+  证书要用客户端信任、且覆盖这些名字的证书。
+- 在同一台机器上由反向代理终结 TLS 时，用 `--transport http --host 127.0.0.1 --public-name mcp.example.com`，
+  并让代理透传 `Authorization` 头。
+- 审计日志把每个调用者记为 `token:<名字>`。调用并行执行：每个调用独占一个到 Controller（或 Kubernetes context）的
+  会话，每个 target 最多 `VMWARE_MCP_POOL_SIZE`（默认 2）个会话。每个 Controller 会话都是在 Controller 上的一次登录；
+  调用最多等待 300 秒拿到空闲会话。
+- **能连到这个端点的人，都以该 server 配置的账号操作。** token 只用来识别调用者，不在平台上授予任何权限。
+  每个权限级别单独起一个端点。
+
+**只提供读工具，加上你选定的写工具：**
+
+```bash
+vmware-avi mcp --expose read --allow-write disable_lb_pool_member
+# 或：VMWARE_AVI_MCP_EXPOSE=read VMWARE_AVI_MCP_ALLOW_WRITE=disable_lb_pool_member vmware-avi mcp
+```
+
+未提供的工具不会出现在客户端的工具列表里。取值错误或写工具名不存在时服务直接退出（exit 2）。
+这只限制提供给客户端的工具，不是授权；账号本身仍应遵循最小权限。
+
+详见 `skills/vmware-avi/references/setup-guide.md`（"Serving MCP over HTTPS"、"Limiting which tools are offered"）。
+
 ## 许可证
 
 MIT

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/README.md

@@ -551,6 +551,65 @@ Force resync triggers AKO to re-reconcile all K8s objects. If the drift persists
 
 If you encounter any errors or issues, please send the error message, logs, or screenshots to **zhouwei008@gmail.com**. Contributions are welcome -- feel free to join us in maintaining and improving this project!
 
+<!-- usage: remote-and-exposure -->
+## Remote access (HTTPS) and limiting tools
+
+By default `vmware-avi mcp` speaks stdio to one local client and offers every tool. Two options change that
+(vmware-policy ≥ 1.21.0).
+
+**Serve over HTTPS** so clients on other machines can connect. Every caller needs a bearer token:
+
+```bash
+vmware-audit token create alice          # prints the token once; give it to alice
+vmware-audit token list                  # names only
+vmware-audit token revoke alice          # refused from its next request, no restart
+vmware-avi mcp --transport https --host 0.0.0.0 --port 8443 \
+    --cert /etc/vmware-mcp/server.pem --key /etc/vmware-mcp/server-key.pem \
+    --public-name mcp.example.com
+```
+
+Connect a client (Claude Code shown; any MCP client that supports streamable HTTP and custom headers works):
+
+```bash
+claude mcp add --transport http vmware-avi https://mcp.example.com:8443/mcp \
+    --header "Authorization: Bearer $VMWARE_MCP_TOKEN"
+```
+
+```json
+{
+  "mcpServers": {
+    "vmware-avi": {
+      "type": "http",
+      "url": "https://mcp.example.com:8443/mcp",
+      "headers": { "Authorization": "Bearer ${VMWARE_MCP_TOKEN}" }
+    }
+  }
+}
+```
+
+- The server will not start without a token, refuses Host/Origin values outside `--public-name`, and checks
+  before it binds that unauthenticated requests get 401. Use a certificate your clients trust for those names.
+- Behind a TLS-terminating reverse proxy on the same machine use `--transport http --host 127.0.0.1
+  --public-name mcp.example.com` and pass the `Authorization` header through.
+- The audit log records each caller as `token:<name>`. Calls run side by side: each holds its own session to a
+  Controller (or Kubernetes context), up to `VMWARE_MCP_POOL_SIZE` (default 2) sessions per target. Each Controller
+  session is a login on the Controller; a call waits at most 300 s for a free one.
+- **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant
+  nothing on the platform. Run one endpoint per privilege level.
+
+**Offer only read tools, plus the writes you choose:**
+
+```bash
+vmware-avi mcp --expose read --allow-write disable_lb_pool_member
+# or: VMWARE_AVI_MCP_EXPOSE=read VMWARE_AVI_MCP_ALLOW_WRITE=disable_lb_pool_member vmware-avi mcp
+```
+
+Tools not offered do not appear in the client's tool list. A bad value or an unknown write tool stops the server
+(exit 2). This limits what clients are offered; it is not authorization, so the account itself should be
+least-privilege.
+
+Details: `skills/vmware-avi/references/setup-guide.md` ("Serving MCP over HTTPS", "Limiting which tools are offered").
+
 ## License
 
 MIT

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/RELEASE_NOTES.md

@@ -1,3 +1,20 @@
+## v2.3.0 — calls run side by side
+
+**Calls no longer wait for each other** (HLD §16 D-13(2), via vmware-policy 1.22.0). When one server serves several
+callers (`--transport https` / `http`), each call now holds its own Controller session — and its own Kubernetes client
+for the AKO tools — for as long as it runs, up to `VMWARE_MCP_POOL_SIZE` (default 2) per Controller or context. Each
+Controller session is a separate login: avisdk's `ApiSession.get_session` handed every caller the one session it caches
+per controller and user, so concurrent calls used to share, and re-authenticate over, a single login. A call that finds
+every session busy waits at most 300 s, then fails naming the target. The CLI and stdio keep one session per
+Controller, as before.
+
+* Tool output no longer crosses between callers. Each tool captured its text by swapping the ops module's console for
+  the length of the call; two calls at once could each receive the other's lines. Capture is now per call.
+* AKO tools build each Kubernetes client from the kubeconfig directly instead of through `load_kube_config`, which
+  rewrote the process-wide default configuration — two calls on different contexts could reach each other's cluster.
+  A client is rebuilt when the kubeconfig file changes.
+* Requires `vmware-policy>=1.22.0`.
+
 ## v2.2.0 — serve MCP over HTTPS
 
 `vmware-avi mcp` can now serve the network as well as stdio (HLD §16, via vmware-policy 1.21.0):
@@ -8,6 +25,15 @@ vmware-avi mcp --transport https --host 0.0.0.0 --port 8443 \
     --cert server.pem --key server-key.pem --public-name mcp.example.com
 ```
 
+Connect a client and manage callers (Claude Code shown; any MCP client with streamable HTTP and custom headers works):
+
+```bash
+claude mcp add --transport http vmware-avi https://mcp.example.com:8443/mcp \
+    --header "Authorization: Bearer $VMWARE_MCP_TOKEN"
+vmware-audit token list                  # names only
+vmware-audit token revoke alice          # refused from its next request, no restart
+```
+
 * Every request needs `Authorization: Bearer <token>`; the server will not start without a token, refuses Host or
   Origin values outside `--public-name`, and checks itself (unauthenticated requests must get 401) before it
   binds. `--transport http` binds loopback only, for a TLS-terminating reverse proxy.

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/openclaw.plugin.json

@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-avi==2.2.0",
+        "vmware-avi==2.3.0",
         "vmware-avi-mcp"
       ]
     }

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zw008/vmware-avi",
-  "version": "2.2.0",
+  "version": "2.3.0",
   "description": "VMware AVI (NSX ALB) load balancer plus AKO Kubernetes ops — 28 MCP tools.",
   "private": true,
   "license": "MIT",

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-avi"
-version = "2.2.0"
+version = "2.3.0"
 description = "AVI (NSX Advanced Load Balancer) management and AKO Kubernetes operations tool"
 readme = "README.md"
 license = "MIT"
@@ -19,7 +19,7 @@ dependencies = [
     "httpx>=0.27,<1.0",
     "python-dotenv>=1.0,<2.0",
     "mcp[cli]>=1.28,<2.0",
-    "vmware-policy>=1.21.0,<2.0",
+    "vmware-policy>=1.22.0,<2.0",
 ]
 
 

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/vmware-skills/VMware-AVI",
     "source": "github"
   },
-  "version": "2.2.0",
+  "version": "2.3.0",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-avi",
-      "version": "2.2.0",
+      "version": "2.3.0",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/skills/vmware-avi/SKILL.md

@@ -53,7 +53,7 @@ AVI (NSX Advanced Load Balancer) application delivery and AKO Kubernetes operati
 ## Quick Install
 
 ```bash
-uv tool install vmware-avi==2.2.0
+uv tool install vmware-avi==2.3.0
 vmware-avi doctor            # checks Controller connectivity + kubeconfig + avisdk
 ```
 
@@ -235,7 +235,7 @@ Force resync triggers AKO to re-reconcile all K8s objects. If the drift persists
 ## Setup
 
 ```bash
-uv tool install vmware-avi==2.2.0
+uv tool install vmware-avi==2.3.0
 mkdir -p ~/.vmware-avi
 vmware-avi init              # generates config.yaml and .env templates
 chmod 600 ~/.vmware-avi/.env

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/skills/vmware-avi/references/capabilities.md

@@ -37,7 +37,7 @@ All 28 MCP tools exposed by `vmware-avi mcp` (v1.5.15+; legacy entry point: `vmw
 | `vmware-avi mcp` (CLI subcommand, stdio) | ✅ Full | ✅ v1.5.15+ default — no PyPI re-resolve, works behind corporate TLS proxies. |
 | `vmware-avi-mcp` (legacy console script, stdio) | ✅ Full | Kept for backward compatibility with pre-1.5.15 configs. |
 | `python -m vmware_avi.mcp_server` (stdio, via `__main__.py`) | ✅ Full | Docker image `CMD` only — not for end-user CLI install, and no longer used by `smithery.yaml` (which now calls the `vmware-avi mcp` entry point). Added v1.5.22. |
-| `uvx --from vmware-avi==2.2.0 vmware-avi-mcp` | ⚠ Fallback | Re-resolves PyPI on each launch; fails behind corporate TLS proxies (踩坑 #25). Use `UV_NATIVE_TLS=true` workaround. |
+| `uvx --from vmware-avi==2.3.0 vmware-avi-mcp` | ⚠ Fallback | Re-resolves PyPI on each launch; fails behind corporate TLS proxies (踩坑 #25). Use `UV_NATIVE_TLS=true` workaround. |
 
 ## Automation Level Reference
 

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/skills/vmware-avi/references/setup-guide.md

@@ -21,7 +21,7 @@ Complete installation, configuration, and AI platform integration guide for the
 ### Standard Install (recommended)
 
 ```bash
-uv tool install vmware-avi==2.2.0
+uv tool install vmware-avi==2.3.0
 ```
 
 This installs the CLI (`vmware-avi`, with `vmware-avi mcp` subcommand for the MCP server in v1.5.15+), the legacy `vmware-avi-mcp` entry point (for backward compatibility), and all Python dependencies in an isolated environment.
@@ -29,7 +29,7 @@ This installs the CLI (`vmware-avi`, with `vmware-avi mcp` subcommand for the MC
 ### Development Install
 
 ```bash
-git clone --branch v2.2.0 https://github.com/vmware-skills/VMware-AVI.git
+git clone --branch v2.3.0 https://github.com/vmware-skills/VMware-AVI.git
 cd VMware-AVI
 uv pip install -e ".[dev]"
 ```
@@ -43,7 +43,7 @@ For platforms that prefer containerized MCP servers (e.g., Smithery registry, Ku
 Build and run the MCP server in a container. The image uses `python:3.12-slim` with `uv` for dependency installation and runs `python -m vmware_avi.mcp_server` on stdio (no port exposed — MCP uses stdin/stdout).
 
 ```bash
-git clone --branch v2.2.0 https://github.com/vmware-skills/VMware-AVI.git
+git clone --branch v2.3.0 https://github.com/vmware-skills/VMware-AVI.git
 cd VMware-AVI
 
 # Build
@@ -72,7 +72,7 @@ Users can install via the Smithery UI or CLI without managing Python environment
 
 | Deployment | Best For |
 |------------|----------|
-| `uv tool install vmware-avi==2.2.0` + `vmware-avi mcp` | Local developer workstation, single-user CLI + MCP |
+| `uv tool install vmware-avi==2.3.0` + `vmware-avi mcp` | Local developer workstation, single-user CLI + MCP |
 | Docker image | Self-hosted agents, CI runners, isolated environments, multi-user servers |
 | Smithery | Zero-install agent integration, registry-managed discovery, hosted-MCP workflows |
 
@@ -239,6 +239,35 @@ vmware-avi mcp --expose read --allow-write disable_lb_pool_member
 - An agent that can run shell commands can also reach the platform without MCP (SSH, curl, govc, PowerCLI). So
   the service account itself must be least-privilege: exposure and deny rules are guardrails, not the boundary.
 
+## Serving MCP over HTTPS
+
+By default the MCP server speaks stdio to one local client. To let clients on other machines reach it, serve it over
+HTTPS. Every caller then needs a bearer token.
+
+```bash
+vmware-audit token create alice                      # prints the token once; give it to alice
+vmware-avi mcp --transport https --host 0.0.0.0 --port 8443 \
+    --cert /etc/vmware-mcp/server.pem --key /etc/vmware-mcp/server-key.pem \
+    --public-name mcp.example.com
+```
+
+- Clients connect to `https://mcp.example.com:8443/mcp` and send `Authorization: Bearer <token>`.
+- `--public-name` lists every host name clients use (comma-separated); requests for any other Host or Origin are
+  refused. Use a certificate your clients trust for those names.
+- Behind a reverse proxy that terminates TLS (Nginx, HAProxy) on the same machine, use
+  `--transport http --host 127.0.0.1 --public-name mcp.example.com` (the names the proxy forwards in `Host`), and
+  have the proxy pass the `Authorization` header through.
+- `vmware-audit token list` / `token revoke NAME` manage callers; a revoked token is refused from its next request.
+  Replace a leaked token under a new name.
+- The server will not start without at least one token, and checks before it binds that unauthenticated requests
+  are refused.
+- Each audit row records the caller as `token:<name>`. Calls run side by side: each holds its own session to a
+  Controller (or Kubernetes context), up to `VMWARE_MCP_POOL_SIZE` (default 2) sessions per target. Each Controller
+  session is a login on the Controller; a call waits at most 300 s for a free one.
+- **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant
+  nothing on the platform. Run one endpoint per privilege level (for example a read-only account behind
+  `--expose read`, and a separate endpoint for operators).
+
 ## Security
 
 > **Disclaimer**: This is a community-maintained open-source project and is **not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom Inc.** "VMware", "NSX", and "AVI" are trademarks of Broadcom.

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/tests/conftest.py

@@ -171,3 +171,22 @@ def _patch_k8s_connect(
         ),
     ):
         yield
+
+
+# ---------------------------------------------------------------------------
+# Process-wide session pools (HLD §16 D-13(2))
+# ---------------------------------------------------------------------------
+
+
+@pytest.fixture(autouse=True)
+def _fresh_session_pools(monkeypatch: pytest.MonkeyPatch) -> None:
+    """Each test starts with empty pools: the managers share theirs process-wide."""
+    from vmware_avi.connection import AviConnectionManager
+    from vmware_avi.k8s_connection import K8sConnectionManager
+
+    for cls, registry in (
+        (AviConnectionManager, "_built_from"),
+        (K8sConnectionManager, "_kubeconfig_for"),
+    ):
+        monkeypatch.setattr(cls, "_pool", None)
+        monkeypatch.setattr(cls, registry, {})

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/tests/eval/regression/test_avi_specific.py

@@ -339,7 +339,8 @@ class TestLogoutIsPost:
 
         mgr = AviConnectionManager(sample_config)
         session = MagicMock()
-        mgr._sessions["lab"] = session
+        with patch.object(AviConnectionManager, "_create_session", return_value=session):
+            assert mgr.connect("lab") is session
 
         mgr.disconnect("lab")
 
@@ -349,7 +350,7 @@ class TestLogoutIsPost:
             assert call.args[:1] != ("logout",), (
                 "logout must not be sent as DELETE"
             )
-        assert "lab" not in mgr._sessions
+        assert "lab" not in mgr.list_connected()
 
     def test_logout_failure_does_not_raise(self, sample_config) -> None:
         from vmware_avi.connection import AviConnectionManager
@@ -357,10 +358,11 @@ class TestLogoutIsPost:
         mgr = AviConnectionManager(sample_config)
         session = MagicMock()
         session.post.side_effect = RuntimeError("controller gone")
-        mgr._sessions["lab"] = session
+        with patch.object(AviConnectionManager, "_create_session", return_value=session):
+            mgr.connect("lab")
 
         mgr.disconnect("lab")  # must not raise
-        assert "lab" not in mgr._sessions
+        assert "lab" not in mgr.list_connected()
 
 
 # ── Finding 7 — error-log filter must be ge(response_code,400) ───────────────

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/tests/eval/regression/test_fix_pack.py

@@ -19,7 +19,7 @@ Each test pins one production bug:
 7. list_pools vs_filter missed pools because '#name' / '?...' fragments were
    left on refs.
 9. CLI write commands never called the audit module.
-10. FQDN→IP resolution + verify_ssl kwarg must reach ApiSession.get_session.
+10. FQDN→IP resolution + verify_ssl kwarg must reach the ApiSession it builds.
 """
 
 from __future__ import annotations
@@ -525,24 +525,24 @@ class TestConnectionSessionKwargs:
         assert resolved == "10.0.0.1"
         mock_gai.assert_not_called()
 
-    def test_verify_ssl_kwarg_reaches_get_session(self) -> None:
+    def test_verify_ssl_kwarg_reaches_the_api_session(self) -> None:
         ctrl = ControllerConfig(name="lab", host="10.0.0.1", verify_ssl=False)
         with (
-            patch("avi.sdk.avi_api.ApiSession.get_session") as mock_get_session,
+            patch("avi.sdk.avi_api.ApiSession") as mock_api_session,
             patch.dict("os.environ", {"LAB_PASSWORD": "pw"}),
         ):
             AviConnectionManager._create_session(ctrl)
 
-        kwargs = mock_get_session.call_args.kwargs
+        kwargs = mock_api_session.call_args.kwargs
         assert kwargs["verify"] is False
         assert kwargs["controller_ip"] == "10.0.0.1"
 
     def test_verify_ssl_default_true(self) -> None:
         ctrl = ControllerConfig(name="lab", host="10.0.0.1")
         with (
-            patch("avi.sdk.avi_api.ApiSession.get_session") as mock_get_session,
+            patch("avi.sdk.avi_api.ApiSession") as mock_api_session,
             patch.dict("os.environ", {"LAB_PASSWORD": "pw"}),
         ):
             AviConnectionManager._create_session(ctrl)
 
-        assert mock_get_session.call_args.kwargs["verify"] is True
+        assert mock_api_session.call_args.kwargs["verify"] is True

{vmware_avi-2.2.0 → vmware_avi-2.3.0}/tests/test_mcp_error_paths.py

@@ -210,15 +210,19 @@ def test_a_successful_call_is_still_audited_as_ok(monkeypatch, audit_rows):
 
 
 def test_console_is_restored_after_a_failure(op):
-    """The swap is global to the ops module; leaking it would silently redirect
-    every later CLI call in the same process into a dead buffer."""
+    """Leaking the capture would silently redirect every later CLI call in the
+    same process into a dead buffer: after a failed capture, printing outside a
+    capture must reach the module's own console again."""
+    import io
     import sys
 
     mod = sys.modules[__name__]
-    before = mod.console
+    own = io.StringIO()
+    mod.console = Console(file=own, force_terminal=False)
 
     def failing():
         raise SystemExit(1)
 
     srv._capture_output(op(failing))
-    assert mod.console is before
+    mod.console.print("after the capture")
+    assert "after the capture" in own.getvalue()