@blogic-cz/agent-tools 0.14.30 → 0.14.31

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "0.14.30",
+  "version": "0.14.31",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/schemas/agent-tools.schema.json

@@ -240,6 +240,10 @@
           "description": "Optional timeout for establishing a tunnel, in milliseconds.",
           "type": "number"
         },
+        "apiProbeTimeoutMs": {
+          "description": "Timeout in milliseconds for the Kubernetes API-server reachability probe run before a tunnel attempt. Lets the direct (no-VPN) attempt fail fast instead of waiting out tunnelTimeoutMs when the API server is unreachable. Set to 0 to disable. Defaults to 2000.",
+          "type": "number"
+        },
         "remotePort": {
           "description": "Optional remote database port used by the tunnel.",
           "type": "number"

package/src/config/types.ts

@@ -103,6 +103,15 @@ export type DatabaseConfig = ProfilePrerequisites & {
     service?: string;
   };
   tunnelTimeoutMs?: number;
+  /**
+   * Timeout in milliseconds for the cheap Kubernetes API-server reachability probe
+   * run before attempting a tunnel. When the API server is unreachable (VPN down and
+   * not on the office network) `kubectl port-forward` hangs silently on TCP connect, so
+   * a short probe lets the direct (no-VPN) attempt fail fast and fall back to connecting
+   * the VPN instead of waiting out `tunnelTimeoutMs`. Set to 0 to disable the probe.
+   * Defaults to 2000.
+   */
+  apiProbeTimeoutMs?: number;
   remotePort?: number;
 };
 

package/src/db-tool/service.ts

@@ -51,6 +51,27 @@ export function resolveDbAccessMode(
   };
 }
 
+/**
+ * Build the kubectl args for the lightweight API-server reachability probe.
+ * Hitting `/version` via `--raw` is the cheapest authenticated round-trip; `--request-timeout`
+ * bounds it so an unreachable server (VPN down, off the office network) fails fast instead of
+ * letting a subsequent `kubectl port-forward` hang on a silent TCP connect.
+ */
+export function buildApiProbeArgs(
+  kubeconfig: string | undefined,
+  context: string,
+  timeoutMs: number,
+): string[] {
+  return [
+    ...(kubeconfig ? ["--kubeconfig", kubeconfig] : []),
+    "--context",
+    context,
+    "get",
+    "--raw=/version",
+    `--request-timeout=${timeoutMs}ms`,
+  ];
+}
+
 export class DbService extends Context.Service<
   DbService,
   {
@@ -89,6 +110,7 @@ export class DbService extends Context.Service<
         const kubectlNamespace = dbConfig.kubectl?.namespace;
         const kubectlService = dbConfig.kubectl?.service ?? "postgresql";
         const tunnelTimeoutMs = dbConfig.tunnelTimeoutMs ?? 5000;
+        const apiProbeTimeoutMs = dbConfig.apiProbeTimeoutMs ?? 2000;
         const remotePort = dbConfig.remotePort ?? 5432;
 
         const zshrcEnvCache = yield* Ref.make<Record<string, string> | null>(null);
@@ -326,6 +348,35 @@ export class DbService extends Context.Service<
             return proc;
           });
 
+        /**
+         * Cheap pre-flight check: is the Kubernetes API server reachable right now?
+         * Returns true when the probe is disabled (apiProbeTimeoutMs <= 0) or no context is
+         * configured, so behaviour is unchanged unless a probe can meaningfully run. A false
+         * result lets the direct (no-VPN) tunnel attempt bail fast and fall back to the VPN
+         * prerequisite instead of waiting out tunnelTimeoutMs on a silently hanging port-forward.
+         */
+        const probeApiServerReachable = Effect.fn("DbService.probeApiServerReachable")(function* (
+          config: DbConfig,
+        ) {
+          if (!kubectlContext || apiProbeTimeoutMs <= 0) {
+            return true;
+          }
+
+          const kubeconfig = yield* resolveKubeconfig(config.port).pipe(
+            Effect.orElseSucceed(() => undefined),
+          );
+
+          const result = yield* executeShellCommand(
+            ChildProcess.make(
+              "kubectl",
+              buildApiProbeArgs(kubeconfig, kubectlContext, apiProbeTimeoutMs),
+              { stdout: "pipe", stderr: "pipe" },
+            ),
+          ).pipe(Effect.catch(() => Effect.succeed({ stdout: "", stderr: "", exitCode: 1 })));
+
+          return result.exitCode === 0;
+        });
+
         const buildPsqlCommand = (
           config: DbConfig,
           sql: string,
@@ -606,6 +657,14 @@ export class DbService extends Context.Service<
 
           return Effect.scoped(
             Effect.gen(function* () {
+              const reachable = yield* probeApiServerReachable(config);
+              if (!reachable) {
+                return yield* new DbTunnelError({
+                  message: `Kubernetes API server not reachable within ${apiProbeTimeoutMs}ms; skipping tunnel attempt (VPN likely not connected and not on the office network).`,
+                  port: config.port,
+                });
+              }
+
               const tunnelProc = yield* startTunnelProcess(config).pipe(
                 Effect.mapError(
                   (platformError) =>