admin / Synapse-Cortex

import type { ApprovalLevel, PlaybookGraph } from '../api/types'

export interface PlaybookTemplate {
  id: string
  name: string
  description: string
  /** Display-only grouping for the catalogue sidebar (Admin -> Playbooks) -
   * not sent to the backend. Guardrail matching still uses allowedTargetOs. */
  platform: 'Ubuntu / Debian' | 'Windows' | 'Docker' | 'Proxmox' | 'General'
  allowedTargetOs: string[]
  requiredApprovalLevel: ApprovalLevel
  forbiddenCommands: string[]
  /** Review-eligible baseline categories (e.g. "host_power") this template
   * pre-acknowledges, so a disruptive-but-reversible step (a reboot) reaches
   * human review instead of being auto-blocked. Only settable by a global
   * admin on save. Omitted/[] for ordinary templates. */
  acknowledgedDangerousCommands?: string[]
  graph: PlaybookGraph
}

/** Builds a straight-line Start -> Command -> Command -> ... graph, the
 * shape shared by every template below except the one that demonstrates a
 * Condition node. Keeps each template definition to just its step list. */
function linearGraph(steps: { id: string; label: string; command: string }[]): PlaybookGraph {
  const nodes: PlaybookGraph['nodes'] = [{ id: 'start', type: 'start', data: {}, position: { x: 250, y: 0 } }]
  const edges: PlaybookGraph['edges'] = []
  let previousId = 'start'
  steps.forEach((step, i) => {
    const y = (i + 1) * 130
    nodes.push({ id: step.id, type: 'command', data: { label: step.label, command: step.command }, position: { x: 250, y } })
    edges.push({ id: `e_${previousId}_${step.id}`, source: previousId, target: step.id })
    previousId = step.id
  })
  return { nodes, edges }
}

// Run-time discovery: a Docker Compose container carries its project's
// working directory and its own service name as labels, so a compose
// playbook can resolve both from just the container name at execution time -
// the admin never enters a folder path, and once the AI proposes the fix no
// human has to point it at the right directory. These expand inline into the
// stored command strings (the `$( … )` is literal shell command substitution,
// not a template-literal interpolation). `<container>` is the only edit-me
// token, matching every other container-level Docker playbook.
const COMPOSE_WORKDIR =
  `$(docker inspect --format '{{ index .Config.Labels "com.docker.compose.project.working_dir" }}' <container>)`
const COMPOSE_SERVICE =
  `$(docker inspect --format '{{ index .Config.Labels "com.docker.compose.service" }}' <container>)`

/** Built-in starter playbooks shown in the template catalogue (Admin ->
 * Playbooks). Picking one pre-loads the canvas, name, and guardrails into
 * the builder - nothing is saved until the admin clicks Save there, so
 * these are just a starting point, fully editable like any hand-built
 * playbook. Mirrors the worked examples in docs/admin-guide.md so the two
 * stay consistent. 36 cover the most common Ubuntu/Debian remediation
 * tasks, 10 cover the most common Windows ones, 11 cover common Docker
 * container operations, 14 cover Proxmox VE (VMs, LXC, storage/backup,
 * cluster, and management services), and 1 General "command runner" whose
 * command the AI proposes at run time (global-admin only, always
 * human-in-the-loop). */
export const PLAYBOOK_TEMPLATES: PlaybookTemplate[] = [
  // ---- Ubuntu / Debian (36) ------------------------------------------------
  {
    id: 'restart-linux-service',
    name: 'Restart Nginx Service (Linux)',
    description: 'Straight-line restart of a hung service: check status, restart, confirm it came back up.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check service status', command: 'systemctl status nginx' },
      { id: 'cmd_restart', label: 'Restart the service', command: 'systemctl restart nginx' },
      { id: 'cmd_confirm', label: "Confirm it's active", command: 'systemctl is-active nginx' },
    ]),
  },
  {
    id: 'free-disk-space-linux',
    name: 'Free Disk Space — Rotate & Purge Old Logs (Linux)',
    description: 'Routine housekeeping for a low-disk-space alert: rotate logs, purge anything older than 14 days.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_usage', label: 'Show current disk usage', command: 'df -h /' },
      { id: 'cmd_rotate', label: 'Rotate and compress logs', command: 'logrotate -f /etc/logrotate.conf' },
      { id: 'cmd_purge', label: 'Purge logs older than 14 days', command: 'find /var/log -name "*.log.*" -mtime +14 -delete' },
      { id: 'cmd_confirm', label: 'Confirm space was reclaimed', command: 'df -h /' },
    ]),
  },
  {
    id: 'conditional-disk-cleanup',
    name: 'Conditional Cleanup — Disk Usage Check (Linux)',
    description:
      'Demonstrates a Condition node: only clears temp files when usage is high. Execution always follows the True branch.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: {
      nodes: [
        { id: 'start', type: 'start', data: {}, position: { x: 250, y: 0 } },
        {
          id: 'cmd_check',
          type: 'command',
          data: { label: 'Check disk usage', command: 'df -h / --output=pcent' },
          position: { x: 250, y: 130 },
        },
        {
          id: 'cond_usage',
          type: 'condition',
          data: { label: 'Usage over 90%?', expression: 'df -h / | usage > 90%' },
          position: { x: 250, y: 260 },
        },
        {
          id: 'cmd_clear_temp',
          type: 'command',
          data: { label: 'Clear temp files', command: 'rm -f /tmp/*.tmp' },
          position: { x: 100, y: 400 },
        },
        {
          id: 'cmd_log_ok',
          type: 'command',
          data: { label: 'Log OK, no action', command: 'echo "Disk usage nominal, no action taken"' },
          position: { x: 400, y: 400 },
        },
      ],
      edges: [
        { id: 'e_start_check', source: 'start', target: 'cmd_check' },
        { id: 'e_check_cond', source: 'cmd_check', target: 'cond_usage' },
        { id: 'e_cond_true', source: 'cond_usage', target: 'cmd_clear_temp', sourceHandle: 'true' },
        { id: 'e_cond_false', source: 'cond_usage', target: 'cmd_log_ok', sourceHandle: 'false' },
      ],
    },
  },
  {
    id: 'restart-apache-linux',
    name: 'Restart Apache HTTP Server (Ubuntu/Debian)',
    description: 'Check status, restart apache2, and confirm it came back up.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check service status', command: 'systemctl status apache2' },
      { id: 'cmd_restart', label: 'Restart the service', command: 'systemctl restart apache2' },
      { id: 'cmd_confirm', label: "Confirm it's active", command: 'systemctl is-active apache2' },
    ]),
  },
  {
    id: 'restart-mysql-linux',
    name: 'Restart MySQL/MariaDB Service (Ubuntu/Debian)',
    description: 'Check status, restart the database service, and confirm it came back up.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check service status', command: 'systemctl status mysql' },
      { id: 'cmd_restart', label: 'Restart the service', command: 'systemctl restart mysql' },
      { id: 'cmd_confirm', label: "Confirm it's active", command: 'systemctl is-active mysql' },
    ]),
  },
  {
    id: 'restart-ssh-linux',
    name: 'Restart SSH Daemon (Ubuntu/Debian)',
    description: 'Check status, restart the SSH service, and confirm it came back up.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check service status', command: 'systemctl status ssh' },
      { id: 'cmd_restart', label: 'Restart the service', command: 'systemctl restart ssh' },
      { id: 'cmd_confirm', label: "Confirm it's active", command: 'systemctl is-active ssh' },
    ]),
  },
  {
    id: 'check-ssh-auth-linux',
    name: 'Check SSH Authentication (Ubuntu/Debian)',
    description:
      'Diagnose SSH login problems: verify sshd is running and its config is valid, test authentication as the ticket’s user, and review recent failed/accepted attempts in the auth log.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check SSH service status', command: 'systemctl status ssh' },
      { id: 'cmd_config', label: 'Validate sshd configuration', command: 'sshd -t' },
      {
        id: 'cmd_authtest',
        label: 'Test authentication as ticket user',
        command: 'ssh -o BatchMode=yes -o ConnectTimeout=5 {{username}}@{{ip_address}} "echo auth-ok"',
      },
      {
        id: 'cmd_failures',
        label: 'Review recent failed attempts',
        command: 'grep "Failed password" /var/log/auth.log | tail -n 20',
      },
      {
        id: 'cmd_accepted',
        label: 'Review recent successful logins',
        command: 'grep "Accepted" /var/log/auth.log | tail -n 10',
      },
    ]),
  },
  {
    id: 'restart-docker-linux',
    name: 'Restart Docker Service (Ubuntu/Debian)',
    description: 'Check status, restart the Docker engine, and confirm it came back up.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check service status', command: 'systemctl status docker' },
      { id: 'cmd_restart', label: 'Restart the service', command: 'systemctl restart docker' },
      { id: 'cmd_confirm', label: "Confirm it's active", command: 'systemctl is-active docker' },
    ]),
  },
  {
    id: 'restart-cron-linux',
    name: 'Restart Cron Service (Ubuntu/Debian)',
    description: 'Check status, restart the cron scheduler, and confirm it came back up.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check service status', command: 'systemctl status cron' },
      { id: 'cmd_restart', label: 'Restart the service', command: 'systemctl restart cron' },
      { id: 'cmd_confirm', label: "Confirm it's active", command: 'systemctl is-active cron' },
    ]),
  },
  {
    id: 'kill-high-cpu-process-linux',
    name: 'Kill a Runaway High-CPU Process (Linux)',
    description: 'List the top CPU consumers, terminate the offending process, and confirm load has dropped.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_list', label: 'List top CPU-consuming processes', command: 'ps -eo pid,comm,%cpu --sort=-%cpu | head -n 10' },
      { id: 'cmd_kill', label: 'Terminate the offending process', command: 'pkill -TERM -f "<process_name>"' },
      { id: 'cmd_confirm', label: 'Confirm CPU usage has dropped', command: 'ps -eo pid,comm,%cpu --sort=-%cpu | head -n 5' },
    ]),
  },
  {
    id: 'clear-apt-cache-linux',
    name: 'Clear APT Package Cache (Ubuntu/Debian)',
    description: 'Check the cache size, clean downloaded package archives, and confirm space was reclaimed.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_check', label: 'Check package cache size', command: 'du -sh /var/cache/apt/archives' },
      { id: 'cmd_clean', label: 'Clean the package cache', command: 'apt-get clean' },
      { id: 'cmd_confirm', label: 'Confirm space was reclaimed', command: 'du -sh /var/cache/apt/archives' },
    ]),
  },
  {
    id: 'apt-update-upgrade-linux',
    name: 'Update & Upgrade Security Patches (Ubuntu/Debian)',
    description: 'Refresh package lists, apply available upgrades, and list anything still outstanding.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_update', label: 'Refresh package lists', command: 'apt-get update' },
      { id: 'cmd_upgrade', label: 'Apply available upgrades', command: 'apt-get upgrade -y' },
      { id: 'cmd_confirm', label: 'List any remaining upgrades', command: 'apt list --upgradable' },
    ]),
  },
  {
    id: 'apt-dist-upgrade-linux',
    name: 'Full Dist-Upgrade (Ubuntu/Debian)',
    description:
      'A fuller upgrade than plain apt upgrade: refresh lists, preview the changes with a dry run, run apt-get dist-upgrade (which can add/remove packages to satisfy dependency changes), confirm none remain, then reboot only if the upgrade flagged one as required. The reboot is a host-power command, so this template pre-acknowledges "host_power": the run is never auto-blocked, but it always stops for explicit human approval before rebooting.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    acknowledgedDangerousCommands: ['host_power'],
    graph: linearGraph([
      { id: 'cmd_update', label: 'Refresh package lists', command: 'apt-get update' },
      { id: 'cmd_preview', label: 'Preview the dist-upgrade (dry run)', command: 'apt-get -s dist-upgrade' },
      { id: 'cmd_upgrade', label: 'Apply the dist-upgrade', command: 'apt-get dist-upgrade -y' },
      { id: 'cmd_confirm', label: 'Confirm no upgrades remain', command: 'apt list --upgradable' },
      {
        id: 'cmd_reboot',
        label: 'Reboot only if the upgrade requires it',
        command: 'if [ -f /var/run/reboot-required ]; then reboot; else echo "No reboot required."; fi',
      },
    ]),
  },
  {
    id: 'restart-networking-linux',
    name: 'Restart Networking Service (Ubuntu/Debian)',
    description: 'Check status, restart the networking service, and confirm interfaces came back up.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check service status', command: 'systemctl status networking' },
      { id: 'cmd_restart', label: 'Restart networking', command: 'systemctl restart networking' },
      { id: 'cmd_confirm', label: 'Confirm interfaces are up', command: 'ip a' },
    ]),
  },
  {
    id: 'flush-dns-linux',
    name: 'Flush DNS Resolver Cache (Ubuntu/Debian)',
    description: 'Check the resolver service, flush the cached DNS entries, and confirm the flush took effect.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check resolver status', command: 'systemctl status systemd-resolved' },
      { id: 'cmd_flush', label: 'Flush DNS cache', command: 'resolvectl flush-caches' },
      { id: 'cmd_confirm', label: 'Confirm cache statistics reset', command: 'resolvectl statistics' },
    ]),
  },
  {
    id: 'clear-journal-logs-linux',
    name: 'Clear Systemd Journal Logs (Ubuntu/Debian)',
    description: 'Check journal disk usage, vacuum entries older than 7 days, and confirm space was reclaimed.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_check', label: 'Check journal disk usage', command: 'journalctl --disk-usage' },
      { id: 'cmd_vacuum', label: 'Vacuum logs older than 7 days', command: 'journalctl --vacuum-time=7d' },
      { id: 'cmd_confirm', label: 'Confirm space was reclaimed', command: 'journalctl --disk-usage' },
    ]),
  },
  {
    id: 'clear-tmp-linux',
    name: 'Check & Clear /tmp Directory (Linux)',
    description: 'Check current size, remove files older than 3 days, and confirm space was reclaimed.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_check', label: 'Check /tmp size', command: 'du -sh /tmp' },
      { id: 'cmd_clear', label: 'Delete files older than 3 days', command: 'find /tmp -type f -mtime +3 -delete' },
      { id: 'cmd_confirm', label: 'Confirm space was reclaimed', command: 'du -sh /tmp' },
    ]),
  },
  {
    id: 'unlock-account-linux',
    name: 'Unlock a Locked User Account (Ubuntu/Debian)',
    description: 'Check the account lock status, reset failed login attempts, and confirm it is unlocked.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_check', label: 'Check account lock status', command: 'faillock --user "<username>"' },
      { id: 'cmd_reset', label: 'Reset failed login attempts', command: 'faillock --user "<username>" --reset' },
      { id: 'cmd_confirm', label: 'Confirm the account is unlocked', command: 'faillock --user "<username>"' },
    ]),
  },
  {
    id: 'disk-health-smart-linux',
    name: 'Check & Report Disk Health (SMART) (Linux)',
    description: 'Check overall SMART health, run a short self-test, and review the self-test log.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_health', label: 'Check overall SMART health', command: 'smartctl -H /dev/sda' },
      { id: 'cmd_test', label: 'Run a short self-test', command: 'smartctl -t short /dev/sda' },
      { id: 'cmd_confirm', label: 'Review self-test results', command: 'smartctl -l selftest /dev/sda' },
    ]),
  },
  {
    id: 'check-open-ports-linux',
    name: 'Check Listening / Open Ports (Linux)',
    description: 'List listening sockets, count them, and list currently established connections.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_list', label: 'List listening TCP/UDP ports', command: 'ss -tulpn' },
      { id: 'cmd_count', label: 'Count total listening sockets', command: 'ss -tulpn | wc -l' },
      { id: 'cmd_established', label: 'List established connections', command: 'ss -tn state established' },
    ]),
  },
  {
    id: 'restart-failed-systemd-service-linux',
    name: 'Restart a Failed Systemd Service — Generic (Linux)',
    description: 'List failed units, clear the failed state, restart the affected service, and confirm it recovered.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_list', label: 'List failed units', command: 'systemctl --failed' },
      { id: 'cmd_reset', label: 'Clear the failed state', command: 'systemctl reset-failed' },
      { id: 'cmd_restart', label: 'Restart the affected service', command: 'systemctl restart "<service_name>"' },
      { id: 'cmd_confirm', label: 'Confirm it recovered', command: 'systemctl status "<service_name>"' },
    ]),
  },
  {
    id: 'free-memory-linux',
    name: 'Free Memory — Clear Page Cache (Linux)',
    description: 'Check current memory usage, sync and drop the page cache, and confirm memory was freed.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_check', label: 'Check memory usage', command: 'free -h' },
      { id: 'cmd_drop', label: 'Sync and drop the page cache', command: 'sync && echo 1 > /proc/sys/vm/drop_caches' },
      { id: 'cmd_confirm', label: 'Confirm memory was freed', command: 'free -h' },
    ]),
  },
  {
    id: 'free-port-in-use-linux',
    name: 'Free a Port In Use (Linux)',
    description: 'Find the process holding a port a service needs, terminate it, and confirm the port is free.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_show', label: "Show what's using the port", command: 'ss -tulpn | grep :<port>' },
      { id: 'cmd_kill', label: 'Kill the process on the port', command: 'fuser -k <port>/tcp' },
      { id: 'cmd_confirm', label: 'Confirm the port is free', command: 'ss -tulpn | grep :<port> || echo "port <port> is free"' },
    ]),
  },
  {
    id: 'clean-boot-old-kernels-linux',
    name: 'Clean /boot & Remove Old Kernels (Ubuntu/Debian)',
    description: 'Reclaim space on a full /boot partition (which breaks apt) by autoremoving superseded kernels and packages.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_check', label: 'Check /boot space', command: 'df -h /boot' },
      { id: 'cmd_clean', label: 'Remove old kernels & unused packages', command: 'apt-get autoremove --purge -y' },
      { id: 'cmd_confirm', label: 'Confirm /boot space reclaimed', command: 'df -h /boot' },
    ]),
  },
  {
    id: 'check-inode-exhaustion-linux',
    name: 'Check Inode Exhaustion (Linux)',
    description: 'Read-only diagnostic for a "disk full" that df -h can\'t explain — checks inode usage and finds the file-heavy directory.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_inodes', label: 'Show inode usage per filesystem', command: 'df -i' },
      { id: 'cmd_count', label: 'Count files under the suspect directory', command: 'find <dir> -xdev -type f | wc -l' },
    ]),
  },
  {
    id: 'find-largest-files-dirs-linux',
    name: 'Find Largest Files & Directories (Linux)',
    description: 'Read-only disk-usage triage: filesystem usage, the largest directories, and any oversized files.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_df', label: 'Show filesystem usage', command: 'df -h' },
      { id: 'cmd_dirs', label: 'Top 20 largest directories', command: 'du -ahx / 2>/dev/null | sort -rh | head -20' },
      { id: 'cmd_files', label: 'Files larger than 500 MB', command: 'find / -xdev -type f -size +500M 2>/dev/null' },
    ]),
  },
  {
    id: 'remount-readonly-filesystem-linux',
    name: 'Remount a Read-Only Filesystem (Linux)',
    description: 'A disk error can flip a filesystem to read-only — inspect the mount and kernel errors, then remount read-write.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_show', label: 'Show the mount and its options', command: 'mount | grep <mountpoint>' },
      {
        id: 'cmd_dmesg',
        label: 'Check kernel log for disk/fs errors',
        command: 'dmesg -T | grep -iE "read-only|EXT4-fs error|I/O error" | tail -20',
      },
      { id: 'cmd_remount', label: 'Remount read-write', command: 'mount -o remount,rw <mountpoint>' },
      { id: 'cmd_confirm', label: 'Confirm it is read-write', command: 'mount | grep <mountpoint>' },
    ]),
  },
  {
    id: 'reload-service-config-linux',
    name: 'Reload a Service After a Config Change (Linux)',
    description:
      'Apply an edited config with no dropped connections: reload (not restart) the service and confirm it stayed healthy. Add your service’s own validate step (e.g. nginx -t) as a first command if it has one.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Show current status', command: 'systemctl status <service> --no-pager' },
      { id: 'cmd_reload', label: 'Reload the service (no downtime)', command: 'systemctl reload <service>' },
      { id: 'cmd_confirm', label: 'Confirm it reloaded cleanly', command: 'systemctl status <service> --no-pager' },
    ]),
  },
  {
    id: 'triage-failed-systemd-units-linux',
    name: 'Triage Failed systemd Units (Linux)',
    description: 'Read-only: list failed units, review recent error-level journal entries, and inspect a specific unit.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_failed', label: 'List failed units', command: 'systemctl --failed --no-pager' },
      { id: 'cmd_journal', label: 'Recent error-level journal entries', command: 'journalctl -p err -b --no-pager | tail -50' },
      { id: 'cmd_unit', label: 'Status of a specific failed unit', command: 'systemctl status <unit> --no-pager' },
    ]),
  },
  {
    id: 'diagnose-restart-dns-linux',
    name: 'Diagnose & Restart DNS Resolution (Linux)',
    description: 'Name resolution failing on the host — check the resolver config, test a lookup, restart the resolver, and re-test.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_conf', label: 'Show resolver config', command: 'cat /etc/resolv.conf' },
      { id: 'cmd_test', label: 'Test resolution of a host', command: 'dig +short <host> || nslookup <host>' },
      { id: 'cmd_restart', label: 'Restart the resolver', command: 'systemctl restart systemd-resolved' },
      { id: 'cmd_retest', label: 'Re-test resolution', command: 'dig +short <host>' },
    ]),
  },
  {
    id: 'reload-firewall-rules-linux',
    name: 'Reload Firewall Rules (Linux)',
    description: 'Reload the firewall after a rule change (handles both UFW and firewalld) and confirm the active rules.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_show', label: 'Show current firewall rules', command: 'ufw status verbose || firewall-cmd --list-all' },
      { id: 'cmd_reload', label: 'Reload the firewall', command: 'ufw reload || firewall-cmd --reload' },
      { id: 'cmd_confirm', label: 'Confirm rules after reload', command: 'ufw status verbose || firewall-cmd --list-all' },
    ]),
  },
  {
    id: 'fix-clock-drift-linux',
    name: 'Fix Clock Drift / Re-sync Time (Linux)',
    description: 'Clock drift silently breaks TLS, Kerberos, and auth — enable NTP, restart the time service, and confirm sync.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Show time sync status', command: 'timedatectl status' },
      { id: 'cmd_ntp', label: 'Enable NTP sync', command: 'timedatectl set-ntp true' },
      {
        id: 'cmd_restart',
        label: 'Restart the time sync service',
        command: 'systemctl restart chrony || systemctl restart systemd-timesyncd',
      },
      { id: 'cmd_confirm', label: 'Confirm synchronized', command: 'timedatectl status' },
    ]),
  },
  {
    id: 'fail2ban-unban-ip-linux',
    name: 'Fail2ban: Unban an IP (Linux)',
    description: 'A legitimate user got locked out — check the jail, unban the client IP, and confirm it is cleared.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Show jail status', command: 'fail2ban-client status sshd' },
      { id: 'cmd_unban', label: 'Unban the IP', command: 'fail2ban-client set sshd unbanip <ip>' },
      { id: 'cmd_confirm', label: 'Confirm it is no longer banned', command: 'fail2ban-client status sshd' },
    ]),
  },
  {
    id: 'check-renew-tls-cert-linux',
    name: 'Check / Renew an Expiring TLS Certificate (Linux)',
    description: 'List Certbot certificates and expiry, dry-run then perform the renewal, and reload the web server.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_list', label: 'List certificates & expiry', command: 'certbot certificates' },
      { id: 'cmd_dryrun', label: 'Dry-run the renewal', command: 'certbot renew --dry-run' },
      { id: 'cmd_renew', label: 'Renew certificates', command: 'certbot renew' },
      { id: 'cmd_reload', label: 'Reload the web server', command: 'systemctl reload nginx || systemctl reload apache2' },
    ]),
  },
  {
    id: 'server-slowness-triage-linux',
    name: 'Server Slowness Triage (Linux)',
    description: 'Read-only one-shot triage for a slow host: load average, top CPU consumers, and top memory consumers.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_uptime', label: 'Load average & uptime', command: 'uptime' },
      { id: 'cmd_cpu', label: 'Top processes by CPU', command: 'top -bn1 | head -20' },
      { id: 'cmd_mem', label: 'Top processes by memory', command: 'ps aux --sort=-%mem | head -10' },
    ]),
  },
  {
    id: 'check-oom-killer-history-linux',
    name: 'Check OOM-Killer History (Linux)',
    description: 'Read-only: find what the kernel out-of-memory killer terminated and the current memory/swap picture.',
    platform: 'Ubuntu / Debian',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      {
        id: 'cmd_dmesg',
        label: 'Kernel log for OOM kills',
        command: 'dmesg -T | grep -iE "killed process|out of memory" | tail -20',
      },
      { id: 'cmd_journal', label: 'Journal for OOM events', command: 'journalctl -k --no-pager | grep -i oom | tail -20' },
      { id: 'cmd_free', label: 'Current memory & swap', command: 'free -h' },
    ]),
  },

  // ---- Windows (10) ---------------------------------------------------------
  {
    id: 'restart-print-spooler-windows',
    name: 'Windows: Restart Print Spooler',
    description: 'The same restart pattern translated to a Windows PowerShell target.',
    platform: 'Windows',
    allowedTargetOs: ['windows'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_stop', label: 'Stop the spooler', command: 'Stop-Service -Name Spooler -Force' },
      { id: 'cmd_clear', label: 'Clear the print queue', command: 'Remove-Item "C:\\Windows\\System32\\spool\\PRINTERS\\*" -Force' },
      { id: 'cmd_start', label: 'Start the spooler', command: 'Start-Service -Name Spooler' },
    ]),
  },
  {
    id: 'flush-dns-windows',
    name: 'Windows: Flush DNS Cache',
    description: 'Check cached DNS entries, flush the resolver cache, and confirm it is clear.',
    platform: 'Windows',
    allowedTargetOs: ['windows'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_check', label: 'Check cached DNS entries', command: 'ipconfig /displaydns' },
      { id: 'cmd_flush', label: 'Flush the DNS cache', command: 'ipconfig /flushdns' },
      { id: 'cmd_confirm', label: 'Confirm the cache is clear', command: 'ipconfig /displaydns' },
    ]),
  },
  {
    id: 'restart-windows-update-service',
    name: 'Windows: Restart Windows Update Service',
    description: 'Check status, restart the Windows Update service, and confirm it came back up.',
    platform: 'Windows',
    allowedTargetOs: ['windows'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check service status', command: 'Get-Service -Name wuauserv' },
      { id: 'cmd_restart', label: 'Restart the service', command: 'Restart-Service -Name wuauserv -Force' },
      { id: 'cmd_confirm', label: "Confirm it's running", command: 'Get-Service -Name wuauserv' },
    ]),
  },
  {
    id: 'clear-temp-disk-cleanup-windows',
    name: 'Windows: Clear Temp Files & Run Disk Cleanup',
    description: 'Check temp folder size, clear it, and run the built-in Disk Cleanup utility.',
    platform: 'Windows',
    allowedTargetOs: ['windows'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_check', label: 'Check temp folder size', command: 'Get-ChildItem $env:TEMP -Recurse | Measure-Object -Property Length -Sum' },
      { id: 'cmd_clear', label: 'Clear temp files', command: 'Remove-Item "$env:TEMP\\*" -Recurse -Force -ErrorAction SilentlyContinue' },
      { id: 'cmd_cleanup', label: 'Run Disk Cleanup', command: 'cleanmgr /sagerun:1' },
    ]),
  },
  {
    id: 'reset-network-adapter-windows',
    name: 'Windows: Reset Network Adapter (Winsock/TCP-IP Stack)',
    description: 'Reset Winsock and the TCP/IP stack, then confirm adapter state.',
    platform: 'Windows',
    allowedTargetOs: ['windows'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_winsock', label: 'Reset Winsock catalog', command: 'netsh winsock reset' },
      { id: 'cmd_tcpip', label: 'Reset the TCP/IP stack', command: 'netsh int ip reset' },
      { id: 'cmd_confirm', label: 'Confirm adapter state', command: 'Get-NetAdapter' },
    ]),
  },
  {
    id: 'kill-high-cpu-process-windows',
    name: 'Windows: Kill a Runaway High-CPU Process',
    description: 'List the top CPU consumers, stop the offending process, and confirm load has dropped.',
    platform: 'Windows',
    allowedTargetOs: ['windows'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_list', label: 'List top CPU-consuming processes', command: 'Get-Process | Sort-Object CPU -Descending | Select-Object -First 10' },
      { id: 'cmd_stop', label: 'Stop the offending process', command: 'Stop-Process -Name "<process_name>" -Force' },
      { id: 'cmd_confirm', label: 'Confirm CPU usage has dropped', command: 'Get-Process | Sort-Object CPU -Descending | Select-Object -First 5' },
    ]),
  },
  {
    id: 'restart-iis-windows',
    name: 'Windows: Restart IIS (World Wide Web Publishing Service)',
    description: 'Check status, restart IIS, and confirm the service came back up.',
    platform: 'Windows',
    allowedTargetOs: ['windows'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check service status', command: 'Get-Service -Name W3SVC' },
      { id: 'cmd_restart', label: 'Restart IIS', command: 'iisreset /restart' },
      { id: 'cmd_confirm', label: "Confirm it's running", command: 'Get-Service -Name W3SVC' },
    ]),
  },
  {
    id: 'unlock-account-windows',
    name: 'Windows: Unlock a Locked User Account',
    description: 'Check account status, re-enable it, and confirm it is active again.',
    platform: 'Windows',
    allowedTargetOs: ['windows'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_check', label: 'Check account status', command: 'net user "<username>"' },
      { id: 'cmd_unlock', label: 'Re-enable the account', command: 'net user "<username>" /active:yes' },
      { id: 'cmd_confirm', label: 'Confirm the account is active', command: 'net user "<username>"' },
    ]),
  },
  {
    id: 'restart-explorer-windows',
    name: 'Windows: Restart Windows Explorer Shell',
    description: 'Stop and restart the Explorer shell process to recover a frozen or glitched desktop.',
    platform: 'Windows',
    allowedTargetOs: ['windows'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_stop', label: 'Stop Explorer', command: 'Stop-Process -Name explorer -Force' },
      { id: 'cmd_start', label: 'Start Explorer', command: 'Start-Process explorer.exe' },
    ]),
  },
  {
    id: 'check-event-log-windows',
    name: 'Windows: Check Event Log for Recent Critical Errors',
    description: 'Review the most recent Error-level entries in the System and Application logs.',
    platform: 'Windows',
    allowedTargetOs: ['windows'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      {
        id: 'cmd_system',
        label: 'Check System log for errors',
        command: 'Get-WinEvent -LogName System -MaxEvents 20 | Where-Object { $_.LevelDisplayName -eq "Error" }',
      },
      {
        id: 'cmd_application',
        label: 'Check Application log for errors',
        command: 'Get-WinEvent -LogName Application -MaxEvents 20 | Where-Object { $_.LevelDisplayName -eq "Error" }',
      },
    ]),
  },

  // ---- Docker (11) ----------------------------------------------------------
  // All run docker/docker compose on the Docker host over the ticket's linked
  // SSH credential, so allowed OS is linux. `<container>` / `<service>` /
  // `<project_dir>` are edit-me tokens (same convention as `<process_name>`
  // above) the admin fills in per playbook.
  //
  // Locating containers: the container-level commands (docker ps/restart/stop/
  // inspect/stats/logs/prune) address a container by NAME/ID via the Docker
  // daemon, so they work from any directory - where the container's files live
  // is irrelevant. Only `docker compose` is directory-sensitive (it must find
  // the project's compose file and resolve its relative paths); those playbooks
  // resolve the project directory (and service name) at RUN TIME from the
  // container's own Compose labels (COMPOSE_WORKDIR / COMPOSE_SERVICE above), so
  // no folder is ever hand-entered - the AI's proposed fix runs end to end with
  // no human pointing it at a directory. The standalone "Locate ..." playbook
  // exposes the same labels as a read-only diagnostic.
  //
  // Note: docker's own Go-template format fields like {{.Name}} / {{.LogPath}}
  // and label lookups like {{ index .Config.Labels "..." }} are NOT ticket
  // placeholders and are left untouched at run time - only
  // {{username}}/{{ip_address}}/{{password}} resolve.
  {
    id: 'restart-unhealthy-container',
    name: 'Docker: Restart an Unhealthy / Stopped Container',
    description: 'Check a container’s state, restart it, and confirm it came back up.',
    platform: 'Docker',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check container status', command: 'docker ps -a --filter name=<container>' },
      { id: 'cmd_restart', label: 'Restart the container', command: 'docker restart <container>' },
      { id: 'cmd_confirm', label: "Confirm it's running", command: 'docker ps --filter name=<container>' },
    ]),
  },
  {
    id: 'recover-restart-loop-container',
    name: 'Docker: Recover a Container Stuck in a Restart Loop',
    description: 'Check the restart count, stop the container cleanly, start it again, and confirm.',
    platform: 'Docker',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check container status', command: 'docker ps -a --filter name=<container>' },
      { id: 'cmd_count', label: 'Check restart count', command: "docker inspect --format '{{.RestartCount}}' <container>" },
      { id: 'cmd_stop', label: 'Stop the container', command: 'docker stop <container>' },
      { id: 'cmd_start', label: 'Start the container', command: 'docker start <container>' },
      { id: 'cmd_confirm', label: "Confirm it's running", command: 'docker ps --filter name=<container>' },
    ]),
  },
  {
    id: 'restart-runaway-container',
    name: 'Docker: Find & Restart a Runaway-Resource Container',
    description: 'Snapshot per-container CPU/memory, restart the offending container, and re-check.',
    platform: 'Docker',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_stats', label: 'Snapshot resource usage', command: 'docker stats --no-stream' },
      { id: 'cmd_restart', label: 'Restart the container', command: 'docker restart <container>' },
      { id: 'cmd_confirm', label: 'Re-check resource usage', command: 'docker stats --no-stream' },
    ]),
  },
  {
    id: 'docker-safe-prune',
    name: 'Docker: Reclaim Disk Space — Safe Prune',
    description:
      'Remove stopped containers, dangling images, and build cache. Leaves volumes and in-use images alone — safe to run often.',
    platform: 'Docker',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_df', label: 'Show Docker disk usage', command: 'docker system df' },
      { id: 'cmd_containers', label: 'Remove stopped containers', command: 'docker container prune -f' },
      { id: 'cmd_images', label: 'Remove dangling images', command: 'docker image prune -f' },
      { id: 'cmd_cache', label: 'Remove build cache', command: 'docker builder prune -f' },
      { id: 'cmd_confirm', label: 'Confirm space reclaimed', command: 'docker system df' },
    ]),
  },
  {
    id: 'docker-deep-prune',
    name: 'Docker: Deep Prune — Unused Images & Networks',
    description:
      'More aggressive: removes every image not attached to a running container, plus unused networks. Still leaves volumes untouched — review before approving.',
    platform: 'Docker',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_df', label: 'Show Docker disk usage', command: 'docker system df' },
      { id: 'cmd_images', label: 'Remove all unused images', command: 'docker image prune -a -f' },
      { id: 'cmd_networks', label: 'Remove unused networks', command: 'docker network prune -f' },
      { id: 'cmd_confirm', label: 'Confirm space reclaimed', command: 'docker system df' },
    ]),
  },
  {
    id: 'truncate-container-log',
    name: 'Docker: Truncate a Container’s Growing Log File',
    description:
      'Find the container’s json-file log and truncate it in place — reclaims disk from a runaway log without restarting the container.',
    platform: 'Docker',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      {
        id: 'cmd_find',
        label: 'Find the container log file',
        command: "docker inspect --format '{{.LogPath}}' <container>",
      },
      {
        id: 'cmd_truncate',
        label: 'Truncate the log file',
        command: "truncate -s 0 $(docker inspect --format '{{.LogPath}}' <container>)",
      },
      {
        id: 'cmd_confirm',
        label: 'Confirm new log size',
        command: "ls -lh $(docker inspect --format '{{.LogPath}}' <container>)",
      },
    ]),
  },
  {
    id: 'tail-container-logs-errors',
    name: 'Docker: Tail Container Logs for Errors',
    description: 'Read-only diagnostic: recent log lines matching error/fatal/panic/exception, plus the health status.',
    platform: 'Docker',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check container status', command: 'docker ps --filter name=<container>' },
      {
        id: 'cmd_logs',
        label: 'Scan recent logs for errors',
        command: 'docker logs --tail 200 <container> 2>&1 | grep -iE "error|fatal|panic|exception"',
      },
      {
        id: 'cmd_health',
        label: 'Check container health',
        command: "docker inspect --format '{{.State.Health.Status}}' <container>",
      },
    ]),
  },
  {
    id: 'container-health-snapshot',
    name: 'Docker: Host-wide Container Health Snapshot',
    description: 'Read-only: list all containers, isolate any marked unhealthy, and snapshot resource usage.',
    platform: 'Docker',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_all', label: 'List all containers', command: 'docker ps' },
      { id: 'cmd_unhealthy', label: 'List unhealthy containers', command: 'docker ps --filter health=unhealthy' },
      { id: 'cmd_stats', label: 'Snapshot resource usage', command: 'docker stats --no-stream' },
    ]),
  },
  {
    id: 'locate-container-compose-project',
    name: 'Docker: Locate a Container’s Compose Project & Files',
    description:
      'Discovery step: read a container’s Compose labels to find its project name, its working directory, and the exact compose file path(s) — so the compose playbooks below can be pointed at the right place even when the project isn’t in the root/home directory.',
    platform: 'Docker',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_exists', label: 'Confirm the container exists', command: 'docker ps -a --filter name=<container>' },
      {
        id: 'cmd_project',
        label: 'Show its Compose project name',
        command: 'docker inspect --format \'{{ index .Config.Labels "com.docker.compose.project" }}\' <container>',
      },
      {
        id: 'cmd_workdir',
        label: 'Show its project working directory',
        command:
          'docker inspect --format \'{{ index .Config.Labels "com.docker.compose.project.working_dir" }}\' <container>',
      },
      {
        id: 'cmd_files',
        label: 'Show its compose file path(s)',
        command:
          'docker inspect --format \'{{ index .Config.Labels "com.docker.compose.project.config_files" }}\' <container>',
      },
    ]),
  },
  {
    id: 'restart-compose-stack',
    name: 'Docker: Restart a Compose Stack',
    description:
      'Auto-locates the stack’s project directory from the container’s Compose labels (no folder to enter — works wherever the stack lives), then restarts all its services and confirms.',
    platform: 'Docker',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_verify', label: 'Confirm the container exists', command: 'docker ps -a --filter name=<container>' },
      { id: 'cmd_status', label: 'Show stack status', command: `cd "${COMPOSE_WORKDIR}" && docker compose ps` },
      { id: 'cmd_restart', label: 'Restart the stack', command: `cd "${COMPOSE_WORKDIR}" && docker compose restart` },
      { id: 'cmd_confirm', label: 'Confirm stack status', command: `cd "${COMPOSE_WORKDIR}" && docker compose ps` },
    ]),
  },
  {
    id: 'update-compose-service',
    name: 'Docker: Update a Compose Service to Latest Image',
    description:
      'Auto-locates the project directory and the service name from the container’s Compose labels (no folder or service to enter), pulls the latest image, recreates the service, and confirms it is running the new build.',
    platform: 'Docker',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_verify', label: 'Confirm the container exists', command: 'docker ps -a --filter name=<container>' },
      {
        id: 'cmd_pull',
        label: 'Pull the latest image',
        command: `cd "${COMPOSE_WORKDIR}" && docker compose pull "${COMPOSE_SERVICE}"`,
      },
      {
        id: 'cmd_up',
        label: 'Recreate the service',
        command: `cd "${COMPOSE_WORKDIR}" && docker compose up -d "${COMPOSE_SERVICE}"`,
      },
      { id: 'cmd_confirm', label: 'Confirm service status', command: `cd "${COMPOSE_WORKDIR}" && docker compose ps` },
    ]),
  },

  // ---- Proxmox (14) ---------------------------------------------------------
  // Run over SSH on the Proxmox VE node (Debian-based, so the Ubuntu/Debian
  // playbooks also apply to the host itself). `<vmid>` / `<ctid>` / `<storage>`
  // are edit-me tokens. Guest power ops deliberately use `qm reset` (hard
  // reset) and `pct stop`+`pct start` (hard cycle) rather than the graceful
  // `qm reboot`/`qm shutdown`/`pct reboot`/`pct shutdown` verbs: the baseline
  // forbidden-command filter blocks the words reboot/shutdown/halt/poweroff to
  // protect the HOST, and can't tell a guest verb from a host one - a hard
  // cycle is the right move for a hung guest anyway.
  {
    id: 'proxmox-start-vm',
    name: 'Proxmox: Start a Stopped VM',
    description: 'Check a VM’s state, start it, and confirm it is running.',
    platform: 'Proxmox',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check VM status', command: 'qm status <vmid>' },
      { id: 'cmd_start', label: 'Start the VM', command: 'qm start <vmid>' },
      { id: 'cmd_confirm', label: 'Confirm it is running', command: 'qm status <vmid>' },
    ]),
  },
  {
    id: 'proxmox-force-restart-vm',
    name: 'Proxmox: Force-Restart a Hung VM',
    description: 'Immediately hardware-resets a hung VM (qm reset) and confirms it came back up.',
    platform: 'Proxmox',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check VM status', command: 'qm status <vmid>' },
      { id: 'cmd_reset', label: 'Hard-reset the VM', command: 'qm reset <vmid>' },
      { id: 'cmd_confirm', label: 'Confirm it is running', command: 'qm status <vmid>' },
    ]),
  },
  {
    id: 'proxmox-unlock-vm',
    name: 'Proxmox: Unlock a Locked VM',
    description: 'Clears a stuck lock left by a failed backup or migration so the VM can be managed again.',
    platform: 'Proxmox',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check VM status (shows the lock)', command: 'qm status <vmid> --verbose' },
      { id: 'cmd_unlock', label: 'Remove the lock', command: 'qm unlock <vmid>' },
      { id: 'cmd_confirm', label: 'Confirm the lock is gone', command: 'qm status <vmid> --verbose' },
    ]),
  },
  {
    id: 'proxmox-check-vm-config',
    name: 'Proxmox: Check VM Status & Config',
    description: 'Read-only: list VMs, show a VM’s configuration, and its detailed runtime status.',
    platform: 'Proxmox',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_list', label: 'List all VMs', command: 'qm list' },
      { id: 'cmd_config', label: 'Show the VM configuration', command: 'qm config <vmid>' },
      { id: 'cmd_status', label: 'Show detailed runtime status', command: 'qm status <vmid> --verbose' },
    ]),
  },
  {
    id: 'proxmox-check-vm-agent',
    name: 'Proxmox: Check VM Guest Agent',
    description: 'Read-only: ping the QEMU guest agent and read guest OS info to diagnose an unresponsive agent.',
    platform: 'Proxmox',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_ping', label: 'Ping the guest agent', command: 'qm agent <vmid> ping' },
      { id: 'cmd_osinfo', label: 'Read guest OS info', command: 'qm agent <vmid> get-osinfo' },
    ]),
  },
  {
    id: 'proxmox-start-lxc',
    name: 'Proxmox: Start a Stopped LXC Container',
    description: 'Check a container’s state, start it, and confirm it is running.',
    platform: 'Proxmox',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check container status', command: 'pct status <ctid>' },
      { id: 'cmd_start', label: 'Start the container', command: 'pct start <ctid>' },
      { id: 'cmd_confirm', label: 'Confirm it is running', command: 'pct status <ctid>' },
    ]),
  },
  {
    id: 'proxmox-force-restart-lxc',
    name: 'Proxmox: Force-Restart a Hung LXC Container',
    description: 'Hard-cycles a hung container (stop then start) and confirms it came back up.',
    platform: 'Proxmox',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check container status', command: 'pct status <ctid>' },
      { id: 'cmd_stop', label: 'Stop the container', command: 'pct stop <ctid>' },
      { id: 'cmd_start', label: 'Start the container', command: 'pct start <ctid>' },
      { id: 'cmd_confirm', label: 'Confirm it is running', command: 'pct status <ctid>' },
    ]),
  },
  {
    id: 'proxmox-unlock-lxc',
    name: 'Proxmox: Unlock a Locked Container',
    description: 'Clears a stuck lock on an LXC container so it can be managed again.',
    platform: 'Proxmox',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check container status', command: 'pct status <ctid>' },
      { id: 'cmd_unlock', label: 'Remove the lock', command: 'pct unlock <ctid>' },
      { id: 'cmd_confirm', label: 'Confirm the lock is gone', command: 'pct status <ctid>' },
    ]),
  },
  {
    id: 'proxmox-check-storage',
    name: 'Proxmox: Check Storage Status & Free Space',
    description: 'Read-only: overall storage status, host disk usage, and a specific storage’s details — full storage stops VMs writing.',
    platform: 'Proxmox',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Show all storage status', command: 'pvesm status' },
      { id: 'cmd_df', label: 'Show host disk usage', command: 'df -h' },
      { id: 'cmd_one', label: 'Show a specific storage', command: 'pvesm status --storage <storage>' },
    ]),
  },
  {
    id: 'proxmox-backup-vm',
    name: 'Proxmox: On-Demand Backup of a VM',
    description: 'Take an immediate snapshot-mode, zstd-compressed backup of a VM to a storage, then confirm it landed.',
    platform: 'Proxmox',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check VM status', command: 'qm status <vmid>' },
      {
        id: 'cmd_backup',
        label: 'Run the backup',
        command: 'vzdump <vmid> --storage <storage> --mode snapshot --compress zstd',
      },
      { id: 'cmd_confirm', label: 'Confirm the backup landed', command: 'pvesm list <storage>' },
    ]),
  },
  {
    id: 'proxmox-check-cluster',
    name: 'Proxmox: Check Cluster Health / Quorum',
    description: 'Read-only: cluster quorum status, node membership, and HA manager state — critical on clustered nodes.',
    platform: 'Proxmox',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Show cluster / quorum status', command: 'pvecm status' },
      { id: 'cmd_nodes', label: 'Show node membership', command: 'pvecm nodes' },
      { id: 'cmd_ha', label: 'Show HA manager status', command: 'ha-manager status' },
    ]),
  },
  {
    id: 'proxmox-restart-services',
    name: 'Proxmox: Restart Management Services',
    description:
      'Recover an unresponsive web UI / grey "?" nodes by restarting the pve management daemons. Running guests are unaffected — these are host-management services only.',
    platform: 'Proxmox',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_status', label: 'Check management services', command: 'systemctl status pveproxy pvedaemon pvestatd --no-pager' },
      { id: 'cmd_restart', label: 'Restart the management daemons', command: 'systemctl restart pvedaemon pveproxy pvestatd' },
      { id: 'cmd_confirm', label: 'Confirm they are active', command: 'systemctl status pveproxy pvedaemon pvestatd --no-pager' },
    ]),
  },
  {
    id: 'proxmox-update',
    name: 'Proxmox: Update (apt dist-upgrade)',
    description:
      'Refresh package lists and apply the Proxmox-recommended dist-upgrade, then show the resulting version. A kernel update still needs a manual reboot (intentionally not automated).',
    platform: 'Proxmox',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_update', label: 'Refresh package lists', command: 'apt-get update' },
      { id: 'cmd_upgrade', label: 'Apply the dist-upgrade', command: 'apt-get dist-upgrade -y' },
      { id: 'cmd_version', label: 'Show the resulting version', command: 'pveversion -v' },
    ]),
  },
  {
    id: 'proxmox-check-version-repo',
    name: 'Proxmox: Check Version & Repo Status',
    description: 'Read-only: full component versions, the configured PVE apt repositories, and the subscription status.',
    platform: 'Proxmox',
    allowedTargetOs: ['linux'],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([
      { id: 'cmd_version', label: 'Show component versions', command: 'pveversion -v' },
      { id: 'cmd_repos', label: 'Show configured PVE repositories', command: 'cat /etc/apt/sources.list.d/pve-*.list' },
      { id: 'cmd_sub', label: 'Show subscription status', command: 'pvesubscription get' },
    ]),
  },

  // ---- General (1) ----------------------------------------------------------
  // The one "command runner" playbook: its command is the {{command}} token,
  // supplied at run time. The AI investigator, if it picks this playbook,
  // proposes the exact command; a human reviews (and may edit) it on the
  // approval card, and it runs only after explicit approval. The proposed /
  // edited command still passes the full guardrail engine, so the
  // non-overridable forbidden-command baseline blocks rm -rf / mkfs /
  // shutdown / etc. exactly as for a fixed playbook. Creating or editing it
  // is global-admin only and it can never be Auto-Approve (enforced in
  // app/routers/playbooks.py); importing/enabling it is the deliberate opt-in.
  {
    id: 'ai-command-runner',
    name: 'Run an AI-Suggested Command (review required)',
    description:
      'Flexible command runner: the AI proposes the exact command to resolve the ticket, a human reviews/edits it on the approval card, and it executes only after an explicit approval. The command still passes every guardrail (the non-overridable forbidden-command baseline blocks rm -rf, mkfs, shutdown, and the like). Global-admin only; always human-in-the-loop; enable it deliberately.',
    platform: 'General',
    allowedTargetOs: [],
    requiredApprovalLevel: 'human_in_the_loop',
    forbiddenCommands: [],
    graph: linearGraph([{ id: 'cmd_run', label: 'Run the AI-suggested command', command: '{{command}}' }]),
  },
]