vmware-debug 2.0.0__py3-none-any.whl → 2.2.0__py3-none-any.whl

vmware_debug/__init__.py

@@ -6,4 +6,4 @@ remediation to vmware-aiops / vmware-pilot. Never writes to any VMware system
 and never executes fixes; its only writes go to the local case ledger.
 """
 
-__version__ = "2.0.0"
+__version__ = "2.2.0"

vmware_debug/cli.py

@@ -104,11 +104,44 @@ def triage(
 
 @app.command()
 @cli_local("starts the MCP server; its tools audit themselves")
-def mcp() -> None:
-    """Start the stdio MCP server (no network access; proxy-safe)."""
+def mcp(
+    expose: Optional[str] = typer.Option(
+        None,
+        "--expose",
+        help="Which tools to offer: all (default) or read. Limits what clients see; "
+        "not authorization: the account's permissions still decide.",
+    ),
+    allow_write: Optional[str] = typer.Option(
+        None,
+        "--allow-write",
+        help="With --expose read: comma-separated write tools to offer as well.",
+    ),
+    transport: Optional[str] = typer.Option(
+        None,
+        "--transport",
+        help="stdio (default), https, or http (loopback only, behind a TLS reverse proxy). "
+        "https/http need a token: 'vmware-audit token create NAME'.",
+    ),
+    host: Optional[str] = typer.Option(None, "--host", help="Bind address (default 127.0.0.1)."),
+    port: Optional[int] = typer.Option(None, "--port", help="Port (default 8443)."),
+    cert: Optional[str] = typer.Option(None, "--cert", help="TLS certificate (PEM) for https."),
+    key: Optional[str] = typer.Option(None, "--key", help="TLS private key (PEM) for https."),
+    public_name: Optional[str] = typer.Option(
+        None,
+        "--public-name",
+        help="Host names clients use, comma-separated; other Host/Origin values are refused.",
+    ),
+    token_file: Optional[str] = typer.Option(
+        None, "--token-file", help="Token hash file (default $OPS_HOME/mcp-tokens)."
+    ),
+) -> None:
+    """Start the MCP server: stdio by default (proxy-safe), or --transport https."""
     from vmware_debug.mcp_server.server import main as _main
 
-    _main()
+    _main(
+        expose=expose, allow_write=allow_write, transport=transport, host=host, port=port,
+        cert=cert, key=key, public_name=public_name, token_file=token_file,
+    )
 
 
 if __name__ == "__main__":

vmware_debug/mcp_server/server.py

@@ -862,7 +862,17 @@ def build_server() -> FastMCP:
 
 
     return server
-def main() -> None:
+def main(
+    expose: Optional[str] = None,
+    allow_write: Optional[str] = None,
+    transport: Optional[str] = None,
+    host: Optional[str] = None,
+    port: Optional[int] = None,
+    cert: Optional[str] = None,
+    key: Optional[str] = None,
+    public_name: Optional[str] = None,
+    token_file: Optional[str] = None,
+) -> None:
     """Entry point for `vmware-debug-mcp` (stdio transport)."""
     # Floor is 3.10, matching `requires-python` and the other eleven skills.
     # This guard used to demand 3.11 on the grounds that FastMCP schema
@@ -878,7 +888,14 @@ def main() -> None:
             "Reinstall on a newer interpreter: "
             "uv tool install --python 3.12 --force vmware-debug"
         )
-    build_server().run()
+    from vmware_policy.serve import run_server
+    server = build_server()
+    run_server(
+        server,
+        skill="debug",
+        expose=expose, allow_write=allow_write, transport=transport, host=host, port=port,
+        cert=cert, key=key, public_name=public_name, token_file=token_file,
+    )
 
 
 if __name__ == "__main__":

{vmware_debug-2.0.0.dist-info → vmware_debug-2.2.0.dist-info}/METADATA

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-debug
-Version: 2.0.0
+Version: 2.2.0
 Summary: VMware diagnostic brain — offline incident triage, log/event correlation, and root-cause routing across the VMware skill family
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-Debug
 Project-URL: Repository, https://github.com/vmware-skills/VMware-Debug
@@ -14,11 +14,11 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
 Classifier: Topic :: System :: Monitoring
 Requires-Python: >=3.10
-Requires-Dist: mcp[cli]<2.0,>=1.10
+Requires-Dist: mcp[cli]<2.0,>=1.28
 Requires-Dist: pyyaml<7.0,>=6.0
 Requires-Dist: rich<15.0,>=13.0
 Requires-Dist: typer<1.0,>=0.12
-Requires-Dist: vmware-policy<2.0,>=1.18.1
+Requires-Dist: vmware-policy<2.0,>=1.21.0
 Description-Content-Type: text/markdown
 
 <!-- mcp-name: io.github.vmware-skills/vmware-debug -->
@@ -52,6 +52,23 @@ renames widened), and vmware-pilot ≥ 1.13 translates old names in saved workfl
 If an install older than 2.0 shares that `rules.yaml`, give it vmware-policy ≥ 1.18.2 too: it matches each rule
 against both the old and the new name, so one file serves both.
 
+## Companion Skills
+
+| Need | Skill |
+|---|---|
+| Incident correlation / root cause | **vmware-debug** (this project) |
+| Centralized log search | vmware-log-insight (feed its `search_logs` results here) |
+| vCenter events and alarms | vmware-monitor |
+| Metrics / anomalies | vmware-aria |
+| Executing a fix | vmware-aiops (single op) / vmware-pilot (multi-step, gated) |
+
+## Install
+
+```bash
+uv tool install vmware-debug
+vmware-debug categories          # see which symptom categories it can diagnose
+```
+
 ## MCP tools (14 — 7 read, 7 write)
 
 The seven writes go to the local case ledger only; none reaches a VMware system.
@@ -80,6 +97,26 @@ The seven writes go to the local case ledger only; none reaches a VMware system.
 | `grade_case` | [WRITE] Recompute the conclusion grade from the ledger and record it |
 | `close_case` | [WRITE] Record the final grade, archive, and name what was left open |
 
+**Event envelope**: `{ts, source, severity, entity, text, fields}`. The agent normalizes events from each source
+into this shape before handing them to debug, so debug has zero runtime dependency on the other packages.
+**Keep each event's `event_type` in `fields`** — the classifier matches it as well as the text, and most modern
+vSphere events are `EventEx`: the text is a generic boilerplate sentence, and only `eventTypeId` says what the
+event actually is.
+
+## Security
+
+Offline and credential-free by construction: it connects to no vCenter/NSX/Aria, has no destructive surface on
+VMware, and holds no secret to leak. The only writes are the local case ledger: evidence, gaps, hypotheses and
+grade history are append-only; `timeline.md` is regenerated from the evidence, and `case.json` holds the current
+grade and status. The same holds with several writers: every write to a case first takes that case's lock file
+(`.ledger.lock`, exclusive create), so two processes writing the same case in a shared `$OPS_HOME` are serialized
+instead of dropping each other's entries; every file is written under a temporary name and then moved into place,
+so a reader never sees a half-written file (on a file system without hard links, a new evidence file is instead
+created in place: still never overwritten, but it can be read half-written). A lock left behind by a crashed
+process is reported together with its holder and never deleted automatically; delete it by hand once you have
+confirmed no process is writing that case. Released versions 1.11.3 and earlier do not take this lock, so every
+machine sharing a case directory must upgrade. See [SECURITY.md](SECURITY.md).
+
 ## Offline / Air-Gapped Install (from source)
 
 This project uses the modern PEP 517 build system (hatchling), so there is **no

{vmware_debug-2.0.0.dist-info → vmware_debug-2.2.0.dist-info}/RECORD

@@ -1,10 +1,10 @@
-vmware_debug/__init__.py,sha256=HgXmztN-9zVLKmVLLP8tSY-KkzK36Q6VDV9yurnx8ws,376
-vmware_debug/cli.py,sha256=MCreiUBS1x2Ne5cZXuafLHrjThSdkL7GqeREhfVWXV8,4135
+vmware_debug/__init__.py,sha256=JjgubSbR8Xhn-i8kk8lV2EtYQxwqZUwSAQqxyW3k46o,376
+vmware_debug/cli.py,sha256=nho92ORzfyqEPPvnFWuAY3J5uyWpVdzx5kAd7DPmbcA,5690
 vmware_debug/envelope.py,sha256=66AQzI_h4JoopUcFxHvqaFe48rYRZz0uX9Wdm5lDcuI,11235
 vmware_debug/mcp/__init__.py,sha256=isuSzMWp1iXgJWGz2Q0JyUXlDTfcFfHNPSTHALuNHaA,220
 vmware_debug/mcp/tools.py,sha256=TcWywxro1zqGYFmJC8NUgxb7DMyGpSQbZusJrHzqnGI,2796
 vmware_debug/mcp_server/__init__.py,sha256=QZpQxriDdqDCYaS-HP7McsaPbTPbHwcamIwu-7UxY-E,49
-vmware_debug/mcp_server/server.py,sha256=LhBuwoon-IlGOMj71mK0-M6rzbaP4wMUkUlwqYWXWa8,46786
+vmware_debug/mcp_server/server.py,sha256=uz4BnW-6Zu7G4fYYffT6B5cfOQ7xVFDzLWsmpASTrfc,47379
 vmware_debug/ops/__init__.py,sha256=Co9u0zZexST7-IOUBOAS5eq5RHkaEeI2FqfYijzhI1g,46
 vmware_debug/ops/skill_names.py,sha256=JkBaKBJYyq0RrEqzro-e-zhSVh7Cn5wlxjAoakgXSyY,3990
 vmware_debug/ops/timeline.py,sha256=GzafF7jkEfa6cr3H2wO0At7fZEBdn_9m9_0Omh7faTs,27556
@@ -25,7 +25,7 @@ vmware_debug/ops/cases/store.py,sha256=dIgdAR111_gDoZ4rYbTtccuiaQVdksMCDoZOHKmbW
 vmware_debug/ops/cases/timeline.py,sha256=WbJg2xUrqyHxMERBFYA-tgU9Mmy67whH9GGh96R8ifk,7843
 vmware_debug/rules/evidence_sources.yaml,sha256=w8YOdUtKw-oi-t9c5ePJaktx7CwZlfFinH8aQAQfhzo,11387
 vmware_debug/rules/grading_rules.yaml,sha256=USCp7D2geU_CZgscvo8GMHEHZPgqbzbjqE-qwWG3QtA,3261
-vmware_debug-2.0.0.dist-info/METADATA,sha256=7SkPIgndd2IACxjSgv_hfox9iSg6Y_BG2z0sCMJgn30,5877
-vmware_debug-2.0.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-vmware_debug-2.0.0.dist-info/entry_points.txt,sha256=4d14JRHy0ouSOfCJyczaxUFH6p8AsHZNS19AKom0v4c,109
-vmware_debug-2.0.0.dist-info/RECORD,,
+vmware_debug-2.2.0.dist-info/METADATA,sha256=HCpMz0WTX-CNGVrBN0YmFA3M6IANeTRMH7fRJFyAPVM,8059
+vmware_debug-2.2.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
+vmware_debug-2.2.0.dist-info/entry_points.txt,sha256=4d14JRHy0ouSOfCJyczaxUFH6p8AsHZNS19AKom0v4c,109
+vmware_debug-2.2.0.dist-info/RECORD,,