vmware-storage 2.3.1__tar.gz → 2.4.0__tar.gz

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/.claude-plugin/plugin.json

@@ -2,7 +2,7 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-storage",
   "displayName": "VMware Storage",
-  "version": "2.3.1",
+  "version": "2.4.0",
   "description": "VMware vSphere storage with 15 MCP tools: datastores, iSCSI, vSAN, FC multipath.",
   "author": {
     "name": "Wei Zhou",

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-storage==2.3.1",
+        "vmware-storage==2.4.0",
         "vmware-storage-mcp"
       ]
     }

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-storage
-Version: 2.3.1
+Version: 2.4.0
 Summary: VMware vSphere storage management: datastores, iSCSI, vSAN. Domain-focused MCP skill.
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-Storage
 Project-URL: Repository, https://github.com/vmware-skills/VMware-Storage
@@ -329,6 +329,7 @@ claude mcp add --transport http vmware-storage https://mcp.example.com:8443/mcp
 - The audit log records each caller as `token:<name>`. Calls run side by side, also on the same target: the server keeps up to `VMWARE_MCP_POOL_SIZE` (default 2) sessions per target, each one a login on that target, and a call waits at most 300 s for a free session (vmware-policy ≥ 1.22.0).
 - **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant
   nothing on the platform. Run one endpoint per privilege level. `vmware-storage access-info` shows which account that is and what it may do.
+- **Several people or roles on one endpoint:** run `vmware-audit roles enable` once, then give each token a role (`vmware-audit token create NAME --role reader`, or a role in `roles.yaml` naming tools and targets; vmware-policy ≥ 1.24.0). A role limits what the token may call on this endpoint; it cannot grant more than the account has. See vmware-policy's README, "Roles for network callers".
 
 **Offer only read tools, plus the writes you choose:**
 

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/README-CN.md

@@ -341,6 +341,7 @@ claude mcp add --transport http vmware-storage https://mcp.example.com:8443/mcp
 - 审计日志把每个调用者记为 `token:<名字>`。调用并行执行，同一 target 上也一样：server 为每个 target 最多保持 `VMWARE_MCP_POOL_SIZE`（默认 2）个会话，每个会话都是在该 target 上的一次登录；一个调用最多等 300 秒拿到空闲会话（vmware-policy ≥ 1.22.0）。
 - **能连到这个端点的人，都以该 server 配置的账号操作。** token 只用来识别调用者，不在平台上授予任何权限。
   每个权限级别单独起一个端点。`vmware-storage access-info` 可查看是哪个账号、它能做什么。
+- **一个端点给多人或多种角色用：** 先运行一次 `vmware-audit roles enable`，再给每个 token 指定角色（`vmware-audit token create 名字 --role reader`，或在 `roles.yaml` 里定义可用的工具和 target；需 vmware-policy ≥ 1.24.0）。角色只能限定这个 token 在本端点上能调用什么，不能超出账号本身的权限。详见 vmware-policy README 的「网络调用者的角色」一节。
 
 **只提供读工具，加上你选定的写工具：**
 

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/README.md

@@ -308,6 +308,7 @@ claude mcp add --transport http vmware-storage https://mcp.example.com:8443/mcp
 - The audit log records each caller as `token:<name>`. Calls run side by side, also on the same target: the server keeps up to `VMWARE_MCP_POOL_SIZE` (default 2) sessions per target, each one a login on that target, and a call waits at most 300 s for a free session (vmware-policy ≥ 1.22.0).
 - **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant
   nothing on the platform. Run one endpoint per privilege level. `vmware-storage access-info` shows which account that is and what it may do.
+- **Several people or roles on one endpoint:** run `vmware-audit roles enable` once, then give each token a role (`vmware-audit token create NAME --role reader`, or a role in `roles.yaml` naming tools and targets; vmware-policy ≥ 1.24.0). A role limits what the token may call on this endpoint; it cannot grant more than the account has. See vmware-policy's README, "Roles for network callers".
 
 **Offer only read tools, plus the writes you choose:**
 

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/RELEASE_NOTES.md

@@ -1,3 +1,12 @@
+## v2.4.0 — roles for network callers (HLD §18)
+
+* Declares the role metadata vmware-policy ≥ 1.24.0 needs to apply **roles** to this server over HTTPS
+  (HLD §18): how a missing target resolves. With an older vmware-policy nothing changes. Once an operator runs
+  `vmware-audit roles enable`, a token's role decides which tools and targets it may use here; a refused call is
+  audited as `denied`. See vmware-policy's README, "Roles for network callers".
+* A target-limited role is checked against the same config the connection uses: the copy the server's connection manager loaded on its first connection. Edit `config.yaml` and restart for both to see the change.
+* README and setup guide: one endpoint for several people or roles.
+
 ## v2.3.1 — a login with no vSphere role is named as such (AIops#47)
 
 * An account that logs in but has no vSphere role (vCenter shows no session for it) is now refused at connect time

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/openclaw.plugin.json

@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-storage==2.3.1",
+        "vmware-storage==2.4.0",
         "vmware-storage-mcp"
       ]
     }

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@zw008/vmware-storage",
-  "version": "2.3.1",
+  "version": "2.4.0",
   "description": "VMware vSphere storage with 15 MCP tools: datastores, iSCSI, vSAN, FC multipath.",
   "private": true,
   "license": "MIT",

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-storage"
-version = "2.3.1"
+version = "2.4.0"
 description = "VMware vSphere storage management: datastores, iSCSI, vSAN. Domain-focused MCP skill."
 readme = "README.md"
 license = "MIT"

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/server.json

@@ -7,12 +7,12 @@
     "url": "https://github.com/vmware-skills/VMware-Storage",
     "source": "github"
   },
-  "version": "2.3.1",
+  "version": "2.4.0",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-storage",
-      "version": "2.3.1",
+      "version": "2.4.0",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/skills/vmware-storage/SKILL.md

@@ -40,7 +40,7 @@ VMware vSphere storage management — 15 MCP tools for datastores, iSCSI, vSAN,
 ## Quick Install
 
 ```bash
-uv tool install vmware-storage==2.3.1
+uv tool install vmware-storage==2.4.0
 vmware-storage init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
 vmware-storage doctor
 ```
@@ -271,7 +271,7 @@ Corporate TLS proxies inject certificates that uv's bundled CA store doesn't tru
 ## Setup
 
 ```bash
-uv tool install vmware-storage==2.3.1
+uv tool install vmware-storage==2.4.0
 mkdir -p ~/.vmware-storage
 cp config.example.yaml ~/.vmware-storage/config.yaml
 # Edit config.yaml with your vCenter/ESXi targets

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/skills/vmware-storage/references/setup-guide.md

@@ -13,19 +13,19 @@ Complete setup and security guide for `vmware-storage`.
 ### Via uv (recommended)
 
 ```bash
-uv tool install vmware-storage==2.3.1
+uv tool install vmware-storage==2.4.0
 ```
 
 ### Via pip
 
 ```bash
-pip install vmware-storage==2.3.1
+pip install vmware-storage==2.4.0
 ```
 
 ### From source
 
 ```bash
-git clone --branch v2.3.1 https://github.com/vmware-skills/VMware-Storage.git
+git clone --branch v2.4.0 https://github.com/vmware-skills/VMware-Storage.git
 cd VMware-Storage
 pip install -e .
 ```
@@ -250,6 +250,7 @@ vmware-storage mcp --transport https --host 0.0.0.0 --port 8443 \
 - **Everyone who can reach the endpoint acts with this server's account.** Tokens identify callers; they grant
   nothing on the platform. Run one endpoint per privilege level (for example a read-only account behind
   `--expose read`, and a separate endpoint for operators).
+- **Several people or roles on one endpoint:** run `vmware-audit roles enable` once, then give each token a role (`vmware-audit token create NAME --role reader`, or a role in `roles.yaml` naming tools and targets; vmware-policy ≥ 1.24.0). A role limits what the token may call on this endpoint; it cannot grant more than the account has. See vmware-policy's README, "Roles for network callers".
 
 ## Security Details
 

vmware_storage-2.4.0/tests/test_policy_roles.py

@@ -0,0 +1,55 @@
+"""HLD §18: the role metadata this skill declares matches its real tools."""
+
+from __future__ import annotations
+
+import asyncio
+
+import pytest
+
+from vmware_storage import policy_roles
+
+
+def _registry() -> set[str]:
+    from vmware_storage.mcp_server.server import mcp
+
+    return {t.name for t in asyncio.run(mcp.list_tools())}
+
+
+@pytest.mark.unit
+def test_every_declared_name_is_a_real_tool():
+    named = set(policy_roles.ESCAPES) | set(getattr(policy_roles, "AKO_TOOLS", ()))
+    assert named - _registry() == set(), sorted(named - _registry())
+
+
+@pytest.mark.unit
+def test_metadata_is_declared_when_policy_has_roles():
+    roles = pytest.importorskip("vmware_policy.roles")
+    import vmware_storage.mcp_server.server  # noqa: F401  (registers the metadata on import)
+
+    meta = roles.metadata("storage")
+    assert meta is not None and meta.version == 1
+    assert meta.escapes == policy_roles.ESCAPES
+    assert (meta.resolver is not None) is True
+
+
+@pytest.mark.unit
+def test_the_resolver_uses_the_config_the_connection_manager_holds(monkeypatch):
+    """Review H1/H-1: once the server's connection manager exists, a config edit must
+    not move the role check off the config it connects with; before, read the file."""
+    import importlib
+    import types
+
+    from vmware_storage import policy_roles as pr
+
+    server = importlib.import_module("vmware_storage.mcp_server.server")
+    assert hasattr(server, "_conn_mgr"), "policy_roles looks up a global the server does not have"
+    edited, loads = object(), []
+    monkeypatch.setattr(pr, "load_config", lambda: loads.append(1) or edited)
+
+    monkeypatch.setattr(server, "_conn_mgr", None)
+    assert pr._connection_config() is edited and pr._connection_config() is edited
+    assert len(loads) == 2  # no manager yet: the file as it is now, every time
+
+    held = object()
+    monkeypatch.setattr(server, "_conn_mgr", types.SimpleNamespace(_config=held))
+    assert pr._connection_config() is held  # the manager's copy, not the edited file

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/uv.lock

@@ -1162,21 +1162,21 @@ wheels = [
 
 [[package]]
 name = "vmware-policy"
-version = "1.23.0"
+version = "1.24.0"
 source = { registry = "https://pypi.org/simple" }
 dependencies = [
     { name = "pyyaml" },
     { name = "rich" },
     { name = "typer" },
 ]
-sdist = { url = "https://files.pythonhosted.org/packages/1b/ef/2c56cc93e0744d7e68b75f7a288f580215865b4685a07b9d58e49773819b/vmware_policy-1.23.0.tar.gz", hash = "sha256:70a682fa44e36fadee7ca09c7c5411fff51c9e25ad9d638f9877737361e2ae31", size = 325401, upload-time = "2026-10-16T00:10:32.297Z" }
+sdist = { url = "https://files.pythonhosted.org/packages/4a/62/3a3cb83af77e3dd3c8fc92cb3b7968bfda04a2f71bf0d6f9b72ee3198441/vmware_policy-1.24.0.tar.gz", hash = "sha256:fba12732ccbd4371232c15d9fd014f9f5d697497210aedff2515d1d205ed3577", size = 361302, upload-time = "2026-10-16T07:18:28.317Z" }
 wheels = [
-    { url = "https://files.pythonhosted.org/packages/e3/ca/bdfc9e50cedf6684ed7d34348177f7688323617ce26d492f55b3d80cd45c/vmware_policy-1.23.0-py3-none-any.whl", hash = "sha256:2f35a97f7d0997dd49ab5a0d8d0fd5f4eae11ef66ca8ed26bc9e4b395cb0d45c", size = 110836, upload-time = "2026-10-16T00:10:30.55Z" },
+    { url = "https://files.pythonhosted.org/packages/3d/f2/fe3d9d384712023916e2cacddc385f14b095509c5e00aea417d1a9550e98/vmware_policy-1.24.0-py3-none-any.whl", hash = "sha256:cf615d0256134f01fb84c39b083649281a66d2c064c2eaa28786a0fa95ec6e58", size = 131460, upload-time = "2026-10-16T07:18:26.907Z" },
 ]
 
 [[package]]
 name = "vmware-storage"
-version = "2.3.1"
+version = "2.4.0"
 source = { editable = "." }
 dependencies = [
     { name = "mcp", extra = ["cli"] },

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/vmware_storage/__init__.py

@@ -1,3 +1,3 @@
 """VMware Storage — vSphere datastore, iSCSI, and vSAN management."""
 
-__version__ = "2.3.1"
+__version__ = "2.4.0"

{vmware_storage-2.3.1 → vmware_storage-2.4.0}/vmware_storage/policy_environment.py

@@ -38,3 +38,7 @@ def _environment_for(target: str | None) -> str:
 # to ALLOW. Keyed, a resolver only ever answers for its own skill, so
 # registering at import time is safe again.
 set_environment_resolver(_environment_for, skill=skill_name(__name__))
+
+
+# Role metadata (HLD §18) is declared beside the environment resolver, on every surface.
+import vmware_storage.policy_roles  # noqa: E402,F401

vmware_storage-2.4.0/vmware_storage/policy_roles.py

@@ -0,0 +1,52 @@
+"""What vmware-policy needs to apply roles to this skill (HLD §18 D-21/D-22).
+
+Policy cannot see which tools escape a role or how a missing target resolves; this
+module declares them. Imported by ``policy_environment``, so the MCP server and
+the CLI both register it. With a vmware-policy that has no roles module (< 1.24)
+nothing is declared.
+"""
+
+from __future__ import annotations
+
+import sys
+
+from vmware_policy import skill_name
+
+from vmware_storage.config import load_config
+
+#: Tools that give their holder more than a role. Host-path tools are added by
+#: policy while a file root is set.
+ESCAPES = frozenset()
+
+
+def _connection_config():
+    """The config the connection layer uses for this call (review H1, then H-1).
+
+    The server's connection manager loads the config once, on its first connection,
+    and keeps it. Once it exists, the role is checked against that same object, so
+    an edit to config.yaml cannot move the check off the target the call connects
+    to. Before it exists, the file as it is now is what the manager is about to load.
+    Looked up in ``sys.modules`` so the CLI never imports the MCP server.
+    """
+    server = sys.modules.get("vmware_storage.mcp_server.server")
+    manager = getattr(server, "_conn_mgr", None) if server is not None else None
+    return manager._config if manager is not None else load_config()
+
+
+def _target_name(target: str | None) -> str:
+    """The target the connection layer would use for ``target`` (or the default)."""
+    config = _connection_config()
+    return (config.get_target(target) if target else config.default_target).name
+
+
+try:
+    from vmware_policy.roles import declare_role_metadata
+except ImportError:  # vmware-policy without roles: nothing to declare
+    declare_role_metadata = None
+
+if declare_role_metadata is not None:
+    declare_role_metadata(
+        skill_name(__name__),
+        escapes=ESCAPES,
+        resolver=_target_name,
+    )