feat: Add a download_manifests tool to our agent harness mcp server

[JohnBlackwell]

This should:

take a cluster handle + service name and fetch the manifests using our service files gql api.

place those files in a separate subdirectory (use the {handle}-{name} syntax to make it semantically meaningful perhaps)

instruct the agent harness that the files are located there and it can inspect them as it wishes

This will help agents better understand both plural's gitops system + things like external charts without mistakenly guessing via web searches.

Test Plan

Test environment: https://jbdemo.console.cloud.plural.sh/

verifed with https://jbdemo.console.cloud.plural.sh/ai/agent-runs/49dfb980-21a3-4cf5-83a8-0d72f6f412b1

Checklist

• I have added a meaningful title and summary to convey the impact of this PR to a user.
• If required, I have updated the Plural documentation accordingly.
• I have added tests to cover my changes.
• I have deployed the agent to a test environment and verified that it works as expected (required only when changing agent code).
  • Agent starts successfully.
  • Service creation works without any issues when using raw manifests and Helm templates.
  • Service creation works when resources contain both CRD and CRD instances.
  • Service templating works correctly.
  • Service errors are reported properly and visible in the UI.
  • Service updates are reflected properly in the cluster.
  • Service resync triggers immediately and works as expected.
  • Sync waves annotations are respected.
  • Sync phases annotations are respected. Phases are executed in the correct order.
  • Sync hook delete policies are respected. Resources are not recreated once they reach the desired state.
  • Service deletion works and cleanups resources properly.
  • Services can be recreated after deletion.
  • Service detachment works and keeps resources unaffected.
  • Services can be recreated after detachment.
  • Service component trees are working as expected.
  • Cluster health statuses are being updated.
  • Agent logs do not contain any errors (after running for at least 30 minutes).
  • There are no visible anomalies in Datadog (after running for at least 30 minutes).

Plural Flow: console

[greptile-apps]

Greptile Summary

This PR adds a downloadServiceManifests MCP tool to the agent harness server. The tool accepts a cluster handle and service name, looks up the service via GraphQL, downloads its rendered manifest tarball, and writes the files to a sandboxed subdirectory so agents can inspect them instead of guessing via web searches.

• New DownloadManifests tool in downloadmanifests.go: uses securejoin for path-traversal safety, RawStdEncoding + TrimRight for flexible base64 decoding, and safeNamePattern (dots excluded) for sanitizing directory names.
• All four agent harnesses (Claude analyze/write/babysit, Codex read/write, Gemini template, agent JSON configs) updated consistently to expose the new tool.

Confidence Score: 5/5

Safe to merge; all previously flagged issues are resolved and the new tool is consistently wired across all agent harnesses.

The implementation is well-guarded: path traversal is prevented with securejoin, directory names are sanitized with a tight regex, and base64 handling now tolerates both padded and unpadded encodings. All four agent harness integrations are consistent. The one remaining note (aborting vs. skipping on empty file paths) is a minor behavioural preference and does not affect correctness in the happy path.

No files require special attention.

Important Files Changed

Filename	Overview
go/deployment-operator/internal/mcpserver/agent/tool/downloadmanifests.go	New MCP tool implementing download_manifests; previous review issues (dots in safeNamePattern, agentRunID param, base64 encoding, arg count) are all addressed in this revision
go/deployment-operator/pkg/client/service.go	Adds GetServiceDeploymentByHandle and GetServiceTarball client methods with proper nil guards
go/deployment-operator/pkg/agentrun-harness/tool/claude/claude.go	downloadServiceManifests added to all three Claude run modes (analyze, write, babysit)
go/deployment-operator/pkg/agentrun-harness/tool/gemini/settings_test.go	Test updated to verify both tools are present in ANALYZE mode includeTools; logic is correct

_{Reviews (4): Last reviewed commit: "fix import name" | Re-trigger Greptile}

[JohnBlackwell]

@greptile

[socket-security]

Review the following changes in direct dependencies. Learn more about Socket for GitHub.

Diff	Package	Supply Chain Security	Vulnerability	Quality	Maintenance	License
	github.com/​pluralsh/​console/​go/​client@​v1.74.1 ⏵ v1.61.0
	github.com/​fluxcd/​pkg/​oci@​v0.47.0
	github.com/​envoyproxy/​protoc-gen-validate@​v1.3.0
	github.com/​arttor/​helmify@​v0.4.18
	github.com/​a8m/​envsubst@​v1.4.3
	github.com/​elastic/​crd-ref-docs@​v0.2.0

View full report

[JohnBlackwell]

@greptile

[JohnBlackwell]

@greptile