vmware-debug 1.13.0__tar.gz → 1.13.2__tar.gz

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-debug",
   "displayName": "VMware Debug",
-  "version": "1.13.0",
+  "version": "1.13.2",
   "description": "VMware incident timeline, root-cause routing, local case ledger; no vSphere access. 14 MCP tools.",
   "author": {
     "name": "Wei Zhou",

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-debug==1.13.0",
+        "vmware-debug==1.13.2",
         "vmware-debug-mcp"
       ]
     }

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-debug
-Version: 1.13.0
+Version: 1.13.2
 Summary: VMware diagnostic brain — offline incident triage, log/event correlation, and root-cause routing across the VMware skill family
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-Debug
 Project-URL: Repository, https://github.com/vmware-skills/VMware-Debug

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/RELEASE_NOTES.md

@@ -1,3 +1,47 @@
+## v1.13.2 — auth diagnosis never reads or records a secret
+
+Docs only; no code change.
+
+* **The auth routing said to check "config/.env"** without limiting that to whether a credential is set, and nothing
+  told the agent to keep secret values out of case evidence, which is stored as submitted and kept until deleted.
+  The auth route now uses the owning skill's `doctor` (it reports whether a credential is set and whether login
+  works, never the value). SKILL.md and the small-model guardrails now forbid putting a password, token or `.env`
+  contents into any evidence field, and forbid opening `.env` files to diagnose. Raised by ClawHub's review of
+  1.13.1.
+
+## v1.13.1 — a hypothesis is ruled out only by sources against it
+
+Corrections to 1.13.0, from a second independent review on 2026-09-15. Each case below was reproduced on 1.13.0
+and is now a test.
+
+* **Exclusion counts sources per hypothesis.** 1.13.0 counted the two independent sources an exclusion needs
+  across the whole case. One observation against H2 plus any unrelated evidence ruled H2 out, retired the gap that
+  blocked H2, and promoted the case from Candidate to Probable; H1 falsified by Aria and H2 by Monitor excluded
+  both. A hypothesis is now ruled out only when two independent skills falsify *that* hypothesis.
+* **No registered hypotheses never grades Excluded.** With a missing ledger, or a case older than the ledger,
+  "every hypothesis is ruled out" was true of an empty list, and the case was graded Excluded.
+* **A contradicted hypothesis holds the case at Candidate.** Evidence against an open hypothesis that is not yet
+  enough to rule it out now holds the case where a gap that could overturn it would. Without this, the stricter
+  count above made a lone falsifier count for nothing, and a case kept Probable, or Confirmed, with an observation
+  against a hypothesis still unanswered (third review, same day).
+* **A corrupt `hypotheses.md` is a reason, not a crash.** 1.13.0 handled a missing file but let a hand-edited
+  broken entry raise out of `case_grade`, including entries that are valid JSON but not a hypothesis (`[]`,
+  `null`, `{}`).
+* **Falsifying evidence never counts as support.** 1.13.0 took it out of the count only when an exclusion
+  succeeded, so under a site rule needing three sources two falsifiers of H2 graded the case Probable.
+* `case_hypotheses` loads the grading rules before registering a hypothesis, so a broken site
+  `grading_rules.yaml` fails the call without writing; a retry no longer registers it twice.
+* **Behaviour change:** `case_hypotheses` marks a hypothesis `refuted` by the same rule as `case_grade`. With one
+  falsifying source it stays `open` or `blocked`; `refuted_by` still lists the item, and the first next step says
+  how many more sources are needed. `case_grade` reasons name each contradicted hypothesis with its evidence and
+  source count. A site that sets `excluded.requires_falsifying_evidence: false` never excludes, so under that
+  setting a contradicted hypothesis holds its case at Candidate for as long as the contradiction stands — the
+  grade reason says so instead of promising a rule-out that cannot happen.
+
+Re-running the lab investigation of the same Aria alert on this code: the first observation against H2 held the
+case at Candidate ("H2 is contradicted by E007 from 1 independent source(s)"), a second skill ruled H2 out, H3
+went the same way, and the case ended **Probable** on H1, held below Confirmed by three open gaps.
+
 ## v1.13.0 — exclusion is per hypothesis
 
 Found in a real investigation of an Aria "vCenter app health is affected" alert on 2026-09-15, then corrected

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/openclaw.plugin.json

@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-debug==1.13.0",
+        "vmware-debug==1.13.2",
         "vmware-debug-mcp"
       ]
     }

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zw008/vmware-debug",
-  "version": "1.13.0",
+  "version": "1.13.2",
   "description": "VMware incident timeline, root-cause routing, local case ledger; no vSphere access. 14 MCP tools.",
   "private": true,
   "license": "MIT",

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-debug"
-version = "1.13.0"
+version = "1.13.2"
 description = "VMware diagnostic brain — offline incident triage, log/event correlation, and root-cause routing across the VMware skill family"
 readme = "README.md"
 license = "MIT"

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/vmware-skills/VMware-Debug",
     "source": "github"
   },
-  "version": "1.13.0",
+  "version": "1.13.2",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-debug",
-      "version": "1.13.0",
+      "version": "1.13.2",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/skills/vmware-debug/SKILL.md

@@ -51,7 +51,7 @@ write tools touch only the local case ledger.
 ## Quick Install
 
 ```bash
-uv tool install vmware-debug==1.13.0
+uv tool install vmware-debug==1.13.2
 vmware-debug categories          # see what it can diagnose
 ```
 
@@ -77,7 +77,7 @@ a recommended plan.
 | CPU / memory contention | vmware-aria (metrics/anomalies) | rightsizing via pilot |
 | HA / DRS / cluster | vmware-monitor, vmware-aiops | cluster remediation via pilot |
 | Power / clone / snapshot | vmware-aiops, vmware-monitor | task status, then fix via aiops |
-| Auth / cert / login | check creds & cert; (security) | fix config/.env |
+| Auth / cert / login | owning skill's `doctor`, cert, time sync | user fixes config |
 
 ## Common Workflows
 
@@ -175,10 +175,12 @@ ledger — submit the missing evidence, or record the gap that is blocking it.
 - **Confirmed** — that, plus a decisive item: a direct hardware diagnostic, a
   version-checked knowledge-base entry, or a vendor SR; and no gap left open
 - **Excluded** — an observation that actually rules it out. "We looked and found
-  nothing" is a gap, not an exclusion. Exclusion is per hypothesis: the case is
-  Excluded only when every registered hypothesis is ruled out. Otherwise
-  `case_grade` grades what remains, counting only evidence that rules nothing
-  out, and lists each hypothesis as `open` or `excluded` in `hypotheses`
+  nothing" is a gap, not an exclusion. Exclusion is per hypothesis: two
+  independent sources must falsify *that* hypothesis, and the case is Excluded
+  only when every registered hypothesis is ruled out. A hypothesis contradicted
+  by too few sources holds the case at Candidate. Otherwise `case_grade`
+  grades what remains, counting only evidence that falsifies nothing, and lists
+  each hypothesis as `open` or `excluded` in `hypotheses`
 
 `case_plan` is not a checklist: submit evidence and the next plan is shorter,
 lose a source and it routes around it. Its `unavailable` half is the important
@@ -254,6 +256,11 @@ fetches with the other skills' read tools and submits the results here. Its only
 writes are to the local case ledger. Running with local or small models? See
 [`references/agent-guardrails.md`](references/agent-guardrails.md).
 
+**Never put a secret into a case.** For an auth symptom, record *that* a credential is
+missing, expired or rejected (the owning skill's `doctor` says which) — never a password,
+token, or the contents of a `.env` file, in any evidence `summary`, `query` or `payload`.
+Do not open `.env` files to diagnose; case folders are kept until you delete them.
+
 ## CLI Quick Reference
 
 ```bash

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/skills/vmware-debug/references/agent-guardrails.md

@@ -99,6 +99,10 @@ your agent's instruction block.
 - Report the timeline in the order the tool returned it.
 - If a requested field was not returned, show it as "not available".
 - When a response is long, report every item it contains.
+- Never record a secret. For an auth problem, record that a credential is
+  missing, expired or rejected (the owning skill's `doctor` reports which) —
+  never a password, token, or `.env` contents, in any evidence field. Do not
+  open `.env` files to diagnose.
 
 ## Analysis discipline
 

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/skills/vmware-debug/references/routing.md

@@ -12,7 +12,7 @@ Keep this in sync with `_CATEGORY_SIGNATURES` in `vmware_debug/ops/timeline.py`
 | **ha_drs** | ha, high availability, drs, failover, admission control, isolation | vmware-monitor, vmware-aiops (cluster) | pilot |
 | **host_lifecycle** | maintenance mode, shut down of, host reboot, standby mode, lost connection to, cannot synchronize, not responding | vmware-monitor (host/cluster state), vmware-harden (drift — a host that left service on cue was told to), vmware-log-insight (vpxd/hostd) | pilot |
 | **power_lifecycle** | power on/off, failed to start, boot, vmx, ovf, clone, snapshot | vmware-aiops (snapshot tree), vmware-monitor | aiops |
-| **auth** | login, authentication, denied, 401, 403, token, certificate, tls, password | config/.env, target cert + time sync | config fix |
+| **auth** | login, authentication, denied, 401, 403, token, certificate, tls, password | the owning skill's `doctor` (reports whether a credential is set and whether login works — never its value), target cert + time sync | config fix (by the user) |
 | **platform** | vpxd, hostd, service restart, crash, 503, not responding, disconnected | vmware-monitor (connection/service), vmware-log-insight (vpxd/hostd) | pilot |
 | **hardware** | tpm, attestation, ipmi, sensor, bmc | vmware-monitor (host sensors and the CIM Server that supplies them, host logs for ipmi/cim), the server's BMC | site / vendor |
 | **licensing** | license | vmware-monitor (license_status — which asset holds which key); an Aria alert on "Unlicensed Group" is Aria's own license | license portal |

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/skills/vmware-debug/references/setup-guide.md

@@ -6,7 +6,7 @@ is a pure, offline correlation engine. There is no `config.yaml` and no `.env`.
 ## Install
 
 ```bash
-uv tool install vmware-debug==1.13.0
+uv tool install vmware-debug==1.13.2
 vmware-debug categories      # verify it runs
 ```
 
@@ -15,7 +15,7 @@ vmware-debug categories      # verify it runs
 ```json
 {
   "command": "uvx",
-  "args": ["--from", "vmware-debug==1.13.0", "vmware-debug-mcp"]
+  "args": ["--from", "vmware-debug==1.13.2", "vmware-debug-mcp"]
 }
 ```
 

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/tests/eval/capability/_scores.json

@@ -62,7 +62,7 @@
               "names_artifact",
               "states_remedy"
             ],
-            "where": "conclusion.py:81"
+            "where": "conclusion.py:91"
           },
           {
             "message": "Evidence field {} is required and cannot be blank. {}",
@@ -70,7 +70,7 @@
               "names_artifact",
               "states_remedy"
             ],
-            "where": "evidence.py:41"
+            "where": "evidence.py:48"
           },
           {
             "message": "Cannot read gaps.json for case {}: {}.",
@@ -78,7 +78,7 @@
               "names_artifact",
               "states_remedy"
             ],
-            "where": "evidence.py:289"
+            "where": "evidence.py:308"
           },
           {
             "message": "gaps.json in case {} is not valid JSON: {}. It was hand-edited. Restore it rather than deleting it \u2014",
@@ -86,7 +86,7 @@
               "names_artifact",
               "states_remedy"
             ],
-            "where": "evidence.py:291"
+            "where": "evidence.py:310"
           },
           {
             "message": "Cannot read grading_rules.yaml at {}: {}",
@@ -94,7 +94,7 @@
               "names_artifact",
               "states_remedy"
             ],
-            "where": "grading.py:57"
+            "where": "grading.py:133"
           },
           {
             "message": "grading_rules.yaml at {} is not valid YAML: {}. Fix it rather than deleting it \u2014 falling back to the",
@@ -102,7 +102,7 @@
               "names_artifact",
               "states_remedy"
             ],
-            "where": "grading.py:59"
+            "where": "grading.py:135"
           },
           {
             "message": "A hypothesis needs a statement \u2014 what you think happened, in one line. An unnamed hypothesis cannot ",
@@ -111,7 +111,7 @@
               "names_input",
               "states_remedy"
             ],
-            "where": "hypotheses.py:88"
+            "where": "hypotheses.py:101"
           },
           {
             "message": "Cannot read hypotheses.md for case {}: {}",
@@ -119,7 +119,7 @@
               "names_artifact",
               "states_remedy"
             ],
-            "where": "hypotheses.py:60"
+            "where": "hypotheses.py:66"
           },
           {
             "message": "Scope field {} is required and cannot be blank. It is what step 01 of the evidence loop produces; a ",
@@ -159,7 +159,7 @@
               "names_artifact",
               "states_remedy"
             ],
-            "where": "store.py:81"
+            "where": "store.py:293"
           },
           {
             "message": "Case {} is already closed. Its record is not rewritten \u2014 reopen the question by opening a new case t",
@@ -167,7 +167,7 @@
               "names_artifact",
               "states_remedy"
             ],
-            "where": "timeline.py:137"
+            "where": "timeline.py:154"
           },
           {
             "message": "Cannot read case.json for {}: {}",
@@ -175,39 +175,39 @@
               "names_artifact",
               "states_remedy"
             ],
-            "where": "timeline.py:151"
+            "where": "timeline.py:168"
           }
         ],
         "per_dimension_pct": {
-          "names_artifact": 37.2,
-          "names_input": 95.3,
-          "states_remedy": 62.8
+          "names_artifact": 40.0,
+          "names_input": 95.6,
+          "states_remedy": 64.4
         },
-        "raise_sites": 43
+        "raise_sites": 45
       },
-      "maximum": 129,
-      "pct": 65.1,
+      "maximum": 135,
+      "pct": 66.7,
       "unit": "points",
-      "value": 84
+      "value": 90
     },
     "manifest_context_headroom": {
       "detail": {
         "heaviest_tools": {
           "case_open": 521,
-          "case_plan": 499,
+          "case_plan": 502,
           "case_record_gap": 410,
           "case_submit_evidence": 971,
           "incident_timeline": 521
         },
-        "manifest_tokens": 5160,
-        "mean_tokens_per_tool": 368.6,
+        "manifest_tokens": 5215,
+        "mean_tokens_per_tool": 372.5,
         "reference_context": 16384,
         "tool_count": 14
       },
       "maximum": 16384,
-      "pct": 68.5,
+      "pct": 68.2,
       "unit": "tokens",
-      "value": 11224
+      "value": 11169
     },
     "parameter_documentation_coverage": {
       "detail": {
@@ -248,7 +248,7 @@
         "ceiling": 350,
         "over_ceiling": {
           "case_open": 521,
-          "case_plan": 499,
+          "case_plan": 502,
           "case_record_gap": 410,
           "case_submit_evidence": 971,
           "case_timeline": 393,
@@ -290,27 +290,27 @@
         "remedy_after_interpolation": [
           "envelope.py:126",
           "envelope.py:138",
-          "conclusion.py:135",
-          "conclusion.py:144",
-          "evidence.py:179",
-          "evidence.py:211",
-          "evidence.py:248",
-          "grading.py:67",
-          "hypotheses.py:47",
-          "hypotheses.py:70"
+          "conclusion.py:145",
+          "conclusion.py:154",
+          "evidence.py:186",
+          "evidence.py:229",
+          "evidence.py:264",
+          "grading.py:143",
+          "hypotheses.py:53",
+          "hypotheses.py:76"
         ]
       },
-      "maximum": 28,
+      "maximum": 30,
       "pct": 100.0,
       "unit": "messages",
-      "value": 28
+      "value": 30
     },
     "teaching_error_rate": {
       "detail": {},
-      "maximum": 43,
-      "pct": 34.9,
+      "maximum": 45,
+      "pct": 37.8,
       "unit": "messages",
-      "value": 15
+      "value": 17
     },
     "tool_description_quality": {
       "detail": {

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/tests/eval/capability/_scoring.py

@@ -31,7 +31,7 @@ from __future__ import annotations
 
 import json
 import re
-from dataclasses import dataclass, field, replace
+from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
 

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/tests/eval/regression/test_capability_grader.py

@@ -306,7 +306,7 @@ def test_credits_a_named_env_var():
 
 import ast  # noqa: E402 — grouped with the tests that use it
 
-from ..capability.test_error_actionability import _messages_in_tree
+from ..capability.test_error_actionability import _messages_in_tree  # noqa: E402
 
 
 def _messages(src: str):
@@ -344,7 +344,7 @@ def test_folds_in_the_strings_a_hint_helper_can_return():
 # on fabricated messages because a repo with nothing over budget would pass this
 # check without exercising a line of it.
 
-from ..capability.test_error_actionability import _truncation_findings
+from ..capability.test_error_actionability import _truncation_findings  # noqa: E402
 
 _TAUGHT = {"names_input": True, "states_remedy": True, "names_artifact": True}
 _BARE = {"names_input": True, "states_remedy": False, "names_artifact": False}

{vmware_debug-1.13.0 → vmware_debug-1.13.2}/tests/test_case_grading.py

@@ -194,13 +194,20 @@ class TestExclusionNeedsAFalsifyingObservation:
         record_gap(case, blocking_gap())
         assert grade_case(case).grade != "excluded"
 
-    def test_a_falsifying_observation_excludes(self, case):
+    def test_falsifying_observations_from_two_skills_exclude(self, case):
         record_evidence(case, evidence(skill="vmware-monitor", falsifies=("H1",)))
-        record_evidence(case, evidence(skill="vmware-log-insight"))
+        record_evidence(case, evidence(skill="vmware-log-insight", falsifies=("H1",)))
         r = grade_case(case)
         assert r.grade == "excluded"
         assert any("E001" in reason for reason in r.reasons)
 
+    def test_one_falsifier_and_an_unrelated_source_do_not_exclude(self, case):
+        """The two sources have to be against the hypothesis, not anywhere in the
+        case (independent review, 2026-09-15)."""
+        record_evidence(case, evidence(skill="vmware-monitor", falsifies=("H1",)))
+        record_evidence(case, evidence(skill="vmware-log-insight"))
+        assert grade_case(case).grade != "excluded"
+
 
 class TestDemotion:
     def test_a_new_gap_takes_confirmed_back_down_to_probable(self, case, mounted_kb):