feat(ai): add Helm release management tools for the AI agent - #665
Open
yupanzi wants to merge 2 commits into
Open
feat(ai): add Helm release management tools for the AI agent#665yupanzi wants to merge 2 commits into
yupanzi wants to merge 2 commits into
Conversation
Update the Claude integration to the current API surface and fix several agent-loop problems: - Move the Anthropic path to the Beta Messages API with adaptive thinking, context management, and output_config.effort. Effort is the reasoning-depth knob on current Claude models (budget_tokens returns 400 there); it is exposed as a new AIEffort setting (low/medium/high/xhigh/max, default xhigh) in the general settings. Use is gated per model by anthropicModelSupportsModernFeatures, so models that reject the modern request surface keep the classic shape. - Send AIMaxTokens as configured and make the default provider-aware (64000 for Anthropic, 8192 for OpenAI): on current Claude models thinking and answer share max_tokens, so a small default truncates the answer mid-sentence. The default Anthropic model becomes claude-opus-5. - Bound the conversation with per-message and total character budgets, trimming oldest-first, so a long session cannot silently overflow the request. - Strip tool calls the model emits as plain text or XML instead of through the native mechanism, and instruct it not to in the system prompt. A textual call is never executed, and echoing it back poisons later turns into repeating it. - Mask Secret data in tool results before they reach the model. - Emit an SSE keepalive comment every 20s. An agent turn is legitimately silent while a tool runs, and ingress-nginx closes a connection after 60s of backend silence. Raise the chart's gateway request timeout to 900s and document the matching ingress-nginx annotations next to it. - Tighten resource tool schemas and descriptions with explicit caps, and fix long-token overflow in AI chat markdown tables. - Cover conversation replay, handler streaming, settings migration and the agent loop with tests. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
Give the agent first-class Helm capabilities instead of forcing it to poke at release Secrets with generic resource tools: - New tools: list_helm_releases, get_helm_release (with optional chart default values), get_helm_release_history, update_helm_release_values (merge or replace semantics), rollback_helm_release, uninstall_helm_release. Results are bounded (item caps, values size cap) so one large chart cannot consume the tool-result budget. - Sensitive-looking values are masked with the shared redaction placeholder; masked placeholders written back in values_yaml are rejected so the agent cannot corrupt a release with "***". - RBAC: helm tools map onto helmrelease get/update/delete permissions per namespace; namespaced tools reject the _all pseudo-namespace so helm's cluster-wide storage cannot bypass namespace deny rules. The three mutating tools require the existing user confirmation flow, and the chat UI describes and previews them like resource mutations. - Export scheduler.DeleteHelmReleaseAutoUpgradeTask (moved from the resources handler) so uninstalling via the agent also clears a configured auto-upgrade task. Built on top of the Anthropic modernization branch, which provides the shared value-redaction placeholder. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com> Co-Authored-By: Claude Opus 5 (1M context) <noreply@anthropic.com>
yupanzi
force-pushed
the
feature/ai-helm-tool
branch
from
September 1, 2026 04:56
2e93fdb to
69941bf
Compare
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Give the AI agent first-class Helm release tools:
list_helm_releases,get_helm_release(optionally with the chart's default values),get_helm_release_history,update_helm_release_values(merge — like--reuse-values— or replace semantics),rollback_helm_release,uninstall_helm_release.update_helm_release_valuesrejects payloads that contain the placeholder so the agent cannot write"***"back into a release.helmreleaseget/update/delete permissions per namespace, and namespaced tools reject the_allpseudo-namespace — helm's storage would treat it as cluster-wide, which would bypass namespace deny rules.values_yamllike resource mutations.DeleteHelmReleaseAutoUpgradeTaskmoves from the resources handler intopkg/scheduler(exported) so uninstalling via the agent also clears a configured auto-upgrade task.Why
The agent could only investigate Helm releases by poking at release Secrets with the generic resource tools, which is slow, leaks chart values wholesale, and cannot perform release operations safely.
Related issue
Closes #670
Validation
go test ./pkg/ai/... ./pkg/resources/...— newtool_helm_test.goplus authorization tests covering every helm tool, the_allrejection, and a coverage test asserting every registered tool has an authorization mappingpnpm run type-check && pnpm run lint && pnpm run testChecklist
🤖 Generated with Claude Code