@blogic-cz/agent-tools 0.15.6 → 0.15.7

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "0.15.6",
+  "version": "0.15.7",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/k8s-tool/index.ts

@@ -120,8 +120,10 @@ const executeK8sCommand = (command: string, options: CommonK8sCommandOptions) =>
           const errorResult: CommandResult = {
             success: false,
             error: error.message,
-            hint: `Verify cluster ID "${k8sConfig.clusterId}" matches a context in kubectl config. Run: kubectl config get-contexts`,
-            nextCommand: "kubectl config get-contexts",
+            hint:
+              error.hint ??
+              `Verify cluster ID "${k8sConfig.clusterId}" matches a context in kubectl config. Run: kubectl config get-contexts`,
+            ...(error.hint ? {} : { nextCommand: "kubectl config get-contexts" }),
             executionTimeMs: 0,
           };
           return Effect.succeed(errorResult);

package/src/k8s-tool/service.ts

@@ -16,6 +16,7 @@ import type { K8sConfig } from "#config";
 import { collectProcessOutput, quoteShellArg } from "#shared/exec";
 import { resolveEnvTemplate } from "#shared/env-template";
 import { isPrerequisiteRunError } from "#shared/prerequisites/errors";
+import { normalizeProfilePrerequisites } from "#shared/prerequisites/config";
 import { runWithProfilePrerequisites } from "#shared/prerequisites/runtime";
 import { buildApiProbeArgs } from "#shared/k8s-probe";
 import { isKubectlCommandAllowed, isSafeLogPath } from "./security";
@@ -275,14 +276,23 @@ export class K8sService extends Context.Service<
           const k8sConfig = yield* requireK8sConfig(profile);
           const timeoutMs = k8sConfig.timeoutMs ?? 60000;
           const apiProbeTimeoutMs = k8sConfig.apiProbeTimeoutMs ?? 2000;
+          const { context, kubeconfig } = yield* resolveContext(profile, k8sConfig);
+          const reachableWithoutPrerequisites = yield* probeApiReachable(
+            context,
+            kubeconfig,
+            apiProbeTimeoutMs,
+          );
+          const vpnGated = normalizeProfilePrerequisites(k8sConfig).some(
+            (prerequisite) => prerequisite.type === "vpn",
+          );
           return yield* runWithProfilePrerequisites(
             config ?? {},
             k8sConfig,
             runPrerequisiteCommand,
             Effect.gen(function* () {
-              const { context, kubeconfig } = yield* resolveContext(profile, k8sConfig);
-
-              const reachable = yield* probeApiReachable(context, kubeconfig, apiProbeTimeoutMs);
+              const reachable =
+                reachableWithoutPrerequisites ||
+                (vpnGated && (yield* probeApiReachable(context, kubeconfig, apiProbeTimeoutMs)));
               if (!reachable) {
                 return yield* new K8sContextError({
                   message: `Kubernetes API server (${k8sConfig.clusterId}) not reachable within ${apiProbeTimeoutMs}ms. VPN likely not connected, or the cluster API is degraded.`,
@@ -332,6 +342,7 @@ export class K8sService extends Context.Service<
                 command: fullCommand,
               };
             }),
+            { alreadySatisfied: apiProbeTimeoutMs > 0 && reachableWithoutPrerequisites },
           ).pipe(
             Effect.mapError((error) =>
               isPrerequisiteRunError(error)

package/src/shared/prerequisites/guardian.ts

@@ -78,32 +78,38 @@ export async function stopWhenIdle(
   const deadline = now() + init.disconnectTimeoutMs;
   let evidence = "VPN stop did not produce confirmed disconnected status.";
   try {
-    let remaining = deadline - now();
+    const remaining = deadline - now();
     if (remaining > 0) {
       const stop = await runCommand("stop", remaining);
-      remaining = deadline - now();
       if (stop.exitCode !== 0) {
-        evidence = "VPN stop command failed; ownership is unknown and stop will not be retried.";
+        evidence = `VPN stop command failed (exit ${stop.exitCode}); ownership is unknown and stop will not be retried.`;
       } else {
-        const confirmDisconnected = async (): Promise<boolean> => {
+        const stillConnected =
+          "VPN still reported connected after stop when the disconnect deadline expired.";
+        const confirmDisconnected = async (): Promise<true | string> => {
           const statusRemaining = deadline - now();
-          if (statusRemaining <= 0) return false;
+          if (statusRemaining <= 0) {
+            return "VPN stop was dispatched, but the disconnect deadline expired before status could be confirmed.";
+          }
           const status = await runCommand("status", statusRemaining);
-          remaining = deadline - now();
           const connected = parseVpnStatus(init.driver, status);
           if (connected === false) return true;
-          if (connected === undefined || remaining <= 0) return false;
+          if (connected === undefined) {
+            return status.exitCode === 0
+              ? "VPN status output after stop was unparseable; ownership is unknown."
+              : `VPN status command after stop failed (exit ${status.exitCode}); ownership is unknown.`;
+          }
           const sleepRemaining = deadline - now();
-          if (sleepRemaining <= 0) return false;
+          if (sleepRemaining <= 0) return stillConnected;
           await sleep(Math.min(250, sleepRemaining));
-          remaining = deadline - now();
-          return remaining > 0 && confirmDisconnected();
+          return deadline - now() > 0 ? confirmDisconnected() : stillConnected;
         };
-        if (await confirmDisconnected()) {
+        const confirmed = await confirmDisconnected();
+        if (confirmed === true) {
           store.commitStop(guard, true, "VPN stop confirmed disconnected.", now());
           return;
         }
-        evidence = "VPN status failed, stayed connected, or was unparseable after stop.";
+        evidence = confirmed;
       }
     } else {
       evidence = "VPN disconnect deadline expired before a command could safely start.";

package/src/shared/prerequisites/runtime.ts

@@ -742,6 +742,8 @@ export const runWithProfilePrerequisites = <A, E, CommandError>(
   runCommand: PrerequisiteCommandRunner<CommandError>,
   effect: Effect.Effect<A, E, never>,
   options?: {
+    /** Caller proved the target is already reachable: skip the VPN entirely (no status, no lease). */
+    alreadySatisfied?: boolean;
     tryWithoutPrerequisites?: boolean;
     runGuardianInProcess?: boolean;
     guardianSpawn?: GuardianSpawner;
@@ -750,7 +752,7 @@ export const runWithProfilePrerequisites = <A, E, CommandError>(
   const vpnPrerequisites = normalizeProfilePrerequisites(profile).filter(
     (prerequisite) => prerequisite.type === "vpn",
   );
-  if (vpnPrerequisites.length === 0) return effect;
+  if (vpnPrerequisites.length === 0 || options?.alreadySatisfied === true) return effect;
 
   return Effect.gen(function* () {
     const tryDirect = () => effect.pipe(Effect.result);