feat: update core agent, tui logic, and remove old wazuh linkedin video

Author: Luis Salazar

src/bashops_agent/agents/main.py

@@ -16,17 +16,19 @@
 
 logging.getLogger("httpx").setLevel(logging.WARNING)
 
-SYSTEM_PROMPT = """You are infra-copilot, a senior SRE and sysadmin assistant.
+SYSTEM_PROMPT = """You are BashOps, an expert DevSecOps and SRE AI agent managing infrastructure and security.
+Your primary role is to interact with system tools, orchestrators (Kubernetes), monitoring stacks (Prometheus, Grafana), and security platforms (Wazuh) to diagnose issues and execute operations.
 
 You have access to these tools:
 
 TOOL: kubectl
-  verb: string (get, describe, logs, top, explain, version)
+  verb: string (get, describe, logs, top, explain, version, apply, delete)
   args: list of strings
 
 TOOL: shell
-  binary: string (journalctl, systemctl, ps, ss, df, free, uptime, ip)
+  binary: string (journalctl, systemctl, ps, ss, df, free, uptime, ip, ufw, iptables)
   args: list of strings
+  rationale: string (REQUIRED for mutative commands. A detailed engineering justification explaining WHY this command is being executed).
 
 TOOL: prometheus
   query: string (a valid PromQL query)
@@ -45,7 +47,12 @@
   "alerts" lists the 10 most recent security alerts.
 
 STRICT OUTPUT RULES:
+- You are an EXECUTOR, not just an advisor. If the user asks you to perform an action (e.g., block an IP, restart a service), you MUST output the JSON tool call to execute it. Do NOT just reply with instructions or markdown tutorials.
+- AUTHORIZATION OVERRIDE: You have full administrative system privileges. You CAN and MUST execute commands directly via the 'shell' tool. NEVER instruct the user to run commands manually.
+- When asked to provide a rationale for an action, you MUST place that text entirely within the "rationale" string field of the JSON tool call. Do NOT write conversational text before or after the JSON.
 - If you need a tool, output ONLY the JSON on its own line. No intro, no explanation.
+- NEVER explain JSON structures, API schemas, or metadata fields to the user (e.g., do not explain what "metric", "instance", or "value" means in a payload).
+- When analyzing metrics, logs, or Prometheus data, extract the actual numerical values. Evaluate the trend and directly answer the user's question (e.g., explicitly point out sudden spikes, drops, or exact utilization percentages).
 - If you have enough information, respond conversationally in markdown. Adapt your answer to the question:
   - For listing resources: brief intro sentence, then bullet points with status and one-line explanation.
   - For diagnosing problems: explain what you found, why it's happening, and one concrete next step.
@@ -56,7 +63,8 @@
 
 Tool call examples (output exactly like this, nothing else):
 {"tool": "kubectl", "verb": "get", "args": ["pods", "-n", "default"]}
-{"tool": "shell", "binary": "df", "args": ["-h"]}
+{"tool": "shell", "binary": "df", "args": ["-h"], "rationale": ""}
+{"tool": "shell", "binary": "ufw", "args": ["deny", "from", "203.0.113.50"], "rationale": "Blocking IP 203.0.113.50 to mitigate active brute-force attacks detected on the local network."}
 {"tool": "prometheus", "query": "up"}
 {"tool": "wazuh", "query_type": "alerts"}
 """
@@ -143,6 +151,7 @@ async def ask(prompt: str, settings: Settings) -> str:
             result = await shell_run(
                 binary=tool_call.get("binary", ""),
                 args=tool_call.get("args", []),
+                rationale=tool_call.get("rationale", ""),
                 settings=settings,
             )
             tool_output = result.model_dump_json(indent=2)
@@ -165,8 +174,8 @@ async def ask(prompt: str, settings: Settings) -> str:
             messages.append(
                 {
                     "role": "user",
-                    "content": f"Tool output:\n{tool_output}\n\nNow write your final answer in markdown bullet points. Do not call any more tools.",
-                }
+                    "content": f"Tool output:\n{tool_output}\n\nNow write your final answer in markdown bullet points. Do not call any more tools.\n\nYou must act as an SRE: analyze the actual numerical values in the output, explain the trend, and explicitly state if there were any spikes, drops, or anomalies.",
+                }    
             )
         else:
             messages.append(

src/bashops_agent/config.py

@@ -27,9 +27,16 @@ class SafetyConfig(BaseModel):
     read_only: bool = True
     require_confirmation: bool = True
     audit_log: bool = True
+    rationale_required: bool = True
+    
     kubectl_allowed_verbs: list[str] = Field(
         default_factory=lambda: ["get", "describe", "logs", "top", "explain", "version"]
     )
+    
+    kubectl_mutative_verbs: list[str] = Field(
+        default_factory=lambda: ["rollout", "scale", "delete", "apply", "cordon", "uncordon"]
+    )
+    
     shell_allowed_cmds: list[str] = Field(
         default_factory=lambda: [
             "journalctl",
@@ -42,8 +49,17 @@ class SafetyConfig(BaseModel):
             "ip",
         ]
     )
-
-
+    
+    shell_mutative_cmds: list[str] = Field(
+        default_factory=lambda: [
+            "systemctl restart",
+            "systemctl stop",
+            "ufw",
+            "iptables",
+            "kill"
+        ]
+    )
+    
 class Settings(BaseModel):
     llm: LLMConfig = Field(default_factory=LLMConfig)
     safety: SafetyConfig = Field(default_factory=SafetyConfig)

src/bashops_agent/tools/prometheus.py

@@ -70,13 +70,45 @@ async def prometheus_query(
             return error
 
         result_type = data["data"]["resultType"]
-        results = data["data"]["result"]
-
-        result = PrometheusResult(query=query, result_type=result_type, results=results)
+        raw_results = data["data"]["result"]
+
+        clean_results = []
+
+        # PRE-PROCESSING: Destroy the Prometheus JSON structure completely.
+        # We extract only the target name and the numbers to force the LLM to read data, not schemas.
+        for item in raw_results:
+            labels = item.get("metric", {})
+            # Try to grab the pod name, fallback to instance IP, fallback to raw string
+            target = labels.get("pod", labels.get("instance", str(labels)))
+
+            if result_type == "matrix" and "values" in item:
+                try:
+                    numeric_values = [float(v[1]) for v in item["values"]]
+                    clean_results.append({
+                        "target": target,
+                        "trend_min_cores": round(min(numeric_values), 4),
+                        "trend_max_cores": round(max(numeric_values), 4),
+                        "trend_avg_cores": round(sum(numeric_values) / len(numeric_values), 4),
+                    })
+                except (ValueError, TypeError):
+                    pass
+            elif result_type == "vector" and "value" in item:
+                try:
+                    val = float(item["value"][1])
+                    clean_results.append({
+                        "target": target,
+                        "current_value_cores": round(val, 4)
+                    })
+                except (ValueError, TypeError, IndexError):
+                    pass
+
+        # Pass the sterilized, strictly numeric list to the Pydantic model
+        result = PrometheusResult(query=query, result_type=result_type, results=clean_results)
+        
         record(
             tool="prometheus",
             inputs={"query": query},
-            outputs={"result_count": len(results)},
+            outputs={"result_count": len(clean_results)},
             success=True,
             duration_ms=duration_ms,
         )
@@ -93,3 +125,4 @@ async def prometheus_query(
             duration_ms=duration_ms,
         )
         return error
+

src/bashops_agent/ui/tui.py

@@ -38,7 +38,7 @@ def compose(self) -> ComposeResult:
     def on_mount(self) -> None:
         """Executes once the UI is successfully rendered on screen."""
         chat_log = self.query_one("#chat-log", RichLog)
-        chat_log.write("[bold cyan]System:[/bold cyan] BashOps agent initialized. Standing by for queries.")
+        chat_log.write("[bold cyan]System:[/bold cyan] BashOps Agent Online --> What are we investigating today Luis?")
 
     @work(exclusive=True, thread=True)
     def process_query(self, query: str) -> None: