@blogic-cz/agent-tools 0.15.14 → 0.17.0

package/README.md

@@ -27,6 +27,11 @@ These tools wrap each CLI with:
 bun add -d @blogic-cz/agent-tools
 ```
 
+`effect` is a peer dependency pinned to an exact version, and package managers install
+it for you. If your project depends on `effect` too, pin it to the same exact version.
+Two copies of `effect` are structurally incompatible types, so the values this package
+exports stop typechecking in your project when the versions drift.
+
 ### Skill installation
 
 Install per-tool skills for only the tools your project uses:

package/dist/audit-tool/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env bun
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/audit-tool/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/audit-tool/index.ts"],"names":[],"mappings":""}

package/dist/az-tool/build.d.ts

@@ -0,0 +1,47 @@
+import { Effect } from "effect";
+import type { BuildJob, BuildLogs, BuildTimeline, JobSummary, PipelineRun } from "./types";
+import { AzParseError } from "./errors";
+import { AzService } from "./service";
+/**
+ * Get build timeline with all records (jobs, stages, tasks, etc.)
+ */
+export declare const getBuildTimeline: (buildId: number) => Effect.Effect<BuildTimeline, import("./errors").AzSecurityError | import("./errors").AzCommandError | import("./errors").AzTimeoutError | AzParseError, AzService>;
+/**
+ * Get jobs and stages from build timeline
+ */
+export declare const getBuildJobs: (buildId: number) => Effect.Effect<{
+    jobs: BuildJob[];
+    stages: BuildJob[];
+}, import("./errors").AzSecurityError | import("./errors").AzCommandError | import("./errors").AzTimeoutError | AzParseError, AzService>;
+/**
+ * Get list of build logs
+ */
+export declare const getBuildLogs: (buildId: number) => Effect.Effect<BuildLogs, import("./errors").AzSecurityError | import("./errors").AzCommandError | import("./errors").AzTimeoutError | AzParseError, AzService>;
+/**
+ * Get specific log content by log ID
+ */
+export declare const getBuildLogContent: (buildId: number, logId: number) => Effect.Effect<string, import("./errors").AzSecurityError | import("./errors").AzCommandError | import("./errors").AzTimeoutError | AzParseError, AzService>;
+/**
+ * Get job summaries with duration and status information
+ */
+export declare const getBuildJobSummary: (buildId: number) => Effect.Effect<JobSummary[], import("./errors").AzSecurityError | import("./errors").AzCommandError | import("./errors").AzTimeoutError | AzParseError, AzService>;
+/**
+ * Find failed or canceled jobs in a build
+ */
+export declare const findFailedJobs: (buildId: number) => Effect.Effect<{
+    id: string;
+    name: string;
+    result: "succeeded" | "failed" | "canceled" | "skipped" | null | undefined;
+    errorCount: number;
+    warningCount: number;
+    logId: number | undefined;
+}[], import("./errors").AzSecurityError | import("./errors").AzCommandError | import("./errors").AzTimeoutError | AzParseError, AzService>;
+/**
+ * List pipeline runs with optional filters
+ */
+export declare const listPipelineRuns: (options?: {
+    branch?: string;
+    pipelineId?: number;
+    top?: number;
+} | undefined) => Effect.Effect<PipelineRun[], import("./errors").AzSecurityError | import("./errors").AzCommandError | import("./errors").AzTimeoutError | AzParseError, AzService>;
+//# sourceMappingURL=build.d.ts.map

package/dist/az-tool/build.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"build.d.ts","sourceRoot":"","sources":["../../src/az-tool/build.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;AAExC,OAAO,KAAK,EAAE,QAAQ,EAAE,SAAS,EAAE,aAAa,EAAE,UAAU,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE3F,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AACxC,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AAGtC;;GAEG;AACH,eAAO,MAAM,gBAAgB,yLAuD3B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,YAAY;UAOP,QAAQ,EAAE;YACN,QAAQ,EAAE;wIAE9B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,YAAY,qLAkCvB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,kBAAkB,iMAwC7B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,kBAAkB,wLAgC7B,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,cAAc;;;;;;;0IAazB,CAAC;AAEH;;GAEG;AACH,eAAO,MAAM,gBAAgB;aAClB,MAAM;iBACF,MAAM;UACb,MAAM;oLAwDZ,CAAC"}

package/dist/az-tool/config.d.ts

@@ -0,0 +1,13 @@
+export declare const ALLOWED_SUBCOMMANDS: readonly ["list", "run", "show", "show-tags"];
+export declare const BLOCKED_SUBCOMMANDS: readonly ["create", "delete", "update", "cancel", "queue"];
+export declare const DIRECT_AZ_COMMANDS: readonly ["pipelines", "repos"];
+export declare const STANDALONE_AZ_COMMANDS: readonly ["acr", "account"];
+export declare const ALLOWED_INVOKE_AREAS: readonly ["build"];
+export declare const ALLOWED_INVOKE_RESOURCES: Record<string, readonly string[]>;
+export declare const BLOCKED_INVOKE_AREAS: readonly ["git", "policy", "security", "wiki", "work", "graph", "audit", "permissions"];
+export declare const BLOCKED_INVOKE_RESOURCES: Record<string, readonly string[]>;
+export type AllowedSubcommand = (typeof ALLOWED_SUBCOMMANDS)[number];
+export type BlockedSubcommand = (typeof BLOCKED_SUBCOMMANDS)[number];
+export type AllowedInvokeArea = (typeof ALLOWED_INVOKE_AREAS)[number];
+export type BlockedInvokeArea = (typeof BLOCKED_INVOKE_AREAS)[number];
+//# sourceMappingURL=config.d.ts.map

package/dist/az-tool/config.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"config.d.ts","sourceRoot":"","sources":["../../src/az-tool/config.ts"],"names":[],"mappings":"AAAA,eAAO,MAAM,mBAAmB,+CAAgD,CAAC;AAEjF,eAAO,MAAM,mBAAmB,4DAA6D,CAAC;AAE9F,eAAO,MAAM,kBAAkB,iCAAkC,CAAC;AAElE,eAAO,MAAM,sBAAsB,6BAA8B,CAAC;AAElE,eAAO,MAAM,oBAAoB,oBAAqB,CAAC;AAEvD,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAE7D,CAAC;AAEX,eAAO,MAAM,oBAAoB,yFASvB,CAAC;AAEX,eAAO,MAAM,wBAAwB,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,MAAM,EAAE,CAE7D,CAAC;AAEX,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,mBAAmB,CAAC,CAAC,MAAM,CAAC,CAAC;AACrE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC;AACtE,MAAM,MAAM,iBAAiB,GAAG,CAAC,OAAO,oBAAoB,CAAC,CAAC,MAAM,CAAC,CAAC"}

package/dist/az-tool/errors.d.ts

@@ -0,0 +1,43 @@
+import { Schema } from "effect";
+declare const AzSecurityError_base: Schema.Class<AzSecurityError, Schema.TaggedStruct<"AzSecurityError", {
+    readonly message: Schema.String;
+    readonly command: Schema.String;
+    readonly hint: Schema.optionalKey<Schema.String>;
+    readonly nextCommand: Schema.optionalKey<Schema.String>;
+    readonly retryable: Schema.optionalKey<Schema.Boolean>;
+}>, import("effect/Cause").YieldableError>;
+export declare class AzSecurityError extends AzSecurityError_base {
+}
+declare const AzCommandError_base: Schema.Class<AzCommandError, Schema.TaggedStruct<"AzCommandError", {
+    readonly message: Schema.String;
+    readonly command: Schema.String;
+    readonly exitCode: Schema.optionalKey<Schema.Number>;
+    readonly stderr: Schema.optionalKey<Schema.String>;
+    readonly hint: Schema.optionalKey<Schema.String>;
+    readonly nextCommand: Schema.optionalKey<Schema.String>;
+    readonly retryable: Schema.optionalKey<Schema.Boolean>;
+}>, import("effect/Cause").YieldableError>;
+export declare class AzCommandError extends AzCommandError_base {
+}
+declare const AzTimeoutError_base: Schema.Class<AzTimeoutError, Schema.TaggedStruct<"AzTimeoutError", {
+    readonly message: Schema.String;
+    readonly command: Schema.String;
+    readonly timeoutMs: Schema.Number;
+    readonly hint: Schema.optionalKey<Schema.String>;
+    readonly nextCommand: Schema.optionalKey<Schema.String>;
+    readonly retryable: Schema.optionalKey<Schema.Boolean>;
+}>, import("effect/Cause").YieldableError>;
+export declare class AzTimeoutError extends AzTimeoutError_base {
+}
+declare const AzParseError_base: Schema.Class<AzParseError, Schema.TaggedStruct<"AzParseError", {
+    readonly message: Schema.String;
+    readonly rawOutput: Schema.String;
+    readonly hint: Schema.optionalKey<Schema.String>;
+    readonly nextCommand: Schema.optionalKey<Schema.String>;
+    readonly retryable: Schema.optionalKey<Schema.Boolean>;
+}>, import("effect/Cause").YieldableError>;
+export declare class AzParseError extends AzParseError_base {
+}
+export type AzError = AzSecurityError | AzCommandError | AzTimeoutError | AzParseError;
+export {};
+//# sourceMappingURL=errors.d.ts.map

package/dist/az-tool/errors.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"errors.d.ts","sourceRoot":"","sources":["../../src/az-tool/errors.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;;;;;;;;AAEhC,qBAAa,eAAgB,SAAQ,oBAMnC;CAAG;;;;;;;;;;AAEL,qBAAa,cAAe,SAAQ,mBAQlC;CAAG;;;;;;;;;AAEL,qBAAa,cAAe,SAAQ,mBAOlC;CAAG;;;;;;;;AAEL,qBAAa,YAAa,SAAQ,iBAMhC;CAAG;AAEL,MAAM,MAAM,OAAO,GAAG,eAAe,GAAG,cAAc,GAAG,cAAc,GAAG,YAAY,CAAC"}

package/dist/az-tool/extract-option-value.d.ts

@@ -0,0 +1,2 @@
+export declare function extractOptionValue(args: readonly string[], optionName: string): string | undefined;
+//# sourceMappingURL=extract-option-value.d.ts.map

package/dist/az-tool/extract-option-value.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"extract-option-value.d.ts","sourceRoot":"","sources":["../../src/az-tool/extract-option-value.ts"],"names":[],"mappings":"AAAA,wBAAgB,kBAAkB,CAChC,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,UAAU,EAAE,MAAM,GACjB,MAAM,GAAG,SAAS,CAQpB"}

package/dist/az-tool/index.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env bun
+export {};
+//# sourceMappingURL=index.d.ts.map

package/dist/az-tool/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/az-tool/index.ts"],"names":[],"mappings":""}

package/dist/az-tool/security.d.ts

@@ -0,0 +1,4 @@
+import type { InvokeParams, SecurityCheckResult } from "./types";
+export declare function isCommandAllowed(cmd: string): SecurityCheckResult;
+export declare function isInvokeAllowed(params: InvokeParams): SecurityCheckResult;
+//# sourceMappingURL=security.d.ts.map

package/dist/az-tool/security.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"security.d.ts","sourceRoot":"","sources":["../../src/az-tool/security.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,YAAY,EAAE,mBAAmB,EAAE,MAAM,SAAS,CAAC;AAYjE,wBAAgB,gBAAgB,CAAC,GAAG,EAAE,MAAM,GAAG,mBAAmB,CAiFjE;AAED,wBAAgB,eAAe,CAAC,MAAM,EAAE,YAAY,GAAG,mBAAmB,CAkCzE"}

package/dist/az-tool/service.d.ts

@@ -0,0 +1,15 @@
+import { ChildProcessSpawner } from "effect/unstable/process";
+import { Context, Effect, Layer } from "effect";
+import type { InvokeParams } from "./types";
+import { AzSecurityError, AzCommandError, AzTimeoutError, AzParseError } from "./errors";
+import { ConfigService } from "#config";
+declare const AzService_base: Context.ServiceClass<AzService, "@agent-tools/AzService", {
+    readonly runCommand: (cmd: string, project?: string) => Effect.Effect<string, AzSecurityError | AzCommandError | AzTimeoutError | AzParseError>;
+    readonly runInvoke: (params: InvokeParams) => Effect.Effect<unknown, AzSecurityError | AzCommandError | AzTimeoutError | AzParseError>;
+}>;
+export declare class AzService extends AzService_base {
+    static readonly layer: Layer.Layer<AzService, never, ConfigService | ChildProcessSpawner.ChildProcessSpawner>;
+}
+export declare const AzServiceLayer: Layer.Layer<AzService, never, ConfigService | ChildProcessSpawner.ChildProcessSpawner>;
+export {};
+//# sourceMappingURL=service.d.ts.map

package/dist/az-tool/service.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/az-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAkB,MAAM,QAAQ,CAAC;AAEhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI5C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAGzF,OAAO,EAAE,aAAa,EAAiB,MAAM,SAAS,CAAC;;yBAK9B,CACnB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,GAAG,cAAc,GAAG,YAAY,CAAC;wBACxE,CAClB,MAAM,EAAE,YAAY,KACjB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc,GAAG,cAAc,GAAG,YAAY,CAAC;;AATjG,qBAAa,SAAU,SAAQ,cAWF;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,yFA6MnB;CACH;AAED,eAAO,MAAM,cAAc,wFAAkB,CAAC"}

package/dist/az-tool/transformers.d.ts

@@ -0,0 +1,10 @@
+import type { BuildJob } from "./types";
+type ParsedTable = {
+    headers: string[];
+    rows: Record<string, string>[];
+};
+export declare function transformBuildLogContent(rawLog: string): string;
+export declare function transformCmdOutput(rawOutput: string): string | Record<string, unknown> | unknown[] | ParsedTable;
+export declare function transformTimeline(records: BuildJob[]): BuildJob[];
+export {};
+//# sourceMappingURL=transformers.d.ts.map

package/dist/az-tool/transformers.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"transformers.d.ts","sourceRoot":"","sources":["../../src/az-tool/transformers.ts"],"names":[],"mappings":"AAEA,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAExC,KAAK,WAAW,GAAG;IACjB,OAAO,EAAE,MAAM,EAAE,CAAC;IAClB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,EAAE,CAAC;CAChC,CAAC;AAwCF,wBAAgB,wBAAwB,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAoC/D;AAED,wBAAgB,kBAAkB,CAChC,SAAS,EAAE,MAAM,GAChB,MAAM,GAAG,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,OAAO,EAAE,GAAG,WAAW,CA6B5D;AAED,wBAAgB,iBAAiB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,QAAQ,EAAE,CAQjE"}

package/dist/az-tool/types.d.ts

@@ -0,0 +1,64 @@
+export type SecurityCheckResult = {
+    allowed: boolean;
+    command?: string;
+    reason?: string;
+};
+export type InvokeParams = {
+    area: string;
+    resource: string;
+    project?: string;
+    routeParameters?: Record<string, string | number>;
+    queryParameters?: Record<string, string | number>;
+};
+export type BuildJob = {
+    id: string;
+    parentId?: string | null;
+    type: "Job" | "Stage" | "Task" | "Phase" | "Checkpoint";
+    name: string;
+    state: "pending" | "inProgress" | "completed";
+    result?: "succeeded" | "failed" | "canceled" | "skipped" | null;
+    startTime?: string | null;
+    finishTime?: string | null;
+    errorCount?: number | null;
+    warningCount?: number | null;
+    log?: {
+        id: number;
+        url: string;
+    } | null;
+};
+export type BuildTimeline = {
+    records: BuildJob[];
+    id: string;
+    changeId: number;
+    lastChangedBy: string;
+    lastChangedOn: string;
+    url: string;
+};
+export type BuildLog = {
+    id: number;
+    type: string;
+    url: string;
+    lineCount?: number;
+};
+export type BuildLogs = {
+    count: number;
+    value: BuildLog[];
+};
+export type JobSummary = {
+    name: string;
+    state: string;
+    result?: string;
+    stage?: string;
+    duration?: string;
+    logId?: number;
+};
+export type PipelineRun = {
+    id: number;
+    buildNumber: string;
+    status: string;
+    result?: string;
+    sourceBranch: string;
+    startTime?: string;
+    finishTime?: string;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/az-tool/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/az-tool/types.ts"],"names":[],"mappings":"AAAA,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,OAAO,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,MAAM,MAAM,YAAY,GAAG;IACzB,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;IAClD,eAAe,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,CAAC,CAAC;CACnD,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IACzB,IAAI,EAAE,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,OAAO,GAAG,YAAY,CAAC;IACxD,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,SAAS,GAAG,YAAY,GAAG,WAAW,CAAC;IAC9C,MAAM,CAAC,EAAE,WAAW,GAAG,QAAQ,GAAG,UAAU,GAAG,SAAS,GAAG,IAAI,CAAC;IAChE,SAAS,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,YAAY,CAAC,EAAE,MAAM,GAAG,IAAI,CAAC;IAC7B,GAAG,CAAC,EAAE;QAAE,EAAE,EAAE,MAAM,CAAC;QAAC,GAAG,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;CAC1C,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG;IAC1B,OAAO,EAAE,QAAQ,EAAE,CAAC;IACpB,EAAE,EAAE,MAAM,CAAC;IACX,QAAQ,EAAE,MAAM,CAAC;IACjB,aAAa,EAAE,MAAM,CAAC;IACtB,aAAa,EAAE,MAAM,CAAC;IACtB,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAEF,MAAM,MAAM,QAAQ,GAAG;IACrB,EAAE,EAAE,MAAM,CAAC;IACX,IAAI,EAAE,MAAM,CAAC;IACb,GAAG,EAAE,MAAM,CAAC;IACZ,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,SAAS,GAAG;IACtB,KAAK,EAAE,MAAM,CAAC;IACd,KAAK,EAAE,QAAQ,EAAE,CAAC;CACnB,CAAC;AAEF,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC;IACb,KAAK,EAAE,MAAM,CAAC;IACd,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,EAAE,EAAE,MAAM,CAAC;IACX,WAAW,EAAE,MAAM,CAAC;IACpB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,CAAC,EAAE,MAAM,CAAC;IAChB,YAAY,EAAE,MAAM,CAAC;IACrB,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC"}

package/dist/config/index.d.ts

@@ -0,0 +1,4 @@
+export type { AgentToolsConfig, AzureConfig, K8sConfig, DbEnvConfig, DbAllowedMutationTargets, DbMutationOperation, DatabaseConfig, ObservabilityConfig, ObservabilityEnvTarget, LogsConfig, AuditConfig, CliToolOverride, CredentialGuardConfig, GitHubPrTitlePolicy, GitHubRepoConfig, } from "./types";
+export { DbMutationOperationSchema } from "./types";
+export { ConfigService, ConfigServiceLayer, getToolConfig, getDefaultEnvironment, getGitHubConfig, resolveGitHubRepoTarget, loadConfig, } from "./loader";
+//# sourceMappingURL=index.d.ts.map

package/dist/config/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/config/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,gBAAgB,EAChB,WAAW,EACX,SAAS,EACT,WAAW,EACX,wBAAwB,EACxB,mBAAmB,EACnB,cAAc,EACd,mBAAmB,EACnB,sBAAsB,EACtB,UAAU,EACV,WAAW,EACX,eAAe,EACf,qBAAqB,EACrB,mBAAmB,EACnB,gBAAgB,GACjB,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,yBAAyB,EAAE,MAAM,SAAS,CAAC;AAEpD,OAAO,EACL,aAAa,EACb,kBAAkB,EAClB,aAAa,EACb,qBAAqB,EACrB,eAAe,EACf,uBAAuB,EACvB,UAAU,GACX,MAAM,UAAU,CAAC"}

package/dist/config/loader.d.ts

@@ -0,0 +1,22 @@
+import { Context, Layer } from "effect";
+import type { AgentToolsConfig, GitHubRepoConfig } from "./types";
+export declare function decodeConfig(parsed: unknown, configPath?: string): AgentToolsConfig;
+export declare function loadConfig(): Promise<AgentToolsConfig | undefined>;
+declare const ConfigService_base: Context.ServiceClass<ConfigService, "@agent-tools/ConfigService", AgentToolsConfig | undefined>;
+export declare class ConfigService extends ConfigService_base {
+}
+declare const ConfigLoadError_base: new <A extends Record<string, any> = {}>(args: import("effect/Types").VoidIfEmpty<{ readonly [P in keyof A as P extends "_tag" ? never : P]: A[P]; }>) => import("effect/Cause").YieldableError & {
+    readonly _tag: "ConfigLoadError";
+} & Readonly<A>;
+export declare class ConfigLoadError extends ConfigLoadError_base<{
+    readonly cause: unknown;
+}> {
+}
+export declare const ConfigServiceLayer: Layer.Layer<ConfigService, ConfigLoadError, never>;
+type ProfiledSection = keyof Pick<AgentToolsConfig, "azure" | "kubernetes" | "database" | "observability" | "logs">;
+export declare function getToolConfig<T>(config: AgentToolsConfig | undefined, section: ProfiledSection, profile?: string): T | undefined;
+export declare function getDefaultEnvironment(config: AgentToolsConfig | undefined): string | undefined;
+export declare function getGitHubConfig(config: AgentToolsConfig | undefined, profile?: string): GitHubRepoConfig | undefined;
+export declare function resolveGitHubRepoTarget(config: AgentToolsConfig | undefined, target?: string | null): string | undefined;
+export {};
+//# sourceMappingURL=loader.d.ts.map

package/dist/config/loader.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAgB,KAAK,EAAU,MAAM,QAAQ,CAAC;AAE9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AA2NlE,wBAAgB,YAAY,CAC1B,MAAM,EAAE,OAAO,EACf,UAAU,GAAE,MAA4B,GACvC,gBAAgB,CAmClB;AAmFD,wBAAsB,UAAU,IAAI,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAcxE;;AAED,qBAAa,aAAc,SAAQ,kBAElC;CAAG;;;;AAEJ,qBAAa,eAAgB,SAAQ,qBAAoC;IACvE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;CAAG;AAEL,eAAO,MAAM,kBAAkB,oDAM9B,CAAC;AAEF,KAAK,eAAe,GAAG,MAAM,IAAI,CAC/B,gBAAgB,EAChB,OAAO,GAAG,YAAY,GAAG,UAAU,GAAG,eAAe,GAAG,MAAM,CAC/D,CAAC;AAEF,wBAAgB,aAAa,CAAC,CAAC,EAC7B,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,CAAC,GAAG,SAAS,CAkCf;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAE9F;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,OAAO,CAAC,EAAE,MAAM,GACf,gBAAgB,GAAG,SAAS,CAc9B;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM,GAAG,SAAS,CAqBpB"}

package/dist/config/types.d.ts

@@ -0,0 +1,189 @@
+import { Schema } from "effect";
+/** Azure DevOps profile configuration */
+export type AzureConfig = {
+    organization: string;
+    defaultProject: string;
+    timeoutMs?: number;
+};
+export type CleanupPolicy = "leave-running" | "stop-if-started";
+export type VpnPrerequisite = {
+    type: "vpn";
+    key: string;
+    cleanup?: CleanupPolicy;
+};
+export type MacosScutilVpnDriverConfig = {
+    type: "macos-scutil";
+    serviceName?: string;
+    /** Name of environment variable holding the IPSec shared secret for scutil --nc start. */
+    secretEnvVar?: string;
+};
+export type LinuxNmcliVpnDriverConfig = {
+    type: "linux-nmcli";
+    connectionName?: string;
+};
+export type WindowsRasdialVpnDriverConfig = {
+    type: "windows-rasdial";
+    entryName?: string;
+};
+export type VpnDriverConfig = MacosScutilVpnDriverConfig | LinuxNmcliVpnDriverConfig | WindowsRasdialVpnDriverConfig;
+export type VpnConfig = {
+    name: string;
+    /** Defaults to true. Auto maps name to the current OS driver deterministically. */
+    auto?: boolean;
+    defaultCleanup?: CleanupPolicy;
+    connectTimeoutMs?: number;
+    /** Total bounded stop-and-confirm window in milliseconds. */
+    disconnectTimeoutMs?: number;
+    /** Managed VPN reuse window after the last lease. Defaults to 30000; 0 disconnects immediately. */
+    idleDisconnectMs?: number;
+    /** Name of environment variable holding the VPN shared secret for supported drivers. */
+    secretEnvVar?: string;
+    drivers?: {
+        darwin?: MacosScutilVpnDriverConfig;
+        linux?: LinuxNmcliVpnDriverConfig;
+        win32?: WindowsRasdialVpnDriverConfig;
+    };
+    /** Explicit current-platform driver, required when auto is false and no per-OS driver is available. */
+    driver?: VpnDriverConfig;
+};
+export type ProfilePrerequisites = {
+    prerequisites?: readonly VpnPrerequisite[];
+    /** Convenience input sugar; normalize to prerequisites before execution. */
+    vpn?: string;
+};
+/** Kubernetes cluster profile configuration */
+export type K8sConfig = ProfilePrerequisites & {
+    /** Optional kubeconfig path. Supports ${ENV_VAR} templates. */
+    kubeconfig?: string;
+    clusterId: string;
+    /** Named namespaces, e.g. { test: "my-app-test", prod: "my-app-prod" } */
+    namespaces: Record<string, string>;
+    timeoutMs?: number;
+    /**
+     * Timeout in milliseconds for the cheap Kubernetes API-server reachability probe run
+     * before each command. When the cluster API is unreachable (VPN down / off the office
+     * network, or the API degraded) a real kubectl command hangs until `timeoutMs`; the
+     * probe lets it fail fast with a clear message instead. Set to 0 to disable. Defaults to 2000.
+     */
+    apiProbeTimeoutMs?: number;
+};
+/** Single database environment connection details */
+export type DbEnvConfig = ProfilePrerequisites & {
+    host: string;
+    port: number;
+    user: string;
+    database: string;
+    /** Plain-text password for local development. Prefer passwordEnvVar for non-local environments. */
+    password?: string;
+    /** Name of environment variable holding the password, e.g. "DB_TEST_PWD" */
+    passwordEnvVar?: string;
+};
+/** SQL mutation operation that can be explicitly allowed for a database environment. */
+export declare const DbMutationOperationSchema: Schema.Literals<readonly ["insert", "update", "delete"]>;
+export type DbMutationOperation = Schema.Schema.Type<typeof DbMutationOperationSchema>;
+export type DbAllowedMutationTargets = Partial<Record<DbMutationOperation, readonly string[]>>;
+/** Database profile configuration */
+export type DatabaseConfig = ProfilePrerequisites & {
+    /** Named database environments, e.g. { local: {...}, test: {...}, prod: {...} } */
+    environments: Record<string, DbEnvConfig>;
+    /** Explicitly allowed SQL mutation operations per environment. Non-local environments default to read-only. */
+    allowedMutations?: Record<string, readonly DbMutationOperation[]>;
+    allowedMutationTargets?: Record<string, DbAllowedMutationTargets>;
+    kubectl?: {
+        /** Optional kubeconfig path. Supports ${ENV_VAR} templates. */
+        kubeconfig?: string;
+        context: string;
+        namespace: string;
+        service?: string;
+    };
+    tunnelTimeoutMs?: number;
+    /**
+     * Timeout in milliseconds for the cheap Kubernetes API-server reachability probe
+     * run before attempting a tunnel. When the API server is unreachable (VPN down and
+     * not on the office network) `kubectl port-forward` hangs silently on TCP connect, so
+     * a short probe lets the direct (no-VPN) attempt fail fast and fall back to connecting
+     * the VPN instead of waiting out `tunnelTimeoutMs`. Set to 0 to disable the probe.
+     * Defaults to 2000.
+     */
+    apiProbeTimeoutMs?: number;
+    remotePort?: number;
+};
+/** Logs profile configuration */
+export type LogsConfig = ProfilePrerequisites & {
+    localDir: string;
+    remotePath: string;
+    kubernetesProfile?: string;
+};
+/** Single observability environment connection details */
+export type ObservabilityEnvTarget = {
+    url: string;
+    tokenEnvVar?: string;
+    prometheusUid?: string;
+    lokiUid?: string;
+};
+/** Observability profile configuration */
+export type ObservabilityConfig = {
+    environments: Record<string, ObservabilityEnvTarget>;
+};
+export type CliToolOverride = {
+    tool: string;
+    suggestion: string;
+};
+/** Credential guard config - merged with built-in defaults */
+export type CredentialGuardConfig = {
+    additionalBlockedPaths?: string[];
+    additionalAllowedPaths?: string[];
+    additionalBlockedCliTools?: CliToolOverride[];
+    additionalDangerousBashPatterns?: string[];
+};
+export type AuditConfig = {
+    retentionDays?: number;
+    dbPath?: string;
+};
+/** Single GitHub repository configuration */
+export type GitHubPrTitlePolicy = {
+    pattern: string;
+    expected: string;
+    example?: string;
+};
+export type GitHubRepoConfig = {
+    owner: string;
+    repo: string;
+    prTitle?: GitHubPrTitlePolicy;
+};
+/**
+ * Root agent-tools configuration.
+ *
+ * Each tool section (azure, kubernetes, database, logs) is a Record<string, ToolConfig>
+ * of named profiles. Tools select a profile via the --profile <name> flag (default = "default" key).
+ * If only one profile exists, it is used automatically.
+ *
+ * session, credentialGuard, and audit are global - not per-profile.
+ */
+export type AgentToolsConfig = {
+    $schema?: string;
+    /** Named Azure DevOps profiles. e.g. { default: { organization: "...", defaultProject: "..." } } */
+    azure?: Record<string, AzureConfig>;
+    /** Named VPN definitions referenced by profile prerequisites. */
+    vpns?: Record<string, VpnConfig>;
+    /** Named Kubernetes cluster profiles. e.g. { default: {...}, staging: {...} } */
+    kubernetes?: Record<string, K8sConfig>;
+    /** Named database profiles. e.g. { default: {...}, analytics: {...} } */
+    database?: Record<string, DatabaseConfig>;
+    /** Named logs profiles. e.g. { default: { localDir: "...", remotePath: "..." } } */
+    logs?: Record<string, LogsConfig>;
+    /** Named observability profiles. e.g. { default: { environments: { local: {...}, prod: {...} } } } */
+    observability?: Record<string, ObservabilityConfig>;
+    /** Global session config (not per-profile) */
+    session?: {
+        storagePath: string;
+    };
+    audit?: AuditConfig;
+    /** Global credential guard config (merged with built-in defaults, not per-profile) */
+    credentialGuard?: CredentialGuardConfig;
+    /** Optional default environment name (local|test|prod) used by tools when no --env flag is provided */
+    defaultEnvironment?: string;
+    /** Named GitHub repository profiles. e.g. { default: { owner: "...", repo: "..." } } */
+    github?: Record<string, GitHubRepoConfig>;
+};
+//# sourceMappingURL=types.d.ts.map

package/dist/config/types.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,yCAAyC;AACzC,MAAM,MAAM,WAAW,GAAG;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAEhE,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,KAAK,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,aAAa,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB,0BAA0B,GAC1B,yBAAyB,GACzB,6BAA6B,CAAC;AAElC,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wFAAwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,0BAA0B,CAAC;QACpC,KAAK,CAAC,EAAE,yBAAyB,CAAC;QAClC,KAAK,CAAC,EAAE,6BAA6B,CAAC;KACvC,CAAC;IACF,uGAAuG;IACvG,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,aAAa,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,SAAS,GAAG,oBAAoB,GAAG;IAC7C,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,qDAAqD;AACrD,MAAM,MAAM,WAAW,GAAG,oBAAoB,GAAG;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,0DAAkD,CAAC;AACzF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACvF,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAE/F,qCAAqC;AACrC,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG;IAClD,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C,+GAA+G;IAC/G,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC,CAAC;IAClE,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAClE,OAAO,CAAC,EAAE;QACR,+DAA+D;QAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,iCAAiC;AACjC,MAAM,MAAM,UAAU,GAAG,oBAAoB,GAAG;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,0CAA0C;AAC1C,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CACtD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,8DAA8D;AAC9D,MAAM,MAAM,qBAAqB,GAAG;IAClC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,yBAAyB,CAAC,EAAE,eAAe,EAAE,CAAC;IAC9C,+BAA+B,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,sGAAsG;IACtG,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,8CAA8C;IAC9C,OAAO,CAAC,EAAE;QACR,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,sFAAsF;IACtF,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C,CAAC"}

package/dist/credential-guard/claude-hook.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env bun
+/**
+ * Claude Code PreToolUse hook wrapper.
+ *
+ * Reads JSON from stdin (Claude Code hook protocol), runs the credential guard,
+ * and exits with code 2 + stderr message if blocked, or 0 if allowed.
+ *
+ * Usage in .claude/settings.json:
+ *   { "hooks": { "PreToolUse": [{ "matcher": ".*", "hooks": [{ "type": "command",
+ *     "command": "bun node_modules/@blogic-cz/agent-tools/src/credential-guard/claude-hook.ts" }] }] } }
+ */
+export {};
+//# sourceMappingURL=claude-hook.d.ts.map

package/dist/credential-guard/claude-hook.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"claude-hook.d.ts","sourceRoot":"","sources":["../../src/credential-guard/claude-hook.ts"],"names":[],"mappings":";AACA;;;;;;;;;GASG"}

package/dist/credential-guard/index.d.ts

@@ -0,0 +1,77 @@
+/**
+ * Credential Guard
+ *
+ * Security patterns and functions for detecting sensitive files and secrets.
+ * Used by AI coding agent hooks/plugins.
+ *
+ * Security layers:
+ * 1. Path-based blocking (files that should never be read)
+ * 2. Content scanning (detect secrets in write operations)
+ * 3. Dangerous bash command detection
+ * 4. CLI tool blocking (must use wrapper tools)
+ *
+ * Note: This is a convenience layer. Real security should be enforced
+ * at infrastructure level (K8s RBAC, file permissions, etc.)
+ */
+import type { CredentialGuardConfig } from "#config/types";
+/** Input format received by hooks/plugins. */
+export type HookInput = {
+    tool: string;
+};
+/** Output format received by hooks/plugins. */
+export type HookOutput = {
+    args: Record<string, unknown>;
+};
+/** Object returned by createCredentialGuard */
+export type CredentialGuard = {
+    handleToolExecuteBefore: (input: HookInput, output: HookOutput) => void;
+    detectSecrets: (content: string) => {
+        name: string;
+        match: string;
+    } | null;
+    isPathAllowed: (filePath: string) => boolean;
+    isPathBlocked: (filePath: string) => boolean;
+    isDangerousBashCommand: (command: string) => boolean;
+    getBlockedCliTool: (command: string) => {
+        name: string;
+        wrapper: string;
+    } | null;
+    isGhCommandAllowed: (command: string) => boolean;
+    detectSleepPolling: (command: string) => string | null;
+};
+/** Extract file path from hook arguments. */
+export declare function extractFilePath(args: Record<string, unknown>): string;
+/** Extract content from hook arguments. */
+export declare function extractContent(args: Record<string, unknown>): string;
+/** Extract command from hook arguments. */
+export declare function extractCommand(args: Record<string, unknown>): string;
+/**
+ * Create a credential guard with optional extra patterns merged into defaults.
+ *
+ * @param config - Optional overrides. Arrays are concatenated with defaults (not replaced).
+ * @returns Object with all guard functions bound to the merged pattern sets.
+ */
+export declare function createCredentialGuard(config?: CredentialGuardConfig): CredentialGuard;
+/** Handle tool execution with default guard (no extra config). */
+export declare const handleToolExecuteBefore: (input: HookInput, output: HookOutput) => void;
+/** Detect secrets in content with default guard. */
+export declare const detectSecrets: (content: string) => {
+    name: string;
+    match: string;
+} | null;
+/** Check if a path is in the allowed exceptions list (default guard). */
+export declare const isPathAllowed: (filePath: string) => boolean;
+/** Check if a path should be blocked (default guard). */
+export declare const isPathBlocked: (filePath: string) => boolean;
+/** Check if a bash command might expose secrets (default guard). */
+export declare const isDangerousBashCommand: (command: string) => boolean;
+/** Get blocked CLI tool info (default guard). */
+export declare const getBlockedCliTool: (command: string) => {
+    name: string;
+    wrapper: string;
+} | null;
+/** Check if a gh command is allowed (default guard). */
+export declare const isGhCommandAllowed: (command: string) => boolean;
+/** Detect sleep-polling with agent-tools wrapper commands (default guard). */
+export declare const detectSleepPolling: (command: string) => string | null;
+//# sourceMappingURL=index.d.ts.map

package/dist/credential-guard/index.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAM5E,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAkMF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAqMrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAjbD,SAAS,UAAU,UAAU,KAAK,IAibM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAnbC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAmbjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aArbE,MAAM,KAAK,OAqbgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAvbE,MAAM,KAAK,OAubgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAzbC,MAAM,KAAK,OAyb0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YA3bC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IA2bf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA7bC,MAAM,KAAK,OA6bsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YA/bC,MAAM,KAAK,MAAM,GAAG,IA+ba,CAAC"}