vmware-storage 2.4.2__tar.gz → 2.5.0__tar.gz

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/.claude-plugin/plugin.json

@@ -2,8 +2,8 @@
   "$schema": "https://anthropic.com/claude-code/plugin.schema.json",
   "name": "vmware-storage",
   "displayName": "VMware Storage",
-  "version": "2.4.2",
-  "description": "VMware vSphere storage with 15 MCP tools: datastores, iSCSI, vSAN, FC multipath.",
+  "version": "2.5.0",
+  "description": "VMware vSphere storage with 16 MCP tools: datastores, iSCSI, vSAN, FC multipath.",
   "author": {
     "name": "Wei Zhou",
     "email": "zhouwei008@gmail.com",

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/.mcp.json

@@ -5,7 +5,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-storage==2.4.2",
+        "vmware-storage==2.5.0",
         "vmware-storage-mcp"
       ]
     }

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/PKG-INFO

@@ -1,6 +1,6 @@
 Metadata-Version: 2.5
 Name: vmware-storage
-Version: 2.4.2
+Version: 2.5.0
 Summary: VMware vSphere storage management: datastores, iSCSI, vSAN. Domain-focused MCP skill.
 Project-URL: Homepage, https://github.com/vmware-skills/VMware-Storage
 Project-URL: Repository, https://github.com/vmware-skills/VMware-Storage
@@ -22,13 +22,15 @@ Description-Content-Type: text/markdown
 <!-- mcp-name: io.github.vmware-skills/vmware-storage -->
 # VMware Storage
 
+For a read-only check of this skill with your model and agent host, use the shared [model-fit self-test](https://github.com/vmware-skills/marketplace/blob/main/MODEL_FIT_SELF_TEST.md) in the marketplace root.
+
 > **Author**: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com
 > This is a community-driven project by a VMware engineer, not an official VMware product.
 > For official VMware developer tools see [developer.broadcom.com](https://developer.broadcom.com).
 
 [English](README.md) | [中文](README-CN.md)
 
-VMware vSphere storage management: datastores, iSCSI, vSAN, and read-only Fibre Channel / multipath diagnostics — 15 MCP tools, domain-focused and lightweight.
+VMware vSphere storage management: datastores, iSCSI, vSAN, and read-only Fibre Channel / multipath diagnostics — 16 MCP tools, domain-focused and lightweight.
 
 > Split from vmware-aiops for lighter context and local model compatibility.
 
@@ -109,11 +111,11 @@ chmod 600 ~/.vmware-storage/.env
 vmware-storage doctor
 ```
 
-## MCP Tools (15)
+## MCP Tools (16)
 
 | Category | Tools | Type |
 |----------|-------|------|
-| Datastore | `list_all_datastores`, `browse_datastore`, `scan_datastore_images`, `list_cached_images` | Read |
+| Datastore | `list_all_datastores`, `get_datastore_vm_usage`, `browse_datastore`, `scan_datastore_images`, `list_cached_images` | Read |
 | iSCSI | `enable_iscsi`, `get_iscsi_status`, `add_iscsi_target`, `remove_iscsi_target`, `rescan_storage` | Read/Write |
 | vSAN | `get_vsan_health`, `get_vsan_capacity`, `get_vsan_efficiency` | Read |
 | FC / multipath | `list_fc_adapters`, `list_storage_device_paths` | Read |
@@ -233,7 +235,7 @@ vmware-storage-mcp
 
 `vmware-aiops` has 61 MCP tools — too heavy for local LLMs (7B-14B). By splitting storage into its own skill:
 
-- **15 tools** — fits comfortably in small model context windows
+- **16 tools** — fits comfortably in small model context windows
 - **Domain-focused** — storage admins get only what they need
 - **Least privilege** — can run under a vCenter service account with storage read-only permissions
 - **Composable** — use alongside vmware-monitor or vmware-aiops as needed
@@ -260,8 +262,8 @@ vmware-storage-mcp
 
 | Feature | Description |
 |---------|-------------|
-| Read-heavy | 11/15 tools are read-only |
-| Preview by default (MCP) | The 4 write tools take `confirm` (default `false`): a call without it changes nothing and returns `blast_radius` (host, adapters, and for target removal the paths, devices and datastores behind the target). `confirm=true` is refused when a datastore would lose every path or part of the blast radius could not be read. `dry_run` is a deprecated alias |
+| Read-heavy | 12/16 tools are read-only |
+| Preview by default (MCP) | The 4 write tools take `confirm` (default `false`): a call without it changes nothing and returns `blast_radius` (host, adapters, and for target removal the paths, devices and datastores behind the target). `confirm=true` is refused when a datastore would lose every path or part of the blast radius could not be read. the old `dry_run` alias was removed in 2.4.3 and is refused as an unknown argument |
 | Input validation | IP addresses and ports validated before iSCSI operations |
 | Audit logging | All operations logged to `~/.vmware-storage/audit.log` |
 | No VM operations | Cannot create, delete, or modify VMs |

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/README-CN.md

@@ -1,13 +1,15 @@
 <!-- mcp-name: io.github.vmware-skills/vmware-storage -->
 # VMware Storage
 
+要用自己的模型和 Agent 平台进行只读自测，请看 marketplace 根目录的[共享模型适配自测任务](https://github.com/vmware-skills/marketplace/blob/main/MODEL_FIT_SELF_TEST.md)。
+
 > **作者**: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com
 > 本项目由 VMware 工程师维护的社区项目，非 VMware 官方产品。
 > VMware 官方开发者工具请访问 [developer.broadcom.com](https://developer.broadcom.com)。
 
 [English](README.md) | [中文](README-CN.md)
 
-VMware vSphere 存储管理：数据存储、iSCSI、vSAN，以及只读的光纤通道（FC）/ 多路径诊断 — 15 个 MCP 工具，领域专注、轻量级。
+VMware vSphere 存储管理：数据存储、iSCSI、vSAN，以及只读的光纤通道（FC）/ 多路径诊断 — 16 个 MCP 工具，领域专注、轻量级。
 
 > 从 vmware-aiops 拆分，更轻量的上下文，兼容本地小模型。
 
@@ -99,11 +101,11 @@ targets:
     password_env: VMWARE_ESXIPROD_PASSWORD
 ```
 
-## MCP 工具（15 个）
+## MCP 工具（16 个）
 
 | 类别 | 工具 | 类型 |
 |------|------|------|
-| 数据存储 | `list_all_datastores`、`browse_datastore`、`scan_datastore_images`、`list_cached_images` | 只读 |
+| 数据存储 | `list_all_datastores`、`get_datastore_vm_usage`、`browse_datastore`、`scan_datastore_images`、`list_cached_images` | 只读 |
 | iSCSI | `enable_iscsi`、`get_iscsi_status`、`add_iscsi_target`、`remove_iscsi_target`、`rescan_storage` | 读/写 |
 | vSAN | `get_vsan_health`、`get_vsan_capacity`、`get_vsan_efficiency` | 只读 |
 | FC / 多路径 | `list_fc_adapters`、`list_storage_device_paths` | 只读 |
@@ -113,6 +115,7 @@ targets:
 
 **数据存储**
 - `list_all_datastores` — 列出所有数据存储，含容量、使用率、可达性
+- `get_datastore_vm_usage` — 一个数据存储上哪些虚拟机占得最多（实际占用 GB，从大到小），以及不属于任何虚拟机的空间
 - `browse_datastore` — 浏览数据存储目录下的文件（支持 glob 过滤）
 - `scan_datastore_images` — 扫描可部署镜像（OVA、ISO、OVF、VMDK）
 - `list_cached_images` — 查询本地镜像注册表（支持按类型/数据存储/target 过滤）
@@ -251,7 +254,7 @@ vmware-storage-mcp
 
 `vmware-aiops` 有 61 个 MCP 工具——对本地小模型（7B-14B）来说上下文占用太重。独立拆分后：
 
-- **15 个工具** — 完全适合小模型上下文窗口
+- **16 个工具** — 完全适合小模型上下文窗口
 - **领域专注** — 存储管理员只看到需要的工具
 - **最小权限** — 可以配置只有存储只读权限的 vCenter 服务账号
 - **可组合** — 可与 vmware-monitor 或 vmware-aiops 同时运行
@@ -270,8 +273,8 @@ vmware-storage-mcp
 
 | 功能 | 说明 |
 |------|------|
-| 只读为主 | 15 个工具中 11 个只读 |
-| 默认只预览（MCP） | 4 个写工具接受 `confirm`（默认 `false`）：不带它的调用不做任何变更，只返回 `blast_radius`（主机、适配器；移除目标时还有该目标背后的路径、设备和数据存储）。某个数据存储会失去全部路径、或影响范围有任何部分读不到时，`confirm=true` 会被拒绝。`dry_run` 为已弃用的别名 |
+| 只读为主 | 16 个工具中 12 个只读 |
+| 默认只预览（MCP） | 4 个写工具接受 `confirm`（默认 `false`）：不带它的调用不做任何变更，只返回 `blast_radius`（主机、适配器；移除目标时还有该目标背后的路径、设备和数据存储）。某个数据存储会失去全部路径、或影响范围有任何部分读不到时，`confirm=true` 会被拒绝。旧的 `dry_run` 别名已在 2.4.3 移除，仍传它会被当作未知参数拒绝 |
 | 输入验证 | iSCSI 操作前验证 IP 地址和端口 |
 | 审计日志 | 所有操作记录到 `~/.vmware-storage/audit.log`（JSON Lines） |
 | 双重确认 | CLI iSCSI 写操作需两次确认 |

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/README.md

@@ -1,13 +1,15 @@
 <!-- mcp-name: io.github.vmware-skills/vmware-storage -->
 # VMware Storage
 
+For a read-only check of this skill with your model and agent host, use the shared [model-fit self-test](https://github.com/vmware-skills/marketplace/blob/main/MODEL_FIT_SELF_TEST.md) in the marketplace root.
+
 > **Author**: Wei Zhou, VMware by Broadcom — wei-wz.zhou@broadcom.com
 > This is a community-driven project by a VMware engineer, not an official VMware product.
 > For official VMware developer tools see [developer.broadcom.com](https://developer.broadcom.com).
 
 [English](README.md) | [中文](README-CN.md)
 
-VMware vSphere storage management: datastores, iSCSI, vSAN, and read-only Fibre Channel / multipath diagnostics — 15 MCP tools, domain-focused and lightweight.
+VMware vSphere storage management: datastores, iSCSI, vSAN, and read-only Fibre Channel / multipath diagnostics — 16 MCP tools, domain-focused and lightweight.
 
 > Split from vmware-aiops for lighter context and local model compatibility.
 
@@ -88,11 +90,11 @@ chmod 600 ~/.vmware-storage/.env
 vmware-storage doctor
 ```
 
-## MCP Tools (15)
+## MCP Tools (16)
 
 | Category | Tools | Type |
 |----------|-------|------|
-| Datastore | `list_all_datastores`, `browse_datastore`, `scan_datastore_images`, `list_cached_images` | Read |
+| Datastore | `list_all_datastores`, `get_datastore_vm_usage`, `browse_datastore`, `scan_datastore_images`, `list_cached_images` | Read |
 | iSCSI | `enable_iscsi`, `get_iscsi_status`, `add_iscsi_target`, `remove_iscsi_target`, `rescan_storage` | Read/Write |
 | vSAN | `get_vsan_health`, `get_vsan_capacity`, `get_vsan_efficiency` | Read |
 | FC / multipath | `list_fc_adapters`, `list_storage_device_paths` | Read |
@@ -212,7 +214,7 @@ vmware-storage-mcp
 
 `vmware-aiops` has 61 MCP tools — too heavy for local LLMs (7B-14B). By splitting storage into its own skill:
 
-- **15 tools** — fits comfortably in small model context windows
+- **16 tools** — fits comfortably in small model context windows
 - **Domain-focused** — storage admins get only what they need
 - **Least privilege** — can run under a vCenter service account with storage read-only permissions
 - **Composable** — use alongside vmware-monitor or vmware-aiops as needed
@@ -239,8 +241,8 @@ vmware-storage-mcp
 
 | Feature | Description |
 |---------|-------------|
-| Read-heavy | 11/15 tools are read-only |
-| Preview by default (MCP) | The 4 write tools take `confirm` (default `false`): a call without it changes nothing and returns `blast_radius` (host, adapters, and for target removal the paths, devices and datastores behind the target). `confirm=true` is refused when a datastore would lose every path or part of the blast radius could not be read. `dry_run` is a deprecated alias |
+| Read-heavy | 12/16 tools are read-only |
+| Preview by default (MCP) | The 4 write tools take `confirm` (default `false`): a call without it changes nothing and returns `blast_radius` (host, adapters, and for target removal the paths, devices and datastores behind the target). `confirm=true` is refused when a datastore would lose every path or part of the blast radius could not be read. the old `dry_run` alias was removed in 2.4.3 and is refused as an unknown argument |
 | Input validation | IP addresses and ports validated before iSCSI operations |
 | Audit logging | All operations logged to `~/.vmware-storage/audit.log` |
 | No VM operations | Cannot create, delete, or modify VMs |

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/RELEASE_NOTES.md

@@ -1,3 +1,9 @@
+## v2.5.0 — per-VM datastore usage and clearer storage refusals (2026-11-01)
+
+* New read-only `get_datastore_vm_usage(datastore_name, top_n=10)` reports per-VM committed, uncommitted and unshared space on one datastore, plus attributed/unattributed used space and VMs whose usage could not be measured. It uses one PropertyCollector pass, sorts largest committed usage first, and does not turn unknown into zero. The MCP surface now has 16 tools. Verified against a lab vCenter before this release branch.
+* An unknown cluster or invalid storage path now returns the specific corrective hint instead of a generic connection hint. On a cluster without vSAN, `get_vsan_efficiency` reports both feature flags as unknown and says vSAN is disabled.
+* Removed the deprecated MCP `dry_run` alias from the destructive tools. Use `confirm=False` for a no-write preview and `confirm=True` after reviewing its blast radius; clients still passing `dry_run` must update.
+
 ## v2.4.2 — a login refused for lack of a vSphere role says so (2026-10-19)
 
 * **A login vCenter refuses with `NoPermission` gets the role error, not the raw fault.** Found on a vCenter 8.0.3
@@ -8,8 +14,6 @@
   neutral text naming the (sanitized) privilege. A wrong password (`InvalidLogin`) is unchanged. Same text as
   vmware-monitor.
 
-## Unreleased — follow-ups to the 2.4.1 review
-
 * **`list_cached_images(target=...)`** returns one target's cached images; without it, nothing changes.
 * The cache write takes a lock across processes, so a CLI and an MCP scan at the same time keep both sides' rows; a
   lock held for more than 10 s is reported in `cache_note` with the lock file's path.
@@ -1512,4 +1516,4 @@ Domain-focused VMware storage skill, split from vmware-aiops for lighter context
 
 ### Datastore Management / 数据存储管理
 
-- `list_all_datastores` — List all datastores with capacity, usage 
+- `list_all_datastores` — List all datastores with capacity, usage

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/openclaw.plugin.json

@@ -1,7 +1,7 @@
 {
   "id": "vmware-storage",
   "name": "VMware Storage",
-  "description": "VMware vSphere storage with 15 MCP tools: datastores, iSCSI, vSAN, FC multipath.",
+  "description": "VMware vSphere storage with 16 MCP tools: datastores, iSCSI, vSAN, FC multipath.",
   "skills": [
     "./skills"
   ],
@@ -11,7 +11,7 @@
       "command": "uvx",
       "args": [
         "--from",
-        "vmware-storage==2.4.2",
+        "vmware-storage==2.5.0",
         "vmware-storage-mcp"
       ]
     }

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/package.json

@@ -1,7 +1,7 @@
 {
   "name": "@zw008/vmware-storage",
-  "version": "2.4.2",
-  "description": "VMware vSphere storage with 15 MCP tools: datastores, iSCSI, vSAN, FC multipath.",
+  "version": "2.5.0",
+  "description": "VMware vSphere storage with 16 MCP tools: datastores, iSCSI, vSAN, FC multipath.",
   "private": true,
   "license": "MIT",
   "homepage": "https://github.com/vmware-skills/VMware-Storage",

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/pyproject.toml

@@ -4,7 +4,7 @@ build-backend = "hatchling.build"
 
 [project]
 name = "vmware-storage"
-version = "2.4.2"
+version = "2.5.0"
 description = "VMware vSphere storage management: datastores, iSCSI, vSAN. Domain-focused MCP skill."
 readme = "README.md"
 license = "MIT"

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/server.json

@@ -2,17 +2,17 @@
   "$schema": "https://static.modelcontextprotocol.io/schemas/2025-12-11/server.schema.json",
   "name": "io.github.vmware-skills/vmware-storage",
   "title": "VMware Storage",
-  "description": "VMware vSphere storage with 15 MCP tools: datastores, iSCSI, vSAN, FC multipath.",
+  "description": "VMware vSphere storage with 16 MCP tools: datastores, iSCSI, vSAN, FC multipath.",
   "repository": {
     "url": "https://github.com/vmware-skills/VMware-Storage",
     "source": "github"
   },
-  "version": "2.4.2",
+  "version": "2.5.0",
   "packages": [
     {
       "registryType": "pypi",
       "identifier": "vmware-storage",
-      "version": "2.4.2",
+      "version": "2.5.0",
       "runtimeHint": "uvx",
       "packageArguments": [
         {

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/skills/vmware-storage/SKILL.md

@@ -19,9 +19,11 @@ compatibility: >
 
 # VMware Storage
 
+> Self-test: [guide](https://github.com/vmware-skills/marketplace/blob/main/MODEL_FIT_SELF_TEST.md).
+
 > **Disclaimer**: This is a community-maintained open-source project and is **not affiliated with, endorsed by, or sponsored by VMware, Inc. or Broadcom Inc.** "VMware" and "vSphere" are trademarks of Broadcom. Source code is publicly auditable at [github.com/vmware-skills/VMware-Storage](https://github.com/vmware-skills/VMware-Storage) under the MIT license.
 
-VMware vSphere storage management — 15 MCP tools for datastores, iSCSI, vSAN, Fibre Channel / multipath diagnostics, and an access self-check.
+VMware vSphere storage management — 16 MCP tools for datastores, iSCSI, vSAN, Fibre Channel / multipath diagnostics, and an access self-check.
 
 > Split from vmware-aiops for lighter context and local model compatibility.
 > **Companion skills**: [vmware-aiops](https://github.com/vmware-skills/VMware-AIops) (VM lifecycle), [vmware-monitor](https://github.com/vmware-skills/VMware-Monitor) (read-only monitoring), [vmware-vks](https://github.com/vmware-skills/VMware-VKS) (Tanzu Kubernetes), [vmware-nsx](https://github.com/vmware-skills/VMware-NSX) (NSX networking), [vmware-nsx-security](https://github.com/vmware-skills/VMware-NSX-Security) (DFW/firewall), [vmware-aria](https://github.com/vmware-skills/VMware-Aria) (metrics/alerts/capacity), [vmware-avi](https://github.com/vmware-skills/VMware-AVI) (AVI/ALB/AKO), [vmware-harden](https://github.com/vmware-skills/VMware-Harden) (compliance baselines).
@@ -40,7 +42,7 @@ VMware vSphere storage management — 15 MCP tools for datastores, iSCSI, vSAN,
 ## Quick Install
 
 ```bash
-uv tool install vmware-storage==2.4.2
+uv tool install vmware-storage==2.5.0
 vmware-storage init      # guided setup: writes config + .env (chmod 600, password grep-safe), then verifies
 vmware-storage doctor
 ```
@@ -147,15 +149,16 @@ vmware-storage iscsi status esxi-lab --target lab-esxi
 | Cloud models (Claude, GPT-4o) | Either | MCP gives structured JSON I/O |
 | Automated pipelines | **MCP** | Type-safe parameters, structured output |
 
-## MCP Tools (15 — 11 read, 4 write)
+## MCP Tools (16 — 12 read, 4 write)
 
-All MCP tools accept an optional `target` parameter to select which vCenter/ESXi to connect to. The 4 write tools take `confirm` (default false): without it they change nothing and return `blast_radius` — the host and adapters touched, and for `remove_iscsi_target` the paths, devices and datastores behind the target. Show it to the user; pass `confirm: true` only after they decide. `dry_run` is a deprecated alias.
+All MCP tools accept an optional `target` parameter to select which vCenter/ESXi to connect to. The 4 write tools take `confirm` (default false): without it they change nothing and return `blast_radius` — the host and adapters touched, and for `remove_iscsi_target` the paths, devices and datastores behind the target. Show it to the user; pass `confirm: true` only after they decide. the old `dry_run` alias was removed in 2.4.3 and is refused as an unknown argument.
 
 The four Datastore read tools return the family list envelope — `{items, returned, limit, total, truncated, hint}` — rather than a bare array. Read the rows from `items`; `truncated` says whether the listing is complete, so it never has to be guessed from the row count. All four enumerate their collection in full, so `total` is the real count and `truncated` is always `false`.
 
 | Category | Tool | Type | Description |
 |----------|------|:----:|-------------|
 | Datastore | `list_all_datastores` | Read | List datastores with capacity, usage %, VM count |
+| | `get_datastore_vm_usage` | Read | Which VMs take the space on one datastore (committed GB, largest first) and how much no VM accounts for |
 | | `browse_datastore` | Read | Browse files with optional path and glob pattern |
 | | `scan_datastore_images` | Read | Find OVA/ISO/OVF/VMDK in a datastore |
 | | `list_cached_images` | Read | Query local image registry with type/datastore/target filters |
@@ -171,7 +174,7 @@ The four Datastore read tools return the family list envelope — `{items, retur
 | | `list_storage_device_paths` | Read | Per-device path state across a cluster/host/datastore; visibility and path-count differences |
 | Access | `get_access_info` | Read | Account in use and, per tool, whether its privileges are granted on the root folder |
 
-**Read/write split**: 11 tools are read-only, 4 modify state. Write tools require explicit parameters (host name, IP address), preview unless `confirm: true`, refuse when a datastore would lose every path or the host's storage view cannot be read, and are audit-logged. `remove_iscsi_target` is classified `risk:high` (destructive — LUNs can become inaccessible) and goes through the policy confirmation gate.
+**Read/write split**: 12 tools are read-only, 4 modify state. Write tools require explicit parameters (host name, IP address), preview unless `confirm: true`, refuse when a datastore would lose every path or the host's storage view cannot be read, and are audit-logged. `remove_iscsi_target` is classified `risk:high` (destructive — LUNs can become inaccessible) and goes through the policy confirmation gate.
 
 Running with local or small models? See [`references/agent-guardrails.md`](references/agent-guardrails.md).
 
@@ -257,7 +260,7 @@ Corporate TLS proxies inject certificates that uv's bundled CA store doesn't tru
 ## Safety
 
 - **No VM operations**: This skill cannot power on/off, create, delete, or modify VMs — that scope belongs to `vmware-aiops`
-- **Read-heavy**: 11 of 15 tools are read-only (list, browse, scan, cached images, status, health, capacity, efficiency, FC adapters, device paths, access info)
+- **Read-heavy**: 12 of 16 tools are read-only (list, per-VM usage, browse, scan, cached images, status, health, capacity, efficiency, FC adapters, device paths, access info)
 - **Audit logging**: All operations (including reads) are logged to `~/.vmware/audit.db` (SQLite WAL, via vmware-policy) with timestamp, user, target, operation, parameters, and result
 - **Double confirmation**: CLI write commands (iSCSI enable, add/remove target) require two separate "Are you sure?" prompts before executing
 - **Dry-run mode**: All write commands support `--dry-run` to preview API calls without executing
@@ -271,7 +274,7 @@ Corporate TLS proxies inject certificates that uv's bundled CA store doesn't tru
 ## Setup
 
 ```bash
-uv tool install vmware-storage==2.4.2
+uv tool install vmware-storage==2.5.0
 mkdir -p ~/.vmware-storage
 cp config.example.yaml ~/.vmware-storage/config.yaml
 # Edit config.yaml with your vCenter/ESXi targets

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/skills/vmware-storage/references/agent-guardrails.md

@@ -14,7 +14,7 @@ vmware-monitor and vmware-aria against a production vSphere estate with Llama
 cross-skill rules are identical across this family; the parts below marked
 vmware-storage are specific to this skill.
 
-vmware-storage exposes 15 MCP tools, 4 of which change state. The write
+vmware-storage exposes 16 MCP tools, 4 of which change state. The write
 surface is small but sharp: removing an iSCSI send target can make LUNs — and
 every VM living on them — inaccessible.
 

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/skills/vmware-storage/references/capabilities.md

@@ -1,6 +1,6 @@
 # VMware Storage Capabilities
 
-All 15 MCP tools exposed by `vmware-storage-mcp`, organized by category.
+All 16 MCP tools exposed by `vmware-storage-mcp`, organized by category.
 
 ## Automation Level Reference
 
@@ -8,7 +8,7 @@ Each operation is classified by autonomy level per the Enterprise Harness Engine
 
 | Level | Meaning | Agent autonomy | Examples in this skill |
 |:-:|---|---|---|
-| **L1** | Read-only, raw data | Always auto-run | `list_all_datastores`, `browse_datastore`, `scan_datastore_images`, `list_cached_images`, `get_iscsi_status`, vSAN status queries |
+| **L1** | Read-only, raw data | Always auto-run | `list_all_datastores`, `get_datastore_vm_usage`, `browse_datastore`, `scan_datastore_images`, `list_cached_images`, `get_iscsi_status`, vSAN status queries |
 | **L2** | Read + analysis / recommendation | Always auto-run | datastore capacity analysis, image registry queries, iSCSI target health correlation |
 | **L3** | Single write — user must approve | Only after explicit confirmation; high-risk ops require double-confirm + `--dry-run` (see Confirm column) | `enable_iscsi`, `add_iscsi_target`, `remove_iscsi_target`, vSAN cluster ops |
 | **L4** | Multi-step plan / apply workflow | Plan generation auto; apply gated by user approval | *(roadmap — multi-host iSCSI rollout, vSAN expansion plans)* |
@@ -24,6 +24,7 @@ Each operation is classified by autonomy level per the Enterprise Harness Engine
 | Tool | Description | Parameters | Risk | Confirm |
 |------|-------------|------------|:----:|:-------:|
 | `list_all_datastores` | List datastores with capacity, usage %, VM count | `target` (string, optional), `limit` (int, optional; omit for all) | Low | No |
+| `get_datastore_vm_usage` | Per-VM space on one datastore: committed / uncommitted / unshared GB, largest first, plus `unattributed_gb` (used space no VM accounts for) and `unmeasured_vms` | `datastore_name` (string, **required**), `top_n` (int, optional, default 10), `target` (string, optional) | Low | No |
 | `browse_datastore` | Browse files with optional path and glob pattern | `datastore_name` (string, **required**), `path` (string, optional), `pattern` (string, optional), `target` (string, optional) | Low | No |
 | `scan_datastore_images` | Find OVA/ISO/OVF/VMDK deployable images in a datastore | `datastore_name` (string, **required**), `target` (string, optional) | Low | No |
 | `list_cached_images` | Query local image registry with type/datastore/target filters | `image_type` (string, optional), `datastore` (string, optional), `target` (string, optional) | Low | No |
@@ -108,7 +109,7 @@ Source: each host's `config.storageDevice` (HBAs, SCSI LUNs, `multipathInfo`) an
 
 ## Audit Coverage
 
-All 15 tools are wrapped with `@vmware_tool` from vmware-policy, which provides:
+All 16 tools are wrapped with `@vmware_tool` from vmware-policy, which provides:
 
 - **Pre-execution**: Policy rule check against `~/.vmware/rules.yaml` (deny rules, maintenance windows)
 - **Post-execution**: Audit log entry written to `~/.vmware/audit.db` (SQLite WAL mode)
@@ -118,7 +119,7 @@ All 15 tools are wrapped with `@vmware_tool` from vmware-policy, which provides:
 
 | Type | Count | Tools |
 |------|:-----:|-------|
-| Read | 10 | `list_all_datastores`, `browse_datastore`, `scan_datastore_images`, `list_cached_images`, `get_iscsi_status`, `get_vsan_health`, `get_vsan_capacity`, `get_vsan_efficiency`, `list_fc_adapters`, `list_storage_device_paths` |
+| Read | 11 | `list_all_datastores`, `get_datastore_vm_usage`, `browse_datastore`, `scan_datastore_images`, `list_cached_images`, `get_iscsi_status`, `get_vsan_health`, `get_vsan_capacity`, `get_vsan_efficiency`, `list_fc_adapters`, `list_storage_device_paths` |
 | Write | 4 | `enable_iscsi`, `add_iscsi_target`, `remove_iscsi_target`, `rescan_storage` |
 
 > Write tools require explicit parameters (host name, IP address) and support `--dry-run` in CLI mode. Over MCP they preview by default: without `confirm: true` they return `blast_radius` and change nothing. All write operations are audit-logged with timestamp, user, target, operation, parameters, and result.

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/skills/vmware-storage/references/setup-guide.md

@@ -13,19 +13,19 @@ Complete setup and security guide for `vmware-storage`.
 ### Via uv (recommended)
 
 ```bash
-uv tool install vmware-storage==2.4.2
+uv tool install vmware-storage==2.5.0
 ```
 
 ### Via pip
 
 ```bash
-pip install vmware-storage==2.4.2
+pip install vmware-storage==2.5.0
 ```
 
 ### From source
 
 ```bash
-git clone --branch v2.4.2 https://github.com/vmware-skills/VMware-Storage.git
+git clone --branch v2.5.0 https://github.com/vmware-skills/VMware-Storage.git
 cd VMware-Storage
 pip install -e .
 ```

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/tests/eval/regression/test_audit_isolation.py

@@ -121,10 +121,17 @@ def test_an_audited_write_lands_in_the_sandbox_and_not_in_the_real_db() -> None:
     real_db = REAL_HOME / ".vmware" / "audit.db"
     if not real_db.exists():
         pytest.skip("no production audit database on this machine to check against")
-    with sqlite3.connect(f"file:{real_db}?mode=ro", uri=True) as con:
-        leaked = con.execute(
-            "SELECT count(*) FROM audit_log WHERE tool = ?", (marker,)
-        ).fetchone()[0]
+    try:
+        with sqlite3.connect(f"file:{real_db}?mode=ro", uri=True) as con:
+            leaked = con.execute(
+                "SELECT count(*) FROM audit_log WHERE tool = ?", (marker,)
+            ).fetchone()[0]
+    except sqlite3.OperationalError as exc:
+        # A restricted runner may see the file but have no permission to open it.
+        # The sandbox write assertion above still ran; this external check did not.
+        if "unable to open database file" in str(exc):
+            pytest.skip("production audit database is outside this runner's readable roots")
+        raise
     assert leaked == 0, (
         f"{leaked} row(s) from this test reached the operator's audit database "
         f"at {real_db}"

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/tests/eval/regression/test_datastore_list_renders.py

@@ -88,7 +88,9 @@ def test_a_datastore_over_the_threshold_is_still_styled_red() -> None:
     assert cool.style != "red"
 
     # ...and the style survives to the terminal, not just the object.
-    console = Console(force_terminal=True, width=40)
+    # The runner may set TERM=dumb or NO_COLOR=1. Test Rich's colour rendering
+    # explicitly, independent of the surrounding terminal policy.
+    console = Console(force_terminal=True, color_system="standard", no_color=False, width=40)
     with console.capture() as cap:
         console.print(hot)
     assert "\x1b[31m" in cap.get()

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/tests/eval/regression/test_storage_hardening_fixes.py

@@ -101,11 +101,11 @@ def test_iscsi_status_risk_level_is_low():
 
 
 @pytest.mark.parametrize("tool_name", _WRITE_TOOLS)
-def test_write_tools_take_confirm_and_keep_dry_run_as_alias(tool_name):
-    """HLD §7: ``confirm`` defaults to False; ``dry_run`` is a deprecated alias.
+def test_write_tools_take_confirm_and_no_dry_run(tool_name):
+    """HLD §7: ``confirm`` defaults to False; the ``dry_run`` alias is gone (2.4.3).
 
     Until the confirmation gate, ``dry_run`` defaulted to False, so a bare call
-    acted. The alias now defaults to None so the schema shows it was not passed.
+    acted. It was a deprecated alias for one minor cycle and is now removed.
     """
     import inspect
 
@@ -114,7 +114,7 @@ def test_write_tools_take_confirm_and_keep_dry_run_as_alias(tool_name):
     fn = getattr(server, tool_name)
     sig = inspect.signature(inspect.unwrap(fn))
     assert sig.parameters["confirm"].default is False
-    assert sig.parameters["dry_run"].default is None
+    assert "dry_run" not in sig.parameters
 
 
 @pytest.mark.parametrize(
@@ -126,8 +126,8 @@ def test_write_tools_take_confirm_and_keep_dry_run_as_alias(tool_name):
         ("rescan_storage", {"host_name": "esxi-01"}),
     ],
 )
-def test_dry_run_previews_without_writing(tool_name, kwargs, monkeypatch):
-    """dry_run=True must return a preview and never reach an executor.
+def test_a_bare_call_previews_without_writing(tool_name, kwargs, monkeypatch):
+    """A call without confirm must return a preview and never reach an executor.
 
     It used to return a canned string without connecting. The preview now
     measures the blast radius (HLD §7), which needs the connection, so the
@@ -138,7 +138,7 @@ def test_dry_run_previews_without_writing(tool_name, kwargs, monkeypatch):
     from vmware_storage.mcp_server import server
 
     def explode(*a, **k):  # pragma: no cover - failure path
-        raise AssertionError("a dry_run preview must not reach an executor")
+        raise AssertionError("a preview must not reach an executor")
 
     radius = {"already_enabled": False, "already_configured": False,
               "blockers": [], "unmeasured": []}
@@ -152,9 +152,9 @@ def test_dry_run_previews_without_writing(tool_name, kwargs, monkeypatch):
                      "_ops_remove_iscsi_target", "_ops_rescan_storage"):
         monkeypatch.setattr(server, executor, explode)
     fn = inspect.unwrap(getattr(server, tool_name))
-    result = fn(dry_run=True, **kwargs)
+    result = fn(**kwargs)
     assert result["action"] == "preview"
-    assert "dry_run is deprecated" in result["deprecated"]
+    assert "deprecated" not in result
 
 
 # ── Fix 3: audit failure must not flip a successful write ──────────────────
@@ -232,12 +232,12 @@ def _list_tools():
     return asyncio.run(mcp.list_tools())
 
 
-def test_mcp_exposes_15_tools_11_read_4_write():
+def test_mcp_exposes_16_tools_12_read_4_write():
     tools = _list_tools()
-    assert len(tools) == 15, f"Expected 15 MCP tools, got {len(tools)}: {[t.name for t in tools]}"
+    assert len(tools) == 16, f"Expected 16 MCP tools, got {len(tools)}: {[t.name for t in tools]}"
     read = [t.name for t in tools if t.annotations and t.annotations.readOnlyHint]
     write = [t.name for t in tools if not (t.annotations and t.annotations.readOnlyHint)]
-    assert len(read) == 11, f"Expected 11 read tools, got {len(read)}: {read}"
+    assert len(read) == 12, f"Expected 12 read tools, got {len(read)}: {read}"
     assert len(write) == 4, f"Expected 4 write tools, got {len(write)}: {write}"
     assert sorted(write) == sorted(_WRITE_TOOLS)
 

{vmware_storage-2.4.2 → vmware_storage-2.5.0}/tests/eval/regression/test_vsan_efficiency.py

@@ -178,6 +178,23 @@ def test_efficiency_absent_fields_do_not_crash(patched, monkeypatch):
     assert result["compression_enabled"] is None
 
 
+def test_vsan_off_reports_both_flags_as_not_applicable(patched, monkeypatch):
+    # 2026-10-24, 8.0.3 lab, vSAN off: the SDK answered dedupEnabled=False with
+    # compressionEnabled absent, so the tool said dedup "off" and compression
+    # "unknown" about a feature that does not apply.
+    config = SimpleNamespace(
+        enabled=False,
+        dataEfficiencyConfig=SimpleNamespace(dedupEnabled=False),
+    )
+    monkeypatch.setattr(ops, "_config_system", lambda si: _config_system_returning(config))
+
+    result = ops.get_vsan_efficiency(object(), "prod-cluster")
+
+    assert result["vsan_enabled"] is False
+    assert result["dedup_enabled"] is None and result["compression_enabled"] is None
+    assert result["message"] == "vSAN is not enabled on cluster 'prod-cluster'"
+
+
 def test_config_system_teaches_when_stub_absent(monkeypatch):
     # A session with no _stub gets a teaching VSANError, not an AttributeError.
     # VSANError is imported from its home now that vsan_efficiency no longer