714 lines
24 KiB
JavaScript
714 lines
24 KiB
JavaScript
|
"use strict";
|
||
|
|
|
||
|
|
const { AGENT_KINDS, CAPABILITY_STATUS } = require("../constants.cjs");
|
||
|
|
|
||
|
|
/** @type {import("../types.cjs").CapabilityDefinition[]} */
|
||
|
|
const VAULT_CAPABILITIES = [
|
||
|
|
{
|
||
|
|
id: "vault.host.get",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Get host metadata from the vault.",
|
||
|
|
policy: {
|
||
|
|
write: false,
|
||
|
|
sensitiveRead: true,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: true,
|
||
|
|
bypassesChatCancel: true,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["vault", "host", "get"] },
|
||
|
|
global: { rpcMethod: "vault/host/get" },
|
||
|
|
public: { rpcMethod: "public/vault/host/get", mcpTool: "host_get" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.host.list",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "List saved hosts in the vault (metadata only — no passwords or keys).",
|
||
|
|
policy: {
|
||
|
|
write: false,
|
||
|
|
sensitiveRead: true,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: true,
|
||
|
|
bypassesChatCancel: true,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
global: { rpcMethod: "vault/hosts/list" },
|
||
|
|
public: { rpcMethod: "public/vault/hosts/list", mcpTool: "vault_hosts_list" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.host.open",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description:
|
||
|
|
"Open a vault host by creating a new terminal tab and starting the connection. Returns the new sessionId so you can run terminal/SFTP tools against it. Use vault_hosts_list first when you only know the label or hostname.",
|
||
|
|
// Sidebar Catty is scoped to already-open terminals/workspaces and must not
|
||
|
|
// expand that scope mid-turn. Keep host_open for MCP / CLI / global agent.
|
||
|
|
agentKinds: [AGENT_KINDS.GLOBAL],
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["vault", "host", "open"] },
|
||
|
|
global: { rpcMethod: "vault/hosts/open" },
|
||
|
|
public: { rpcMethod: "public/vault/hosts/open", mcpTool: "host_open" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.hosts.create",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Create vault hosts from structured host objects. Use when the user wants to add/create a host (Vault → Hosts). NOT for Vault → Notes sidebar documentation.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
global: { rpcMethod: "vault/hosts/create" },
|
||
|
|
public: { rpcMethod: "public/vault/hosts/create", mcpTool: "vault_hosts_create" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.host.update",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Update selected fields on an existing vault host. Use vault_hosts_list first to resolve the hostId.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
global: { rpcMethod: "vault/hosts/update" },
|
||
|
|
public: { rpcMethod: "public/vault/hosts/update", mcpTool: "vault_hosts_update" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.host.delete",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Delete a saved vault host by id. Use vault_hosts_list first to resolve the hostId.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
global: { rpcMethod: "vault/hosts/delete" },
|
||
|
|
public: { rpcMethod: "public/vault/hosts/delete", mcpTool: "vault_hosts_delete" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.host.import",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Parse known host export file formats (PuTTY, MobaXterm, CSV, SecureCRT, ssh_config) into vault hosts. For arbitrary unstructured text, map to host objects and use vault_hosts_create instead.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
global: { rpcMethod: "vault/hosts/import" },
|
||
|
|
public: { rpcMethod: "public/vault/hosts/import", mcpTool: "vault_hosts_import" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.host.notes.get",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Read host metadata notes attached to a saved host (Host Details panel — not Vault sidebar Notes).",
|
||
|
|
policy: {
|
||
|
|
write: false,
|
||
|
|
sensitiveRead: true,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: true,
|
||
|
|
bypassesChatCancel: true,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["vault", "host-notes", "get"] },
|
||
|
|
global: { rpcMethod: "vault/host/notes/get" },
|
||
|
|
public: { rpcMethod: "public/vault/hostNotes/get", mcpTool: "host_notes_get" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.host.notes.set",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Update host metadata notes on a saved host (Host Details panel — not Vault sidebar Notes).",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["vault", "host-notes", "set"] },
|
||
|
|
global: { rpcMethod: "vault/host/notes/set" },
|
||
|
|
public: { rpcMethod: "public/vault/hostNotes/set", mcpTool: "host_notes_set" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.note.list",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "List notes in Vault → Notes (markdown notes visible in the vault sidebar).",
|
||
|
|
policy: {
|
||
|
|
write: false,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: true,
|
||
|
|
bypassesChatCancel: true,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
global: { rpcMethod: "vault/notes/list" },
|
||
|
|
public: { rpcMethod: "public/vault/notes/list", mcpTool: "vault_notes_list" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.note.get",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Read or search a Vault → Notes entry by exact id, at most 6000 characters per call. Content is only the returned range, not necessarily the whole note. Follow nextOffset with expectedUpdatedAt until null for a complete read; query searches only return matching excerpts. Read every range without query before summarizing the whole note or replacing its content; never treat unread text as absent. For long notes, retain section summaries rather than repeatedly loading all ranges. If the note changed, restart.",
|
||
|
|
policy: {
|
||
|
|
write: false,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: true,
|
||
|
|
bypassesChatCancel: true,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
global: { rpcMethod: "vault/notes/get" },
|
||
|
|
public: { rpcMethod: "public/vault/notes/get", mcpTool: "vault_notes_get" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.note.create",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Create a note in Vault → Notes sidebar (markdown documentation). NOT for adding SSH hosts — use vault_hosts_create for that.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
global: { rpcMethod: "vault/notes/create" },
|
||
|
|
public: { rpcMethod: "public/vault/notes/create", mcpTool: "vault_notes_create" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.note.update",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Update an existing Vault → Notes entry by id.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
global: { rpcMethod: "vault/notes/update" },
|
||
|
|
public: { rpcMethod: "public/vault/notes/update", mcpTool: "vault_notes_update" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.note.delete",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Delete a Vault → Notes entry by id.",
|
||
|
|
policy: { write: true, sensitiveRead: false, longRunning: false, requiresChatSession: false, bypassesObserverBlock: false, bypassesApproval: false, bypassesChatCancel: false },
|
||
|
|
surfaces: {
|
||
|
|
global: { rpcMethod: "vault/notes/delete" },
|
||
|
|
public: { rpcMethod: "public/vault/notes/delete", mcpTool: "vault_notes_delete" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.identity.list",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "List reusable vault identities without passwords, private keys, or passphrases.",
|
||
|
|
policy: { write: false, sensitiveRead: true, longRunning: false, requiresChatSession: false, bypassesObserverBlock: false, bypassesApproval: true, bypassesChatCancel: true },
|
||
|
|
surfaces: {
|
||
|
|
global: { rpcMethod: "vault/identities/list" },
|
||
|
|
public: { rpcMethod: "public/vault/identities/list", mcpTool: "vault_identities_list" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.proxyProfile.list",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "List reusable proxy profiles without credentials.",
|
||
|
|
policy: { write: false, sensitiveRead: true, longRunning: false, requiresChatSession: false, bypassesObserverBlock: false, bypassesApproval: true, bypassesChatCancel: true },
|
||
|
|
surfaces: {
|
||
|
|
global: { rpcMethod: "vault/proxyProfiles/list" },
|
||
|
|
public: { rpcMethod: "public/vault/proxyProfiles/list", mcpTool: "vault_proxy_profiles_list" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
...[
|
||
|
|
["vault.group.list", "List vault groups and their safe default settings.", "list", "vault_groups_list", false],
|
||
|
|
["vault.group.create", "Create a vault group with optional default connection settings.", "create", "vault_groups_create", true],
|
||
|
|
["vault.group.update", "Update or rename a vault group and its default connection settings.", "update", "vault_groups_update", true],
|
||
|
|
["vault.group.delete", "Delete a vault group, moving its hosts to the root unless deleteHosts is true.", "delete", "vault_groups_delete", true],
|
||
|
|
].map(([id, description, action, mcpTool, write]) => ({
|
||
|
|
id,
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description,
|
||
|
|
policy: { write, sensitiveRead: false, longRunning: false, requiresChatSession: false, bypassesObserverBlock: false, bypassesApproval: !write, bypassesChatCancel: !write },
|
||
|
|
surfaces: {
|
||
|
|
global: { rpcMethod: `vault/groups/${action}` },
|
||
|
|
public: { rpcMethod: `public/vault/groups/${action}`, mcpTool },
|
||
|
|
},
|
||
|
|
})),
|
||
|
|
{
|
||
|
|
id: "vault.snippets.list",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "List code snippets stored in the vault.",
|
||
|
|
policy: {
|
||
|
|
write: false,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: true,
|
||
|
|
bypassesChatCancel: true,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["snippets", "list"] },
|
||
|
|
global: { rpcMethod: "vault/snippets/list" },
|
||
|
|
public: { rpcMethod: "public/vault/snippets/list", mcpTool: "snippets_list" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.snippets.get",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Get a single code snippet from the vault.",
|
||
|
|
policy: {
|
||
|
|
write: false,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: true,
|
||
|
|
bypassesChatCancel: true,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["snippets", "get"] },
|
||
|
|
global: { rpcMethod: "vault/snippets/get" },
|
||
|
|
public: { rpcMethod: "public/vault/snippets/get", mcpTool: "snippets_get" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.snippets.run",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Run a vault snippet or automation script in a terminal session. Text snippets paste shell commands; scripts (kind=script) run via the nct JavaScript runtime.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: true,
|
||
|
|
requiresChatSession: true,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["snippets", "run"] },
|
||
|
|
global: { rpcMethod: "vault/snippets/run" },
|
||
|
|
public: { rpcMethod: "public/vault/snippets/run", mcpTool: "snippets_run" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.snippets.create",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Create a vault snippet or automation script (set kind=script for nct automation).",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["snippets", "create"] },
|
||
|
|
global: { rpcMethod: "vault/snippets/create" },
|
||
|
|
public: { rpcMethod: "public/vault/snippets/create", mcpTool: "snippets_create" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.snippets.update",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Update an existing vault snippet or automation script by id.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["snippets", "update"] },
|
||
|
|
global: { rpcMethod: "vault/snippets/update" },
|
||
|
|
public: { rpcMethod: "public/vault/snippets/update", mcpTool: "snippets_update" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.snippets.delete",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Delete a vault snippet or automation script by id.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["snippets", "delete"] },
|
||
|
|
global: { rpcMethod: "vault/snippets/delete" },
|
||
|
|
public: { rpcMethod: "public/vault/snippets/delete", mcpTool: "snippets_delete" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.scripts.list",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "List automation scripts (kind=script) in the vault.",
|
||
|
|
policy: {
|
||
|
|
write: false,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: true,
|
||
|
|
bypassesChatCancel: true,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["scripts", "list"] },
|
||
|
|
global: { rpcMethod: "vault/scripts/list" },
|
||
|
|
public: { rpcMethod: "public/vault/scripts/list", mcpTool: "scripts_list" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.scripts.get",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Get a single automation script including JavaScript source.",
|
||
|
|
policy: {
|
||
|
|
write: false,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: true,
|
||
|
|
bypassesChatCancel: true,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["scripts", "get"] },
|
||
|
|
global: { rpcMethod: "vault/scripts/get" },
|
||
|
|
public: { rpcMethod: "public/vault/scripts/get", mcpTool: "scripts_get" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.scripts.create",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Create an automation script using the nct JavaScript API. Call scripts_reference first when authoring nct automation.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["scripts", "create"] },
|
||
|
|
global: { rpcMethod: "vault/scripts/create" },
|
||
|
|
public: { rpcMethod: "public/vault/scripts/create", mcpTool: "scripts_create" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.scripts.update",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Update an automation script by id (partial fields).",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["scripts", "update"] },
|
||
|
|
global: { rpcMethod: "vault/scripts/update" },
|
||
|
|
public: { rpcMethod: "public/vault/scripts/update", mcpTool: "scripts_update" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.scripts.delete",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Delete an automation script and remove host connect bindings.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["scripts", "delete"] },
|
||
|
|
global: { rpcMethod: "vault/scripts/delete" },
|
||
|
|
public: { rpcMethod: "public/vault/scripts/delete", mcpTool: "scripts_delete" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.scripts.run",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Run an automation script in a terminal session via the nct runtime. Set wait=true to block until completion.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: true,
|
||
|
|
requiresChatSession: true,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["scripts", "run"] },
|
||
|
|
global: { rpcMethod: "vault/scripts/run" },
|
||
|
|
public: { rpcMethod: "public/vault/scripts/run", mcpTool: "scripts_run" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.scripts.reference",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Return Netcatty automation script syntax: nct API, triggers, host targeting, and source wrapping rules.",
|
||
|
|
policy: {
|
||
|
|
write: false,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: true,
|
||
|
|
bypassesChatCancel: true,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["scripts", "reference"] },
|
||
|
|
global: { rpcMethod: "vault/scripts/reference" },
|
||
|
|
public: { rpcMethod: "public/vault/scripts/reference", mcpTool: "scripts_reference" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.scripts.runs.list",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "List automation script runs (optionally filter by sessionId).",
|
||
|
|
policy: {
|
||
|
|
write: false,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: true,
|
||
|
|
bypassesChatCancel: true,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["scripts", "runs", "list"] },
|
||
|
|
global: { rpcMethod: "vault/scripts/runs/list" },
|
||
|
|
public: { rpcMethod: "public/vault/scripts/runs/list", mcpTool: "scripts_runs_list" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.scripts.run.stop",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Stop a running automation script by runId.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: true,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["scripts", "run", "stop"] },
|
||
|
|
global: { rpcMethod: "vault/scripts/run/stop" },
|
||
|
|
public: { rpcMethod: "public/vault/scripts/run/stop", mcpTool: "scripts_run_stop" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.scripts.run.pause",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Pause a running automation script by runId.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: true,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["scripts", "run", "pause"] },
|
||
|
|
global: { rpcMethod: "vault/scripts/run/pause" },
|
||
|
|
public: { rpcMethod: "public/vault/scripts/run/pause", mcpTool: "scripts_run_pause" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.scripts.run.resume",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Resume a paused automation script by runId.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: true,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["scripts", "run", "resume"] },
|
||
|
|
global: { rpcMethod: "vault/scripts/run/resume" },
|
||
|
|
public: { rpcMethod: "public/vault/scripts/run/resume", mcpTool: "scripts_run_resume" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.scripts.targets.set",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Set host IDs, dynamic group paths, or targetsAllHosts for an automation script. onConnect host IDs sync host connect queues.",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["scripts", "targets", "set"] },
|
||
|
|
global: { rpcMethod: "vault/scripts/targets/set" },
|
||
|
|
public: { rpcMethod: "public/vault/scripts/targets/set", mcpTool: "scripts_targets_set" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.host.connectScripts.list",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "List resolved onConnect automation scripts for a host (global, dynamic group, then host queue).",
|
||
|
|
policy: {
|
||
|
|
write: false,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: true,
|
||
|
|
bypassesChatCancel: true,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["vault", "host", "connect-scripts", "list"] },
|
||
|
|
global: { rpcMethod: "vault/host/connectScripts/list" },
|
||
|
|
public: { rpcMethod: "public/vault/hostConnectScripts/list", mcpTool: "host_connect_scripts_list" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
{
|
||
|
|
id: "vault.host.connectScripts.set",
|
||
|
|
domain: "vault",
|
||
|
|
status: CAPABILITY_STATUS.IMPLEMENTED,
|
||
|
|
description: "Set ordered onConnect script IDs for a host (host-specific queue; globals run separately).",
|
||
|
|
policy: {
|
||
|
|
write: true,
|
||
|
|
sensitiveRead: false,
|
||
|
|
longRunning: false,
|
||
|
|
requiresChatSession: false,
|
||
|
|
bypassesObserverBlock: false,
|
||
|
|
bypassesApproval: false,
|
||
|
|
bypassesChatCancel: false,
|
||
|
|
},
|
||
|
|
surfaces: {
|
||
|
|
cli: { command: ["vault", "host", "connect-scripts", "set"] },
|
||
|
|
global: { rpcMethod: "vault/host/connectScripts/set" },
|
||
|
|
public: { rpcMethod: "public/vault/hostConnectScripts/set", mcpTool: "host_connect_scripts_set" },
|
||
|
|
},
|
||
|
|
},
|
||
|
|
];
|
||
|
|
|
||
|
|
module.exports = { VAULT_CAPABILITIES };
|