@blogic-cz/agent-tools 0.14.44 → 0.14.46

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "0.14.44",
+  "version": "0.14.46",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/schemas/agent-tools.schema.json

@@ -291,6 +291,13 @@
               "$ref": "#/definitions/DbMutationOperation"
             }
           }
+        },
+        "allowedMutationTargets": {
+          "description": "Explicitly allowed SQL mutation targets per environment and operation. Use normalized schema-qualified names such as ticker.TimeTickers.",
+          "type": "object",
+          "additionalProperties": {
+            "$ref": "#/definitions/DbAllowedMutationTargets"
+          }
         }
       },
       "required": ["environments"]
@@ -591,6 +598,30 @@
       "description": "SQL mutation operation that can be explicitly allowed for a database environment.",
       "type": "string",
       "enum": ["insert", "update", "delete"]
+    },
+    "DbAllowedMutationTargets": {
+      "type": "object",
+      "additionalProperties": false,
+      "properties": {
+        "insert": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "update": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        },
+        "delete": {
+          "type": "array",
+          "items": {
+            "type": "string"
+          }
+        }
+      }
     }
   },
   "examples": [
@@ -640,6 +671,11 @@
           "remotePort": 5432,
           "allowedMutations": {
             "test": ["insert"]
+          },
+          "allowedMutationTargets": {
+            "prod": {
+              "insert": ["ticker.TimeTickers"]
+            }
           }
         }
       },

package/src/config/index.ts

@@ -3,6 +3,7 @@ export type {
   AzureConfig,
   K8sConfig,
   DbEnvConfig,
+  DbAllowedMutationTargets,
   DbMutationOperation,
   DatabaseConfig,
   ObservabilityConfig,

package/src/config/loader.ts

@@ -96,11 +96,20 @@ const DbEnvConfigSchema = Schema.Struct({
   vpn: Schema.optionalKey(Schema.String),
 });
 
+const DbAllowedMutationTargetsSchema = Schema.Struct({
+  insert: Schema.optionalKey(Schema.Array(Schema.String)),
+  update: Schema.optionalKey(Schema.Array(Schema.String)),
+  delete: Schema.optionalKey(Schema.Array(Schema.String)),
+});
+
 const DatabaseConfigSchema = Schema.Struct({
   environments: Schema.Record(Schema.String, DbEnvConfigSchema),
   allowedMutations: Schema.optionalKey(
     Schema.Record(Schema.String, Schema.Array(DbMutationOperationSchema)),
   ),
+  allowedMutationTargets: Schema.optionalKey(
+    Schema.Record(Schema.String, DbAllowedMutationTargetsSchema),
+  ),
   kubectl: Schema.optionalKey(
     Schema.Struct({
       kubeconfig: Schema.optionalKey(Schema.String),

package/src/config/types.ts

@@ -95,6 +95,7 @@ export type DbEnvConfig = ProfilePrerequisites & {
 /** SQL mutation operation that can be explicitly allowed for a database environment. */
 export const DbMutationOperationSchema = Schema.Literals(["insert", "update", "delete"]);
 export type DbMutationOperation = Schema.Schema.Type<typeof DbMutationOperationSchema>;
+export type DbAllowedMutationTargets = Partial<Record<DbMutationOperation, readonly string[]>>;
 
 /** Database profile configuration */
 export type DatabaseConfig = ProfilePrerequisites & {
@@ -102,6 +103,7 @@ export type DatabaseConfig = ProfilePrerequisites & {
   environments: Record<string, DbEnvConfig>;
   /** Explicitly allowed SQL mutation operations per environment. Non-local environments default to read-only. */
   allowedMutations?: Record<string, readonly DbMutationOperation[]>;
+  allowedMutationTargets?: Record<string, DbAllowedMutationTargets>;
   kubectl?: {
     /** Optional kubeconfig path. Supports ${ENV_VAR} templates. */
     kubeconfig?: string;

package/src/db-tool/index.ts

@@ -64,16 +64,21 @@ const sqlCommand = Command.make(
       ),
     ),
     sql: Flag.string("sql").pipe(Flag.withDescription("SQL query to execute")),
+    limit: Flag.optional(Flag.integer("limit")).pipe(
+      Flag.withDescription(
+        "Max rows to return (default 50). Use 0 for no cap. Prefer a SQL LIMIT for large tables.",
+      ),
+    ),
     format: formatOption,
     profile: Flag.optional(Flag.string("profile")).pipe(
       Flag.withDescription("Database profile name from agent-tools.json5 (if multiple configured)"),
     ),
   },
-  ({ env, sql, format }) =>
+  ({ env, sql, limit, format }) =>
     Effect.gen(function* () {
       const resolvedEnv = yield* resolveEnv(env);
       const db = yield* DbService;
-      const result = yield* db.executeQuery(resolvedEnv, sql);
+      const result = yield* db.executeQuery(resolvedEnv, sql, Option.getOrUndefined(limit));
       yield* Console.log(formatOutput(result, format));
     }),
 ).pipe(Command.withDescription("Execute a SQL query"));

package/src/db-tool/security.ts

@@ -17,6 +17,13 @@ const ALLOWABLE_MUTATION_PATTERNS: Array<[DbMutationOperation, RegExp]> = [
 ];
 
 const TABLE_NAME_PATTERN = /^[a-zA-Z_][a-zA-Z0-9_]*(\.[a-zA-Z_][a-zA-Z0-9_]*)?$/;
+const IDENTIFIER_PATTERN = String.raw`(?:"[^"]+"|[a-zA-Z_][a-zA-Z0-9_]*)`;
+const QUALIFIED_IDENTIFIER_PATTERN = `${IDENTIFIER_PATTERN}(?:\\s*\\.\\s*${IDENTIFIER_PATTERN})?`;
+const MUTATION_TARGET_PATTERNS: Array<[DbMutationOperation, RegExp]> = [
+  ["insert", new RegExp(String.raw`^\s*INSERT\s+INTO\s+(${QUALIFIED_IDENTIFIER_PATTERN})`, "i")],
+  ["update", new RegExp(String.raw`^\s*UPDATE\s+(${QUALIFIED_IDENTIFIER_PATTERN})`, "i")],
+  ["delete", new RegExp(String.raw`^\s*DELETE\s+FROM\s+(${QUALIFIED_IDENTIFIER_PATTERN})`, "i")],
+];
 
 /**
  * Strip SQL comments (block and line) while preserving string literals.
@@ -89,6 +96,27 @@ export function getAllowedMutationOperation(sql: string): DbMutationOperation |
   return ALLOWABLE_MUTATION_PATTERNS.find(([, pattern]) => pattern.test(stripped))?.[0];
 }
 
+function normalizeSqlIdentifier(identifier: string): string {
+  return identifier
+    .split(".")
+    .map((part) =>
+      part
+        .trim()
+        .replace(/^"(.+)"$/, "$1")
+        .replace(/""/g, '"'),
+    )
+    .join(".");
+}
+
+export function getMutationTarget(sql: string): string | undefined {
+  const stripped = stripSqlComments(sql);
+  const operation = getAllowedMutationOperation(stripped);
+  const pattern = MUTATION_TARGET_PATTERNS.find(([candidate]) => candidate === operation)?.[1];
+  const target = pattern?.exec(stripped)?.[1];
+
+  return target === undefined ? undefined : normalizeSqlIdentifier(target);
+}
+
 export function isValidTableName(tableName: string): boolean {
   return TABLE_NAME_PATTERN.test(tableName);
 }

package/src/db-tool/service.ts

@@ -28,6 +28,7 @@ import {
 import {
   detectSchemaError,
   getAllowedMutationOperation,
+  getMutationTarget,
   isValidTableName,
   isMutationQuery,
 } from "./security";
@@ -58,7 +59,11 @@ export { buildApiProbeArgs } from "#shared/k8s-probe";
 export class DbService extends Context.Service<
   DbService,
   {
-    readonly executeQuery: (env: string, sql: string) => Effect.Effect<QueryResult, DbError>;
+    readonly executeQuery: (
+      env: string,
+      sql: string,
+      limit?: number,
+    ) => Effect.Effect<QueryResult, DbError>;
     readonly executeSchemaQuery: (
       env: string,
       mode: SchemaMode,
@@ -82,7 +87,8 @@ export class DbService extends Context.Service<
               environment: env,
             });
           return {
-            executeQuery: (env: string, _sql: string) => Effect.fail(noConfigError(env)),
+            executeQuery: (env: string, _sql: string, _limit?: number) =>
+              Effect.fail(noConfigError(env)),
             executeSchemaQuery: (env: string, _mode: SchemaMode, _table?: string) =>
               Effect.fail(noConfigError(env)),
           };
@@ -467,6 +473,7 @@ export class DbService extends Context.Service<
           password: string,
           startTimeMs: number,
           applyTransform = false,
+          limit?: number,
         ) {
           const selectSql = sql.trim().replace(/;\s*$/, "");
           const wrappedSql = `SELECT json_agg(t) FROM (${selectSql}) t;`;
@@ -531,7 +538,7 @@ export class DbService extends Context.Service<
           });
 
           const transformed = applyTransform
-            ? transformQueryResult(rawData)
+            ? transformQueryResult(rawData, limit)
             : {
                 data: rawData,
                 showing: rawData.length,
@@ -712,12 +719,14 @@ export class DbService extends Context.Service<
             needsTunnel: accessMode.needsTunnel,
             allowMutations: accessMode.allowMutations,
             allowedMutations: accessMode.allowedMutations,
+            allowedMutationTargets: dbConfig.allowedMutationTargets?.[env] ?? {},
           };
         });
 
         const executeQuery = Effect.fn("DbService.executeQuery")(function* (
           env: string,
           sql: string,
+          limit?: number,
         ) {
           const config = yield* getConfigForEnv(env);
           const startTimeMs = yield* Clock.currentTimeMillis;
@@ -725,11 +734,17 @@ export class DbService extends Context.Service<
           const password = yield* resolvePassword(resolvedConfig, env);
           const mutation = isMutationQuery(sql);
           const mutationOperation = mutation ? getAllowedMutationOperation(sql) : undefined;
+          const mutationTarget = mutation ? getMutationTarget(sql) : undefined;
           const mutationAllowed =
             !mutation ||
             resolvedConfig.allowMutations ||
             (mutationOperation !== undefined &&
-              resolvedConfig.allowedMutations.includes(mutationOperation));
+              resolvedConfig.allowedMutations.includes(mutationOperation)) ||
+            (mutationOperation !== undefined &&
+              mutationTarget !== undefined &&
+              (resolvedConfig.allowedMutationTargets[mutationOperation] ?? []).includes(
+                mutationTarget,
+              ));
 
           if (!mutationAllowed) {
             const allowed =
@@ -739,13 +754,13 @@ export class DbService extends Context.Service<
             return yield* new DbMutationBlockedError({
               message: `Mutation queries are not allowed on environment ${env}. Allowed mutation operations: ${allowed}.`,
               environment: env,
-              hint: 'Configure database.<profile>.allowedMutations.<env> with explicit operations such as ["insert"] if this environment should allow controlled mutations.',
+              hint: 'Configure database.<profile>.allowedMutationTargets.<env> with explicit targets such as { insert: ["ticker.TimeTickers"] }, or allowedMutations.<env> for broader operation-level access.',
             });
           }
 
           const queryEffect = mutation
             ? executeMutationQuery(resolvedConfig, sql, password, Number(startTimeMs))
-            : executeSelectQuery(resolvedConfig, sql, password, Number(startTimeMs), true);
+            : executeSelectQuery(resolvedConfig, sql, password, Number(startTimeMs), true, limit);
 
           return yield* runWithVpnPrerequisites(
             resolvedConfig.port,

package/src/db-tool/transformers.ts

@@ -22,12 +22,17 @@ function truncateValue(value: unknown): unknown {
   return `${value.slice(0, MAX_VALUE_LENGTH)}...`;
 }
 
-export function transformQueryResult(data: Record<string, unknown>[]): TransformResult {
+export function transformQueryResult(
+  data: Record<string, unknown>[],
+  // limit 0 (or negative) means "no row cap".
+  limit: number = DEFAULT_ROW_LIMIT,
+): TransformResult {
   const withoutEmptyColumns = stripEmptyColumns(data);
   const truncatedValues = withoutEmptyColumns.map((record) =>
     Object.fromEntries(Object.entries(record).map(([key, value]) => [key, truncateValue(value)])),
   );
-  const { rows, truncated, total, showing } = truncateRows(truncatedValues, DEFAULT_ROW_LIMIT);
+  const effectiveLimit = limit > 0 ? limit : Number.POSITIVE_INFINITY;
+  const { rows, truncated, total, showing } = truncateRows(truncatedValues, effectiveLimit);
 
   return {
     data: rows,

package/src/db-tool/types.ts

@@ -1,5 +1,8 @@
-import type { DbMutationOperation } from "#config";
-import type { ProfilePrerequisites } from "#config/types";
+import type {
+  DbAllowedMutationTargets,
+  DbMutationOperation,
+  ProfilePrerequisites,
+} from "#config/types";
 import type { Environment, OutputFormat } from "#shared";
 
 export type { DbMutationOperation };
@@ -17,6 +20,7 @@ export type DbConfig = ProfilePrerequisites & {
   needsTunnel: boolean;
   allowMutations: boolean;
   allowedMutations: readonly DbMutationOperation[];
+  allowedMutationTargets: DbAllowedMutationTargets;
 };
 
 export type QueryResult = {