ongridio/ongrid

{
    "name": "host_files",
    "metadata": {
        "os": [
            "linux",
            "darwin"
        ],
        "ongrid": {
            "scope": "edge",
            "activation": {
                "mode": "keyword",
                "keywords": [
                    "文件",
                    "目录",
                    "磁盘",
                    "file",
                    "disk",
                    "du",
                    "size",
                    "大文件",
                    "占用"
                ]
            },
            "edge_runtime": "subprocess",
            "edge_capabilities": [
                {
                    "filesystem.read.deny": [
                        "\/proc",
                        "\/sys",
                        "\/dev",
                        "\/run",
                        "\/etc\/shadow",
                        "\/etc\/sudoers",
                        "\/root\/.ssh",
                        "\/root\/.gnupg"
                    ]
                },
                {
                    "process.exec": [
                        "find",
                        "du",
                        "stat",
                        "ls"
                    ]
                }
            ],
            "min_ongrid_version": ">=0.7.30"
        },
        "requires": {
            "bins": [
                "find",
                "du",
                "stat"
            ]
        }
    },
    "description": "设备文件系统排查工具组 — 找大文件、看目录占用、stat 单文件（一次最多 16 个 path 批量查询）",
    "when_to_use": "当用户问这些时调用本组工具：\n  • \"找大文件\" \/ \"哪些文件最大\" \/ \"top N 大文件\"\n  • \"磁盘占用 \/ 哪个目录在涨 \/ du\"\n  • \"看一下 \/var\/xxx 这个目录 \/ 这个文件 size\"\n  • \"为什么磁盘满了\"\n\n明确不要用于：\n  • 查日志内容 → 用 query_logql\n  • 查 metric \/ Prom 看磁盘用率 → 用 query_promql（拿宏观数；具体哪些文件用 host_files）\n  • 查进程在写哪些 fd → 用 get_host_processes（看 IO 列）\n\n常见组合：先用 query_promql 看 disk_used_pct 趋势 → 拿到设备 ID 后用 host_du_summary 下钻\n"
}

{
    "name": "host_bash",
    "metadata": {
        "os": [
            "linux"
        ],
        "ongrid": {
            "scope": "edge",
            "activation": {
                "mode": "always"
            },
            "edge_runtime": "subprocess",
            "edge_capabilities": [
                {
                    "process.exec": [
                        "cat",
                        "head",
                        "tail",
                        "tac",
                        "less",
                        "ls",
                        "find",
                        "du",
                        "stat",
                        "readlink",
                        "file",
                        "tree",
                        "wc",
                        "grep",
                        "egrep",
                        "fgrep",
                        "awk",
                        "sed",
                        "ps",
                        "top",
                        "uptime",
                        "free",
                        "df",
                        "iostat",
                        "vmstat",
                        "mpstat",
                        "pidstat",
                        "lsof",
                        "ss",
                        "netstat",
                        "dmesg",
                        "who",
                        "w",
                        "uname",
                        "id",
                        "groups",
                        "hostname",
                        "date",
                        "journalctl",
                        "iptables",
                        "ip6tables",
                        "tc",
                        "systemctl",
                        "ip",
                        "mount",
                        "crontab",
                        "nc",
                        "curl",
                        "wget",
                        "dig",
                        "host",
                        "nslookup",
                        "ping",
                        "traceroute",
                        "ovs-vsctl",
                        "ovs-ofctl",
                        "ovs-dpctl",
                        "ovs-appctl",
                        "nft",
                        "conntrack",
                        "ipset",
                        "ethtool",
                        "bpftool"
                    ]
                }
            ],
            "min_ongrid_version": ">=0.7.30"
        },
        "requires": {
            "bins": [
                "ps",
                "grep",
                "awk",
                "sed",
                "find",
                "du",
                "stat",
                "ls",
                "cat",
                "head",
                "tail",
                "wc",
                "sort",
                "uniq"
            ]
        }
    },
    "description": "设备上跑只读 shell 命令做诊断探索（沙箱化 \/ read-only policy）",
    "when_to_use": "当结构化工具（host_load \/ host_processes \/ host_find_large_files \/ query_logql \/ query_promql）\n不够用、需要灵活的 shell 一行 \/ pipe 时使用。**只读**：写操作（rm \/ mv \/ chmod \/ systemctl restart 等）\n会被边端 cmdpolicy 沙箱拒掉。\n\n典型场景：\n  • 复杂条件的 ps \/ grep \/ awk \/ sed pipe（\"找 cpu top 10 + 名字含 nginx 的\"）\n  • iptables -L \/ ip addr \/ tc qdisc show \/ mount 等只读运维查询\n  • systemctl status \/ cat \/ list-units \/ is-active（不能 restart \/ stop）\n  • journalctl \/ dmesg 配合 grep \/ awk 做日志快速定位\n  • find \/ du \/ stat 配合 sort \/ head 做文件系统下钻\n  • 网络探测 nc -z \/ curl --head \/ dig \/ ping（host 在 operator allowlist 内）\n\n明确不要用于：\n  • 重启服务 → 用 host_restart_service（mutating，走 reviewer）\n  • 改文件 \/ 改配置 → 不支持（也不应让 LLM 自主改）\n  • 简单单一动作 → 用结构化工具更省 token：\n    - 看 cpu\/mem 用 get_host_load\n    - 看进程列表用 get_host_processes\n    - 找大文件用 host_find_large_files\n    - 看磁盘占用用 host_du_summary\n\n**被沙箱拒绝时（response.allowed=false）读 reason，按提示改命令重试**。\n常见拒绝：sed -i \/ find -delete \/ shell 嵌套 ($()\/`) \/ redirect (> >>) \/\nsystemctl restart \/ 任何 ClassDenied 二进制（rm \/ bash \/ python \/ ...）。\n"
}

{
    "name": "host_restart_service",
    "metadata": {
        "os": [
            "linux"
        ],
        "ongrid": {
            "scope": "edge",
            "activation": {
                "mode": "keyword",
                "keywords": [
                    "重启",
                    "重起",
                    "restart",
                    "systemctl"
                ]
            },
            "edge_runtime": "subprocess",
            "edge_capabilities": [
                {
                    "process.exec": [
                        "systemctl"
                    ]
                }
            ],
            "min_ongrid_version": ">=0.7.30"
        },
        "requires": {
            "bins": [
                "systemctl"
            ]
        }
    },
    "description": "重启允许列表内的 systemd service（mutating，触发 reviewer 二审）",
    "when_to_use": "用户**明确**要求重启某个允许列表内的服务时使用。\n\n**本工具是 mutating，会触发 reviewer 二审（agents\/reviewer.md），等待 approve 后才执行**。\n调用前 reviewer 会去查 SOP \/ 设备状态 \/ 并行操作，任一不满足即 reject — 你（coordinator）\n收到 reject 时**直接告知用户原因，不要重试**。\n\n不要主动建议重启 — 让用户先要求。常见的\"我猜重启就好了\"是诊断不深入的信号，\n应该先用 query_logql \/ query_promql \/ get_edge_summary 把根因摸清楚再让用户决定。\n\n允许列表（白名单）：nginx \/ redis \/ prometheus \/ loki \/ tempo \/ grafana \/ mysql \/ ongrid\n其他 service 直接拒绝（也不走 reviewer）。\n"
}