@blogic-cz/agent-tools 0.14.53 → 0.14.54

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "0.14.53",
+  "version": "0.14.54",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/db-tool/service.ts

@@ -53,6 +53,16 @@ export function resolveDbAccessMode(
   };
 }
 
+export function isFullyReadOnly(
+  config: Pick<DbConfig, "allowMutations" | "allowedMutations" | "allowedMutationTargets">,
+): boolean {
+  return (
+    !config.allowMutations &&
+    config.allowedMutations.length === 0 &&
+    Object.keys(config.allowedMutationTargets).length === 0
+  );
+}
+
 // Re-exported from the shared probe so existing `#db/service` consumers keep working.
 export { buildApiProbeArgs } from "#shared/k8s-probe";
 
@@ -393,6 +403,9 @@ export class DbService extends Context.Service<
             env: {
               ...process.env,
               ...(password ? { PGPASSWORD: password } : {}),
+              ...(isFullyReadOnly(config)
+                ? { PGOPTIONS: "-c default_transaction_read_only=on" }
+                : {}),
             } as Record<string, string>,
           });
         };