vmware-debug 1.12.1__tar.gz → 1.12.2__tar.gz

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-debug",
   "displayName": "VMware Debug",
-  "version": "1.12.1",
+  "version": "1.12.2",
   "description": "VMware incident timeline, root-cause routing, local case ledger; no vSphere access. 14 MCP tools.",
   "author": {
     "name": "Wei Zhou",

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-debug==1.12.1",
+        "vmware-debug==1.12.2",
         "vmware-debug-mcp"
       ]
     }

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-debug
-Version: 1.12.1
+Version: 1.12.2
 Summary: VMware diagnostic brain — offline incident triage, log/event correlation, and root-cause routing across the VMware skill family
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-Debug
 Project-URL: Repository, https://github.com/vmware-skills/VMware-Debug
@@ -18,7 +18,7 @@ Requires-Dist: mcp[cli]<2.0,>=1.10
 Requires-Dist: pyyaml<7.0,>=6.0
 Requires-Dist: rich<15.0,>=13.0
 Requires-Dist: typer<1.0,>=0.12
-Requires-Dist: vmware-policy<2.0,>=1.15.0
+Requires-Dist: vmware-policy<2.0,>=1.16.0
 Description-Content-Type: text/markdown
 
 <!-- mcp-name: io.github.vmware-skills/vmware-debug -->

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/RELEASE_NOTES.md

@@ -1,3 +1,35 @@
+## v1.12.2 — every tool call is audited, failures included
+
+Until now no vmware-debug MCP tool wrote to `~/.vmware/audit.db`. The server said that was on
+purpose — nothing here acts on a VMware target — and the case ledger stood in as the record. It
+records the investigation, not the calls: in a live session case evidence was submitted with
+invented fetch times, and nothing could show when the calls had really been made or which failed.
+
+* All 14 MCP tools now go through `@vmware_tool`. Each call writes one row under the tool's own
+  name; a call that raises or returns `{"error": …}` is recorded as `error`.
+* `payload` (`case_submit_evidence`) and `events` (`incident_timeline`) are kept out of the row.
+  The row still has the case id, source skill and tool, query, fetch time and outcome; the data
+  itself is in the case folder, or with the caller.
+* The CLI twins audit too: `categories` as `list_symptom_categories`, `triage` as
+  `incident_timeline` — including a `triage` that fails on bad input. `version` and `mcp` still
+  write no row.
+* **Event text is not copied into the row.** `incident_timeline` and `case_timeline` return event
+  text (`hypotheses[].sample_text`, `classification.unmatched_samples`, `rejected`), and a probe
+  with `password=…` and `https://user:pass@host` in an event stored both in the row's result. Both
+  tools now declare `sensitive_result`: the row keeps the call, arguments and status (a returned
+  `{"error": …}` is still `error`) and records the result as `[redacted: return value declared
+  sensitive]`. The other tools return ids, counts, grades and text you passed as an argument, and
+  are stored after vmware-policy's credential scrubbing.
+* Because the tools now pass through `guard()`, vmware-policy's rules apply to them: a `deny` rule
+  naming a debug tool, or with no `operations`, refuses it; a malformed `~/.vmware/rules.yaml`
+  refuses every tool (the `categories`/`triage` commands exit 1 with a traceback ending in the
+  reason); the runaway guard refuses the 26th identical call within 120 s. It compares a digest of the
+  arguments the tool received, not the audit row's redacted copy, so `incident_timeline` calls with
+  different events are not identical — this needs vmware-policy 1.16.0, which this release requires.
+  Environment-scoped rules still never match (debug has no targets), and maintenance windows never
+  gate a debug tool (all are `low` risk). `references/setup-guide.md` said the opposite — that no
+  policy rule applies — and is corrected.
+
 ## v1.12.1 — every CLI command declares what it reaches
 
 Across the family, CLI reads never wrote `~/.vmware/audit.db`; they now do (`@audited`, under the

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/openclaw.plugin.json

@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-debug==1.12.1",
+        "vmware-debug==1.12.2",
         "vmware-debug-mcp"
       ]
     }

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zw008/vmware-debug",
-  "version": "1.12.1",
+  "version": "1.12.2",
   "description": "VMware incident timeline, root-cause routing, local case ledger; no vSphere access. 14 MCP tools.",
   "private": true,
   "license": "MIT",

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-debug"
-version = "1.12.1"
+version = "1.12.2"
 description = "VMware diagnostic brain — offline incident triage, log/event correlation, and root-cause routing across the VMware skill family"
 readme = "README.md"
 license = "MIT"
@@ -21,7 +21,7 @@ dependencies = [
     "typer>=0.12,<1.0",
     "rich>=13.0,<15.0",
     "mcp[cli]>=1.10,<2.0",
-    "vmware-policy>=1.15.0,<2.0",
+    "vmware-policy>=1.16.0,<2.0",
     # Imported directly by ops/cases/grading.py for the rules file. It has
     # always arrived transitively via vmware-policy; a package should
     # declare what it imports rather than rely on a dependency's dependency.

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/vmware-skills/VMware-Debug",
     "source": "github"
   },
-  "version": "1.12.1",
+  "version": "1.12.2",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-debug",
-      "version": "1.12.1",
+      "version": "1.12.2",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/skills/vmware-debug/SKILL.md

@@ -51,7 +51,7 @@ write tools touch only the local case ledger.
 ## Quick Install
 
 ```bash
-uv tool install vmware-debug==1.12.1
+uv tool install vmware-debug==1.12.2
 vmware-debug categories          # see what it can diagnose
 ```
 
@@ -275,10 +275,32 @@ No network, nothing executed. The seven [WRITE] tools write only to the local ca
 ledger under `$OPS_HOME`; nothing here touches a remote VMware estate. Evidence, gaps,
 hypotheses and grade history are only ever added to — `timeline.md` is regenerated from
 the evidence and `case.json` holds the current grade and state. Remediation is always routed to
-aiops/pilot, where the double-confirm / approval / audit gates live (audit DB
-`~/.vmware/audit.db`). debug has no config and no connection, so it registers no
-environment resolver, and its tools do not pass through the policy engine — no policy
-rule applies to them. See `references/setup-guide.md`.
+aiops/pilot, where the double-confirm / approval gates live.
+
+**What the audit row holds.** Every debug tool call — a failed one included — writes one
+row to `~/.vmware/audit.db` through `@vmware_tool`, as do the `categories` and `triage`
+CLI commands under their MCP tools' names. The row records the tool, time, OS user,
+detected agent, arguments, status (`ok`, `error`, `denied`, `budget_exceeded`,
+`interrupted`) and a result. Two arguments are stored as `***`: evidence `payload` and
+`incident_timeline` `events`. Two results are not stored at all — `incident_timeline` and
+`case_timeline` quote event text (`sample_text`, `unmatched_samples`, `rejected`), which
+can carry anything the source logged, so their row says
+`[redacted: return value declared sensitive]`. Every other result (ids, counts, grades,
+your own summaries and statements) is stored after credential scrubbing. The data itself
+is in the case folder, or with you.
+
+**What debug inherits from vmware-policy**, since its tools pass through `guard()`:
+- **Runaway guard** — the 26th call to one tool with identical arguments within 120 s is
+  refused (`budget_exceeded`; `VMWARE_RUNAWAY_MAX`, `VMWARE_RUNAWAY_WINDOW_SEC`). It
+  compares a digest of the arguments the tool received (vmware-policy ≥1.16.0), so
+  calls with different `events` are not identical.
+- **A malformed `~/.vmware/rules.yaml` fails closed** — every tool is refused with a reason
+  naming the file; `categories`/`triage` exit 1 with a traceback ending in that message.
+- **A `deny` rule without `operations`** matches every tool, debug's included.
+- **Environment-scoped rules never match** — debug registers no resolver (no targets).
+- **Maintenance windows** gate only `high`/`critical` risk; every debug tool is `low`.
+
+See `references/setup-guide.md`.
 
 **Case data is sensitive and is kept until you delete it.** Each case lives in
 `$OPS_HOME/cases/<case-id>/` (default `~/.vmware/cases/`), created owner-only (`0700`).

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/skills/vmware-debug/references/agent-guardrails.md

@@ -46,7 +46,7 @@ These are structural, so it cannot.
 | "Do not fabricate a timeline — build it from the events I gave you" | **`incident_timeline` correlates only its input.** It is source-agnostic and has no way to fetch anything, so the timeline cannot contain an event the agent did not supply. |
 | "Tell me when the symptom is outside what you can recognise" | **`list_symptom_categories`** states the catalogue, and unmatched symptoms come back as `uncategorized` rather than being forced into the nearest signature. |
 | "Use explicit limits for queries that may return large amounts of data" | **The list envelope.** `list_symptom_categories` returns `{items, returned, limit, total, truncated, hint}` with `truncated` always `false` — which is the point: it states that the catalogue is complete instead of leaving you to infer it. |
-| "Log everything you looked at" | **The case ledger, for investigations.** Evidence submitted to a case is recorded with its source skill, tool, query and fetch time. Debug's own tool calls are not written to `~/.vmware/audit.db`: none of them acts on a VMware target. |
+| "Log everything you looked at" | **`~/.vmware/audit.db` and the case ledger.** Every debug tool call, a failed one included, writes one audit row (tool, time, user, agent, arguments, status and result — evidence `payload` and `events` are stored as `***`, and the results of `incident_timeline` and `case_timeline`, which quote event text, are not stored at all). Evidence submitted to a case is also recorded in the ledger with its source skill, tool, query and fetch time — so pass the real fetch time, never a placeholder. |
 
 ---
 

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/skills/vmware-debug/references/setup-guide.md

@@ -6,7 +6,7 @@ is a pure, offline correlation engine. There is no `config.yaml` and no `.env`.
 ## Install
 
 ```bash
-uv tool install vmware-debug==1.12.1
+uv tool install vmware-debug==1.12.2
 vmware-debug categories      # verify it runs
 ```
 
@@ -15,7 +15,7 @@ vmware-debug categories      # verify it runs
 ```json
 {
   "command": "uvx",
-  "args": ["--from", "vmware-debug==1.12.1", "vmware-debug-mcp"]
+  "args": ["--from", "vmware-debug==1.12.2", "vmware-debug-mcp"]
 }
 ```
 
@@ -53,8 +53,31 @@ routes fixes to (vmware-aiops, vmware-pilot).
    `staging` / `lab`) per target in their own `config.yaml` as an optional label
    an environment-scoped `deny` rule can match on. debug has no config and no
    connection to declare one about, so it registers no environment resolver —
-   it has no basis to answer for any target. Its tools do not pass through the
-   policy engine either, so no policy rule, environment-scoped or not, applies
-   to them.
-7. **Static analysis** — `uvx bandit -r vmware_debug/` (release bar:
+   it has no basis to answer for any target — and an environment-scoped rule
+   never matches its tools. Every other policy rule does apply: each MCP tool
+   and the `categories` / `triage` CLI commands pass through vmware-policy's
+   `guard()`. Verified behaviour:
+   - A `deny` rule naming a debug tool, or with no `operations` key at all,
+     refuses it (status `denied`, with the rule's reason).
+   - A malformed `~/.vmware/rules.yaml` fails closed: every tool is refused with
+     a reason naming the file and the way out (fix it, or
+     `VMWARE_POLICY_DISABLED=1`). The `categories` and `triage` commands exit 1
+     with a Python traceback whose last lines are that message; `version` and
+     `mcp` are unaffected.
+   - Runaway guard: within one MCP server process, the 26th call to the same
+     tool with identical arguments inside 120 s is refused (`budget_exceeded`).
+     Tune with `VMWARE_RUNAWAY_MAX` / `VMWARE_RUNAWAY_WINDOW_SEC`. The guard
+     compares a SHA-256 digest of the arguments the tool actually received
+     (vmware-policy ≥1.16.0), not the redacted copy in the audit row — so calls
+     with different `events` or `payload` are never counted as identical.
+   - A `maintenance_window` gates only `high`/`critical` risk operations; every
+     debug tool is `low`, so a window never blocks one.
+7. **Audit row contents** — one row per call in `~/.vmware/audit.db`: tool,
+   time, OS user, detected agent, arguments, status and result. `payload` and
+   `events` are stored as `***`. The results of `incident_timeline` and
+   `case_timeline` are not stored (`[redacted: return value declared
+   sensitive]`) because they quote event text; other results are stored after
+   credential scrubbing. The status is still truthful — a call that returns
+   `{"error": …}` is `error`.
+8. **Static analysis** — `uvx bandit -r vmware_debug/` (release bar:
    0 Medium+).

vmware_debug-1.12.2/tests/test_mcp_audit.py

@@ -0,0 +1,274 @@
+"""Every call to this skill's MCP tools — and every failed call — writes one audit row.
+
+Until 2026-09-15 no vmware-debug tool wrote to ``~/.vmware/audit.db``. The server
+said that was deliberate ("nothing in this skill acts on a VMware target"), and
+the case ledger was offered as the record. It is a record of the investigation,
+not of the calls: a live session submitted evidence with invented timestamps,
+and nothing could show when the calls had really been made or which had failed.
+HLD §8.1 / I-10 (amended 2026-09-15b) now require a row for every MCP call,
+local tools included, and for the CLI twins of those tools under the same name.
+
+Rows are read back from the sandbox database the engine is bound to, so these
+tests would fail if the call reached the audit engine but not the file.
+"""
+
+from __future__ import annotations
+
+import asyncio
+import json
+import sqlite3
+from pathlib import Path
+
+import pytest
+from typer.testing import CliRunner
+from vmware_policy import get_engine
+from vmware_policy.audit import reset_engine
+
+from vmware_debug.cli import app
+from vmware_debug.mcp_server.server import build_server
+
+EXPECTED_TOOLS = {
+    "incident_timeline",
+    "list_symptom_categories",
+    "case_open",
+    "case_list",
+    "case_get",
+    "case_submit_evidence",
+    "case_record_gap",
+    "case_grade",
+    "case_readiness",
+    "case_plan",
+    "case_hypotheses",
+    "case_timeline",
+    "case_close",
+    "case_knowledge",
+}
+
+AT = "2026-09-15T05:48:16Z"
+
+
+@pytest.fixture(autouse=True)
+def isolated_audit(tmp_path, monkeypatch):
+    """A fresh OPS_HOME per test, and an engine bound to it."""
+    monkeypatch.setenv("OPS_HOME", str(tmp_path / "vmware"))
+    reset_engine()
+    yield
+    reset_engine()
+
+
+@pytest.fixture
+def server():
+    return build_server()
+
+
+def rows(tool: str | None = None) -> list[dict]:
+    db = Path(get_engine()._path)
+    if not db.exists():
+        return []
+    with sqlite3.connect(f"file:{db}?mode=ro", uri=True) as con:
+        con.row_factory = sqlite3.Row
+        query = "SELECT skill, tool, status, params, result FROM audit_log"
+        args: tuple = ()
+        if tool is not None:
+            query += " WHERE tool = ?"
+            args = (tool,)
+        return [dict(r) for r in con.execute(query + " ORDER BY id", args)]
+
+
+def call(server, name: str, arguments: dict):
+    return asyncio.run(server.call_tool(name, arguments))
+
+
+def test_every_registered_tool_wears_vmware_tool(server) -> None:
+    tools = server._tool_manager._tools
+    assert set(tools) >= EXPECTED_TOOLS, f"tools missing from the registry: {EXPECTED_TOOLS - set(tools)}"
+    unwrapped = sorted(name for name, tool in tools.items() if not getattr(tool.fn, "_is_vmware_tool", False))
+    assert not unwrapped, f"MCP tools that write no audit row: {unwrapped}"
+
+
+def test_a_successful_call_writes_one_ok_row_under_the_tool_name(server) -> None:
+    call(server, "case_open", {"summary": "vsan latency on cluster-01", "determined_by": "alarm 42"})
+
+    found = rows("case_open")
+    assert len(found) == 1, f"expected one case_open row, got {rows()}"
+    assert found[0]["skill"] == "debug"
+    assert found[0]["status"] == "ok"
+
+
+def test_a_failed_call_writes_an_error_row(server) -> None:
+    call(server, "case_get", {"case_id": "20990101-000000-no-such-case"})
+
+    found = rows("case_get")
+    assert len(found) == 1, f"a failed call left no row: {rows()}"
+    assert found[0]["status"] == "error"
+
+
+def test_a_malformed_incident_timeline_call_is_recorded_as_an_error(server) -> None:
+    call(server, "incident_timeline", {"events": [{"not": "an event"}]})
+
+    found = rows("incident_timeline")
+    assert len(found) == 1
+    assert found[0]["status"] == "error"
+
+
+def test_evidence_payload_is_not_copied_into_the_audit_row(server) -> None:
+    opened = call(server, "case_open", {"summary": "vcenter memory exhaustion", "determined_by": "alarm"})
+    case_id = _structured(opened)["case_id"]
+    marker = "PAYLOAD-MARKER-3f9c"
+
+    call(
+        server,
+        "case_submit_evidence",
+        {
+            "case_id": case_id,
+            "source_skill": "vmware-monitor",
+            "source_tool": "get_events",
+            "summary": "one event",
+            "fetched_at": AT,
+            "query": {"target": "home-vcenter", "hours": 1},
+            "payload": [{"time": AT, "message": marker}],
+        },
+    )
+
+    found = rows("case_submit_evidence")
+    assert len(found) == 1
+    assert found[0]["status"] == "ok"
+    assert marker not in found[0]["params"], "the raw payload was duplicated into audit.db"
+    params = json.loads(found[0]["params"])
+    assert params["case_id"] == case_id
+    assert params["source_tool"] == "get_events"
+    assert params["fetched_at"] == AT
+
+
+def test_cli_categories_is_audited_under_its_mcp_twin_name() -> None:
+    result = CliRunner().invoke(app, ["categories"])
+
+    assert result.exit_code == 0, result.output
+    found = rows("list_symptom_categories")
+    assert len(found) == 1 and found[0]["status"] == "ok", rows()
+
+
+def test_cli_triage_is_audited_under_its_mcp_twin_name(tmp_path) -> None:
+    events = tmp_path / "events.json"
+    events.write_text(
+        json.dumps([{"ts": AT, "source": "vcenter", "severity": "warning", "entity": "vcsa", "text": "memory"}]),
+        encoding="utf-8",
+    )
+
+    result = CliRunner().invoke(app, ["triage", "--events", str(events)])
+
+    assert result.exit_code == 0, result.output
+    found = rows("incident_timeline")
+    assert len(found) == 1 and found[0]["status"] == "ok", rows()
+
+
+def test_a_failed_cli_triage_is_recorded_as_an_error(tmp_path) -> None:
+    bad = tmp_path / "events.json"
+    bad.write_text("{not json", encoding="utf-8")
+
+    result = CliRunner().invoke(app, ["triage", "--events", str(bad)])
+
+    assert result.exit_code != 0
+    found = rows("incident_timeline")
+    assert len(found) == 1, f"a failed triage left no row: {rows()}"
+    assert found[0]["status"] == "error"
+
+
+def test_version_writes_no_row() -> None:
+    result = CliRunner().invoke(app, ["version"])
+
+    assert result.exit_code == 0
+    assert rows() == []
+
+
+def _structured(result) -> dict:
+    """FastMCP returns (content, structured) or a content list depending on version."""
+    if isinstance(result, tuple):
+        content, structured = result
+        if isinstance(structured, dict):
+            return structured.get("result", structured)
+        result = content
+    return json.loads("".join(getattr(c, "text", "") for c in result))
+
+
+# ── Result bodies that carry event text are not copied (review D3) ──────────
+
+REDACTED_RESULT = json.dumps("[redacted: return value declared sensitive]")
+EVENT_MARKER = "EVENT-TEXT-MARKER-7d21"
+
+#: Tools whose result quotes event text the caller fetched from another system —
+#: vCenter event messages, log lines — which can carry anything, credentials
+#: included. incident_timeline returns it as hypotheses[].sample_text and
+#: classification.unmatched_samples; case_timeline returns the same structure
+#: rebuilt from the ledger, plus `rejected` entries that quote the offending row.
+#: Every other tool returns ids, counts, grades and text the caller wrote as an
+#: argument (a summary, a hypothesis statement, a gap's how_to_close), which the
+#: row already holds in `params`.
+SENSITIVE_RESULT_TOOLS = {"incident_timeline", "case_timeline"}
+
+
+def _events(text: str) -> list[dict]:
+    return [{"ts": AT, "source": "vcenter", "severity": "error", "entity": "vc01", "text": text}]
+
+
+def test_only_tools_that_return_event_text_declare_a_sensitive_result(server) -> None:
+    declared = {
+        name for name, tool in server._tool_manager._tools.items() if getattr(tool.fn, "_sensitive_result", False)
+    }
+    assert declared == SENSITIVE_RESULT_TOOLS
+
+
+def test_incident_timeline_result_body_is_not_copied(server) -> None:
+    returned = _structured(call(server, "incident_timeline", {"events": _events(f"{EVENT_MARKER} login failed")}))
+
+    assert any(EVENT_MARKER in h["sample_text"] for h in returned["hypotheses"]), "the caller must get the real result"
+    found = rows("incident_timeline")
+    assert len(found) == 1
+    assert found[0]["status"] == "ok"
+    assert EVENT_MARKER not in found[0]["result"], "event text was copied into audit.db"
+    assert found[0]["result"] == REDACTED_RESULT
+    assert json.loads(found[0]["params"])["top_n"] == 5
+
+
+def test_incident_timeline_returned_error_is_still_recorded_as_error(server) -> None:
+    call(server, "incident_timeline", {"events": [{"text": EVENT_MARKER}]})
+
+    found = rows("incident_timeline")
+    assert len(found) == 1
+    assert found[0]["status"] == "error", "declaring the result sensitive hid the failure"
+    assert EVENT_MARKER not in found[0]["result"]
+
+
+def test_case_timeline_result_body_is_not_copied(server) -> None:
+    case_id = _structured(call(server, "case_open", {"summary": "auth failures on vc01", "determined_by": "alarm"}))[
+        "case_id"
+    ]
+    call(
+        server,
+        "case_submit_evidence",
+        {
+            "case_id": case_id,
+            "source_skill": "vmware-monitor",
+            "source_tool": "get_events",
+            "summary": "one event",
+            "fetched_at": AT,
+            "payload": _events(f"{EVENT_MARKER} login failed"),
+        },
+    )
+
+    returned = _structured(call(server, "case_timeline", {"case_id": case_id}))
+
+    assert returned["event_count"] == 1
+    found = rows("case_timeline")
+    assert len(found) == 1
+    assert found[0]["status"] == "ok"
+    assert EVENT_MARKER not in found[0]["result"], "event text was copied into audit.db"
+    assert json.loads(found[0]["params"])["case_id"] == case_id
+
+
+def test_case_timeline_returned_error_is_still_recorded_as_error(server) -> None:
+    call(server, "case_timeline", {"case_id": "20990101-000000-no-such-case"})
+
+    found = rows("case_timeline")
+    assert len(found) == 1
+    assert found[0]["status"] == "error"

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/uv.lock

@@ -1293,7 +1293,7 @@ wheels = [
 
 [[package]]
 name = "vmware-debug"
-version = "1.12.1"
+version = "1.12.2"
 source = { editable = "." }
 dependencies = [
     { name = "mcp", extra = ["cli"] },
@@ -1316,7 +1316,7 @@ requires-dist = [
     { name = "pyyaml", specifier = ">=6.0,<7.0" },
     { name = "rich", specifier = ">=13.0,<15.0" },
     { name = "typer", specifier = ">=0.12,<1.0" },
-    { name = "vmware-policy", specifier = ">=1.15.0,<2.0" },
+    { name = "vmware-policy", specifier = ">=1.16.0,<2.0" },
 ]
 
 [package.metadata.requires-dev]
@@ -1328,14 +1328,14 @@ dev = [
 
 [[package]]
 name = "vmware-policy"
-version = "1.15.0"
+version = "1.16.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "pyyaml" },
     { name = "rich" },
     { name = "typer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ac/0c/c7b6c9e2e82b5c8d40b0721bfc9a6428bdd9fd41d8c1c6ec492b94f183f8/vmware_policy-1.15.0.tar.gz", hash = "sha256:48e1850c434dd3f34401b1e3785c073d72b451af904cc2f8c7d3bde772309e8a", size = 181525, upload-time = "2026-09-15T05:43:38.307Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/6c/b2/489ce2ab84e7d365c2a32ca37598766a78f998865a9c267d588e638217d7/vmware_policy-1.16.0.tar.gz", hash = "sha256:cbb9f387f5fa6aba749f5c9abfdf8678ad9deed1f8272bbf39a0000f6e54a9d5", size = 194662, upload-time = "2026-09-15T08:49:31.863Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/37/26/088f02325e51109cfe8e433d861c28f75f22ce26bb375944d365c46f85c4/vmware_policy-1.15.0-py3-none-any.whl", hash = "sha256:2f5a7b0e57fc084ea9083e67fb6e3c27059e6bd9c75b3eabfed58d6ee4366db4", size = 69524, upload-time = "2026-09-15T05:43:36.606Z" },
+    { url = "https://files.pythonhosted.org/packages/29/50/fa251d9560db49d606f53ea84e05db69db3237d68fdcf3bf68d2ce9dcf97/vmware_policy-1.16.0-py3-none-any.whl", hash = "sha256:0a35621fece1aeaea70157f0d360c7ac0ecd582bd2aaba38c69f32e4eeab415f", size = 73037, upload-time = "2026-09-15T08:49:30.252Z" },
 ]

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/vmware_debug/__init__.py

@@ -6,4 +6,4 @@ remediation to vmware-aiops / vmware-pilot. Never writes to any VMware system
 and never executes fixes; its only writes go to the local case ledger.
 """
 
-__version__ = "1.12.1"
+__version__ = "1.12.2"

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/vmware_debug/cli.py

@@ -20,7 +20,7 @@ from rich.table import Table
 
 from vmware_debug import __version__
 from vmware_debug.mcp.tools import incident_timeline, list_symptom_categories
-from vmware_policy import cli_local
+from vmware_policy import audited, cli_local
 
 
 def _harden_console_encoding() -> None:
@@ -61,7 +61,7 @@ def version() -> None:
 
 
 @app.command()
-@cli_local("prints the built-in symptom catalogue; contacts nothing")
+@audited(tool="list_symptom_categories")
 def categories() -> None:
     """List the symptom categories debug recognises and what to check for each."""
     table = Table(title="vmware-debug symptom categories")
@@ -74,7 +74,7 @@ def categories() -> None:
 
 
 @app.command()
-@cli_local("correlates events read from a file or stdin; contacts nothing")
+@audited(tool="incident_timeline")
 def triage(
     events_file: Optional[Path] = typer.Option(
         None, "--events", "-e", help="JSON file of event envelopes; reads stdin if omitted."

{vmware_debug-1.12.1 → vmware_debug-1.12.2}/vmware_debug/mcp_server/server.py

@@ -4,10 +4,22 @@ Tool logic lives in vmware_debug.mcp.tools (the case tools' bodies in
 ops/cases/api.py). This module wires them into a FastMCP server and provides
 the stdio entry point.
 
-No tool here goes through vmware_policy's audit decorator, and that is
-deliberate: nothing in this skill acts on a VMware target, so there is no
-operation for the family audit DB (~/.vmware/audit.db) to record. The case
-tools' writes land in the investigation ledger, which is its own record.
+Every tool here goes through vmware_policy's ``@vmware_tool``, so each call —
+a failed one included — writes one row to ~/.vmware/audit.db (HLD §8.1, I-10,
+amended 2026-09-15b). Until then none did: this module said no audit was needed
+because nothing here acts on a VMware target, and the case ledger was offered
+as the record. The ledger records the investigation, not the calls — a live
+session submitted evidence with invented fetch times and nothing could show
+when the calls had really been made or which had failed. Large data the caller
+hands over (``payload``, ``events``) is kept out of the row via
+``sensitive_params``; it lives in the ledger or with the caller. The two tools
+whose *result* quotes that event text — ``incident_timeline`` and
+``case_timeline`` (``hypotheses[].sample_text``, ``unmatched_samples``,
+``rejected``) — declare ``sensitive_result``, so their row keeps the call, the
+arguments and the status but not the result body: event text fetched from
+vCenter or a log can carry anything, credentials included (review D3,
+2026-09-15). The other tools return ids, counts, grades and text the caller
+wrote as an argument, which the row already holds.
 
 Note: signatures here use typing.Optional, never PEP 604 ``X | None`` — FastMCP
 reflects these at registration and ``X | None`` crashes on Python 3.10 + older
@@ -19,7 +31,7 @@ import sys
 from typing import Optional, Union
 
 from mcp.server.fastmcp import FastMCP
-from vmware_policy import describe_tool_parameters, sanitize
+from vmware_policy import describe_tool_parameters, sanitize, vmware_tool
 
 from vmware_debug.mcp import tools as t
 from vmware_debug import __version__
@@ -201,7 +213,8 @@ def build_server() -> FastMCP:
     # bin_seconds and z_threshold are exactly the two knobs a wrong guess makes
     # silently useless.
     @server.tool(name="incident_timeline", annotations=_READ)
-    def _incident_timeline_impl(
+    @vmware_tool(risk_level="low", sensitive_params=["events"], sensitive_result=True)
+    def incident_timeline(
         events: list[dict],
         bin_seconds: Optional[float] = None,
         z_threshold: float = 2.0,
@@ -262,7 +275,8 @@ def build_server() -> FastMCP:
             }
 
     @server.tool(name="list_symptom_categories", annotations=_READ)
-    def _list_symptom_categories_impl() -> dict:
+    @vmware_tool(risk_level="low")
+    def list_symptom_categories() -> dict:
         """[READ] List the symptom categories vmware-debug recognises, each with
         example keywords and a suggested next check (which skill/tool to run).
         Takes no parameters. Use this when you don't yet know what to look
@@ -287,7 +301,8 @@ def build_server() -> FastMCP:
         return {"error": _safe_error(exc, tool), "hint": _CASE_ERROR_HINT}
 
     @server.tool(name="case_open", annotations=_WRITE_LOCAL)
-    def _case_open_impl(
+    @vmware_tool(risk_level="low")
+    def case_open(
         summary: str,
         determined_by: str,
         objects: Optional[list[str]] = None,
@@ -339,7 +354,8 @@ def build_server() -> FastMCP:
             return _case_error(exc, "case_open")
 
     @server.tool(name="case_list", annotations=_READ)
-    def _case_list_impl(limit: int = 50) -> dict:
+    @vmware_tool(risk_level="low")
+    def case_list(limit: int = 50) -> dict:
         """[READ] List investigation cases, newest first.
 
         WHEN: to find the id of a case you or someone else opened earlier.
@@ -359,7 +375,8 @@ def build_server() -> FastMCP:
             return _case_error(exc, "case_list")
 
     @server.tool(name="case_get", annotations=_READ)
-    def _case_get_impl(case_id: str) -> dict:
+    @vmware_tool(risk_level="low")
+    def case_get(case_id: str) -> dict:
         """[READ] One case: its scope, its ledger sizes, and its grade history.
 
         WHEN: to pick up an investigation, or to see why a case sits at the
@@ -392,7 +409,8 @@ def build_server() -> FastMCP:
     # what a model fills with invention. Trim the prose here and the cost stays
     # while the explanation goes.
     @server.tool(name="case_submit_evidence", annotations=_WRITE_LOCAL)
-    def _case_submit_evidence_impl(
+    @vmware_tool(risk_level="low", sensitive_params=["payload"])
+    def case_submit_evidence(
         case_id: str,
         source_skill: str,
         source_tool: str,
@@ -485,7 +503,8 @@ def build_server() -> FastMCP:
             return _case_error(exc, "case_submit_evidence")
 
     @server.tool(name="case_record_gap", annotations=_WRITE_LOCAL)
-    def _case_record_gap_impl(
+    @vmware_tool(risk_level="low")
+    def case_record_gap(
         case_id: str,
         what: str,
         why: str,
@@ -535,7 +554,8 @@ def build_server() -> FastMCP:
             return _case_error(exc, "case_record_gap")
 
     @server.tool(name="case_grade", annotations=_WRITE_LOCAL)
-    def _case_grade_impl(case_id: str) -> dict:
+    @vmware_tool(risk_level="low")
+    def case_grade(case_id: str) -> dict:
         """[WRITE] Compute and record the conclusion grade — steps 07/08.
 
         WHEN: when you think the investigation has reached a conclusion, or to
@@ -574,7 +594,8 @@ def build_server() -> FastMCP:
             return _case_error(exc, "case_grade")
 
     @server.tool(name="case_readiness", annotations=_READ)
-    def _case_readiness_impl(available_skills: Optional[list[str]] = None) -> dict:
+    @vmware_tool(risk_level="low")
+    def case_readiness(available_skills: Optional[list[str]] = None) -> dict:
         """[READ] What strength of conclusion can this environment reach?
 
         WHEN: before starting an investigation, or when a case will not go
@@ -614,7 +635,8 @@ def build_server() -> FastMCP:
             return _case_error(exc, "case_readiness")
 
     @server.tool(name="case_plan", annotations=_READ)
-    def _case_plan_impl(
+    @vmware_tool(risk_level="low")
+    def case_plan(
         case_id: str,
         category: Optional[str] = None,
         available_skills: Optional[list[str]] = None,
@@ -675,7 +697,8 @@ def build_server() -> FastMCP:
             return _case_error(exc, "case_plan")
 
     @server.tool(name="case_hypotheses", annotations=_WRITE_LOCAL)
-    def _case_hypotheses_impl(case_id: str, statement: Optional[str] = None) -> dict:
+    @vmware_tool(risk_level="low")
+    def case_hypotheses(case_id: str, statement: Optional[str] = None) -> dict:
         """[WRITE] Register a candidate explanation, or read the ledger — step 06.
 
         WHEN: as soon as you have a theory worth testing, and again to see where
@@ -712,7 +735,8 @@ def build_server() -> FastMCP:
             return _case_error(exc, "case_hypotheses")
 
     @server.tool(name="case_timeline", annotations=_WRITE_LOCAL)
-    def _case_timeline_impl(
+    @vmware_tool(risk_level="low", sensitive_result=True)
+    def case_timeline(
         case_id: str,
         bin_seconds: Optional[float] = None,
         z_threshold: float = 2.0,
@@ -762,7 +786,8 @@ def build_server() -> FastMCP:
             return _case_error(exc, "case_timeline")
 
     @server.tool(name="case_close", annotations=_WRITE_LOCAL)
-    def _case_close_impl(case_id: str) -> dict:
+    @vmware_tool(risk_level="low")
+    def case_close(case_id: str) -> dict:
         """[WRITE] Record the final grade and archive the case — step 08.
 
         WHEN: when the investigation is finished, or is being handed over.
@@ -788,7 +813,8 @@ def build_server() -> FastMCP:
             return _case_error(exc, "case_close")
 
     @server.tool(name="case_knowledge", annotations=_READ)
-    def _case_knowledge_impl(case_id: Optional[str] = None) -> dict:
+    @vmware_tool(risk_level="low")
+    def case_knowledge(case_id: Optional[str] = None) -> dict:
         """[READ] What the knowledge layer accepts, and what is mounted.
 
         WHEN: when someone asks what can be added to make conclusions stronger,