@blogic-cz/agent-tools 0.15.13 → 0.16.0

package/README.md

@@ -27,6 +27,11 @@ These tools wrap each CLI with:
 bun add -d @blogic-cz/agent-tools
 ```
 
+`effect` is a peer dependency pinned to an exact version, and package managers install
+it for you. If your project depends on `effect` too, pin it to the same exact version.
+Two copies of `effect` are structurally incompatible types, so the values this package
+exports stop typechecking in your project when the versions drift.
+
 ### Skill installation
 
 Install per-tool skills for only the tools your project uses:

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "0.15.13",
+  "version": "0.16.0",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",
@@ -39,90 +39,38 @@
   },
   "files": [
     "src/",
-    "dist/",
     "schemas/",
     "README.md",
     "LICENSE"
   ],
   "type": "module",
-  "types": "./dist/index.d.ts",
+  "types": "./src/index.ts",
   "imports": {
-    "#shared": {
-      "types": "./dist/shared/index.d.ts",
-      "default": "./src/shared/index.ts"
-    },
-    "#shared/*": {
-      "types": "./dist/shared/*.d.ts",
-      "default": "./src/shared/*.ts"
-    },
-    "#config": {
-      "types": "./dist/config/index.d.ts",
-      "default": "./src/config/index.ts"
-    },
-    "#config/*": {
-      "types": "./dist/config/*.d.ts",
-      "default": "./src/config/*.ts"
-    },
-    "#gh/*": {
-      "types": "./dist/gh-tool/*.d.ts",
-      "default": "./src/gh-tool/*.ts"
-    },
-    "#k8s/*": {
-      "types": "./dist/k8s-tool/*.d.ts",
-      "default": "./src/k8s-tool/*.ts"
-    },
-    "#db/*": {
-      "types": "./dist/db-tool/*.d.ts",
-      "default": "./src/db-tool/*.ts"
-    },
-    "#observability/*": {
-      "types": "./dist/observability-tool/*.d.ts",
-      "default": "./src/observability-tool/*.ts"
-    },
-    "#logs/*": {
-      "types": "./dist/logs-tool/*.d.ts",
-      "default": "./src/logs-tool/*.ts"
-    },
-    "#az/*": {
-      "types": "./dist/az-tool/*.d.ts",
-      "default": "./src/az-tool/*.ts"
-    },
-    "#guard": {
-      "types": "./dist/credential-guard/index.d.ts",
-      "default": "./src/credential-guard/index.ts"
-    },
-    "#session/*": {
-      "types": "./dist/session-tool/*.d.ts",
-      "default": "./src/session-tool/*.ts"
-    }
+    "#shared": "./src/shared/index.ts",
+    "#shared/*": "./src/shared/*.ts",
+    "#config": "./src/config/index.ts",
+    "#config/*": "./src/config/*.ts",
+    "#gh/*": "./src/gh-tool/*.ts",
+    "#k8s/*": "./src/k8s-tool/*.ts",
+    "#db/*": "./src/db-tool/*.ts",
+    "#observability/*": "./src/observability-tool/*.ts",
+    "#logs/*": "./src/logs-tool/*.ts",
+    "#az/*": "./src/az-tool/*.ts",
+    "#guard": "./src/credential-guard/index.ts",
+    "#session/*": "./src/session-tool/*.ts"
   },
   "exports": {
-    ".": {
-      "types": "./dist/index.d.ts",
-      "default": "./src/index.ts"
-    },
-    "./credential-guard": {
-      "types": "./dist/credential-guard/index.d.ts",
-      "default": "./src/credential-guard/index.ts"
-    },
-    "./config": {
-      "types": "./dist/config/index.d.ts",
-      "default": "./src/config/index.ts"
-    },
-    "./audit": {
-      "types": "./dist/shared/audit.d.ts",
-      "default": "./src/shared/audit.ts"
-    },
-    "./k8s-probe": {
-      "types": "./dist/shared/k8s-probe.d.ts",
-      "default": "./src/shared/k8s-probe.ts"
-    }
+    ".": "./src/index.ts",
+    "./credential-guard": "./src/credential-guard/index.ts",
+    "./config": "./src/config/index.ts",
+    "./audit": "./src/shared/audit.ts",
+    "./k8s-probe": "./src/shared/k8s-probe.ts",
+    "./prerequisites": "./src/shared/prerequisites/index.ts"
   },
   "publishConfig": {
     "access": "public"
   },
   "scripts": {
-    "build:types": "tsc -p tsconfig.declarations.json",
     "check": "bun check.ts",
     "check:ci": "bun check.ts ci",
     "format": "oxfmt",
@@ -137,23 +85,26 @@
     "test": "vitest run"
   },
   "dependencies": {
-    "@effect/platform-bun": "4.0.0-beta.98",
-    "@toon-format/toon": "2.1.0",
-    "effect": "4.0.0-beta.98"
+    "@effect/platform-bun": "4.0.0-beta.105",
+    "@toon-format/toon": "2.1.0"
   },
   "devDependencies": {
     "@effect/language-service": "0.86.2",
-    "@effect/vitest": "4.0.0-beta.98",
+    "@effect/vitest": "4.0.0-beta.105",
     "@types/bun": "1.3.12",
+    "effect": "4.0.0-beta.105",
     "oxfmt": "0.44.0",
     "oxlint": "1.59.0",
     "typescript": "6.0.2",
     "vitest": "^4.1.4"
   },
+  "peerDependencies": {
+    "effect": "4.0.0-beta.105"
+  },
   "overrides": {
-    "@effect/platform-node-shared": "4.0.0-beta.98"
+    "@effect/platform-node-shared": "4.0.0-beta.105"
   },
   "engines": {
-    "bun": ">=1.0.0"
+    "bun": ">=1.3.0"
   }
 }

package/src/az-tool/errors.ts

@@ -1,6 +1,6 @@
 import { Schema } from "effect";
 
-export class AzSecurityError extends Schema.TaggedErrorClass<AzSecurityError>()("AzSecurityError", {
+export class AzSecurityError extends Schema.TaggedError<AzSecurityError>()("AzSecurityError", {
   message: Schema.String,
   command: Schema.String,
   hint: Schema.optionalKey(Schema.String),
@@ -8,7 +8,7 @@ export class AzSecurityError extends Schema.TaggedErrorClass<AzSecurityError>()(
   retryable: Schema.optionalKey(Schema.Boolean),
 }) {}
 
-export class AzCommandError extends Schema.TaggedErrorClass<AzCommandError>()("AzCommandError", {
+export class AzCommandError extends Schema.TaggedError<AzCommandError>()("AzCommandError", {
   message: Schema.String,
   command: Schema.String,
   exitCode: Schema.optionalKey(Schema.Number),
@@ -18,7 +18,7 @@ export class AzCommandError extends Schema.TaggedErrorClass<AzCommandError>()("A
   retryable: Schema.optionalKey(Schema.Boolean),
 }) {}
 
-export class AzTimeoutError extends Schema.TaggedErrorClass<AzTimeoutError>()("AzTimeoutError", {
+export class AzTimeoutError extends Schema.TaggedError<AzTimeoutError>()("AzTimeoutError", {
   message: Schema.String,
   command: Schema.String,
   timeoutMs: Schema.Number,
@@ -27,7 +27,7 @@ export class AzTimeoutError extends Schema.TaggedErrorClass<AzTimeoutError>()("A
   retryable: Schema.optionalKey(Schema.Boolean),
 }) {}
 
-export class AzParseError extends Schema.TaggedErrorClass<AzParseError>()("AzParseError", {
+export class AzParseError extends Schema.TaggedError<AzParseError>()("AzParseError", {
   message: Schema.String,
   rawOutput: Schema.String,
   hint: Schema.optionalKey(Schema.String),

package/src/az-tool/service.ts

@@ -141,7 +141,7 @@ export class AzService extends Context.Service<
             message: result.stderr || `Command failed with exit code ${result.exitCode}`,
             command: fullCommand,
             exitCode: result.exitCode,
-            stderr: result.stderr || undefined,
+            ...(result.stderr ? { stderr: result.stderr } : {}),
           });
         }
 
@@ -209,7 +209,7 @@ export class AzService extends Context.Service<
             message: result.stderr || `Invoke failed with exit code ${result.exitCode}`,
             command: fullCommand,
             exitCode: result.exitCode,
-            stderr: result.stderr || undefined,
+            ...(result.stderr ? { stderr: result.stderr } : {}),
           });
         }
 

package/src/db-tool/errors.ts

@@ -1,6 +1,6 @@
 import { Schema } from "effect";
 
-export class DbConnectionError extends Schema.TaggedErrorClass<DbConnectionError>()(
+export class DbConnectionError extends Schema.TaggedError<DbConnectionError>()(
   "DbConnectionError",
   {
     message: Schema.String,
@@ -11,7 +11,7 @@ export class DbConnectionError extends Schema.TaggedErrorClass<DbConnectionError
   },
 ) {}
 
-export class DbQueryError extends Schema.TaggedErrorClass<DbQueryError>()("DbQueryError", {
+export class DbQueryError extends Schema.TaggedError<DbQueryError>()("DbQueryError", {
   message: Schema.String,
   sql: Schema.String,
   stderr: Schema.optionalKey(Schema.String),
@@ -20,7 +20,7 @@ export class DbQueryError extends Schema.TaggedErrorClass<DbQueryError>()("DbQue
   retryable: Schema.optionalKey(Schema.Boolean),
 }) {}
 
-export class DbTunnelError extends Schema.TaggedErrorClass<DbTunnelError>()("DbTunnelError", {
+export class DbTunnelError extends Schema.TaggedError<DbTunnelError>()("DbTunnelError", {
   message: Schema.String,
   port: Schema.Number,
   hint: Schema.optionalKey(Schema.String),
@@ -28,15 +28,7 @@ export class DbTunnelError extends Schema.TaggedErrorClass<DbTunnelError>()("DbT
   retryable: Schema.optionalKey(Schema.Boolean),
 }) {}
 
-export class DbParseError extends Schema.TaggedErrorClass<DbParseError>()("DbParseError", {
-  message: Schema.String,
-  rawOutput: Schema.String,
-  hint: Schema.optionalKey(Schema.String),
-  nextCommand: Schema.optionalKey(Schema.String),
-  retryable: Schema.optionalKey(Schema.Boolean),
-}) {}
-
-export class DbMutationBlockedError extends Schema.TaggedErrorClass<DbMutationBlockedError>()(
+export class DbMutationBlockedError extends Schema.TaggedError<DbMutationBlockedError>()(
   "DbMutationBlockedError",
   {
     message: Schema.String,
@@ -47,9 +39,4 @@ export class DbMutationBlockedError extends Schema.TaggedErrorClass<DbMutationBl
   },
 ) {}
 
-export type DbError =
-  | DbConnectionError
-  | DbMutationBlockedError
-  | DbParseError
-  | DbQueryError
-  | DbTunnelError;
+export type DbError = DbConnectionError | DbMutationBlockedError | DbQueryError | DbTunnelError;

package/src/db-tool/index.ts

@@ -17,6 +17,7 @@ import { ConfigService, ConfigServiceLayer, getDefaultEnvironment } from "#confi
 import { DbConfigService, makeDbConfigLayer } from "./config-service";
 import { DbConnectionError } from "./errors";
 import { DbService } from "./service";
+import { DbSqlClient } from "./sql-client";
 
 // Extract --profile from argv before @effect/cli parsing
 // so we can build the correct config layer.
@@ -243,6 +244,7 @@ const dbConfigLayer = makeDbConfigLayer(profileArg);
 const MainLayer = DbService.layer.pipe(
   // provideMerge (not provide) so DbConfigService stays in the program context for the `envs` command,
   // which reads it directly rather than going through DbService.
+  Layer.provideMerge(DbSqlClient.layer),
   Layer.provideMerge(dbConfigLayer),
   Layer.provideMerge(ConfigServiceLayer),
   Layer.provideMerge(BunServices.layer),

package/src/db-tool/security.ts

@@ -25,9 +25,27 @@ const MUTATION_TARGET_PATTERNS: Array<[DbMutationOperation, RegExp]> = [
   ["delete", new RegExp(String.raw`^\s*DELETE\s+FROM\s+(${QUALIFIED_IDENTIFIER_PATTERN})`, "i")],
 ];
 
+const DOLLAR_QUOTE_TAG = /^\$(?:[A-Za-z_][A-Za-z0-9_]*)?\$/;
+
+/**
+ * Postgres treats a backslash as an escape only inside an E'...' literal; in a standard string
+ * it is an ordinary character, so applying escapes everywhere would swallow a real closing quote.
+ */
+function isEscapeStringPrefix(sql: string, quoteIndex: number): boolean {
+  const prefix = sql[quoteIndex - 1];
+  if (prefix !== "E" && prefix !== "e") return false;
+  const before = sql[quoteIndex - 2];
+  return before === undefined || !/[A-Za-z0-9_$]/.test(before);
+}
+
 /**
- * Strip SQL comments (block and line) while preserving string literals.
- * This prevents bypass via inline comment masking before DELETE statements.
+ * Strip SQL comments (block and line) and empty out every string literal, keeping only
+ * double-quoted identifiers verbatim because the mutation-target parser needs them.
+ * Single quotes, double-quoted identifiers and dollar-quoted bodies must all be tracked:
+ * a quote or comment token surviving inside a region another check reads differently is a
+ * guard bypass. `SELECT * FROM "weird--table"; DROP TABLE users` would lose its statement
+ * separator to a phantom comment, and `SELECT $$O\'Brien$$ AS n; DROP TABLE users` would
+ * leave an unpaired apostrophe that swallows the separator instead.
  */
 export function stripSqlComments(sql: string): string {
   let result = "";
@@ -38,38 +56,63 @@ export function stripSqlComments(sql: string): string {
     const ch = sql[i];
     const next = i + 1 < len ? sql[i + 1] : "";
 
-    // Single-quoted string literal — skip through
-    if (ch === "'") {
+    if (ch === "'" || ch === '"') {
+      const keepBody = ch === '"';
+      const backslashEscapes = ch === "'" && isEscapeStringPrefix(sql, i);
       result += ch;
       i++;
       while (i < len) {
-        if (sql[i] === "'" && i + 1 < len && sql[i + 1] === "'") {
-          result += "''";
+        if (backslashEscapes && sql[i] === "\\" && i + 1 < len) {
+          if (keepBody) result += sql[i] + sql[i + 1];
           i += 2;
-        } else if (sql[i] === "'") {
-          result += "'";
+        } else if (sql[i] === ch && sql[i + 1] === ch) {
+          if (keepBody) result += ch + ch;
+          i += 2;
+        } else if (sql[i] === ch) {
+          result += ch;
           i++;
           break;
         } else {
-          result += sql[i];
+          if (keepBody) result += sql[i];
           i++;
         }
       }
       continue;
     }
 
-    // Block comment /* ... */
+    if (ch === "$") {
+      const tag = DOLLAR_QUOTE_TAG.exec(sql.slice(i))?.[0];
+      if (tag) {
+        const closing = sql.indexOf(tag, i + tag.length);
+        const stop = closing === -1 ? len : closing + tag.length;
+        result += closing === -1 ? tag : tag + tag;
+        i = stop;
+        continue;
+      }
+    }
+
+    // Postgres block comments nest, so track depth rather than stopping at the first */.
     if (ch === "/" && next === "*") {
+      let depth = 1;
       i += 2;
-      while (i + 1 < len && !(sql[i] === "*" && sql[i + 1] === "/")) {
-        i++;
+      while (i + 1 < len && depth > 0) {
+        if (sql[i] === "/" && sql[i + 1] === "*") {
+          depth++;
+          i += 2;
+        } else if (sql[i] === "*" && sql[i + 1] === "/") {
+          depth--;
+          i += 2;
+        } else {
+          i++;
+        }
+      }
+      if (depth > 0) {
+        i = len;
       }
-      i += 2; // skip closing */
-      result += " "; // replace comment with space
+      result += " ";
       continue;
     }
 
-    // Line comment -- ...
     if (ch === "-" && next === "-") {
       i += 2;
       while (i < len && sql[i] !== "\n") {
@@ -86,6 +129,44 @@ export function stripSqlComments(sql: string): string {
   return result;
 }
 
+/**
+ * Postgres runs every statement in a simple-query batch, but MUTATION_PATTERNS only match the
+ * first one, so `select 1; delete from x` would otherwise pass the guard as a plain read.
+ * Dollar-quoted bodies containing `;` are rejected as well: this fails closed by design.
+ */
+export function hasMultipleStatements(sql: string): boolean {
+  const stripped = stripSqlComments(sql);
+  let index = 0;
+
+  while (index < stripped.length) {
+    const char = stripped[index];
+
+    if (char === "'" || char === '"') {
+      index++;
+      while (index < stripped.length) {
+        if (stripped[index] === char && stripped[index + 1] === char) {
+          index += 2;
+          continue;
+        }
+        if (stripped[index] === char) {
+          index++;
+          break;
+        }
+        index++;
+      }
+      continue;
+    }
+
+    if (char === ";" && stripped.slice(index + 1).trim().length > 0) {
+      return true;
+    }
+
+    index++;
+  }
+
+  return false;
+}
+
 export function isMutationQuery(sql: string): boolean {
   const stripped = stripSqlComments(sql);
   return MUTATION_PATTERNS.some((pattern) => pattern.test(stripped));