Publish curated Unraid-AppOps-Gateway source from ba66029223865607deddc234e283c11127324eb8

backend/app/mcp_server.py

@@ -46,8 +46,8 @@ from .services.policy_engine import evaluate_policy
 from .services.privatemuse_artifact_installer import ArtifactInstallError
 from .services.privatemuse_artifact_installer import install as install_artifact_file
 from .services.privatemuse_artifact_installer import preflight as artifact_preflight
-from .services.runtime_service import runtime_info
 from .services.runner_statistics import RunnerStatisticsService
+from .services.runtime_service import runtime_info
 
 _SESSION_RUNNING = False
 _SESSION_VERIFIED_AT: str | None = None
@@ -623,6 +623,122 @@ def appops_self_upgrade_status(operation_id: str) -> dict[str, Any]:
     return _json(DeploymentBrokerClient().appops_self_upgrade_status(operation_id))
 
 
+@appops_mcp.tool(name="appops.hub_auto_apply.preflight", annotations=_READ_ONLY_TOOL)
+@_tracked("appops.hub_auto_apply.preflight")
+def appops_hub_auto_apply_preflight(repository: str) -> dict[str, Any]:
+    """Read the fixed registered Hub policy fingerprint without secret values."""
+    return _json(DeploymentBrokerClient().hub_auto_apply({"repository": repository}, preflight=True))
+
+
+@appops_mcp.tool(name="appops.hub_auto_apply.set", annotations=_OPERATION_RUN_TOOL)
+@_tracked("appops.hub_auto_apply.set")
+def appops_hub_auto_apply_set(repository: str, held: bool, expected_registry_sha256: str,
+                             reason: str, request_id: str) -> dict[str, Any]:
+    """CAS-hold the Hub full-stack auto-rollout while retaining every validation gate."""
+    return _json(DeploymentBrokerClient().hub_auto_apply({"repository": repository, "held": held,
+        "expectedRegistrySha256": expected_registry_sha256, "reason": reason, "requestId": request_id}))
+
+
+@appops_mcp.tool(name="appops.hub_component.preflight", annotations=_READ_ONLY_TOOL)
+@_tracked("appops.hub_component.preflight")
+def appops_hub_component_preflight(repository: str, service: str, revision: str,
+                                  expected_baseline: str, reason: str, request_id: str) -> dict[str, Any]:
+    """Prepare one immutable protected-main connector promotion and fingerprint its rollback baseline."""
+    return _json(DeploymentBrokerClient().hub_component_operation("preflight", {
+        "repository": repository, "service": service, "revision": revision,
+        "expectedBaseline": expected_baseline, "reason": reason, "requestId": request_id,
+    }))
+
+
+@appops_mcp.tool(name="appops.hub_component.baseline", annotations=_READ_ONLY_TOOL)
+@_tracked("appops.hub_component.baseline")
+def appops_hub_component_baseline(repository: str, service: str) -> dict[str, Any]:
+    """Read the closed connector baseline and unrelated container identity fingerprint."""
+    return _json(DeploymentBrokerClient().hub_component_operation("baseline", {
+        "repository": repository, "service": service,
+    }))
+
+
+@appops_mcp.tool(name="appops.hub_component.apply", annotations=_OPERATION_RUN_TOOL)
+@_tracked("appops.hub_component.apply")
+def appops_hub_component_apply(repository: str, service: str, revision: str,
+                              expected_baseline: str, reason: str, request_id: str,
+                              plan_id: str, plan_digest: str) -> dict[str, Any]:
+    """Queue the exact preflighted closed connector target; caller-selected images and paths are forbidden."""
+    return _json(DeploymentBrokerClient().hub_component_operation("apply", {
+        "repository": repository, "service": service, "revision": revision,
+        "expectedBaseline": expected_baseline, "reason": reason, "requestId": request_id,
+        "planId": plan_id, "planDigest": plan_digest,
+    }))
+
+
+@appops_mcp.tool(name="appops.hub_component.status", annotations=_READ_ONLY_TOOL)
+@_tracked("appops.hub_component.status")
+def appops_hub_component_status(plan_id: str) -> dict[str, Any]:
+    """Read one durable component receipt without advancing the full Hub revision."""
+    return _json(DeploymentBrokerClient().hub_component_operation("status", {"planId": plan_id}))
+
+
+@appops_mcp.tool(name="appops.registered_legacy.baseline", annotations=_READ_ONLY_TOOL)
+@_tracked("appops.registered_legacy.baseline")
+def appops_registered_legacy_baseline(repository: str, request_id: str) -> dict[str, Any]:
+    """Observe an existing registered runtime whose previous source revision is unknown."""
+    return _json(DeploymentBrokerClient().registered_legacy_operation("baseline", {
+        "repository": repository, "requestId": request_id,
+    }))
+
+
+@appops_mcp.tool(name="appops.registered_legacy.preflight", annotations=_READ_ONLY_TOOL)
+@_tracked("appops.registered_legacy.preflight")
+def appops_registered_legacy_preflight(repository: str, revision: str, request_id: str,
+                                      expected_state_sha256: str) -> dict[str, Any]:
+    """Validate exact protected-main push evidence and the actual rollback baseline."""
+    return _json(DeploymentBrokerClient().registered_legacy_operation("preflight", {
+        "repository": repository, "revision": revision, "requestId": request_id,
+        "expectedStateSha256": expected_state_sha256,
+    }))
+
+
+@appops_mcp.tool(name="appops.registered_legacy.adopt", annotations=_OPERATION_RUN_TOOL)
+@_tracked("appops.registered_legacy.adopt")
+def appops_registered_legacy_adopt(repository: str, revision: str, request_id: str,
+                                  expected_state_sha256: str, preflight_sha256: str) -> dict[str, Any]:
+    """Authorize one CAS-bound unknown-image rollback snapshot without changing the runtime."""
+    return _json(DeploymentBrokerClient().registered_legacy_operation("adopt", {
+        "repository": repository, "revision": revision, "requestId": request_id,
+        "expectedStateSha256": expected_state_sha256, "preflightSha256": preflight_sha256,
+    }))
+
+
+@appops_mcp.tool(name="appops.registered_legacy.status", annotations=_READ_ONLY_TOOL)
+@_tracked("appops.registered_legacy.status")
+def appops_registered_legacy_status(repository: str, request_id: str) -> dict[str, Any]:
+    """Read safe signed adoption metadata; credentials and runtime configuration stay private."""
+    return _json(DeploymentBrokerClient().registered_legacy_operation("status", {
+        "repository": repository, "requestId": request_id,
+    }))
+
+
+@appops_mcp.tool(name="appops.registered_legacy.rollback", annotations=_OPERATION_RUN_TOOL)
+@_tracked("appops.registered_legacy.rollback")
+def appops_registered_legacy_rollback(repository: str, revision: str, request_id: str,
+                                     expected_state_sha256: str) -> dict[str, Any]:
+    """Restore the signed previous image/configuration only if the verified current target matches."""
+    return _json(DeploymentBrokerClient().registered_legacy_operation("rollback", {
+        "repository": repository, "revision": revision, "requestId": request_id,
+        "expectedStateSha256": expected_state_sha256,
+    }))
+
+
+@appops_mcp.tool(name="appops.registered_legacy.delivery", annotations=_OPERATION_RUN_TOOL)
+@_tracked("appops.registered_legacy.delivery")
+def appops_registered_legacy_delivery(repository: str, revision: str, request_id: str) -> dict[str, Any]:
+    """Revalidate one original signed delivery after its registered baseline has been adopted."""
+    return _json(DeploymentBrokerClient().registered_legacy_operation("delivery", {
+        "repository": repository, "revision": revision, "requestId": request_id,
+    }))
+
+
 @appops_mcp.tool(name="server.operation.execute", annotations=_LEGACY_APPROVAL_EXECUTION_TOOL)
 @_tracked("server.operation.execute")
 def execute_operation(