vmware-debug 2.2.0__py3-none-any.whl → 2.3.1__py3-none-any.whl

vmware_debug/__init__.py

@@ -6,4 +6,4 @@ remediation to vmware-aiops / vmware-pilot. Never writes to any VMware system
 and never executes fixes; its only writes go to the local case ledger.
 """
 
-__version__ = "2.2.0"
+__version__ = "2.3.1"

vmware_debug/cli.py

@@ -11,6 +11,7 @@ from __future__ import annotations
 
 import json
 import sys
+from functools import wraps
 from pathlib import Path
 from typing import Optional
 
@@ -20,7 +21,7 @@ from rich.table import Table
 
 from vmware_debug import __version__
 from vmware_debug.mcp.tools import build_incident_timeline, list_symptom_categories
-from vmware_policy import audited, cli_local
+from vmware_policy import PolicyDenied, audited, cli_local, sanitize
 
 
 def _harden_console_encoding() -> None:
@@ -53,6 +54,19 @@ app = typer.Typer(
 console = Console()
 
 
+def handle_cli_errors(func):
+    """Render policy refusals after the audited wrapper has recorded the denial."""
+    @wraps(func)
+    def wrapper(*args, **kwargs):
+        try:
+            return func(*args, **kwargs)
+        except PolicyDenied as exc:
+            rule = f" (rule: {sanitize(exc.result.rule, 100)})" if exc.result.rule else ""
+            typer.echo(f"Denied by policy: {sanitize(exc.result.reason, 500)}{rule}", err=True)
+            raise typer.Exit(1) from None
+    return wrapper
+
+
 @app.command()
 @cli_local("prints the installed version")
 def version() -> None:
@@ -61,6 +75,7 @@ def version() -> None:
 
 
 @app.command()
+@handle_cli_errors
 @audited(tool="list_symptom_categories")
 def categories() -> None:
     """List the symptom categories debug recognises and what to check for each."""
@@ -74,6 +89,7 @@ def categories() -> None:
 
 
 @app.command()
+@handle_cli_errors
 @audited(tool="build_incident_timeline")
 def triage(
     events_file: Optional[Path] = typer.Option(

vmware_debug/mcp_server/server.py

@@ -898,5 +898,8 @@ def main(
     )
 
 
+# Role metadata for network callers (HLD §18).
+import vmware_debug.policy_roles  # noqa: F401
+
 if __name__ == "__main__":
     main()

vmware_debug/policy_roles.py

@@ -0,0 +1,27 @@
+"""What vmware-policy needs to apply roles to this skill (HLD §18 D-21/D-22).
+
+Policy cannot see which tools escape a role or how a missing target resolves; this
+module declares them. Imported by the MCP server (roles apply only to a network
+MCP server). With a vmware-policy that has no roles module (< 1.24) nothing is
+declared.
+"""
+
+from __future__ import annotations
+
+from vmware_policy import skill_name
+
+#: Tools that give their holder more than a role. Host-path tools are added by
+#: policy while a file root is set.
+ESCAPES = frozenset()
+
+
+try:
+    from vmware_policy.roles import declare_role_metadata
+except ImportError:  # vmware-policy without roles: nothing to declare
+    declare_role_metadata = None
+
+if declare_role_metadata is not None:
+    declare_role_metadata(
+        skill_name(__name__),
+        escapes=ESCAPES,
+    )

{vmware_debug-2.2.0.dist-info → vmware_debug-2.3.1.dist-info}/METADATA

@@ -1,12 +1,12 @@
 Metadata-Version: 2.5
 Name: vmware-debug
-Version: 2.2.0
+Version: 2.3.1
 Summary: VMware diagnostic brain — offline incident triage, log/event correlation, and root-cause routing across the VMware skill family
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-Debug
 Project-URL: Repository, https://github.com/vmware-skills/VMware-Debug
 Project-URL: Issues, https://github.com/vmware-skills/VMware-Debug/issues
 Project-URL: Changelog, https://github.com/vmware-skills/VMware-Debug/blob/main/RELEASE_NOTES.md
-Author-email: Wei Zhou <wei-wz.zhou@broadcom.com>
+Author-email: Wei Zhou <zhouwei008@gmail.com>
 License-Expression: MIT
 Keywords: ai-ops,debug,diagnostics,mcp,rca,troubleshooting,vmware,vsphere
 Classifier: Development Status :: 4 - Beta
@@ -14,7 +14,8 @@ Classifier: License :: OSI Approved :: MIT License
 Classifier: Programming Language :: Python :: 3
 Classifier: Topic :: System :: Monitoring
 Requires-Python: >=3.10
-Requires-Dist: mcp[cli]<2.0,>=1.28
+Requires-Dist: certifi>=2026.10.19
+Requires-Dist: mcp[cli]<2.0,>=1.30
 Requires-Dist: pyyaml<7.0,>=6.0
 Requires-Dist: rich<15.0,>=13.0
 Requires-Dist: typer<1.0,>=0.12
@@ -25,6 +26,8 @@ Description-Content-Type: text/markdown
 
 # VMware Debug
 
+For a read-only check of this skill with your model and agent host, use the shared [model-fit self-test](https://github.com/vmware-skills/marketplace/blob/main/MODEL_FIT_SELF_TEST.md) in the marketplace root.
+
 > **Disclaimer**: Community-maintained open-source project, **not affiliated with,
 > endorsed by, or sponsored by VMware, Inc. or Broadcom Inc.** "VMware" and
 > "vSphere" are trademarks of Broadcom. Source is publicly auditable under the MIT
@@ -105,6 +108,8 @@ event actually is.
 
 ## Security
 
+CLI policy refusals print the reason and rule, exit with code 1, and retain one `denied` audit row.
+
 Offline and credential-free by construction: it connects to no vCenter/NSX/Aria, has no destructive surface on
 VMware, and holds no secret to leak. The only writes are the local case ledger: evidence, gaps, hypotheses and
 grade history are append-only; `timeline.md` is regenerated from the evidence, and `case.json` holds the current
@@ -145,6 +150,71 @@ pip wheel . -w dist        # → dist/*.whl   (or: uv build, for just this packa
 pip install --no-index --find-links dist vmware-debug
 ```
 
+<!-- usage: remote-and-exposure -->
+## Remote access (HTTPS) and limiting tools
+
+By default `vmware-debug mcp` speaks stdio to one local client and offers every tool. Two options change that
+(vmware-policy ≥ 1.21.0).
+
+**Serve over HTTPS** so clients on other machines can connect. Every caller needs a bearer token:
+
+```bash
+vmware-audit token create alice          # prints the token once; give it to alice
+vmware-audit token list                  # names only
+vmware-audit token revoke alice          # refused from its next request, no restart
+vmware-debug mcp --transport https --host 0.0.0.0 --port 8443 \
+    --cert /etc/vmware-mcp/server.pem --key /etc/vmware-mcp/server-key.pem \
+    --public-name mcp.example.com
+```
+
+Connect a client (Claude Code shown; any MCP client that supports streamable HTTP and custom headers works):
+
+```bash
+claude mcp add --transport http vmware-debug https://mcp.example.com:8443/mcp \
+    --header "Authorization: Bearer $VMWARE_MCP_TOKEN"
+```
+
+```json
+{
+  "mcpServers": {
+    "vmware-debug": {
+      "type": "http",
+      "url": "https://mcp.example.com:8443/mcp",
+      "headers": { "Authorization": "Bearer ${VMWARE_MCP_TOKEN}" }
+    }
+  }
+}
+```
+
+- The server will not start without a token, refuses Host/Origin values outside `--public-name`, and checks
+  before it binds that unauthenticated requests get 401. Use a certificate your clients trust for those names.
+- Behind a TLS-terminating reverse proxy on the same machine use `--transport http --host 127.0.0.1
+  --public-name mcp.example.com` and pass the `Authorization` header through.
+- Behind a load balancer or gateway on another machine, keep `--transport https` (a self-signed certificate is
+  fine), list in `--public-name` the host name the balancer sends as `Host`, and have it forward `Authorization`.
+  Its health probe can use `GET /healthz`, which needs no token and returns only `{"status": "ok"}`
+  (vmware-policy ≥ 1.23.0).
+- Send `traceparent` or `X-Request-ID` with each request to have it stored on the audit row;
+  `vmware-audit log --correlation-id ID` then finds the calls behind one platform request.
+- The audit log records each caller as `token:<name>`. Calls naming different targets run in parallel; calls that
+  name no target run one at a time, so name the target when several people share a server.
+- **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant
+  nothing on the platform. Run one endpoint per privilege level.
+- **Several people or roles on one endpoint:** run `vmware-audit roles enable` once, then give each token a role (`vmware-audit token create NAME --role reader`, or a role in `roles.yaml` naming tools and targets; vmware-policy ≥ 1.24.0). A role limits what the token may call on this endpoint; it cannot grant more than the account has. See vmware-policy's README, "Roles for network callers".
+
+**Offer only read tools, plus the writes you choose:**
+
+```bash
+vmware-debug mcp --expose read --allow-write close_case
+# or: VMWARE_DEBUG_MCP_EXPOSE=read VMWARE_DEBUG_MCP_ALLOW_WRITE=close_case vmware-debug mcp
+```
+
+Tools not offered do not appear in the client's tool list. A bad value or an unknown write tool stops the server
+(exit 2). This limits what clients are offered; it is not authorization, so the account itself should be
+least-privilege.
+
+Details: `skills/vmware-debug/references/setup-guide.md` ("Serving MCP over HTTPS", "Limiting which tools are offered").
+
 ## License
 
 MIT.

{vmware_debug-2.2.0.dist-info → vmware_debug-2.3.1.dist-info}/RECORD

@@ -1,10 +1,11 @@
-vmware_debug/__init__.py,sha256=JjgubSbR8Xhn-i8kk8lV2EtYQxwqZUwSAQqxyW3k46o,376
-vmware_debug/cli.py,sha256=nho92ORzfyqEPPvnFWuAY3J5uyWpVdzx5kAd7DPmbcA,5690
+vmware_debug/__init__.py,sha256=j8ECx8s2eEC3ROlRNhSlH5UljOsOSNKlai9D6NbjHe0,376
+vmware_debug/cli.py,sha256=AShbZTiMu_WuhfSbIB74ZhvLPRgOJHhrzzUEV_xYtZs,6284
 vmware_debug/envelope.py,sha256=66AQzI_h4JoopUcFxHvqaFe48rYRZz0uX9Wdm5lDcuI,11235
+vmware_debug/policy_roles.py,sha256=iaKA3rT5qg0tfjO59cZHjsJTF4xirIzmsxfkVytrgH0,844
 vmware_debug/mcp/__init__.py,sha256=isuSzMWp1iXgJWGz2Q0JyUXlDTfcFfHNPSTHALuNHaA,220
 vmware_debug/mcp/tools.py,sha256=TcWywxro1zqGYFmJC8NUgxb7DMyGpSQbZusJrHzqnGI,2796
 vmware_debug/mcp_server/__init__.py,sha256=QZpQxriDdqDCYaS-HP7McsaPbTPbHwcamIwu-7UxY-E,49
-vmware_debug/mcp_server/server.py,sha256=uz4BnW-6Zu7G4fYYffT6B5cfOQ7xVFDzLWsmpASTrfc,47379
+vmware_debug/mcp_server/server.py,sha256=pzaqn3oZIgxszVmCzRGZY33rrvupgrdtsPxducXTiGc,47475
 vmware_debug/ops/__init__.py,sha256=Co9u0zZexST7-IOUBOAS5eq5RHkaEeI2FqfYijzhI1g,46
 vmware_debug/ops/skill_names.py,sha256=JkBaKBJYyq0RrEqzro-e-zhSVh7Cn5wlxjAoakgXSyY,3990
 vmware_debug/ops/timeline.py,sha256=GzafF7jkEfa6cr3H2wO0At7fZEBdn_9m9_0Omh7faTs,27556
@@ -25,7 +26,7 @@ vmware_debug/ops/cases/store.py,sha256=dIgdAR111_gDoZ4rYbTtccuiaQVdksMCDoZOHKmbW
 vmware_debug/ops/cases/timeline.py,sha256=WbJg2xUrqyHxMERBFYA-tgU9Mmy67whH9GGh96R8ifk,7843
 vmware_debug/rules/evidence_sources.yaml,sha256=w8YOdUtKw-oi-t9c5ePJaktx7CwZlfFinH8aQAQfhzo,11387
 vmware_debug/rules/grading_rules.yaml,sha256=USCp7D2geU_CZgscvo8GMHEHZPgqbzbjqE-qwWG3QtA,3261
-vmware_debug-2.2.0.dist-info/METADATA,sha256=HCpMz0WTX-CNGVrBN0YmFA3M6IANeTRMH7fRJFyAPVM,8059
-vmware_debug-2.2.0.dist-info/WHEEL,sha256=W3fkpkm7-wf9vBI5Z-7s0eWkeM-spu78I8Neb98DeEg,87
-vmware_debug-2.2.0.dist-info/entry_points.txt,sha256=4d14JRHy0ouSOfCJyczaxUFH6p8AsHZNS19AKom0v4c,109
-vmware_debug-2.2.0.dist-info/RECORD,,
+vmware_debug-2.3.1.dist-info/METADATA,sha256=2XYQYn0ppAvQEPW4Kh0V9xDKGWUp8stG0VzX5hOofHE,11883
+vmware_debug-2.3.1.dist-info/WHEEL,sha256=2iZrJkDIkeDh0k9SikKMqFuRP-ua6mb4Ir1AsER4BEw,87
+vmware_debug-2.3.1.dist-info/entry_points.txt,sha256=4d14JRHy0ouSOfCJyczaxUFH6p8AsHZNS19AKom0v4c,109
+vmware_debug-2.3.1.dist-info/RECORD,,

{vmware_debug-2.2.0.dist-info → vmware_debug-2.3.1.dist-info}/WHEEL

@@ -1,4 +1,4 @@
 Wheel-Version: 1.0
-Generator: hatchling 1.32.4
+Generator: hatchling 1.33.0
 Root-Is-Purelib: true
 Tag: py3-none-any