@blogic-cz/agent-tools 0.16.0 → 0.17.1

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "0.16.0",
+  "version": "0.17.1",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",
@@ -38,34 +38,89 @@
     "session-tool": "./src/session-tool/index.ts"
   },
   "files": [
+    "dist/",
     "src/",
     "schemas/",
     "README.md",
     "LICENSE"
   ],
   "type": "module",
-  "types": "./src/index.ts",
+  "types": "./dist/index.d.ts",
   "imports": {
-    "#shared": "./src/shared/index.ts",
-    "#shared/*": "./src/shared/*.ts",
-    "#config": "./src/config/index.ts",
-    "#config/*": "./src/config/*.ts",
-    "#gh/*": "./src/gh-tool/*.ts",
-    "#k8s/*": "./src/k8s-tool/*.ts",
-    "#db/*": "./src/db-tool/*.ts",
-    "#observability/*": "./src/observability-tool/*.ts",
-    "#logs/*": "./src/logs-tool/*.ts",
-    "#az/*": "./src/az-tool/*.ts",
-    "#guard": "./src/credential-guard/index.ts",
-    "#session/*": "./src/session-tool/*.ts"
+    "#shared": {
+      "types": "./dist/shared/index.d.ts",
+      "default": "./src/shared/index.ts"
+    },
+    "#shared/*": {
+      "types": "./dist/shared/*.d.ts",
+      "default": "./src/shared/*.ts"
+    },
+    "#config": {
+      "types": "./dist/config/index.d.ts",
+      "default": "./src/config/index.ts"
+    },
+    "#config/*": {
+      "types": "./dist/config/*.d.ts",
+      "default": "./src/config/*.ts"
+    },
+    "#gh/*": {
+      "types": "./dist/gh-tool/*.d.ts",
+      "default": "./src/gh-tool/*.ts"
+    },
+    "#k8s/*": {
+      "types": "./dist/k8s-tool/*.d.ts",
+      "default": "./src/k8s-tool/*.ts"
+    },
+    "#db/*": {
+      "types": "./dist/db-tool/*.d.ts",
+      "default": "./src/db-tool/*.ts"
+    },
+    "#observability/*": {
+      "types": "./dist/observability-tool/*.d.ts",
+      "default": "./src/observability-tool/*.ts"
+    },
+    "#logs/*": {
+      "types": "./dist/logs-tool/*.d.ts",
+      "default": "./src/logs-tool/*.ts"
+    },
+    "#az/*": {
+      "types": "./dist/az-tool/*.d.ts",
+      "default": "./src/az-tool/*.ts"
+    },
+    "#guard": {
+      "types": "./dist/credential-guard/index.d.ts",
+      "default": "./src/credential-guard/index.ts"
+    },
+    "#session/*": {
+      "types": "./dist/session-tool/*.d.ts",
+      "default": "./src/session-tool/*.ts"
+    }
   },
   "exports": {
-    ".": "./src/index.ts",
-    "./credential-guard": "./src/credential-guard/index.ts",
-    "./config": "./src/config/index.ts",
-    "./audit": "./src/shared/audit.ts",
-    "./k8s-probe": "./src/shared/k8s-probe.ts",
-    "./prerequisites": "./src/shared/prerequisites/index.ts"
+    ".": {
+      "types": "./dist/index.d.ts",
+      "default": "./src/index.ts"
+    },
+    "./credential-guard": {
+      "types": "./dist/credential-guard/index.d.ts",
+      "default": "./src/credential-guard/index.ts"
+    },
+    "./config": {
+      "types": "./dist/config/index.d.ts",
+      "default": "./src/config/index.ts"
+    },
+    "./audit": {
+      "types": "./dist/shared/audit.d.ts",
+      "default": "./src/shared/audit.ts"
+    },
+    "./k8s-probe": {
+      "types": "./dist/shared/k8s-probe.d.ts",
+      "default": "./src/shared/k8s-probe.ts"
+    },
+    "./prerequisites": {
+      "types": "./dist/shared/prerequisites/index.d.ts",
+      "default": "./src/shared/prerequisites/index.ts"
+    }
   },
   "publishConfig": {
     "access": "public"
@@ -73,6 +128,8 @@
   "scripts": {
     "check": "bun check.ts",
     "check:ci": "bun check.ts ci",
+    "build:types": "tsc -p tsconfig.declarations.json",
+    "prepare": "bun run build:types",
     "format": "oxfmt",
     "format:check": "oxfmt --check",
     "observability-tool": "bun src/observability-tool/index.ts",

package/src/az-tool/service.ts

@@ -9,6 +9,7 @@ import { AzSecurityError, AzCommandError, AzTimeoutError, AzParseError } from ".
 import { isCommandAllowed, isInvokeAllowed } from "./security";
 import { transformCmdOutput } from "./transformers";
 import { ConfigService, getToolConfig } from "#config";
+import { renderCommandLine, tokenizeCommandLine } from "#shared/exec";
 
 export class AzService extends Context.Service<
   AzService,
@@ -43,10 +44,10 @@ export class AzService extends Context.Service<
 
       const executor = yield* ChildProcessSpawner.ChildProcessSpawner;
 
-      const runShellCommand = (fullCommand: string, timeoutMs: number) =>
+      const runAzCommand = (argv: readonly string[], timeoutMs: number) =>
         Effect.scoped(
           Effect.gen(function* () {
-            const command = ChildProcess.make("sh", ["-c", fullCommand], {
+            const command = ChildProcess.make("az", argv, {
               stdout: "pipe",
               stderr: "pipe",
             });
@@ -68,7 +69,7 @@ export class AzService extends Context.Service<
             (platformError) =>
               new AzCommandError({
                 message: `Command execution failed: ${platformError.message}`,
-                command: fullCommand,
+                command: renderCommandLine(["az", ...argv]),
                 exitCode: -1,
                 hint: "Check that the az CLI is installed and authenticated",
                 nextCommand: "az login",
@@ -112,17 +113,22 @@ export class AzService extends Context.Service<
           firstWord as (typeof STANDALONE_AZ_COMMANDS)[number],
         );
 
-        let fullCommand: string;
+        const cmdArgv = tokenizeCommandLine(cmd);
+        const scopeArgv = [
+          "--organization",
+          azConfig.organization,
+          "--project",
+          projectName,
+        ] as const;
 
-        if (isStandaloneCommand) {
-          fullCommand = `az ${cmd}`;
-        } else if (isDirectCommand) {
-          fullCommand = `az ${cmd} --organization "${azConfig.organization}" --project "${projectName}"`;
-        } else {
-          fullCommand = `az devops ${cmd} --organization "${azConfig.organization}" --project "${projectName}"`;
-        }
+        const argv = isStandaloneCommand
+          ? cmdArgv
+          : isDirectCommand
+            ? [...cmdArgv, ...scopeArgv]
+            : ["devops", ...cmdArgv, ...scopeArgv];
 
-        const resultOption = yield* runShellCommand(fullCommand, azConfig.timeoutMs ?? 60000);
+        const fullCommand = renderCommandLine(["az", ...argv]);
+        const resultOption = yield* runAzCommand(argv, azConfig.timeoutMs ?? 60000);
 
         if (Option.isNone(resultOption)) {
           return yield* new AzTimeoutError({
@@ -165,7 +171,7 @@ export class AzService extends Context.Service<
           });
         }
 
-        let fullCommand = `az devops invoke --area ${params.area} --resource ${params.resource}`;
+        const argv = ["devops", "invoke", "--area", params.area, "--resource", params.resource];
 
         const projectName = resolveProject(params.project);
 
@@ -175,22 +181,23 @@ export class AzService extends Context.Service<
         };
 
         if (Object.keys(routeParameters).length > 0) {
-          const routeParams = Object.entries(routeParameters)
-            .map(([k, v]) => `${k}=${v}`)
-            .join(" ");
-          fullCommand += ` --route-parameters ${routeParams}`;
+          argv.push(
+            "--route-parameters",
+            ...Object.entries(routeParameters).map(([k, v]) => `${k}=${v}`),
+          );
         }
 
         if (params.queryParameters) {
-          const queryParams = Object.entries(params.queryParameters)
-            .map(([k, v]) => `${k}=${v}`)
-            .join(" ");
-          fullCommand += ` --query-parameters ${queryParams}`;
+          argv.push(
+            "--query-parameters",
+            ...Object.entries(params.queryParameters).map(([k, v]) => `${k}=${v}`),
+          );
         }
 
-        fullCommand += ` --organization "${azConfig.organization}" --output json`;
+        argv.push("--organization", azConfig.organization, "--output", "json");
 
-        const resultOption = yield* runShellCommand(fullCommand, azConfig.timeoutMs ?? 60000);
+        const fullCommand = renderCommandLine(["az", ...argv]);
+        const resultOption = yield* runAzCommand(argv, azConfig.timeoutMs ?? 60000);
 
         if (Option.isNone(resultOption)) {
           return yield* new AzTimeoutError({

package/src/k8s-tool/context.ts

@@ -0,0 +1,73 @@
+/** Kept free of I/O so the caller spawns kubectl itself instead of piping through sh, jq and head. */
+
+type KubeContextEntry = {
+  readonly name?: unknown;
+  readonly context?: { readonly cluster?: unknown };
+};
+
+type KubeClusterEntry = {
+  readonly name?: unknown;
+  readonly cluster?: { readonly server?: unknown };
+};
+
+type KubeConfigView = {
+  readonly contexts?: readonly KubeContextEntry[];
+  readonly clusters?: readonly KubeClusterEntry[];
+};
+
+const asString = (value: unknown): string | undefined =>
+  typeof value === "string" && value !== "" ? value : undefined;
+
+export const parseKubeConfigView = (stdout: string): KubeConfigView | undefined => {
+  try {
+    const parsed: unknown = JSON.parse(stdout);
+    return typeof parsed === "object" && parsed !== null ? (parsed as KubeConfigView) : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
+/**
+ * Two strategies, in the same order the previous jq pipelines used:
+ * an exact context.cluster match first, then a cluster whose server URL contains the id.
+ * Returns the first match so a multi-context kubeconfig resolves the same way it did before.
+ */
+export const selectKubeContext = (
+  view: KubeConfigView | undefined,
+  clusterId: string,
+): string | undefined => {
+  if (!view) {
+    return undefined;
+  }
+
+  const contexts = view.contexts ?? [];
+
+  for (const entry of contexts) {
+    const name = asString(entry.name);
+    if (name !== undefined && asString(entry.context?.cluster) === clusterId) {
+      return name;
+    }
+  }
+
+  const clusters = view.clusters ?? [];
+
+  for (const entry of contexts) {
+    const name = asString(entry.name);
+    const clusterName = asString(entry.context?.cluster);
+    if (name === undefined || clusterName === undefined) {
+      continue;
+    }
+
+    const matchesServer = clusters.some(
+      (cluster) =>
+        asString(cluster.name) === clusterName &&
+        (asString(cluster.cluster?.server) ?? "").includes(clusterId),
+    );
+
+    if (matchesServer) {
+      return name;
+    }
+  }
+
+  return undefined;
+};

package/src/k8s-tool/service.ts

@@ -1,7 +1,7 @@
 import { posix } from "node:path";
 
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
-import { Context, Effect, Layer, Option, Ref, Stream } from "effect";
+import { Context, Effect, Layer, Option, Ref } from "effect";
 
 import type { CommandResult, Environment } from "./types";
 
@@ -21,6 +21,7 @@ import { normalizeProfilePrerequisites } from "#shared/prerequisites/config";
 import { runWithProfilePrerequisites } from "#shared/prerequisites/runtime";
 import { buildApiProbeArgs } from "#shared/k8s-probe";
 import { isKubectlCommandAllowed, isSafeLogPath } from "./security";
+import { parseKubeConfigView, selectKubeContext } from "./context";
 
 export class K8sService extends Context.Service<
   K8sService,
@@ -98,41 +99,31 @@ export class K8sService extends Context.Service<
           );
         });
 
-        const withKubeconfig = (command: string, kubeconfig: string | undefined) =>
-          kubeconfig ? `KUBECONFIG=${quoteShellArg(kubeconfig)} ${command}` : command;
         const renderArg = (arg: string) =>
           /^[A-Za-z0-9_./:=,@+-]+$/.test(arg) ? arg : quoteShellArg(arg);
-        const renderKubectlCommand = (context: string, argv: readonly string[]) =>
-          ["kubectl", "--context", context, ...argv].map(renderArg).join(" ");
+        const renderKubectlCommand = (context: string | undefined, argv: readonly string[]) =>
+          ["kubectl", ...(context ? ["--context", context] : []), ...argv].map(renderArg).join(" ");
 
         // Cache context by selected profile/cluster instead of a single default profile.
         const contextRef = yield* Ref.make<Record<string, string>>({});
 
         // Helper that uses executor.spawn() to avoid ChildProcessSpawner requirement in return type
-        const runShellCommand = (commandStr: string, timeoutMs: number) =>
+        const runKubectlCapture = (
+          argv: readonly string[],
+          kubeconfig: string | undefined,
+          timeoutMs: number,
+          renderedCommand: string,
+        ) =>
           Effect.scoped(
             Effect.gen(function* () {
-              const command = ChildProcess.make("sh", ["-c", commandStr], {
+              const command = ChildProcess.make("kubectl", argv, {
                 stdout: "pipe",
                 stderr: "pipe",
+                ...(kubeconfig ? { env: { KUBECONFIG: kubeconfig }, extendEnv: true } : {}),
               });
               const process = yield* executor.spawn(command);
 
-              const stdoutChunk = yield* process.stdout.pipe(
-                Stream.decodeText(),
-                Stream.runCollect,
-              );
-              const stdout = stdoutChunk.join("");
-
-              const stderrChunk = yield* process.stderr.pipe(
-                Stream.decodeText(),
-                Stream.runCollect,
-              );
-              const stderr = stderrChunk.join("");
-
-              const exitCode = yield* process.exitCode;
-
-              return { stdout, stderr, exitCode };
+              return yield* collectProcessOutput(process);
             }),
           ).pipe(
             Effect.timeoutOption(timeoutMs),
@@ -140,7 +131,7 @@ export class K8sService extends Context.Service<
               const missing = missingBinaryFromSpawnFailure("kubectl", String(platformError));
               return new K8sCommandError({
                 message: `Command execution failed: ${String(platformError)}`,
-                command: commandStr,
+                command: renderedCommand,
                 exitCode: -1,
                 stderr: String(platformError),
                 ...(missing ? { hint: missing.hint } : {}),
@@ -214,56 +205,37 @@ export class K8sService extends Context.Service<
             return { context: cachedContext, kubeconfig };
           }
 
-          const jqCommand = withKubeconfig(
-            `kubectl config view -o json | jq -r '.contexts[] | select(.context.cluster == "${k8sConfig.clusterId}") | .name' | head -1`,
+          const viewCommand = renderKubectlCommand(undefined, ["config", "view", "-o", "json"]);
+          const viewResultOption = yield* runKubectlCapture(
+            ["config", "view", "-o", "json"],
             kubeconfig,
+            timeoutMs,
+            viewCommand,
           );
 
-          const contextResultOption = yield* runShellCommand(jqCommand, timeoutMs);
-
-          if (Option.isNone(contextResultOption)) {
+          if (Option.isNone(viewResultOption)) {
             return yield* new K8sTimeoutError({
               message: `Context resolution timed out after ${timeoutMs}ms`,
-              command: jqCommand,
+              command: viewCommand,
               timeoutMs,
             });
           }
 
-          const contextResult = contextResultOption.value;
-
-          if (contextResult.exitCode === 0 && contextResult.stdout.trim()) {
-            const resolvedContextValue = contextResult.stdout.trim();
-            yield* Ref.update(contextRef, (contexts) => ({
-              ...contexts,
-              [cacheKey]: resolvedContextValue,
-            }));
-            return { context: resolvedContextValue, kubeconfig };
-          }
-
-          const fallbackCommand = withKubeconfig(
-            `kubectl config view -o json | jq -r '.contexts[] as $ctx | .clusters[] | select(.name == $ctx.context.cluster and (.cluster.server | contains("${k8sConfig.clusterId}"))) | $ctx.name' | head -1`,
-            kubeconfig,
-          );
+          const viewResult = viewResultOption.value;
 
-          const fallbackResultOption = yield* runShellCommand(fallbackCommand, timeoutMs);
-
-          if (Option.isNone(fallbackResultOption)) {
-            return yield* new K8sTimeoutError({
-              message: `Context resolution timed out after ${timeoutMs}ms`,
-              command: fallbackCommand,
-              timeoutMs,
-            });
-          }
-
-          const fallbackResult = fallbackResultOption.value;
+          if (viewResult.exitCode === 0) {
+            const resolvedContextValue = selectKubeContext(
+              parseKubeConfigView(viewResult.stdout),
+              k8sConfig.clusterId,
+            );
 
-          if (fallbackResult.exitCode === 0 && fallbackResult.stdout.trim()) {
-            const resolvedContextValue = fallbackResult.stdout.trim();
-            yield* Ref.update(contextRef, (contexts) => ({
-              ...contexts,
-              [cacheKey]: resolvedContextValue,
-            }));
-            return { context: resolvedContextValue, kubeconfig };
+            if (resolvedContextValue !== undefined) {
+              yield* Ref.update(contextRef, (contexts) => ({
+                ...contexts,
+                [cacheKey]: resolvedContextValue,
+              }));
+              return { context: resolvedContextValue, kubeconfig };
+            }
           }
 
           return yield* new K8sContextError({