VMware AIops

[WRITE] Clear triggered vCenter alarms back to normal state. Use this after resolving the underlying issue; to merely mark an alarm seen use acknowledge_vcenter_alarm instead. Get entity_name and alarm_name from list_vcenter_alarms first. vSphere has no per-alarm clear: this clears EVERY triggered alarm with the named alarm's status (red/yellow) on its entity type (host/VM/all), usually more than the one named. Without confirm=True this only previews: it returns blast_radius with will_clear_count and the alarms it would clear, and changes nothing. Show it to the user and get their decision; do not set confirm=True on your own. Refused when the list of alarms cannot be read. Returns: Dict with action (preview, reset), blast_radius, and on reset the scope cleared.

[WRITE] Revert a VM to its baseline snapshot (Clean Slate). Without confirm=True this only previews: it returns blast_radius (VM identity, power state and whether it is powered off first, the snapshot and when it was taken, snapshot count, blockers) and changes nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen the preview yet. With confirm=True: powers off the VM first if it is running, then reverts to the named snapshot. Use this to reset a lab/dev VM to a clean starting state after a task completes. Irreversible — everything written since the snapshot is lost. Refused: no snapshot of that name, more than one, a VM whose state cannot be read, or a rules.yaml deny on power_off_vm or revert_vm_snapshot (the preview lists it as a blocker). Returns a dict (action, blast_radius).

[WRITE] Revert a VM to a named snapshot (loses changes since snapshot). Without confirm=True this only previews: it returns blast_radius (VM and instance UUID, the snapshot's name, id and creation time, total snapshot count, current power state and the power state after the revert) and changes nothing. Show it to the user and get their decision. Do not set confirm=True on your own because the user asked earlier: they have not seen the preview yet. Irreversible — everything written since the snapshot is lost. Refused: a snapshot name that is not found, a name that matches more than one snapshot on the VM (vSphere allows duplicates; rename one first), and a VM whose snapshot tree, identity or power state cannot be read. Run list_vm_snapshots first for exact names. To reclaim space without changing state use delete_vm_snapshot. Returns: Dict with action (preview, reverted), blast_radius, and result.

[WRITE] Rollback executed steps of a failed plan in reverse order. Without confirm=True this only previews: it returns blast_radius listing the rollback steps that would run (in order, with the VMs a rollback deletes) and those skipped as irreversible — and runs nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen the preview yet. Only call this after apply_vm_plan returns status='failed'; check list_vm_plans first for the plan_id. Irreversible steps (delete_vm, revert_snapshot, etc.) are skipped with a warning. Each destructive rollback step (power off, delete snapshot, cluster delete, host removal) is measured as its own tool measures it, in the preview and again just before it runs; a refused check stops the rollback there and the plan stays 'failed'. Refused on a target other than the one the plan was created against, and for any rollback step ~/.vmware/rules.yaml denies for its own tool (deleting a VM the plan created is authorized as delete_vm).

[WRITE] Execute a command inside a VM via VMware Tools. Requires VMware Tools running in the guest OS. Returns exit_code, stdout, stderr, timed_out, and blast_radius. Without confirm=True this only previews: blast_radius names the VM (name, instance UUID), the guest account, the exact command, arguments and working directory, VMware Tools status and any blockers; nothing runs. Show it to the user. Do not set confirm=True on your own because the user asked earlier: they have not seen the preview yet. Refused outright: VM not powered on, VMware Tools not running, an identity or status that cannot be read, or a name that matches more than one VM. Note: the Guest Ops API does not capture stdout/stderr directly, so use this only for fire-and-forget commands — prefer run_vm_guest_command_with_output whenever you need the output.

[WRITE] Execute a shell command inside a VM and capture stdout + stderr. Automatically detects guest OS (Linux/Windows) and selects the correct shell. Output is captured by redirecting to a temp file, downloading it, then cleaning up — no manual redirection needed. Prefer this over run_vm_guest_command whenever you need the output. Requires VMware Tools running and a writable temp directory in the guest. Returns exit_code, stdout, stderr, timed_out, os_family, and blast_radius. Without confirm=True this only previews: blast_radius names the VM (name, instance UUID), the guest account, the exact command and the shell it runs through, VMware Tools status and any blockers; nothing runs. Show it to the user. Do not set confirm=True on your own because the user asked earlier: they have not seen the preview yet. Refused outright: VM not powered on, VMware Tools not running, an unreadable identity or status, a name that matches more than one VM, or a rules.yaml deny on run_vm_guest_command or download_vm_guest_file (the preview lists it as a blocker).

[READ] Scan all accessible datastores for deployable images (OVA/ISO/OVF/VMDK). Returns the images found and refreshes the cache at ~/.vmware-aiops/image_registry.json. Use this when you do not know which datastore holds an image; prefer browse_datastore once you do, because this walks every datastore and may take minutes on a large estate. Returns: The family list envelope {items, returned, limit, total, truncated, hint} plus `last_scan`; each item is one image. `images` is kept as a deprecated alias for `items`.

[WRITE] Enable or disable an existing DRS rule - preview/confirm gated. The day-2 toggle: anti-affinity rules often must be disabled while a cluster is temporarily too small to satisfy them, then re-enabled when hosts return. Idempotent - matching state returns a noop, no write. Names are matched exactly; ambiguous names refuse. Audited. Returns: Preview dict (action="preview"), noop dict (action="noop"), or result dict (action="set", rule_now). Errors return "error" + hint.

[WRITE] Set a Time-To-Live (TTL) for a VM. The daemon auto-deletes it when expired. Without confirm=True this only previews: it returns blast_radius — the VM that will be deleted (identity, host, disks, total size, snapshot count), when (expires_at), and any TTL it replaces — and schedules nothing. Show that to the user and get their explicit decision. Do not set confirm=True on your own because the user asked earlier: they have not seen the preview yet. Refused when the VM's identity or disks cannot be read. Use this for short-lived lab VMs so cleanup is not forgotten; cancel with cancel_vm_ttl and review pending expiries with list_vm_ttls. The scheduler daemon must be running (`vmware-aiops daemon start`) or nothing is ever deleted; it powers a running VM off first. TTLs persist in ~/.vmware-aiops/ttl.json. Returns a dict (action, blast_radius).

[WRITE] Enable/disable a host service on an existing vmk - preview/confirm gated. Completes the add_host_vmk story: adapters are created serviceless by design, then tagged here (e.g. enable "vmotion" on a new vMotion vmk). Idempotent - re-applying the current state returns a no-write noop. Verify with list_host_vmks (the services field). Audited. Valid services are the vSphere nicType names: management, vmotion, vsan, vSphereProvisioning, faultToleranceLogging, vSphereReplication, vSphereReplicationNFC, vSphereBackupNFC, ptp, and the nvme/vsan variants. Note "vSphereProvisioning", not "provisioning". FAIL CLOSED: refuses both directions when the host's service map cannot be read. ABSOLUTE, no override: disabling management on the host's only management-enabled vmk - the call rides the interface it would untag. Returns: Preview dict (action="preview"), noop dict (action="noop") when the state already matches, or result dict (action="set", services_now). Errors return a dict with "error" + hint.

[WRITE] Upload a file from local machine to a VM via VMware Tools. Returns a dict with action, message and blast_radius (a status string before the confirmation gate). Requires VMware Tools running in the guest OS. An existing file at guest_path is replaced. Use download_vm_guest_file for the reverse direction, and provision_vm_guest instead when uploads and commands belong to one ordered provisioning run. Without confirm=True this only previews: blast_radius names the VM (name, instance UUID), the guest account, the local path and size, the guest path, VMware Tools status and any blockers; nothing is transferred. Show it to the user. Do not set confirm=True on your own because the user asked earlier: they have not seen the preview yet. Refused outright: VM not powered on, VMware Tools not running, a local file that is missing or unreadable, an unreadable identity or status, or a name that matches more than one VM.