vmware-debug 1.13.1__tar.gz → 1.13.2__tar.gz

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-debug",
   "displayName": "VMware Debug",
-  "version": "1.13.1",
+  "version": "1.13.2",
   "description": "VMware incident timeline, root-cause routing, local case ledger; no vSphere access. 14 MCP tools.",
   "author": {
     "name": "Wei Zhou",

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-debug==1.13.1",
+        "vmware-debug==1.13.2",
         "vmware-debug-mcp"
       ]
     }

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-debug
-Version: 1.13.1
+Version: 1.13.2
 Summary: VMware diagnostic brain — offline incident triage, log/event correlation, and root-cause routing across the VMware skill family
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-Debug
 Project-URL: Repository, https://github.com/vmware-skills/VMware-Debug

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/RELEASE_NOTES.md

@@ -1,3 +1,14 @@
+## v1.13.2 — auth diagnosis never reads or records a secret
+
+Docs only; no code change.
+
+* **The auth routing said to check "config/.env"** without limiting that to whether a credential is set, and nothing
+  told the agent to keep secret values out of case evidence, which is stored as submitted and kept until deleted.
+  The auth route now uses the owning skill's `doctor` (it reports whether a credential is set and whether login
+  works, never the value). SKILL.md and the small-model guardrails now forbid putting a password, token or `.env`
+  contents into any evidence field, and forbid opening `.env` files to diagnose. Raised by ClawHub's review of
+  1.13.1.
+
 ## v1.13.1 — a hypothesis is ruled out only by sources against it
 
 Corrections to 1.13.0, from a second independent review on 2026-09-15. Each case below was reproduced on 1.13.0

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/openclaw.plugin.json

@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-debug==1.13.1",
+        "vmware-debug==1.13.2",
         "vmware-debug-mcp"
       ]
     }

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zw008/vmware-debug",
-  "version": "1.13.1",
+  "version": "1.13.2",
   "description": "VMware incident timeline, root-cause routing, local case ledger; no vSphere access. 14 MCP tools.",
   "private": true,
   "license": "MIT",

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-debug"
-version = "1.13.1"
+version = "1.13.2"
 description = "VMware diagnostic brain — offline incident triage, log/event correlation, and root-cause routing across the VMware skill family"
 readme = "README.md"
 license = "MIT"

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/vmware-skills/VMware-Debug",
     "source": "github"
   },
-  "version": "1.13.1",
+  "version": "1.13.2",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-debug",
-      "version": "1.13.1",
+      "version": "1.13.2",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/skills/vmware-debug/SKILL.md

@@ -51,7 +51,7 @@ write tools touch only the local case ledger.
 ## Quick Install
 
 ```bash
-uv tool install vmware-debug==1.13.1
+uv tool install vmware-debug==1.13.2
 vmware-debug categories          # see what it can diagnose
 ```
 
@@ -77,7 +77,7 @@ a recommended plan.
 | CPU / memory contention | vmware-aria (metrics/anomalies) | rightsizing via pilot |
 | HA / DRS / cluster | vmware-monitor, vmware-aiops | cluster remediation via pilot |
 | Power / clone / snapshot | vmware-aiops, vmware-monitor | task status, then fix via aiops |
-| Auth / cert / login | check creds & cert; (security) | fix config/.env |
+| Auth / cert / login | owning skill's `doctor`, cert, time sync | user fixes config |
 
 ## Common Workflows
 
@@ -256,6 +256,11 @@ fetches with the other skills' read tools and submits the results here. Its only
 writes are to the local case ledger. Running with local or small models? See
 [`references/agent-guardrails.md`](references/agent-guardrails.md).
 
+**Never put a secret into a case.** For an auth symptom, record *that* a credential is
+missing, expired or rejected (the owning skill's `doctor` says which) — never a password,
+token, or the contents of a `.env` file, in any evidence `summary`, `query` or `payload`.
+Do not open `.env` files to diagnose; case folders are kept until you delete them.
+
 ## CLI Quick Reference
 
 ```bash

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/skills/vmware-debug/references/agent-guardrails.md

@@ -99,6 +99,10 @@ your agent's instruction block.
 - Report the timeline in the order the tool returned it.
 - If a requested field was not returned, show it as "not available".
 - When a response is long, report every item it contains.
+- Never record a secret. For an auth problem, record that a credential is
+  missing, expired or rejected (the owning skill's `doctor` reports which) —
+  never a password, token, or `.env` contents, in any evidence field. Do not
+  open `.env` files to diagnose.
 
 ## Analysis discipline
 

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/skills/vmware-debug/references/routing.md

@@ -12,7 +12,7 @@ Keep this in sync with `_CATEGORY_SIGNATURES` in `vmware_debug/ops/timeline.py`
 | **ha_drs** | ha, high availability, drs, failover, admission control, isolation | vmware-monitor, vmware-aiops (cluster) | pilot |
 | **host_lifecycle** | maintenance mode, shut down of, host reboot, standby mode, lost connection to, cannot synchronize, not responding | vmware-monitor (host/cluster state), vmware-harden (drift — a host that left service on cue was told to), vmware-log-insight (vpxd/hostd) | pilot |
 | **power_lifecycle** | power on/off, failed to start, boot, vmx, ovf, clone, snapshot | vmware-aiops (snapshot tree), vmware-monitor | aiops |
-| **auth** | login, authentication, denied, 401, 403, token, certificate, tls, password | config/.env, target cert + time sync | config fix |
+| **auth** | login, authentication, denied, 401, 403, token, certificate, tls, password | the owning skill's `doctor` (reports whether a credential is set and whether login works — never its value), target cert + time sync | config fix (by the user) |
 | **platform** | vpxd, hostd, service restart, crash, 503, not responding, disconnected | vmware-monitor (connection/service), vmware-log-insight (vpxd/hostd) | pilot |
 | **hardware** | tpm, attestation, ipmi, sensor, bmc | vmware-monitor (host sensors and the CIM Server that supplies them, host logs for ipmi/cim), the server's BMC | site / vendor |
 | **licensing** | license | vmware-monitor (license_status — which asset holds which key); an Aria alert on "Unlicensed Group" is Aria's own license | license portal |

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/skills/vmware-debug/references/setup-guide.md

@@ -6,7 +6,7 @@ is a pure, offline correlation engine. There is no `config.yaml` and no `.env`.
 ## Install
 
 ```bash
-uv tool install vmware-debug==1.13.1
+uv tool install vmware-debug==1.13.2
 vmware-debug categories      # verify it runs
 ```
 
@@ -15,7 +15,7 @@ vmware-debug categories      # verify it runs
 ```json
 {
   "command": "uvx",
-  "args": ["--from", "vmware-debug==1.13.1", "vmware-debug-mcp"]
+  "args": ["--from", "vmware-debug==1.13.2", "vmware-debug-mcp"]
 }
 ```
 

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/tests/eval/capability/_scoring.py

@@ -31,7 +31,7 @@ from __future__ import annotations
 
 import json
 import re
-from dataclasses import dataclass, field, replace
+from dataclasses import dataclass, field
 from pathlib import Path
 from typing import Any
 

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/tests/eval/regression/test_capability_grader.py

@@ -306,7 +306,7 @@ def test_credits_a_named_env_var():
 
 import ast  # noqa: E402 — grouped with the tests that use it
 
-from ..capability.test_error_actionability import _messages_in_tree
+from ..capability.test_error_actionability import _messages_in_tree  # noqa: E402
 
 
 def _messages(src: str):
@@ -344,7 +344,7 @@ def test_folds_in_the_strings_a_hint_helper_can_return():
 # on fabricated messages because a repo with nothing over budget would pass this
 # check without exercising a line of it.
 
-from ..capability.test_error_actionability import _truncation_findings
+from ..capability.test_error_actionability import _truncation_findings  # noqa: E402
 
 _TAUGHT = {"names_input": True, "states_remedy": True, "names_artifact": True}
 _BARE = {"names_input": True, "states_remedy": False, "names_artifact": False}

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/uv.lock

@@ -690,14 +690,14 @@ wheels = [
 
 [[package]]
 name = "pyjwt"
-version = "2.13.0"
+version = "2.15.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "typing-extensions", marker = "python_full_version < '3.11'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/3b/81/58d0ac84e1ef3a3843791d6954d94c0b33d526c75eeb1efbce9d0a4c4077/pyjwt-2.13.0.tar.gz", hash = "sha256:41571c89ca91598c79e8ef18a2d07367d4810fbbd6f637794879baf1b7703423", size = 107515, upload-time = "2026-05-21T19:54:36.618Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/02/a5/5197bfd06417837ac079921c66fa6393f1dea3557272a263cebfef69e432/pyjwt-2.15.0.tar.gz", hash = "sha256:b11c5f9791d7bf51c2b39a81ed669f6b2dbbd669df2942f6c60167e9e3d1abe4", size = 120513, upload-time = "2026-09-23T16:56:00.689Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/a3/5e/ecf12fdb62546d64385c158514e9b2b671f7832108ef2ecd2020ce0af2d1/pyjwt-2.13.0-py3-none-any.whl", hash = "sha256:66adcc2aff09b3f1bbd95fc1e1577df8ac8723c978552fd43304c8a290ac5728", size = 31274, upload-time = "2026-05-21T19:54:35.362Z" },
+    { url = "https://files.pythonhosted.org/packages/e8/55/40e45bf052ee8ee12a4dfd785519660f8effa7b065442b91646ec6828619/pyjwt-2.15.0-py3-none-any.whl", hash = "sha256:7a3742debf6b879e912dbb9819ceec1594be812452b78c5f2e2dfc56564954f8", size = 33680, upload-time = "2026-09-23T16:55:59.241Z" },
 ]
 
 [package.optional-dependencies]
@@ -1293,7 +1293,7 @@ wheels = [
 
 [[package]]
 name = "vmware-debug"
-version = "1.13.1"
+version = "1.13.2"
 source = { editable = "." }
 dependencies = [
     { name = "mcp", extra = ["cli"] },
@@ -1328,14 +1328,14 @@ dev = [
 
 [[package]]
 name = "vmware-policy"
-version = "1.16.0"
+version = "1.17.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "pyyaml" },
     { name = "rich" },
     { name = "typer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/6c/b2/489ce2ab84e7d365c2a32ca37598766a78f998865a9c267d588e638217d7/vmware_policy-1.16.0.tar.gz", hash = "sha256:cbb9f387f5fa6aba749f5c9abfdf8678ad9deed1f8272bbf39a0000f6e54a9d5", size = 194662, upload-time = "2026-09-15T08:49:31.863Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/e9/e9/65fae3001a16eaf33cca1651e7e12517f7cb04f3d4a6d2525c6e8b6b15a8/vmware_policy-1.17.0.tar.gz", hash = "sha256:7e40134d5451bde302a5e7a4012ad4a26609f097b566b3f0b6e39faaebe6bbea", size = 197691, upload-time = "2026-09-19T01:48:51.283Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/29/50/fa251d9560db49d606f53ea84e05db69db3237d68fdcf3bf68d2ce9dcf97/vmware_policy-1.16.0-py3-none-any.whl", hash = "sha256:0a35621fece1aeaea70157f0d360c7ac0ecd582bd2aaba38c69f32e4eeab415f", size = 73037, upload-time = "2026-09-15T08:49:30.252Z" },
+    { url = "https://files.pythonhosted.org/packages/ef/d5/4b1c4e32ad71278185bc449f0145b0cb1b3f208c25026ea0b49384a654e0/vmware_policy-1.17.0-py3-none-any.whl", hash = "sha256:f7961ec4c2a4ccdacc956bd4043e53ce63e8d604ca186bfaaeaacb4a77e600c6", size = 73732, upload-time = "2026-09-19T01:48:49.466Z" },
 ]

{vmware_debug-1.13.1 → vmware_debug-1.13.2}/vmware_debug/__init__.py

@@ -6,4 +6,4 @@ remediation to vmware-aiops / vmware-pilot. Never writes to any VMware system
 and never executes fixes; its only writes go to the local case ledger.
 """
 
-__version__ = "1.13.1"
+__version__ = "1.13.2"