@blogic-cz/agent-tools 0.15.5 → 0.15.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "0.15.5",
+  "version": "0.15.7",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/k8s-tool/index.ts

@@ -17,6 +17,7 @@ import { K8sService, K8sServiceLayer } from "./service";
 import { ConfigService, ConfigServiceLayer, getDefaultEnvironment, getToolConfig } from "#config";
 import type { K8sConfig } from "#config";
 import { K8sContextError } from "./errors";
+import { hasKubernetesConfig, selectK8sProfile } from "./profile";
 import {
   transformDescribe,
   transformGenericKubectl,
@@ -60,6 +61,21 @@ const resolveEnv = (
     });
   });
 
+const resolveEnvAndProfile = (
+  envOption: Option.Option<string>,
+  profileOption: Option.Option<string>,
+  config: Parameters<typeof getDefaultEnvironment>[0],
+) =>
+  Effect.gen(function* () {
+    const resolvedEnv = yield* resolveEnv(envOption, config);
+    const profileName = selectK8sProfile(
+      config?.kubernetes,
+      Option.getOrUndefined(profileOption),
+      resolvedEnv,
+    );
+    return { env: resolvedEnv, profile: profileName };
+  });
+
 type CommonK8sCommandOptions = {
   readonly env: Option.Option<string>;
   readonly dryRun: boolean;
@@ -67,26 +83,36 @@ type CommonK8sCommandOptions = {
   readonly profile: Option.Option<string>;
 };
 
+const noKubernetesConfigResult = (): CommandResult => ({
+  success: false,
+  error: "No Kubernetes configuration found",
+  hint: "Add a 'kubernetes' section to agent-tools.json5 with clusterId and namespaces.",
+  nextCommand:
+    "echo '{ kubernetes: { default: { clusterId: \"my-cluster\" } } }' > agent-tools.json5",
+  executionTimeMs: 0,
+});
+
 const executeK8sCommand = (command: string, options: CommonK8sCommandOptions) =>
   Effect.gen(function* () {
     const config = yield* ConfigService;
-    const profileName = Option.getOrUndefined(options.profile);
+
+    // Check for a missing 'kubernetes' section before resolving --env, so that case still
+    // surfaces "add a kubernetes section" instead of an env-resolution error (e.g. prod-safety).
+    if (!hasKubernetesConfig(config?.kubernetes)) {
+      return noKubernetesConfigResult();
+    }
+
+    const { env: resolvedEnv, profile: profileName } = yield* resolveEnvAndProfile(
+      options.env,
+      options.profile,
+      config,
+    );
     const k8sConfig = getToolConfig<K8sConfig>(config, "kubernetes", profileName);
 
     if (!k8sConfig) {
-      const result: CommandResult = {
-        success: false,
-        error: "No Kubernetes configuration found",
-        hint: "Add a 'kubernetes' section to agent-tools.json5 with clusterId and namespaces.",
-        nextCommand:
-          "echo '{ kubernetes: { default: { clusterId: \"my-cluster\" } } }' > agent-tools.json5",
-        executionTimeMs: 0,
-      };
-      return result;
+      return noKubernetesConfigResult();
     }
 
-    const resolvedEnv = yield* resolveEnv(options.env, config);
-
     const k8sService = yield* K8sService;
     const result = yield* k8sService.runKubectl(command, options.dryRun, profileName).pipe(
       Effect.catchTags({
@@ -94,8 +120,10 @@ const executeK8sCommand = (command: string, options: CommonK8sCommandOptions) =>
           const errorResult: CommandResult = {
             success: false,
             error: error.message,
-            hint: `Verify cluster ID "${k8sConfig.clusterId}" matches a context in kubectl config. Run: kubectl config get-contexts`,
-            nextCommand: "kubectl config get-contexts",
+            hint:
+              error.hint ??
+              `Verify cluster ID "${k8sConfig.clusterId}" matches a context in kubectl config. Run: kubectl config get-contexts`,
+            ...(error.hint ? {} : { nextCommand: "kubectl config get-contexts" }),
             executionTimeMs: 0,
           };
           return Effect.succeed(errorResult);
@@ -190,8 +218,11 @@ const resolveStructuredNamespace = (
     if (explicitNamespace) return explicitNamespace;
 
     const config = yield* ConfigService;
-    const resolvedEnv = yield* resolveEnv(envOption, config);
-    const profileName = Option.getOrUndefined(profileOption);
+    const { env: resolvedEnv, profile: profileName } = yield* resolveEnvAndProfile(
+      envOption,
+      profileOption,
+      config,
+    );
     const k8sConfig = getToolConfig<K8sConfig>(config, "kubernetes", profileName);
 
     if (!k8sConfig) return undefined;

package/src/k8s-tool/profile.ts

@@ -0,0 +1,22 @@
+// --profile wins if given; else a kubernetes.<env> section (different cluster per env) wins; else undefined (getToolConfig default).
+export function selectK8sProfile(
+  kubernetesSection: Record<string, unknown> | undefined,
+  explicitProfile: string | undefined,
+  resolvedEnv: string,
+): string | undefined {
+  if (explicitProfile) {
+    return explicitProfile;
+  }
+
+  if (kubernetesSection && Object.hasOwn(kubernetesSection, resolvedEnv)) {
+    return resolvedEnv;
+  }
+
+  return undefined;
+}
+
+export function hasKubernetesConfig(
+  kubernetesSection: Record<string, unknown> | undefined,
+): boolean {
+  return !!kubernetesSection && Object.keys(kubernetesSection).length > 0;
+}

package/src/k8s-tool/service.ts

@@ -16,6 +16,7 @@ import type { K8sConfig } from "#config";
 import { collectProcessOutput, quoteShellArg } from "#shared/exec";
 import { resolveEnvTemplate } from "#shared/env-template";
 import { isPrerequisiteRunError } from "#shared/prerequisites/errors";
+import { normalizeProfilePrerequisites } from "#shared/prerequisites/config";
 import { runWithProfilePrerequisites } from "#shared/prerequisites/runtime";
 import { buildApiProbeArgs } from "#shared/k8s-probe";
 import { isKubectlCommandAllowed, isSafeLogPath } from "./security";
@@ -275,14 +276,23 @@ export class K8sService extends Context.Service<
           const k8sConfig = yield* requireK8sConfig(profile);
           const timeoutMs = k8sConfig.timeoutMs ?? 60000;
           const apiProbeTimeoutMs = k8sConfig.apiProbeTimeoutMs ?? 2000;
+          const { context, kubeconfig } = yield* resolveContext(profile, k8sConfig);
+          const reachableWithoutPrerequisites = yield* probeApiReachable(
+            context,
+            kubeconfig,
+            apiProbeTimeoutMs,
+          );
+          const vpnGated = normalizeProfilePrerequisites(k8sConfig).some(
+            (prerequisite) => prerequisite.type === "vpn",
+          );
           return yield* runWithProfilePrerequisites(
             config ?? {},
             k8sConfig,
             runPrerequisiteCommand,
             Effect.gen(function* () {
-              const { context, kubeconfig } = yield* resolveContext(profile, k8sConfig);
-
-              const reachable = yield* probeApiReachable(context, kubeconfig, apiProbeTimeoutMs);
+              const reachable =
+                reachableWithoutPrerequisites ||
+                (vpnGated && (yield* probeApiReachable(context, kubeconfig, apiProbeTimeoutMs)));
               if (!reachable) {
                 return yield* new K8sContextError({
                   message: `Kubernetes API server (${k8sConfig.clusterId}) not reachable within ${apiProbeTimeoutMs}ms. VPN likely not connected, or the cluster API is degraded.`,
@@ -332,6 +342,7 @@ export class K8sService extends Context.Service<
                 command: fullCommand,
               };
             }),
+            { alreadySatisfied: apiProbeTimeoutMs > 0 && reachableWithoutPrerequisites },
           ).pipe(
             Effect.mapError((error) =>
               isPrerequisiteRunError(error)

package/src/shared/prerequisites/guardian.ts

@@ -78,32 +78,38 @@ export async function stopWhenIdle(
   const deadline = now() + init.disconnectTimeoutMs;
   let evidence = "VPN stop did not produce confirmed disconnected status.";
   try {
-    let remaining = deadline - now();
+    const remaining = deadline - now();
     if (remaining > 0) {
       const stop = await runCommand("stop", remaining);
-      remaining = deadline - now();
       if (stop.exitCode !== 0) {
-        evidence = "VPN stop command failed; ownership is unknown and stop will not be retried.";
+        evidence = `VPN stop command failed (exit ${stop.exitCode}); ownership is unknown and stop will not be retried.`;
       } else {
-        const confirmDisconnected = async (): Promise<boolean> => {
+        const stillConnected =
+          "VPN still reported connected after stop when the disconnect deadline expired.";
+        const confirmDisconnected = async (): Promise<true | string> => {
           const statusRemaining = deadline - now();
-          if (statusRemaining <= 0) return false;
+          if (statusRemaining <= 0) {
+            return "VPN stop was dispatched, but the disconnect deadline expired before status could be confirmed.";
+          }
           const status = await runCommand("status", statusRemaining);
-          remaining = deadline - now();
           const connected = parseVpnStatus(init.driver, status);
           if (connected === false) return true;
-          if (connected === undefined || remaining <= 0) return false;
+          if (connected === undefined) {
+            return status.exitCode === 0
+              ? "VPN status output after stop was unparseable; ownership is unknown."
+              : `VPN status command after stop failed (exit ${status.exitCode}); ownership is unknown.`;
+          }
           const sleepRemaining = deadline - now();
-          if (sleepRemaining <= 0) return false;
+          if (sleepRemaining <= 0) return stillConnected;
           await sleep(Math.min(250, sleepRemaining));
-          remaining = deadline - now();
-          return remaining > 0 && confirmDisconnected();
+          return deadline - now() > 0 ? confirmDisconnected() : stillConnected;
         };
-        if (await confirmDisconnected()) {
+        const confirmed = await confirmDisconnected();
+        if (confirmed === true) {
           store.commitStop(guard, true, "VPN stop confirmed disconnected.", now());
           return;
         }
-        evidence = "VPN status failed, stayed connected, or was unparseable after stop.";
+        evidence = confirmed;
       }
     } else {
       evidence = "VPN disconnect deadline expired before a command could safely start.";

package/src/shared/prerequisites/runtime.ts

@@ -742,6 +742,8 @@ export const runWithProfilePrerequisites = <A, E, CommandError>(
   runCommand: PrerequisiteCommandRunner<CommandError>,
   effect: Effect.Effect<A, E, never>,
   options?: {
+    /** Caller proved the target is already reachable: skip the VPN entirely (no status, no lease). */
+    alreadySatisfied?: boolean;
     tryWithoutPrerequisites?: boolean;
     runGuardianInProcess?: boolean;
     guardianSpawn?: GuardianSpawner;
@@ -750,7 +752,7 @@ export const runWithProfilePrerequisites = <A, E, CommandError>(
   const vpnPrerequisites = normalizeProfilePrerequisites(profile).filter(
     (prerequisite) => prerequisite.type === "vpn",
   );
-  if (vpnPrerequisites.length === 0) return effect;
+  if (vpnPrerequisites.length === 0 || options?.alreadySatisfied === true) return effect;
 
   return Effect.gen(function* () {
     const tryDirect = () => effect.pipe(Effect.result);