From e8fe0b35bbe42ea8a85922d7ab0d73601834c1da Mon Sep 17 00:00:00 2001 From: AhmadHammad21 Date: Tue, 5 May 2026 23:13:43 +0300 Subject: [PATCH] docs: refresh roadmap and setup guidance --- PLAN.md | 31 +++++++++++++++++++++++-------- README.md | 13 ++++++++----- 2 files changed, 31 insertions(+), 13 deletions(-) diff --git a/PLAN.md b/PLAN.md index 1ffe19e..3a96630 100644 --- a/PLAN.md +++ b/PLAN.md @@ -1,6 +1,6 @@ # PLAN.md — OpenDevOps Agent Roadmap -> An openv-source AWS DevOps Agent clone. Powered by OpenRouter LLMs. +> An open-source AWS DevOps Agent clone. Powered by OpenRouter LLMs. > Investigate incidents, find root causes, ship fixes faster. --- @@ -24,10 +24,23 @@ a community, maybe make AWS nervous enough to call. --- +## Current Status Snapshot (May 2026) + +- Core platform is live on main: CLI, FastAPI API, streaming chat UI, Docker Compose, and PostgreSQL persistence. +- Read-only AWS investigation toolset is in place across CloudWatch, CloudTrail, ECS, Lambda, EC2, RDS, and IAM. +- run_bash_command (read-only AWS CLI / kubectl / docker) is implemented with allowlist validation and timeout. +- MCP server support is implemented (devops-agent mcp) for external clients. +- Slack webhook notifications and proactive polling are implemented. +- Remaining roadmap items are mostly hardening, extensibility, and productization work. + +--- + ## Phase 1 — Solid Foundation (MVP) 🏗️ **Goal:** A working CLI agent that can investigate a described incident using AWS data. +**Status:** Delivered on main + **Duration estimate:** 1–2 weeks solo ### Deliverables @@ -50,6 +63,8 @@ a community, maybe make AWS nervous enough to call. **Goal:** The agent understands *your* environment, not just individual services. +**Status:** Partially delivered (logs insights, ask/report modes, history persistence) + ### Features - **Application topology mapping** — auto-discover how services connect (e.g., API Gateway → Lambda → DynamoDB) @@ -70,6 +85,8 @@ a community, maybe make AWS nervous enough to call. **Goal:** Fit into existing DevOps workflows without friction. +**Status:** Partially delivered (Slack integration complete; PagerDuty/GitHub pending) + ### Features - **Slack webhook output** — post investigation findings to a channel - **PagerDuty trigger input** — auto-start investigations from PD alerts @@ -200,13 +217,11 @@ a community, maybe make AWS nervous enough to call. ## Immediate Next Steps (This Week) -1. `uv init opendevops-agent` — create the project -2. Implement `tools/cloudwatch.py` first (most useful, easiest to mock) -3. Write the system prompt in `agent/prompts.py` -4. Build the bare minimum agent loop in `agent/core.py` -5. Wire up `devops-agent investigate` CLI command -6. Test with a real CloudWatch alarm from your AWS account -7. Record a demo GIF for the README +1. Add CI smoke test for docker compose up plus API/UI health checks. +2. Add secret-scanning in CI and rotate any exposed credentials. +3. Finish soft-delete cleanup job (or explicitly document it as product-only backlog). +4. Implement Bash sandbox Phase 2 (isolated throwaway container runtime). +5. Add context-aware tool loading to reduce unnecessary tool exposure per investigation. --- diff --git a/README.md b/README.md index 68e2a6f..da07585 100644 --- a/README.md +++ b/README.md @@ -64,11 +64,11 @@ docker run -d --name opendevops-pg \ -e POSTGRES_DB=opendevops \ -e POSTGRES_USER=dev \ -e POSTGRES_PASSWORD=dev \ - -p 5432:5432 \ + -p 5433:5432 \ postgres:16 # Add to .env -echo "DATABASE_URL=postgresql://dev:dev@localhost:5432/opendevops" >> .env +echo "DATABASE_URL=postgresql://dev:dev@localhost:5433/opendevops" >> .env # Create tables (safe to re-run) uv run python scripts/setup_db.py @@ -86,6 +86,7 @@ the full schema reference. docker compose up --build # Backend: http://localhost:8000 # Frontend: http://localhost:80 +# Postgres (host): localhost:5433 ``` The backend image installs AWS CLI v2 automatically — the bash execution tool @@ -151,11 +152,12 @@ src/ ├── cli/ # Typer CLI commands └── integrations/ # Future: Slack, PagerDuty frontend/ -└── index.html # Chat UI — sidebar, live tool calls, cost card +└── src/ # React UI source (Vite) migrations/ └── 001_initial.sql # App schema (sessions, messages, tool_calls, usage_events) scripts/ -└── setup_db.py # One-shot DB setup (runs migrations + LangGraph checkpointer) +├── setup_db.py # One-shot DB setup (runs migrations + LangGraph checkpointer) +└── test_db_connection.py # DB connectivity smoke test (.env-driven) docs/ └── schema.md # Full schema reference with ER diagram ``` @@ -192,7 +194,8 @@ docs/ - [x] **Multi-provider LLM support** — 100+ providers via LiteLLM; swap models with a single `LLM_MODEL` env var change; supports OpenRouter, Anthropic, OpenAI, Groq, Ollama, and any OpenAI-compatible endpoint; see [docs/llm_providers.md](docs/llm_providers.md) - [x] **MCP integration** — expose the agent as an MCP server (`devops-agent mcp`); `investigate`, `ask`, and `list_sessions` tools available in Claude Desktop, Cursor, or any MCP-compatible client; stdio and HTTP+SSE transports; see [docs/mcp_server.md](docs/mcp_server.md) - [ ] **Custom tools via URL** — register external tools by pointing at an OpenAPI/HTTP endpoint; agent discovers and calls them alongside built-in AWS tools -- [ ] **Bash sandbox + AWS CLI tool** — expose a sandboxed `run_aws_cli(command)` escape-hatch tool alongside the 19 structured tools; read-only enforcement via per-org IAM role (`List*`/`Get*`/`Describe*` only); covers the long tail of AWS CLI commands no predefined tool handles; per-org credential isolation via scoped profiles +- [x] **Bash CLI escape hatch (Phase 1)** — `run_bash_command` is implemented for read-only AWS CLI, kubectl, and docker commands with strict allowlist validation and timeout. +- [ ] **Bash sandbox Phase 2** — run each bash command in an isolated throwaway container (`--network none`, read-only FS, non-root, resource limits). - [ ] **Optimize tool loading** — pass only relevant tools per investigation context instead of the full 19-tool set - [ ] **Message middleware pipeline** — compaction, summarization, intent detection, context trimmer - [ ] **Guardrails** — input/output validation, PII scrubbing, query scope enforcement