@blogic-cz/agent-tools 0.15.13 → 0.16.0

package/src/db-tool/service.ts

@@ -1,5 +1,5 @@
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
-import { Clock, Context, Duration, Effect, Layer, Ref, Stream } from "effect";
+import { Clock, Context, Duration, Effect, Layer, Ref, Result, Stream } from "effect";
 
 import type { DbConfig, DbMutationOperation, QueryResult, SchemaMode } from "./types";
 
@@ -9,12 +9,12 @@ import { resolveEnvTemplate } from "#shared/env-template";
 import { resolveEnvironmentScopedPrerequisites } from "#shared/prerequisites/config";
 import { runWithProfilePrerequisites } from "#shared/prerequisites/runtime";
 import { buildApiProbeArgs } from "#shared/k8s-probe";
+import { missingBinaryFromSpawnFailure } from "#shared/binary-preflight";
 import { DbConfigService, TUNNEL_CHECK_INTERVAL_MS } from "./config-service";
-import { PSQL_MISSING_HINT, resolvePsqlSearchPath } from "./psql";
+import { DbSqlClient, type DbConnection } from "./sql-client";
 import {
   DbConnectionError,
   DbMutationBlockedError,
-  DbParseError,
   DbQueryError,
   DbTunnelError,
   type DbError,
@@ -30,6 +30,7 @@ import {
   detectSchemaError,
   getAllowedMutationOperation,
   getMutationTarget,
+  hasMultipleStatements,
   isValidTableName,
   isMutationQuery,
 } from "./security";
@@ -87,6 +88,7 @@ export class DbService extends Context.Service<
     Effect.scoped(
       Effect.gen(function* () {
         const executor = yield* ChildProcessSpawner.ChildProcessSpawner;
+        const sqlClient = yield* DbSqlClient;
         const agentToolsConfig = yield* ConfigService;
         const dbConfig = yield* DbConfigService;
 
@@ -231,23 +233,29 @@ export class DbService extends Context.Service<
               return { stdout, stderr, exitCode };
             }),
           ).pipe(
-            Effect.mapError(
-              (platformError) =>
-                new DbQueryError({
-                  message: `Command execution failed: ${String(platformError)}`,
-                  sql: "shell command",
-                  stderr: String(platformError),
-                  ...(String(platformError).includes("psql") ? { hint: PSQL_MISSING_HINT } : {}),
-                }),
-            ),
+            Effect.mapError((platformError) => {
+              const missing = missingBinaryFromSpawnFailure("kubectl", String(platformError));
+              return new DbQueryError({
+                message: `Command execution failed: ${String(platformError)}`,
+                sql: "shell command",
+                stderr: String(platformError),
+                ...(missing ? { hint: missing.hint } : {}),
+              });
+            }),
           );
 
         const checkPortOpen = (port: number) =>
-          executeShellCommand(
-            ChildProcess.make("nc", ["-z", "localhost", String(port)], {
-              stdout: "pipe",
-              stderr: "pipe",
-            }),
+          Effect.tryPromise(async () => {
+            const socket = await Bun.connect({
+              hostname: "127.0.0.1",
+              port,
+              socket: { data: () => undefined },
+            });
+            socket.end();
+            return true;
+          }).pipe(
+            Effect.timeout(TUNNEL_CHECK_INTERVAL_MS),
+            Effect.orElseSucceed(() => false),
           );
 
         const runWithVpnPrerequisites = <E>(
@@ -284,11 +292,7 @@ export class DbService extends Context.Service<
                 return false;
               }
 
-              const result = yield* checkPortOpen(port).pipe(
-                Effect.catch(() => Effect.succeed({ exitCode: 1 })),
-              );
-
-              if (result.exitCode === 0) {
+              if (yield* checkPortOpen(port)) {
                 return true;
               }
 
@@ -378,69 +382,34 @@ export class DbService extends Context.Service<
           return result.exitCode === 0;
         });
 
-        const buildPsqlCommand = (
-          config: DbConfig,
-          sql: string,
-          password: string,
-          useTuplesOnly: boolean,
-        ) => {
-          const args = [
-            "-h",
-            config.host,
-            "-p",
-            String(config.port),
-            "-U",
-            config.user,
-            "-d",
-            config.database,
-          ];
-
-          const commandArgs = useTuplesOnly
-            ? [...args, "-t", "-A", "-c", sql]
-            : [...args, "-c", sql];
-
-          return ChildProcess.make("psql", commandArgs, {
-            stdout: "pipe",
-            stderr: "pipe",
-            env: {
-              ...process.env,
-              PATH: resolvePsqlSearchPath(process.env.PATH),
-              ...(password ? { PGPASSWORD: password } : {}),
-              ...(isFullyReadOnly(config)
-                ? { PGOPTIONS: "-c default_transaction_read_only=on" }
-                : {}),
-            } as Record<string, string>,
-          });
-        };
+        const toConnection = (config: DbConfig, password: string): DbConnection => ({
+          host: config.host,
+          port: config.port,
+          user: config.user,
+          database: config.database,
+          password,
+          readOnly: isFullyReadOnly(config),
+        });
 
-        const fetchTableNamesForError = Effect.fn("DbService.fetchTableNamesForError")(function* (
-          config: DbConfig,
-          password: string,
-        ) {
-          const command = buildPsqlCommand(
-            config,
-            `SELECT schemaname || '.' || tablename FROM pg_tables WHERE schemaname NOT IN (${SYSTEM_SCHEMAS_SQL}) ORDER BY schemaname, tablename;`,
-            password,
-            true,
-          );
-          const result = yield* executeShellCommand(command).pipe(
-            Effect.catch(() =>
-              Effect.succeed({
-                stdout: "",
-                stderr: "",
-                exitCode: 1,
-              }),
+        const runSql = (config: DbConfig, password: string, sql: string) =>
+          sqlClient.run(toConnection(config, password), sql);
+
+        const fetchSingleColumn = (config: DbConfig, password: string, sql: string) =>
+          runSql(config, password, sql).pipe(
+            Effect.map((outcome) =>
+              outcome.rows
+                .map((row) => String(Object.values(row)[0] ?? ""))
+                .filter((value) => value.length > 0),
             ),
+            Effect.orElseSucceed(() => [] as string[]),
           );
-          if (result.exitCode !== 0) {
-            return [] as string[];
-          }
 
-          return result.stdout
-            .trim()
-            .split("\n")
-            .filter((name) => name.length > 0);
-        });
+        const fetchTableNamesForError = (config: DbConfig, password: string) =>
+          fetchSingleColumn(
+            config,
+            password,
+            `SELECT schemaname || '.' || tablename FROM pg_tables WHERE schemaname NOT IN (${SYSTEM_SCHEMAS_SQL}) ORDER BY schemaname, tablename;`,
+          );
 
         const fetchColumnNamesForError = Effect.fn("DbService.fetchColumnNamesForError")(function* (
           config: DbConfig,
@@ -458,29 +427,11 @@ export class DbService extends Context.Service<
             ? `AND table_schema = '${escapedSchemaName}'`
             : `AND table_schema NOT IN (${SYSTEM_SCHEMAS_SQL})`;
 
-          const command = buildPsqlCommand(
+          return yield* fetchSingleColumn(
             config,
-            `SELECT column_name FROM information_schema.columns WHERE table_name = '${escapedTableName}' ${schemaFilter} ORDER BY table_schema, ordinal_position;`,
             password,
-            true,
-          );
-          const result = yield* executeShellCommand(command).pipe(
-            Effect.catch(() =>
-              Effect.succeed({
-                stdout: "",
-                stderr: "",
-                exitCode: 1,
-              }),
-            ),
+            `SELECT column_name FROM information_schema.columns WHERE table_name = '${escapedTableName}' ${schemaFilter} ORDER BY table_schema, ordinal_position;`,
           );
-          if (result.exitCode !== 0) {
-            return [] as string[];
-          }
-
-          return result.stdout
-            .trim()
-            .split("\n")
-            .filter((name) => name.length > 0);
         });
 
         const executeSelectQuery = Effect.fn("DbService.executeSelectQuery")(function* (
@@ -492,16 +443,15 @@ export class DbService extends Context.Service<
           limit?: number,
         ) {
           const selectSql = sql.trim().replace(/;\s*$/, "");
-          const wrappedSql = `SELECT json_agg(t) FROM (${selectSql}) t;`;
-          const command = buildPsqlCommand(config, wrappedSql, password, true);
-          const result = yield* executeShellCommand(command);
+          const outcome = yield* Effect.result(runSql(config, password, selectSql));
           const endTime = yield* Clock.currentTimeMillis;
 
-          if (result.exitCode !== 0) {
-            const schemaError = detectSchemaError(result.stderr, sql);
+          if (Result.isFailure(outcome)) {
+            const failureMessage = outcome.failure.message.trim();
+            const schemaError = detectSchemaError(failureMessage, sql);
             const baseResult: QueryResult = {
               success: false,
-              error: result.stderr.trim() || `psql exited with code ${result.exitCode}`,
+              error: failureMessage || "Query failed",
               executionTimeMs: Number(endTime) - startTimeMs,
             };
 
@@ -527,32 +477,10 @@ export class DbService extends Context.Service<
               };
             }
 
-            return yield* new DbQueryError({
-              message: baseResult.error ?? "Query failed",
-              sql,
-              stderr: result.stderr.trim() || undefined,
-            });
-          }
-
-          const trimmedOutput = result.stdout.trim();
-          if (!trimmedOutput || trimmedOutput === "null") {
-            return {
-              success: true,
-              data: [],
-              rowCount: 0,
-              executionTimeMs: Number(endTime) - startTimeMs,
-            };
+            return yield* outcome.failure;
           }
 
-          const rawData = yield* Effect.try({
-            try: () => JSON.parse(trimmedOutput) as Record<string, unknown>[],
-            catch: () =>
-              new DbParseError({
-                message: "Failed to parse query result as JSON.",
-                rawOutput: trimmedOutput.slice(0, 500),
-              }),
-          });
-
+          const rawData = outcome.success.rows;
           const transformed = applyTransform
             ? transformQueryResult(rawData, limit)
             : {
@@ -577,25 +505,13 @@ export class DbService extends Context.Service<
           password: string,
           startTimeMs: number,
         ) {
-          const command = buildPsqlCommand(config, sql, password, false);
-          const result = yield* executeShellCommand(command);
+          const outcome = yield* runSql(config, password, sql);
           const endTime = yield* Clock.currentTimeMillis;
-
-          if (result.exitCode !== 0) {
-            return yield* new DbQueryError({
-              message: result.stderr.trim() || `psql exited with code ${result.exitCode}`,
-              sql,
-              stderr: result.stderr.trim() || undefined,
-            });
-          }
-
-          const output = result.stdout.trim();
-          const rowCountMatch = output.match(/(?:UPDATE|DELETE|INSERT \d+)\s+(\d+)/i);
-          const rowCount = rowCountMatch ? parseInt(rowCountMatch[1], 10) : 0;
+          const rowCount = outcome.rowCount;
 
           return {
             success: true,
-            message: output,
+            message: `${outcome.command} ${rowCount}`.trim(),
             rowCount,
             executionTimeMs: Number(endTime) - startTimeMs,
           };
@@ -748,6 +664,15 @@ export class DbService extends Context.Service<
           const startTimeMs = yield* Clock.currentTimeMillis;
           const resolvedConfig = yield* resolveDbConfig(config, env);
           const password = yield* resolvePassword(resolvedConfig, env);
+          if (hasMultipleStatements(sql)) {
+            return yield* new DbQueryError({
+              message:
+                "Multiple SQL statements in a single call are not allowed; the mutation guard only inspects the first statement.",
+              sql,
+              hint: "Send one statement per call.",
+            });
+          }
+
           const mutation = isMutationQuery(sql);
           const mutationOperation = mutation ? getAllowedMutationOperation(sql) : undefined;
           const mutationTarget = mutation ? getMutationTarget(sql) : undefined;

package/src/db-tool/sql-client.ts

@@ -0,0 +1,80 @@
+import { Context, Effect, Layer } from "effect";
+
+import { DbQueryError } from "./errors";
+
+export type DbConnection = {
+  readonly host: string;
+  readonly port: number;
+  readonly user: string;
+  readonly database: string;
+  readonly password: string;
+  readonly readOnly: boolean;
+};
+
+export type DbQueryOutcome = {
+  readonly rows: Record<string, unknown>[];
+  readonly rowCount: number;
+  readonly command: string;
+};
+
+type BunQueryResult = unknown[] & { count?: number; command?: string };
+
+export const toErrorMessage = (cause: unknown): string =>
+  cause instanceof Error ? cause.message : String(cause);
+
+const runWithBunSql = (connection: DbConnection, sql: string) =>
+  Effect.tryPromise({
+    try: async (): Promise<DbQueryOutcome> => {
+      const client = new Bun.SQL({
+        hostname: connection.host,
+        port: connection.port,
+        username: connection.user,
+        password: connection.password,
+        database: connection.database,
+        max: 1,
+        // Startup-packet GUC: covers every pooled connection, unlike a post-connect SET.
+        ...(connection.readOnly ? { connection: { default_transaction_read_only: "on" } } : {}),
+      });
+
+      try {
+        if (connection.readOnly) {
+          const [state] = (await client.unsafe("SHOW transaction_read_only")) as {
+            transaction_read_only?: string;
+          }[];
+          if (state?.transaction_read_only !== "on") {
+            throw new Error(
+              "Refusing to query: the read-only session setting was not accepted by the server, so writes would not be blocked.",
+            );
+          }
+        }
+
+        const result = (await client.unsafe(sql)) as BunQueryResult;
+        const rows = Array.isArray(result) ? (result as Record<string, unknown>[]) : [];
+
+        return {
+          rows,
+          rowCount: result.count ?? rows.length,
+          command: result.command ?? "",
+        };
+      } finally {
+        // A rejecting close() would replace the real query error via try/finally semantics.
+        await client.close().catch(() => undefined);
+      }
+    },
+    catch: (cause) => {
+      const message = toErrorMessage(cause);
+      return new DbQueryError({ message, sql, stderr: message });
+    },
+  });
+
+export class DbSqlClient extends Context.Service<
+  DbSqlClient,
+  {
+    readonly run: (
+      connection: DbConnection,
+      sql: string,
+    ) => Effect.Effect<DbQueryOutcome, DbQueryError>;
+  }
+>()("@agent-tools/DbSqlClient") {
+  static readonly layer = Layer.succeed(DbSqlClient, { run: runWithBunSql });
+}

package/src/gh-tool/errors.ts

@@ -1,6 +1,6 @@
 import { Schema } from "effect";
 
-export class GitHubCommandError extends Schema.TaggedErrorClass<GitHubCommandError>()(
+export class GitHubCommandError extends Schema.TaggedError<GitHubCommandError>()(
   "GitHubCommandError",
   {
     message: Schema.String,
@@ -13,7 +13,7 @@ export class GitHubCommandError extends Schema.TaggedErrorClass<GitHubCommandErr
   },
 ) {}
 
-export class GitHubNotFoundError extends Schema.TaggedErrorClass<GitHubNotFoundError>()(
+export class GitHubNotFoundError extends Schema.TaggedError<GitHubNotFoundError>()(
   "GitHubNotFoundError",
   {
     message: Schema.String,
@@ -25,25 +25,22 @@ export class GitHubNotFoundError extends Schema.TaggedErrorClass<GitHubNotFoundE
   },
 ) {}
 
-export class GitHubAuthError extends Schema.TaggedErrorClass<GitHubAuthError>()("GitHubAuthError", {
+export class GitHubAuthError extends Schema.TaggedError<GitHubAuthError>()("GitHubAuthError", {
   message: Schema.String,
   hint: Schema.optionalKey(Schema.String),
   nextCommand: Schema.optionalKey(Schema.String),
   retryable: Schema.optionalKey(Schema.Boolean),
 }) {}
 
-export class GitHubMergeError extends Schema.TaggedErrorClass<GitHubMergeError>()(
-  "GitHubMergeError",
-  {
-    message: Schema.String,
-    reason: Schema.Literals(["conflicts", "checks_failing", "branch_protected", "unknown"]),
-    hint: Schema.optionalKey(Schema.String),
-    nextCommand: Schema.optionalKey(Schema.String),
-    retryable: Schema.optionalKey(Schema.Boolean),
-  },
-) {}
+export class GitHubMergeError extends Schema.TaggedError<GitHubMergeError>()("GitHubMergeError", {
+  message: Schema.String,
+  reason: Schema.Literals(["conflicts", "checks_failing", "branch_protected", "unknown"]),
+  hint: Schema.optionalKey(Schema.String),
+  nextCommand: Schema.optionalKey(Schema.String),
+  retryable: Schema.optionalKey(Schema.Boolean),
+}) {}
 
-export class GitHubTimeoutError extends Schema.TaggedErrorClass<GitHubTimeoutError>()(
+export class GitHubTimeoutError extends Schema.TaggedError<GitHubTimeoutError>()(
   "GitHubTimeoutError",
   {
     message: Schema.String,

package/src/gh-tool/pr/helpers.ts

@@ -2,6 +2,7 @@ import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 import { Effect, Stream } from "effect";
 
 import { GitHubCommandError } from "#gh/errors";
+import { missingBinaryFromSpawnFailure } from "#shared/binary-preflight";
 
 export type LocalCommandResult = {
   stdout: string;
@@ -69,15 +70,16 @@ export const runLocalCommand = Effect.fn("pr.runLocalCommand")(function* (
       return commandResult;
     }),
   ).pipe(
-    Effect.mapError(
-      (error) =>
-        new GitHubCommandError({
-          command: [binary, ...args].join(" "),
-          exitCode: -1,
-          stderr: String(error),
-          message: String(error),
-        }),
-    ),
+    Effect.mapError((error) => {
+      const missing = missingBinaryFromSpawnFailure(binary, String(error));
+      return new GitHubCommandError({
+        command: [binary, ...args].join(" "),
+        exitCode: -1,
+        stderr: String(error),
+        message: missing?.message ?? String(error),
+        ...(missing ? { hint: missing.hint } : {}),
+      });
+    }),
   );
 
   return result;

package/src/index.ts

@@ -1,5 +1,7 @@
 export type { AgentToolsConfig, ObservabilityConfig, ObservabilityEnvTarget } from "./config/index";
 
+export type { BaseResult, Environment, OutputFormat, ToolResult } from "./shared/types";
+
 export {
   AuditService,
   AuditServiceLayer,

package/src/k8s-tool/errors.ts

@@ -1,6 +1,6 @@
 import { Schema } from "effect";
 
-export class K8sContextError extends Schema.TaggedErrorClass<K8sContextError>()("K8sContextError", {
+export class K8sContextError extends Schema.TaggedError<K8sContextError>()("K8sContextError", {
   message: Schema.String,
   clusterId: Schema.String,
   hint: Schema.optionalKey(Schema.String),
@@ -8,7 +8,7 @@ export class K8sContextError extends Schema.TaggedErrorClass<K8sContextError>()(
   retryable: Schema.optionalKey(Schema.Boolean),
 }) {}
 
-export class K8sCommandError extends Schema.TaggedErrorClass<K8sCommandError>()("K8sCommandError", {
+export class K8sCommandError extends Schema.TaggedError<K8sCommandError>()("K8sCommandError", {
   message: Schema.String,
   command: Schema.String,
   exitCode: Schema.optionalKey(Schema.Number),
@@ -18,7 +18,7 @@ export class K8sCommandError extends Schema.TaggedErrorClass<K8sCommandError>()(
   retryable: Schema.optionalKey(Schema.Boolean),
 }) {}
 
-export class K8sTimeoutError extends Schema.TaggedErrorClass<K8sTimeoutError>()("K8sTimeoutError", {
+export class K8sTimeoutError extends Schema.TaggedError<K8sTimeoutError>()("K8sTimeoutError", {
   message: Schema.String,
   command: Schema.String,
   timeoutMs: Schema.Number,
@@ -27,7 +27,7 @@ export class K8sTimeoutError extends Schema.TaggedErrorClass<K8sTimeoutError>()(
   retryable: Schema.optionalKey(Schema.Boolean),
 }) {}
 
-export class K8sDangerousCommandError extends Schema.TaggedErrorClass<K8sDangerousCommandError>()(
+export class K8sDangerousCommandError extends Schema.TaggedError<K8sDangerousCommandError>()(
   "K8sDangerousCommandError",
   {
     message: Schema.String,

package/src/k8s-tool/service.ts

@@ -14,6 +14,7 @@ import {
 import { ConfigService, getToolConfig } from "#config";
 import type { K8sConfig } from "#config";
 import { collectProcessOutput, quoteShellArg } from "#shared/exec";
+import { missingBinaryFromSpawnFailure } from "#shared/binary-preflight";
 import { resolveEnvTemplate } from "#shared/env-template";
 import { isPrerequisiteRunError } from "#shared/prerequisites/errors";
 import { normalizeProfilePrerequisites } from "#shared/prerequisites/config";
@@ -135,15 +136,16 @@ export class K8sService extends Context.Service<
             }),
           ).pipe(
             Effect.timeoutOption(timeoutMs),
-            Effect.mapError(
-              (platformError) =>
-                new K8sCommandError({
-                  message: `Command execution failed: ${String(platformError)}`,
-                  command: commandStr,
-                  exitCode: -1,
-                  stderr: String(platformError),
-                }),
-            ),
+            Effect.mapError((platformError) => {
+              const missing = missingBinaryFromSpawnFailure("kubectl", String(platformError));
+              return new K8sCommandError({
+                message: `Command execution failed: ${String(platformError)}`,
+                command: commandStr,
+                exitCode: -1,
+                stderr: String(platformError),
+                ...(missing ? { hint: missing.hint } : {}),
+              });
+            }),
           );
 
         const runPrerequisiteCommand = (command: ChildProcess.Command, label: string) =>
@@ -153,15 +155,16 @@ export class K8sService extends Context.Service<
               return yield* collectProcessOutput(process);
             }),
           ).pipe(
-            Effect.mapError(
-              (platformError) =>
-                new K8sCommandError({
-                  message: `Prerequisite command failed (${label}): ${String(platformError)}`,
-                  command: label,
-                  exitCode: -1,
-                  stderr: String(platformError),
-                }),
-            ),
+            Effect.mapError((platformError) => {
+              const missing = missingBinaryFromSpawnFailure("kubectl", String(platformError));
+              return new K8sCommandError({
+                message: `Prerequisite command failed (${label}): ${String(platformError)}`,
+                command: label,
+                exitCode: -1,
+                stderr: String(platformError),
+                ...(missing ? { hint: missing.hint } : {}),
+              });
+            }),
           );
 
         /**
@@ -276,6 +279,7 @@ export class K8sService extends Context.Service<
           const k8sConfig = yield* requireK8sConfig(profile);
           const timeoutMs = k8sConfig.timeoutMs ?? 60000;
           const apiProbeTimeoutMs = k8sConfig.apiProbeTimeoutMs ?? 2000;
+
           const { context, kubeconfig } = yield* resolveContext(profile, k8sConfig);
           const reachableWithoutPrerequisites = yield* probeApiReachable(
             context,
@@ -314,15 +318,16 @@ export class K8sService extends Context.Service<
                 }),
               ).pipe(
                 Effect.timeoutOption(timeoutMs),
-                Effect.mapError(
-                  (platformError) =>
-                    new K8sCommandError({
-                      message: `Command execution failed: ${String(platformError)}`,
-                      command: fullCommand,
-                      exitCode: -1,
-                      stderr: String(platformError),
-                    }),
-                ),
+                Effect.mapError((platformError) => {
+                  const missing = missingBinaryFromSpawnFailure("kubectl", String(platformError));
+                  return new K8sCommandError({
+                    message: `Command execution failed: ${String(platformError)}`,
+                    command: fullCommand,
+                    exitCode: -1,
+                    stderr: String(platformError),
+                    ...(missing ? { hint: missing.hint } : {}),
+                  });
+                }),
               );
 
               if (Option.isNone(resultOption)) {
@@ -473,7 +478,7 @@ export class K8sService extends Context.Service<
                 `Remote realpath exited with code ${realpathResult.exitCode}`,
               command: realpathResult.command,
               exitCode: realpathResult.exitCode,
-              stderr: realpathResult.stderr || undefined,
+              ...(realpathResult.stderr ? { stderr: realpathResult.stderr } : {}),
             });
           }
           const [canonicalBase, canonicalPath] = realpathResult.stdout.trim().split("\n");