vmware-privateai 2.3.2__tar.gz → 2.4.2__tar.gz

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-privateai",
   "displayName": "VMware PrivateAI",
-  "version": "2.3.2",
+  "version": "2.4.2",
   "description": "VMware Private AI (NVIDIA): GPU inventory, vGPU profiles, utilization, model serving — 18 tools",
   "author": {
     "name": "Wei Zhou",

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-privateai==2.3.2",
+        "vmware-privateai==2.4.2",
         "vmware-privateai-mcp"
       ]
     }

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-privateai
-Version: 2.3.2
+Version: 2.4.2
 Summary: VMware Private AI Foundation with NVIDIA ops — GPU inventory, vGPU/DirectPath profiles, utilization, model-serving (MCP + CLI)
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-PrivateAI
 Project-URL: Repository, https://github.com/vmware-skills/VMware-PrivateAI
@@ -16,7 +16,7 @@ Classifier: Programming Language :: Python :: 3
 Classifier: Topic :: System :: Systems Administration
 Requires-Python: >=3.11
 Requires-Dist: httpx<1.0,>=0.27
-Requires-Dist: mcp[cli]<2.0,>=1.28
+Requires-Dist: mcp[cli]<2.0,>=1.30
 Requires-Dist: python-dotenv<2.0,>=1.0
 Requires-Dist: pyvmomi<10.0,>=8.0.3.0
 Requires-Dist: pyyaml<7.0,>=6.0
@@ -188,6 +188,7 @@ claude mcp add --transport http vmware-privateai https://mcp.example.com:8443/mc
 - The audit log records each caller as `token:<name>`. Calls run side by side, also on the same target: the server keeps up to `VMWARE_MCP_POOL_SIZE` (default 2) sessions per target, each one a login on that target, and a call waits at most 300 s for a free session (vmware-policy ≥ 1.22.0).
 - **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant
   nothing on the platform. Run one endpoint per privilege level. `vmware-privateai access-info` shows which account that is and what it may do.
+- **Several people or roles on one endpoint:** run `vmware-audit roles enable` once, then give each token a role (`vmware-audit token create NAME --role reader`, or a role in `roles.yaml` naming tools and targets; vmware-policy ≥ 1.24.0). A role limits what the token may call on this endpoint; it cannot grant more than the account has. See vmware-policy's README, "Roles for network callers".
 
 **Offer only read tools, plus the writes you choose:**
 

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/README-CN.md

@@ -148,6 +148,7 @@ claude mcp add --transport http vmware-privateai https://mcp.example.com:8443/mc
 - 审计日志把每个调用者记为 `token:<名字>`。调用并行执行，同一 target 上也一样：server 为每个 target 最多保持 `VMWARE_MCP_POOL_SIZE`（默认 2）个会话，每个会话都是在该 target 上的一次登录；一个调用最多等 300 秒拿到空闲会话（vmware-policy ≥ 1.22.0）。
 - **能连到这个端点的人，都以该 server 配置的账号操作。** token 只用来识别调用者，不在平台上授予任何权限。
   每个权限级别单独起一个端点。`vmware-privateai access-info` 可查看是哪个账号、它能做什么。
+- **一个端点给多人或多种角色用：** 先运行一次 `vmware-audit roles enable`，再给每个 token 指定角色（`vmware-audit token create 名字 --role reader`，或在 `roles.yaml` 里定义可用的工具和 target；需 vmware-policy ≥ 1.24.0）。角色只能限定这个 token 在本端点上能调用什么，不能超出账号本身的权限。详见 vmware-policy README 的「网络调用者的角色」一节。
 
 **只提供读工具，加上你选定的写工具：**
 

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/README.md

@@ -161,6 +161,7 @@ claude mcp add --transport http vmware-privateai https://mcp.example.com:8443/mc
 - The audit log records each caller as `token:<name>`. Calls run side by side, also on the same target: the server keeps up to `VMWARE_MCP_POOL_SIZE` (default 2) sessions per target, each one a login on that target, and a call waits at most 300 s for a free session (vmware-policy ≥ 1.22.0).
 - **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant
   nothing on the platform. Run one endpoint per privilege level. `vmware-privateai access-info` shows which account that is and what it may do.
+- **Several people or roles on one endpoint:** run `vmware-audit roles enable` once, then give each token a role (`vmware-audit token create NAME --role reader`, or a role in `roles.yaml` naming tools and targets; vmware-policy ≥ 1.24.0). A role limits what the token may call on this endpoint; it cannot grant more than the account has. See vmware-policy's README, "Roles for network callers".
 
 **Offer only read tools, plus the writes you choose:**
 

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/RELEASE_NOTES.md

@@ -1,3 +1,24 @@
+## v2.4.2 — a login refused for lack of a vSphere role says so (2026-10-19)
+
+(2.4.1 was not used for this package; this release follows 2.4.0.)
+
+* **A login vCenter refuses with `NoPermission` gets the role error, not the raw fault.** Found on a vCenter 8.0.3
+  lab (follow-up to AIops#47): for an SSO account with no permission anywhere, vCenter refuses the login itself
+  (`System.View` on the root folder), so the post-login no-role check never ran and `doctor` and every tool showed
+  the raw fault with a connectivity hint. It now raises the no-role error: the "no vSphere role / Global
+  Permissions" remedy only for a vCenter target and `System.View`; an ESXi target or another privilege gets a
+  neutral text naming the (sanitized) privilege. A wrong password (`InvalidLogin`) is unchanged. Same text as
+  vmware-monitor.
+
+## v2.4.0 — roles for network callers (HLD §18)
+
+* Declares the role metadata vmware-policy ≥ 1.24.0 needs to apply **roles** to this server over HTTPS
+  (HLD §18): how a missing target resolves. With an older vmware-policy nothing changes. Once an operator runs
+  `vmware-audit roles enable`, a token's role decides which tools and targets it may use here; a refused call is
+  audited as `denied`. See vmware-policy's README, "Roles for network callers".
+* A target-limited role is checked against the same config the connection uses: the copy the server's connection manager loaded on its first connection. Edit `config.yaml` and restart for both to see the change.
+* README and setup guide: one endpoint for several people or roles.
+
 ## v2.3.2 — tools may not touch this server's own control files
 
 * **Security fix (HLD §18 step 0).** the `verify_pais_bundle` manifest path could name this server's own files, so over HTTPS a token holder could

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/openclaw.plugin.json

@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-privateai==2.3.2",
+        "vmware-privateai==2.4.2",
         "vmware-privateai-mcp"
       ]
     }

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zw008/vmware-privateai",
-  "version": "2.3.2",
+  "version": "2.4.2",
   "description": "VMware Private AI (NVIDIA): GPU inventory, vGPU profiles, utilization, model serving — 18 tools",
   "private": true,
   "license": "MIT",

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-privateai"
-version = "2.3.2"
+version = "2.4.2"
 description = "VMware Private AI Foundation with NVIDIA ops — GPU inventory, vGPU/DirectPath profiles, utilization, model-serving (MCP + CLI)"
 readme = "README.md"
 license = "MIT"
@@ -24,7 +24,7 @@ dependencies = [
     "rich>=13.0,<15.0",
     "pyyaml>=6.0,<7.0",
     "python-dotenv>=1.0,<2.0",
-    "mcp[cli]>=1.28,<2.0",
+    "mcp[cli]>=1.30,<2.0",
     "vmware-policy>=1.23.1,<2.0",
 ]
 

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/vmware-skills/VMware-PrivateAI",
     "source": "github"
   },
-  "version": "2.3.2",
+  "version": "2.4.2",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-privateai",
-      "version": "2.3.2",
+      "version": "2.4.2",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/skills/vmware-privateai/SKILL.md

@@ -66,7 +66,7 @@ double-confirmed at the CLI, and is audit-logged. Pre-flight the write with `val
 ## Quick Install
 
 ```bash
-uv tool install vmware-privateai==2.3.2
+uv tool install vmware-privateai==2.4.2
 vmware-privateai version
 vmware-privateai gpu host-list        # first read — lists hosts that have a GPU
 ```

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/skills/vmware-privateai/references/setup-guide.md

@@ -10,7 +10,7 @@ Install, credential, and MCP-client configuration for vmware-privateai, plus the
 ## 1. Install
 
 ```bash
-uv tool install vmware-privateai==2.3.2       # isolated tool env; puts vmware-privateai on PATH
+uv tool install vmware-privateai==2.4.2       # isolated tool env; puts vmware-privateai on PATH
 vmware-privateai version
 ```
 
@@ -91,7 +91,7 @@ Fallback (`uvx` — re-resolves from PyPI each start; if your network runs a TLS
   "mcpServers": {
     "vmware-privateai": {
       "command": "uvx",
-      "args": ["--from", "vmware-privateai==2.3.2", "vmware-privateai-mcp"],
+      "args": ["--from", "vmware-privateai==2.4.2", "vmware-privateai-mcp"],
       "env": { "VMWARE_PRIVATEAI_CONFIG": "~/.vmware-privateai/config.yaml" }
     }
   }
@@ -163,6 +163,7 @@ vmware-privateai mcp --transport https --host 0.0.0.0 --port 8443 \
 - **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant
   nothing on the platform. Run one endpoint per privilege level (for example a read-only account behind
   `--expose read`, and a separate endpoint for operators).
+- **Several people or roles on one endpoint:** run `vmware-audit roles enable` once, then give each token a role (`vmware-audit token create NAME --role reader`, or a role in `roles.yaml` naming tools and targets; vmware-policy ≥ 1.24.0). A role limits what the token may call on this endpoint; it cannot grant more than the account has. See vmware-policy's README, "Roles for network callers".
 
 ## 5. Verify
 

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/tests/eval/regression/test_login_without_a_role.py

@@ -182,3 +182,68 @@ def test_mcp_not_authenticated_says_both_causes(monkeypatch):
     out = gpu_tools.list_gpu_hosts(target="lab")
     _says_both(out["error"])
     assert "unexpected error" not in out["error"]
+
+
+# 2026-10-18, lab vCenter 8.0.3, SSO account with no permission anywhere:
+# vCenter refuses the *login itself* with NoPermission (System.View on the root
+# folder). Before the fix that raw fault reached doctor and every tool.
+def _login_refused(exc: Exception, monkeypatch: pytest.MonkeyPatch):
+    monkeypatch.setenv("VMWARE_PRIVATEAI_LAB_PASSWORD", "pw")
+    mgr = ConnectionManager(_config())
+    with patch("pyVim.connect.SmartConnect", side_effect=exc):
+        try:
+            mgr.connect("lab")
+        except Exception as e:  # noqa: BLE001 — the test inspects whatever is raised
+            return e
+    raise AssertionError("connect did not raise")
+
+
+def test_login_refused_with_no_permission_names_the_missing_role(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    fault = vim.fault.NoPermission(
+        privilegeId="System.View", msg="Permission to perform this operation was denied."
+    )
+    err = _login_refused(fault, monkeypatch)
+    assert isinstance(err, NoVsphereRoleError)
+    msg = str(err)
+    assert "no vSphere role" in msg and "Read-Only" in msg and "'lab'" in msg
+    assert "dynamicType" not in msg and "operation failed" not in msg
+    assert len(msg) <= 300
+    assert err.__cause__ is fault
+
+
+def test_wrong_password_is_not_reported_as_a_missing_role(
+    monkeypatch: pytest.MonkeyPatch,
+) -> None:
+    err = _login_refused(vim.fault.InvalidLogin(), monkeypatch)
+    assert not isinstance(err, NoVsphereRoleError)
+    assert isinstance(err, vim.fault.InvalidLogin)
+
+
+@pytest.mark.parametrize(
+    ("privilege", "esxi"),
+    [("System.View", True), ("Sessions.ValidateSession", False), (None, False)],
+)
+def test_other_login_refusals_get_a_neutral_remedy(
+    privilege, esxi, monkeypatch: pytest.MonkeyPatch
+) -> None:
+    # Review 2026-10-18 (M3): an ESXi host (lockdown mode, host permissions) or
+    # another privilege must not be sent to vCenter Global Permissions.
+    from dataclasses import replace
+
+    fault = vim.fault.NoPermission(privilegeId=privilege)
+    mgr = ConnectionManager(_config())
+    if esxi:
+        esxi_targets = tuple(replace(t, type="esxi") for t in mgr._config.targets)
+        mgr._config = replace(mgr._config, targets=esxi_targets)
+    monkeypatch.setenv("VMWARE_LAB_PASSWORD", "pw")
+    monkeypatch.setenv("VMWARE_PRIVATEAI_LAB_PASSWORD", "pw")
+    with patch("pyVim.connect.SmartConnect", side_effect=fault):
+        with pytest.raises(Exception) as info:
+            mgr.connect("lab")
+    msg = str(info.value)
+    assert "Global Permissions" not in msg and "lockdown mode" in msg
+    if privilege:
+        assert f"({privilege})" in msg
+    assert info.value.__cause__ is fault and len(msg) <= 300

vmware_privateai-2.4.2/tests/test_policy_roles.py

@@ -0,0 +1,55 @@
+"""HLD §18: the role metadata this skill declares matches its real tools."""
+
+from __future__ import annotations
+
+import asyncio
+
+import pytest
+
+from vmware_privateai import policy_roles
+
+
+def _registry() -> set[str]:
+    from vmware_privateai.mcp_server.server import mcp
+
+    return {t.name for t in asyncio.run(mcp.list_tools())}
+
+
+@pytest.mark.unit
+def test_every_declared_name_is_a_real_tool():
+    named = set(policy_roles.ESCAPES) | set(getattr(policy_roles, "AKO_TOOLS", ()))
+    assert named - _registry() == set(), sorted(named - _registry())
+
+
+@pytest.mark.unit
+def test_metadata_is_declared_when_policy_has_roles():
+    roles = pytest.importorskip("vmware_policy.roles")
+    import vmware_privateai.mcp_server.server  # noqa: F401  (registers the metadata on import)
+
+    meta = roles.metadata("privateai")
+    assert meta is not None and meta.version == 1
+    assert meta.escapes == policy_roles.ESCAPES
+    assert (meta.resolver is not None) is True
+
+
+@pytest.mark.unit
+def test_the_resolver_uses_the_config_the_connection_manager_holds(monkeypatch):
+    """Review H1/H-1: once the server's connection manager exists, a config edit must
+    not move the role check off the config it connects with; before, read the file."""
+    import importlib
+    import types
+
+    from vmware_privateai import policy_roles as pr
+
+    server = importlib.import_module("vmware_privateai.mcp_server._shared")
+    assert hasattr(server, "_manager"), "policy_roles looks up a global the server does not have"
+    edited, loads = object(), []
+    monkeypatch.setattr(pr, "load_config", lambda: loads.append(1) or edited)
+
+    monkeypatch.setattr(server, "_manager", None)
+    assert pr._connection_config() is edited and pr._connection_config() is edited
+    assert len(loads) == 2  # no manager yet: the file as it is now, every time
+
+    held = object()
+    monkeypatch.setattr(server, "_manager", types.SimpleNamespace(_config=held))
+    assert pr._connection_config() is held  # the manager's copy, not the edited file

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/uv.lock

@@ -426,7 +426,7 @@ wheels = [
 
 [[package]]
 name = "mcp"
-version = "1.29.0"
+version = "1.30.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "anyio" },
@@ -444,9 +444,9 @@ dependencies = [
     { name = "typing-inspection" },
     { name = "uvicorn", marker = "sys_platform != 'emscripten'" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/30/d3/f9acc21dfc886e4f78e2add1a47db46ce16884346afde53f8a064c02c891/mcp-1.29.0.tar.gz", hash = "sha256:52d01f334de1868cc3bb2d6604931126a67631f99a6c5d3b82ba47290315ec36", size = 643148, upload-time = "2026-07-28T13:41:41.939Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/ba/93/0142dc84a666daf8ad51a34268f34c12fd6fda4f3810c4be2504eecc8212/mcp-1.30.0.tar.gz", hash = "sha256:445414625fce5c295faa505bb11bacece661ab6f4028d57c935db57820b7a3e4", size = 680511, upload-time = "2026-09-07T14:34:15.845Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/01/c8/248b201f6d753d69fd5d6506011abbb35a946d9142b2ae311a948fd0be3d/mcp-1.29.0-py3-none-any.whl", hash = "sha256:f5a075bb611f23d6f4d080c6a1699fa62772eebc562ba9e66b306ddde1c755f7", size = 223436, upload-time = "2026-07-28T13:41:40.337Z" },
+    { url = "https://files.pythonhosted.org/packages/f5/f4/e58bc33317c92a0203664daaf00bf6f41166cc0149e5d6870a03f7cd004a/mcp-1.30.0-py3-none-any.whl", hash = "sha256:666edb5009503e1047c9d60346a756f94b261f05cc2625f23d41c728ffc484d0", size = 234581, upload-time = "2026-09-07T14:34:14.266Z" },
 ]
 
 [package.optional-dependencies]
@@ -1093,21 +1093,21 @@ wheels = [
 
 [[package]]
 name = "vmware-policy"
-version = "1.23.1"
+version = "1.24.2"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "pyyaml" },
     { name = "rich" },
     { name = "typer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/ec/2c/03d2327478838ed3d407c7fc30ebbd6a2cf3b3d2c58285ba6653697224b0/vmware_policy-1.23.1.tar.gz", hash = "sha256:6fe55a99fc71f9591bedd3c5dcc00042559953f02a7bf7da9d2b9b4638877c08", size = 332522, upload-time = "2026-10-16T02:55:48.081Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/15/8d/b9867ea1c0112caa481841c290c3fe718c0dbd738757db7877836f46267a/vmware_policy-1.24.2.tar.gz", hash = "sha256:6c816174fcd0b490bcd1f9ebaaa18b80fcb26b0eccb614e938938bb2e8452a40", size = 369315, upload-time = "2026-10-18T03:43:52.753Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/b7/22/94fc30b3e273fd0e9739fb11ac0bfa8232352cefcaf95ee25229bb277733/vmware_policy-1.23.1-py3-none-any.whl", hash = "sha256:4afe95894e8a05556dfeb9e2c6a37186cf8c4bf3017131dedfb8c23478514cec", size = 114484, upload-time = "2026-10-16T02:55:46.591Z" },
+    { url = "https://files.pythonhosted.org/packages/20/01/bc5f984a420d22514d8c3a627f332891f2008213d455c2f682f311e355f1/vmware_policy-1.24.2-py3-none-any.whl", hash = "sha256:2734ab49a76474fd74beb221a2d6535caab1f91a477668484c145dc2802ae072", size = 134565, upload-time = "2026-10-18T03:43:50.856Z" },
 ]
 
 [[package]]
 name = "vmware-privateai"
-version = "2.3.2"
+version = "2.4.2"
 source = { editable = "." }
 dependencies = [
     { name = "httpx" },
@@ -1130,7 +1130,7 @@ dev = [
 [package.metadata]
 requires-dist = [
     { name = "httpx", specifier = ">=0.27,<1.0" },
-    { name = "mcp", extras = ["cli"], specifier = ">=1.28,<2.0" },
+    { name = "mcp", extras = ["cli"], specifier = ">=1.30,<2.0" },
     { name = "python-dotenv", specifier = ">=1.0,<2.0" },
     { name = "pyvmomi", specifier = ">=8.0.3.0,<10.0" },
     { name = "pyyaml", specifier = ">=6.0,<7.0" },

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/vmware_privateai/__init__.py

@@ -5,4 +5,4 @@ assignment, and Private AI Service (PAIS) model-serving — over vSphere 9.x /
 VCF 9.1, with the family's governed-ops harness (audit + policy + teaching errors).
 """
 
-__version__ = "2.3.2"
+__version__ = "2.4.2"

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/vmware_privateai/connection.py

@@ -17,6 +17,7 @@ from pyVmomi import vim
 if TYPE_CHECKING:
     from pyVmomi.vim import ServiceInstance
 
+from vmware_policy import sanitize
 from vmware_policy.access import login_has_no_session, no_role_message
 from vmware_policy.pool import SessionPool
 
@@ -61,6 +62,32 @@ class NoVsphereRoleError(ConfigError):
     """
 
 
+def login_refused_message(target: str, cli: str, *, privilege: str | None = None, esxi: bool = False) -> str:
+    """The teaching error when the login itself is refused with NoPermission.
+
+    vCenter 8.0.3 refuses the login, with NoPermission for System.View on the
+    root folder, for an SSO account holding no vSphere permission anywhere (lab,
+    2026-10-18); an account with a permission lower down still logs in. Only
+    that case gets the "no vSphere role" remedy. An ESXi host (lockdown mode,
+    host permissions) or another privilege gets a neutral text naming the
+    privilege vCenter returned (sanitized, capped at 48). About 300 characters.
+    """
+    if not esxi and privilege == "System.View":
+        return (
+            f"'{target}' refused the login: the password is right but the account has "
+            "no vSphere role (no System.View on the root). Assign Read-Only or higher "
+            f"(vCenter: Global Permissions), then run '{cli} doctor'. A new password "
+            "will not help."
+        )
+    # vCenter's own string: sanitized and bounded so the text stays short.
+    need = f" ({sanitize(privilege, 48)})" if privilege else ""
+    return (
+        f"'{target}' refused the login with NoPermission{need}: the password is right "
+        "but this account may not log in there. On ESXi check the host's Permissions "
+        f"and lockdown mode; on vCenter assign a role. Then run '{cli} doctor'."
+    )
+
+
 NOT_AUTHENTICATED_HINT = (
     "vCenter answered 'the session is not authenticated'. Either the session "
     "expired (run the command again; a new session is opened) or the account "
@@ -190,6 +217,16 @@ class ConnectionManager:
                 f"vCenter/ESXi host is up and that its 'host' and 'port' in "
                 f"{CONFIG_FILE} are reachable from this machine."
             ) from exc
+        except vim.fault.NoPermission as exc:
+            # A wrong password is InvalidLogin, not this; it passes through.
+            raise NoVsphereRoleError(
+                login_refused_message(
+                    target.name,
+                    "vmware-privateai",
+                    privilege=getattr(exc, "privilegeId", None),
+                    esxi=target.type == "esxi",
+                )
+            ) from exc
 
         def _cleanup(_si: ServiceInstance = si) -> None:
             try:

{vmware_privateai-2.3.2 → vmware_privateai-2.4.2}/vmware_privateai/policy_environment.py

@@ -53,3 +53,7 @@ def _environment_for(target: str | None) -> str:
 # to ALLOW. Keyed, a resolver only ever answers for its own skill, so
 # registering at import time is safe again.
 set_environment_resolver(_environment_for, skill=skill_name(__name__))
+
+
+# Role metadata (HLD §18) is declared beside the environment resolver, on every surface.
+import vmware_privateai.policy_roles  # noqa: E402,F401

vmware_privateai-2.4.2/vmware_privateai/policy_roles.py

@@ -0,0 +1,52 @@
+"""What vmware-policy needs to apply roles to this skill (HLD §18 D-21/D-22).
+
+Policy cannot see which tools escape a role or how a missing target resolves; this
+module declares them. Imported by ``policy_environment``, so the MCP server and
+the CLI both register it. With a vmware-policy that has no roles module (< 1.24)
+nothing is declared.
+"""
+
+from __future__ import annotations
+
+import sys
+
+from vmware_policy import skill_name
+
+from vmware_privateai.config import load_config
+
+#: Tools that give their holder more than a role. Host-path tools are added by
+#: policy while a file root is set.
+ESCAPES = frozenset()
+
+
+def _connection_config():
+    """The config the connection layer uses for this call (review H1, then H-1).
+
+    The server's connection manager loads the config once, on its first connection,
+    and keeps it. Once it exists, the role is checked against that same object, so
+    an edit to config.yaml cannot move the check off the target the call connects
+    to. Before it exists, the file as it is now is what the manager is about to load.
+    Looked up in ``sys.modules`` so the CLI never imports the MCP server.
+    """
+    server = sys.modules.get("vmware_privateai.mcp_server._shared")
+    manager = getattr(server, "_manager", None) if server is not None else None
+    return manager._config if manager is not None else load_config()
+
+
+def _target_name(target: str | None) -> str:
+    """The target the connection layer would use for ``target`` (or the default)."""
+    config = _connection_config()
+    return (config.get_target(target) if target else config.default_target).name
+
+
+try:
+    from vmware_policy.roles import declare_role_metadata
+except ImportError:  # vmware-policy without roles: nothing to declare
+    declare_role_metadata = None
+
+if declare_role_metadata is not None:
+    declare_role_metadata(
+        skill_name(__name__),
+        escapes=ESCAPES,
+        resolver=_target_name,
+    )