@blogic-cz/agent-tools 0.17.0 → 0.17.1

package/dist/az-tool/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/az-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAkB,MAAM,QAAQ,CAAC;AAEhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI5C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAGzF,OAAO,EAAE,aAAa,EAAiB,MAAM,SAAS,CAAC;;yBAK9B,CACnB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,GAAG,cAAc,GAAG,YAAY,CAAC;wBACxE,CAClB,MAAM,EAAE,YAAY,KACjB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc,GAAG,cAAc,GAAG,YAAY,CAAC;;AATjG,qBAAa,SAAU,SAAQ,cAWF;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,yFA6MnB;CACH;AAED,eAAO,MAAM,cAAc,wFAAkB,CAAC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/az-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAkB,MAAM,QAAQ,CAAC;AAEhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI5C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAGzF,OAAO,EAAE,aAAa,EAAiB,MAAM,SAAS,CAAC;;yBAM9B,CACnB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,GAAG,cAAc,GAAG,YAAY,CAAC;wBACxE,CAClB,MAAM,EAAE,YAAY,KACjB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc,GAAG,cAAc,GAAG,YAAY,CAAC;;AATjG,qBAAa,SAAU,SAAQ,cAWF;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,yFAmNnB;CACH;AAED,eAAO,MAAM,cAAc,wFAAkB,CAAC"}

package/dist/k8s-tool/context.d.ts

@@ -0,0 +1,26 @@
+/** Kept free of I/O so the caller spawns kubectl itself instead of piping through sh, jq and head. */
+type KubeContextEntry = {
+    readonly name?: unknown;
+    readonly context?: {
+        readonly cluster?: unknown;
+    };
+};
+type KubeClusterEntry = {
+    readonly name?: unknown;
+    readonly cluster?: {
+        readonly server?: unknown;
+    };
+};
+type KubeConfigView = {
+    readonly contexts?: readonly KubeContextEntry[];
+    readonly clusters?: readonly KubeClusterEntry[];
+};
+export declare const parseKubeConfigView: (stdout: string) => KubeConfigView | undefined;
+/**
+ * Two strategies, in the same order the previous jq pipelines used:
+ * an exact context.cluster match first, then a cluster whose server URL contains the id.
+ * Returns the first match so a multi-context kubeconfig resolves the same way it did before.
+ */
+export declare const selectKubeContext: (view: KubeConfigView | undefined, clusterId: string) => string | undefined;
+export {};
+//# sourceMappingURL=context.d.ts.map

package/dist/k8s-tool/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/k8s-tool/context.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAEtG,KAAK,gBAAgB,GAAG;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACnD,CAAC;AAEF,KAAK,gBAAgB,GAAG;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAClD,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACjD,CAAC;AAKF,eAAO,MAAM,mBAAmB,GAAI,QAAQ,MAAM,KAAG,cAAc,GAAG,SAOrE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,cAAc,GAAG,SAAS,EAChC,WAAW,MAAM,KAChB,MAAM,GAAG,SAmCX,CAAC"}

package/dist/k8s-tool/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/k8s-tool/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAuB,MAAM,QAAQ,CAAC;AAErE,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EACL,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,eAAe,EAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAiB,MAAM,SAAS,CAAC;;yBAc9B,CACnB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,WAAW,EAChB,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAChB,MAAM,EACN,eAAe,GAAG,eAAe,GAAG,eAAe,GAAG,wBAAwB,CAC/E;yBACoB,CACnB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,EACf,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAChB,aAAa,EACb,eAAe,GAAG,eAAe,GAAG,eAAe,GAAG,wBAAwB,CAC/E;yBACoB,CACnB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAChB,aAAa,EACb,eAAe,GAAG,eAAe,GAAG,eAAe,GAAG,wBAAwB,CAC/E;;AA5BL,qBAAa,UAAW,SAAQ,eA8BF;IAC5B,MAAM,CAAC,QAAQ,CAAC,KAAK,0FAwdnB;CACH;AAED,eAAO,MAAM,eAAe,yFAAmB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/k8s-tool/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAe,MAAM,QAAQ,CAAC;AAE7D,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EACL,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,eAAe,EAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAiB,MAAM,SAAS,CAAC;;yBAe9B,CACnB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,WAAW,EAChB,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAChB,MAAM,EACN,eAAe,GAAG,eAAe,GAAG,eAAe,GAAG,wBAAwB,CAC/E;yBACoB,CACnB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,EACf,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAChB,aAAa,EACb,eAAe,GAAG,eAAe,GAAG,eAAe,GAAG,wBAAwB,CAC/E;yBACoB,CACnB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAChB,aAAa,EACb,eAAe,GAAG,eAAe,GAAG,eAAe,GAAG,wBAAwB,CAC/E;;AA5BL,qBAAa,UAAW,SAAQ,eA8BF;IAC5B,MAAM,CAAC,QAAQ,CAAC,KAAK,0FA2bnB;CACH;AAED,eAAO,MAAM,eAAe,yFAAmB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC"}

package/dist/logs-tool/service.d.ts

@@ -1,4 +1,3 @@
-import { ChildProcessSpawner } from "effect/unstable/process";
 import { Context, Effect, Layer } from "effect";
 import type { Environment, LogFile, ReadOptions } from "./types";
 import { K8sService } from "#k8s/service";
@@ -6,18 +5,13 @@ import { ConfigService } from "#config/loader";
 import { type LogsError } from "./errors";
 export declare const parseLogFiles: (output: string) => LogFile[];
 export declare const formatPrettyOutput: (output: string) => string;
-/**
- * Sanitize a string for safe use in shell commands by escaping single quotes
- * and wrapping in single quotes. This prevents shell injection.
- */
-export declare const sanitizeShellArg: (input: string) => string;
 declare const LogsService_base: Context.ServiceClass<LogsService, "@agent-tools/LogsService", {
     readonly listLogs: (env: Environment, profile?: string) => Effect.Effect<LogFile[], LogsError>;
     readonly readLogs: (env: Environment, options: ReadOptions, profile?: string) => Effect.Effect<string, LogsError>;
 }>;
 export declare class LogsService extends LogsService_base {
-    static readonly layer: Layer.Layer<LogsService, never, ConfigService | ChildProcessSpawner.ChildProcessSpawner | K8sService>;
+    static readonly layer: Layer.Layer<LogsService, never, ConfigService | K8sService>;
 }
-export declare const LogsServiceLayer: Layer.Layer<LogsService, import("#config/loader").ConfigLoadError, ChildProcessSpawner.ChildProcessSpawner>;
+export declare const LogsServiceLayer: Layer.Layer<LogsService, import("#config/loader").ConfigLoadError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
 export {};
 //# sourceMappingURL=service.d.ts.map

package/dist/logs-tool/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/logs-tool/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,QAAQ,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEjE,OAAO,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAqC,MAAM,gBAAgB,CAAC;AAElF,OAAO,EAAoC,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAI5E,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,OAAO,EAarD,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,KAAG,MAYnD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,MAA6C,CAAC;;uBAkCxE,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC;uBAC3E,CACjB,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;;AARzC,qBAAa,WAAY,SAAQ,gBAUF;IAC7B,MAAM,CAAC,QAAQ,CAAC,KAAK,wGA8RnB;CACH;AAED,eAAO,MAAM,gBAAgB,6GAG5B,CAAC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/logs-tool/service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,QAAQ,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEjE,OAAO,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAqC,MAAM,gBAAgB,CAAC;AAElF,OAAO,EAAoC,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAG5E,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,OAAO,EAarD,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,KAAG,MAYnD,CAAC;;uBAiEqB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC;uBAC3E,CACjB,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;;AARzC,qBAAa,WAAY,SAAQ,gBAUF;IAC7B,MAAM,CAAC,QAAQ,CAAC,KAAK,8DA6PnB;CACH;AAED,eAAO,MAAM,gBAAgB,+IAG5B,CAAC"}

package/dist/shared/bun.d.ts

@@ -1,5 +1,4 @@
 import type { CommandOptions, CommandResult } from "./types";
 export declare function expandPath(path: string): string;
 export declare function runCommand(cmd: string[], options?: CommandOptions): Promise<CommandResult>;
-export declare function runShellCommand(command: string, options?: CommandOptions): Promise<CommandResult>;
 //# sourceMappingURL=bun.d.ts.map

package/dist/shared/bun.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bun.d.ts","sourceRoot":"","sources":["../../src/shared/bun.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7D,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS/C;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EAAE,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAmCxB;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAExB"}
+{"version":3,"file":"bun.d.ts","sourceRoot":"","sources":["../../src/shared/bun.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7D,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS/C;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EAAE,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAmCxB"}

package/dist/shared/exec.d.ts

@@ -13,11 +13,18 @@ export declare const collectProcessOutput: (process: ChildProcessSpawner.ChildPr
     stderr: string;
     exitCode: ChildProcessSpawner.ExitCode;
 }, import("effect/PlatformError").PlatformError, never>;
-export declare const execEffect: (commandStr: string, timeoutMs?: number) => Effect.Effect<{
+export declare const execEffect: (executable: string, args?: readonly string[], timeoutMs?: number) => Effect.Effect<{
     stdout: string;
     stderr: string;
     exitCode: number;
 }, ExecError, ChildProcessSpawner.ChildProcessSpawner>;
 export declare const quoteShellArg: (value: string) => string;
+/**
+ * Split a command line the way a POSIX shell would word-split it, without running one.
+ * Quotes group a value into a single argument and are removed; nothing else is interpreted,
+ * so a metacharacter reaches the child as literal text instead of shell syntax.
+ */
+export declare const tokenizeCommandLine: (commandLine: string) => string[];
+export declare const renderCommandLine: (argv: readonly string[]) => string;
 export {};
 //# sourceMappingURL=exec.d.ts.map

package/dist/shared/exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/shared/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;;;;;;;AAIhD,qBAAa,SAAU,SAAQ,cAK7B;CAAG;AAEL,eAAO,MAAM,oBAAoB,GAAI,SAAS,mBAAmB,CAAC,kBAAkB;;;;uDAUhF,CAAC;AAEL,eAAO,MAAM,UAAU,GACrB,YAAY,MAAM,EAClB,YAAW,MAA2B,KACrC,MAAM,CAAC,MAAM,CACd;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACpD,SAAS,EACT,mBAAmB,CAAC,mBAAmB,CAsCtC,CAAC;AAEJ,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,WAA0C,CAAC"}
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/shared/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;;;;;;;AAIhD,qBAAa,SAAU,SAAQ,cAK7B;CAAG;AAEL,eAAO,MAAM,oBAAoB,GAAI,SAAS,mBAAmB,CAAC,kBAAkB;;;;uDAUhF,CAAC;AAEL,eAAO,MAAM,UAAU,GACrB,YAAY,MAAM,EAClB,OAAM,SAAS,MAAM,EAAO,EAC5B,YAAW,MAA2B,KACrC,MAAM,CAAC,MAAM,CACd;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACpD,SAAS,EACT,mBAAmB,CAAC,mBAAmB,CAyCxC,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,WAA0C,CAAC;AAEtF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,aAAa,MAAM,KAAG,MAAM,EAwC/D,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,MAAM,SAAS,MAAM,EAAE,KAAG,MACmC,CAAC"}

package/dist/shared/index.d.ts

@@ -1,11 +1,11 @@
 export type { BaseResult, CommandOptions, CommandResult, Environment, OutputFormat, ToolResult, } from "./types";
 export { formatAny, formatOption, formatOutput, logFormatted } from "./format";
-export { expandPath, runCommand, runShellCommand } from "./bun";
+export { expandPath, runCommand } from "./bun";
 export { commonArgOptions, parseCommonArgs } from "./cli";
 export { renderCauseToStderr } from "./error-renderer";
 export { dumpCommandSchema, makeSchemaCommand, type CommandSchema } from "./schema-dump";
 export declare const VERSION: string;
-export { execEffect, type ExecError } from "./exec";
+export { execEffect, renderCommandLine, tokenizeCommandLine, type ExecError } from "./exec";
 export { createThrottle, type ThrottleError } from "./throttle";
 export { aggregateByField, deduplicateLines, formatCountSummary, parseTextTable, stripEmptyColumns, truncateRows, } from "./transform";
 export { transformLogOutput } from "./log-transform";

package/dist/shared/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/shared/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,cAAc,EACd,aAAa,EACb,WAAW,EACX,YAAY,EACZ,UAAU,GACX,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE/E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAIzF,eAAO,MAAM,OAAO,QAAc,CAAC;AAEnC,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/shared/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,cAAc,EACd,aAAa,EACb,WAAW,EACX,YAAY,EACZ,UAAU,GACX,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE/E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAIzF,eAAO,MAAM,OAAO,QAAc,CAAC;AAEnC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AAE5F,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "0.17.0",
+  "version": "0.17.1",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/az-tool/service.ts

@@ -9,6 +9,7 @@ import { AzSecurityError, AzCommandError, AzTimeoutError, AzParseError } from ".
 import { isCommandAllowed, isInvokeAllowed } from "./security";
 import { transformCmdOutput } from "./transformers";
 import { ConfigService, getToolConfig } from "#config";
+import { renderCommandLine, tokenizeCommandLine } from "#shared/exec";
 
 export class AzService extends Context.Service<
   AzService,
@@ -43,10 +44,10 @@ export class AzService extends Context.Service<
 
       const executor = yield* ChildProcessSpawner.ChildProcessSpawner;
 
-      const runShellCommand = (fullCommand: string, timeoutMs: number) =>
+      const runAzCommand = (argv: readonly string[], timeoutMs: number) =>
         Effect.scoped(
           Effect.gen(function* () {
-            const command = ChildProcess.make("sh", ["-c", fullCommand], {
+            const command = ChildProcess.make("az", argv, {
               stdout: "pipe",
               stderr: "pipe",
             });
@@ -68,7 +69,7 @@ export class AzService extends Context.Service<
             (platformError) =>
               new AzCommandError({
                 message: `Command execution failed: ${platformError.message}`,
-                command: fullCommand,
+                command: renderCommandLine(["az", ...argv]),
                 exitCode: -1,
                 hint: "Check that the az CLI is installed and authenticated",
                 nextCommand: "az login",
@@ -112,17 +113,22 @@ export class AzService extends Context.Service<
           firstWord as (typeof STANDALONE_AZ_COMMANDS)[number],
         );
 
-        let fullCommand: string;
+        const cmdArgv = tokenizeCommandLine(cmd);
+        const scopeArgv = [
+          "--organization",
+          azConfig.organization,
+          "--project",
+          projectName,
+        ] as const;
 
-        if (isStandaloneCommand) {
-          fullCommand = `az ${cmd}`;
-        } else if (isDirectCommand) {
-          fullCommand = `az ${cmd} --organization "${azConfig.organization}" --project "${projectName}"`;
-        } else {
-          fullCommand = `az devops ${cmd} --organization "${azConfig.organization}" --project "${projectName}"`;
-        }
+        const argv = isStandaloneCommand
+          ? cmdArgv
+          : isDirectCommand
+            ? [...cmdArgv, ...scopeArgv]
+            : ["devops", ...cmdArgv, ...scopeArgv];
 
-        const resultOption = yield* runShellCommand(fullCommand, azConfig.timeoutMs ?? 60000);
+        const fullCommand = renderCommandLine(["az", ...argv]);
+        const resultOption = yield* runAzCommand(argv, azConfig.timeoutMs ?? 60000);
 
         if (Option.isNone(resultOption)) {
           return yield* new AzTimeoutError({
@@ -165,7 +171,7 @@ export class AzService extends Context.Service<
           });
         }
 
-        let fullCommand = `az devops invoke --area ${params.area} --resource ${params.resource}`;
+        const argv = ["devops", "invoke", "--area", params.area, "--resource", params.resource];
 
         const projectName = resolveProject(params.project);
 
@@ -175,22 +181,23 @@ export class AzService extends Context.Service<
         };
 
         if (Object.keys(routeParameters).length > 0) {
-          const routeParams = Object.entries(routeParameters)
-            .map(([k, v]) => `${k}=${v}`)
-            .join(" ");
-          fullCommand += ` --route-parameters ${routeParams}`;
+          argv.push(
+            "--route-parameters",
+            ...Object.entries(routeParameters).map(([k, v]) => `${k}=${v}`),
+          );
         }
 
         if (params.queryParameters) {
-          const queryParams = Object.entries(params.queryParameters)
-            .map(([k, v]) => `${k}=${v}`)
-            .join(" ");
-          fullCommand += ` --query-parameters ${queryParams}`;
+          argv.push(
+            "--query-parameters",
+            ...Object.entries(params.queryParameters).map(([k, v]) => `${k}=${v}`),
+          );
         }
 
-        fullCommand += ` --organization "${azConfig.organization}" --output json`;
+        argv.push("--organization", azConfig.organization, "--output", "json");
 
-        const resultOption = yield* runShellCommand(fullCommand, azConfig.timeoutMs ?? 60000);
+        const fullCommand = renderCommandLine(["az", ...argv]);
+        const resultOption = yield* runAzCommand(argv, azConfig.timeoutMs ?? 60000);
 
         if (Option.isNone(resultOption)) {
           return yield* new AzTimeoutError({

package/src/k8s-tool/context.ts

@@ -0,0 +1,73 @@
+/** Kept free of I/O so the caller spawns kubectl itself instead of piping through sh, jq and head. */
+
+type KubeContextEntry = {
+  readonly name?: unknown;
+  readonly context?: { readonly cluster?: unknown };
+};
+
+type KubeClusterEntry = {
+  readonly name?: unknown;
+  readonly cluster?: { readonly server?: unknown };
+};
+
+type KubeConfigView = {
+  readonly contexts?: readonly KubeContextEntry[];
+  readonly clusters?: readonly KubeClusterEntry[];
+};
+
+const asString = (value: unknown): string | undefined =>
+  typeof value === "string" && value !== "" ? value : undefined;
+
+export const parseKubeConfigView = (stdout: string): KubeConfigView | undefined => {
+  try {
+    const parsed: unknown = JSON.parse(stdout);
+    return typeof parsed === "object" && parsed !== null ? (parsed as KubeConfigView) : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
+/**
+ * Two strategies, in the same order the previous jq pipelines used:
+ * an exact context.cluster match first, then a cluster whose server URL contains the id.
+ * Returns the first match so a multi-context kubeconfig resolves the same way it did before.
+ */
+export const selectKubeContext = (
+  view: KubeConfigView | undefined,
+  clusterId: string,
+): string | undefined => {
+  if (!view) {
+    return undefined;
+  }
+
+  const contexts = view.contexts ?? [];
+
+  for (const entry of contexts) {
+    const name = asString(entry.name);
+    if (name !== undefined && asString(entry.context?.cluster) === clusterId) {
+      return name;
+    }
+  }
+
+  const clusters = view.clusters ?? [];
+
+  for (const entry of contexts) {
+    const name = asString(entry.name);
+    const clusterName = asString(entry.context?.cluster);
+    if (name === undefined || clusterName === undefined) {
+      continue;
+    }
+
+    const matchesServer = clusters.some(
+      (cluster) =>
+        asString(cluster.name) === clusterName &&
+        (asString(cluster.cluster?.server) ?? "").includes(clusterId),
+    );
+
+    if (matchesServer) {
+      return name;
+    }
+  }
+
+  return undefined;
+};

package/src/k8s-tool/service.ts

@@ -1,7 +1,7 @@
 import { posix } from "node:path";
 
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
-import { Context, Effect, Layer, Option, Ref, Stream } from "effect";
+import { Context, Effect, Layer, Option, Ref } from "effect";
 
 import type { CommandResult, Environment } from "./types";
 
@@ -21,6 +21,7 @@ import { normalizeProfilePrerequisites } from "#shared/prerequisites/config";
 import { runWithProfilePrerequisites } from "#shared/prerequisites/runtime";
 import { buildApiProbeArgs } from "#shared/k8s-probe";
 import { isKubectlCommandAllowed, isSafeLogPath } from "./security";
+import { parseKubeConfigView, selectKubeContext } from "./context";
 
 export class K8sService extends Context.Service<
   K8sService,
@@ -98,41 +99,31 @@ export class K8sService extends Context.Service<
           );
         });
 
-        const withKubeconfig = (command: string, kubeconfig: string | undefined) =>
-          kubeconfig ? `KUBECONFIG=${quoteShellArg(kubeconfig)} ${command}` : command;
         const renderArg = (arg: string) =>
           /^[A-Za-z0-9_./:=,@+-]+$/.test(arg) ? arg : quoteShellArg(arg);
-        const renderKubectlCommand = (context: string, argv: readonly string[]) =>
-          ["kubectl", "--context", context, ...argv].map(renderArg).join(" ");
+        const renderKubectlCommand = (context: string | undefined, argv: readonly string[]) =>
+          ["kubectl", ...(context ? ["--context", context] : []), ...argv].map(renderArg).join(" ");
 
         // Cache context by selected profile/cluster instead of a single default profile.
         const contextRef = yield* Ref.make<Record<string, string>>({});
 
         // Helper that uses executor.spawn() to avoid ChildProcessSpawner requirement in return type
-        const runShellCommand = (commandStr: string, timeoutMs: number) =>
+        const runKubectlCapture = (
+          argv: readonly string[],
+          kubeconfig: string | undefined,
+          timeoutMs: number,
+          renderedCommand: string,
+        ) =>
           Effect.scoped(
             Effect.gen(function* () {
-              const command = ChildProcess.make("sh", ["-c", commandStr], {
+              const command = ChildProcess.make("kubectl", argv, {
                 stdout: "pipe",
                 stderr: "pipe",
+                ...(kubeconfig ? { env: { KUBECONFIG: kubeconfig }, extendEnv: true } : {}),
               });
               const process = yield* executor.spawn(command);
 
-              const stdoutChunk = yield* process.stdout.pipe(
-                Stream.decodeText(),
-                Stream.runCollect,
-              );
-              const stdout = stdoutChunk.join("");
-
-              const stderrChunk = yield* process.stderr.pipe(
-                Stream.decodeText(),
-                Stream.runCollect,
-              );
-              const stderr = stderrChunk.join("");
-
-              const exitCode = yield* process.exitCode;
-
-              return { stdout, stderr, exitCode };
+              return yield* collectProcessOutput(process);
             }),
           ).pipe(
             Effect.timeoutOption(timeoutMs),
@@ -140,7 +131,7 @@ export class K8sService extends Context.Service<
               const missing = missingBinaryFromSpawnFailure("kubectl", String(platformError));
               return new K8sCommandError({
                 message: `Command execution failed: ${String(platformError)}`,
-                command: commandStr,
+                command: renderedCommand,
                 exitCode: -1,
                 stderr: String(platformError),
                 ...(missing ? { hint: missing.hint } : {}),
@@ -214,56 +205,37 @@ export class K8sService extends Context.Service<
             return { context: cachedContext, kubeconfig };
           }
 
-          const jqCommand = withKubeconfig(
-            `kubectl config view -o json | jq -r '.contexts[] | select(.context.cluster == "${k8sConfig.clusterId}") | .name' | head -1`,
+          const viewCommand = renderKubectlCommand(undefined, ["config", "view", "-o", "json"]);
+          const viewResultOption = yield* runKubectlCapture(
+            ["config", "view", "-o", "json"],
             kubeconfig,
+            timeoutMs,
+            viewCommand,
           );
 
-          const contextResultOption = yield* runShellCommand(jqCommand, timeoutMs);
-
-          if (Option.isNone(contextResultOption)) {
+          if (Option.isNone(viewResultOption)) {
             return yield* new K8sTimeoutError({
               message: `Context resolution timed out after ${timeoutMs}ms`,
-              command: jqCommand,
+              command: viewCommand,
               timeoutMs,
             });
           }
 
-          const contextResult = contextResultOption.value;
-
-          if (contextResult.exitCode === 0 && contextResult.stdout.trim()) {
-            const resolvedContextValue = contextResult.stdout.trim();
-            yield* Ref.update(contextRef, (contexts) => ({
-              ...contexts,
-              [cacheKey]: resolvedContextValue,
-            }));
-            return { context: resolvedContextValue, kubeconfig };
-          }
-
-          const fallbackCommand = withKubeconfig(
-            `kubectl config view -o json | jq -r '.contexts[] as $ctx | .clusters[] | select(.name == $ctx.context.cluster and (.cluster.server | contains("${k8sConfig.clusterId}"))) | $ctx.name' | head -1`,
-            kubeconfig,
-          );
+          const viewResult = viewResultOption.value;
 
-          const fallbackResultOption = yield* runShellCommand(fallbackCommand, timeoutMs);
-
-          if (Option.isNone(fallbackResultOption)) {
-            return yield* new K8sTimeoutError({
-              message: `Context resolution timed out after ${timeoutMs}ms`,
-              command: fallbackCommand,
-              timeoutMs,
-            });
-          }
-
-          const fallbackResult = fallbackResultOption.value;
+          if (viewResult.exitCode === 0) {
+            const resolvedContextValue = selectKubeContext(
+              parseKubeConfigView(viewResult.stdout),
+              k8sConfig.clusterId,
+            );
 
-          if (fallbackResult.exitCode === 0 && fallbackResult.stdout.trim()) {
-            const resolvedContextValue = fallbackResult.stdout.trim();
-            yield* Ref.update(contextRef, (contexts) => ({
-              ...contexts,
-              [cacheKey]: resolvedContextValue,
-            }));
-            return { context: resolvedContextValue, kubeconfig };
+            if (resolvedContextValue !== undefined) {
+              yield* Ref.update(contextRef, (contexts) => ({
+                ...contexts,
+                [cacheKey]: resolvedContextValue,
+              }));
+              return { context: resolvedContextValue, kubeconfig };
+            }
           }
 
           return yield* new K8sContextError({

package/src/logs-tool/service.ts

@@ -1,6 +1,6 @@
-import { isAbsolute, posix, relative, resolve } from "node:path";
+import { readFile, readdir, realpath, stat } from "node:fs/promises";
+import { isAbsolute, join, posix, relative, resolve } from "node:path";
 
-import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 import { Context, Effect, Layer, Result } from "effect";
 
 import type { Environment, LogFile, ReadOptions } from "./types";
@@ -9,7 +9,6 @@ import { K8sService, K8sServiceLayer } from "#k8s/service";
 import { ConfigService, ConfigServiceLayer, getToolConfig } from "#config/loader";
 import type { LogsConfig } from "#config/types";
 import { LogsNotFoundError, LogsReadError, type LogsError } from "./errors";
-import { collectProcessOutput } from "#shared/exec";
 import { transformLogOutput } from "./transformers";
 
 export const parseLogFiles = (output: string): LogFile[] => {
@@ -41,11 +40,36 @@ export const formatPrettyOutput = (output: string): string => {
     .join("\n---\n");
 };
 
-/**
- * Sanitize a string for safe use in shell commands by escaping single quotes
- * and wrapping in single quotes. This prevents shell injection.
- */
-export const sanitizeShellArg = (input: string): string => `'${input.replace(/'/g, "'\\''")}'`;
+const errorText = (error: unknown): string =>
+  error instanceof Error ? error.message : String(error);
+
+const takeLastLines = (contents: string, lines: number): string => {
+  const all = contents.split("\n");
+  const withoutTrailingBlank = all.at(-1) === "" ? all.slice(0, -1) : all;
+  return withoutTrailingBlank.slice(-lines).join("\n");
+};
+
+/** Newest first, so callers can take the head as the latest log the way `ls -t` did. */
+const readLocalLogDirectory = async (localDir: string): Promise<LogFile[]> => {
+  const entries = await readdir(localDir, { withFileTypes: true });
+  const logs = entries.filter((entry) => !entry.isDirectory() && entry.name.endsWith(".log"));
+
+  const described = await Promise.all(
+    logs.map(async (entry) => {
+      const stats = await stat(join(localDir, entry.name));
+      return {
+        name: entry.name,
+        size: String(stats.size),
+        date: stats.mtime.toISOString(),
+        modifiedAtMs: stats.mtimeMs,
+      };
+    }),
+  );
+
+  return described
+    .toSorted((left, right) => right.modifiedAtMs - left.modifiedAtMs)
+    .map(({ name, size, date }) => ({ name, size, date }));
+};
 
 const readCommandOutput = (output: unknown): string => (typeof output === "string" ? output : "");
 const filterLogLines = (output: string, grep: string | undefined): string => {
@@ -91,45 +115,8 @@ export class LogsService extends Context.Service<
     LogsService,
     Effect.gen(function* () {
       const k8s = yield* K8sService;
-      const executor = yield* ChildProcessSpawner.ChildProcessSpawner;
       const config = yield* ConfigService;
 
-      const runShellCommand = (commandStr: string) =>
-        Effect.scoped(
-          Effect.gen(function* () {
-            const command = ChildProcess.make("sh", ["-c", commandStr], {
-              stdout: "pipe",
-              stderr: "pipe",
-            });
-            const process = yield* executor.spawn(command);
-            return yield* collectProcessOutput(process);
-          }),
-        ).pipe(
-          Effect.catch((platformError) =>
-            Effect.succeed({
-              stdout: "",
-              stderr: String(platformError),
-              exitCode: -1,
-            }),
-          ),
-        );
-
-      const runDirectCommand = (executable: string, args: readonly string[]) =>
-        Effect.scoped(
-          Effect.gen(function* () {
-            const command = ChildProcess.make(executable, args, {
-              stdout: "pipe",
-              stderr: "pipe",
-            });
-            const process = yield* executor.spawn(command);
-            return yield* collectProcessOutput(process);
-          }),
-        ).pipe(
-          Effect.catch((platformError) =>
-            Effect.succeed({ stdout: "", stderr: String(platformError), exitCode: -1 }),
-          ),
-        );
-
       const getLogsConfig = (profile?: string): LogsConfig | undefined =>
         getToolConfig<LogsConfig>(config, "logs", profile);
 
@@ -137,16 +124,16 @@ export class LogsService extends Context.Service<
         logsConfig: LogsConfig,
       ) {
         const localDir = logsConfig.localDir;
-        const result = yield* runShellCommand(`ls -la ${localDir}`);
-
-        if (result.exitCode !== 0) {
-          return yield* new LogsReadError({
-            message: result.stderr.trim() || "Failed to list local logs",
-            source: localDir,
-          });
-        }
+        const files = yield* Effect.tryPromise(() => readLocalLogDirectory(localDir)).pipe(
+          Effect.mapError(
+            (error) =>
+              new LogsReadError({
+                message: errorText(error) || "Failed to list local logs",
+                source: localDir,
+              }),
+          ),
+        );
 
-        const files = parseLogFiles(result.stdout);
         if (files.length === 0) {
           return yield* new LogsNotFoundError({
             message: "No log files found",
@@ -213,24 +200,25 @@ export class LogsService extends Context.Service<
         let logFile = options.file;
 
         if (!logFile) {
-          const latest = yield* runShellCommand(`ls -t ${localDir}/*.log 2>/dev/null | head -1`);
-
-          if (latest.exitCode !== 0) {
-            return yield* new LogsReadError({
-              message: latest.stderr.trim() || "Failed to find latest log",
-              source: localDir,
-            });
-          }
+          const files = yield* Effect.tryPromise(() => readLocalLogDirectory(localDir)).pipe(
+            Effect.mapError(
+              (error) =>
+                new LogsReadError({
+                  message: errorText(error) || "Failed to find latest log",
+                  source: localDir,
+                }),
+            ),
+          );
 
-          const latestPath = latest.stdout.trim();
-          if (!latestPath) {
+          const latest = files[0];
+          if (!latest) {
             return yield* new LogsNotFoundError({
               message: "No log files found",
               path: localDir,
             });
           }
 
-          logFile = latestPath.split("/").pop() ?? latestPath;
+          logFile = latest.name;
         }
 
         const lexicalPath = resolveLocalLogPath(localDir, logFile);
@@ -240,20 +228,22 @@ export class LogsService extends Context.Service<
             source: localDir,
           });
         }
-        const realpathResult = yield* runDirectCommand("realpath", [localDir, lexicalPath]);
-        if (realpathResult.exitCode !== 0) {
-          return yield* new LogsReadError({
-            message:
-              realpathResult.stderr.trim() ||
-              `realpath failed with exit code ${realpathResult.exitCode}`,
-            source: lexicalPath,
-          });
-        }
-        const [canonicalBase, canonicalPath] = realpathResult.stdout.trim().split("\n");
+        const canonical = yield* Effect.tryPromise(async () => ({
+          base: await realpath(localDir),
+          path: await realpath(lexicalPath),
+        })).pipe(
+          Effect.mapError(
+            (error) =>
+              new LogsReadError({
+                message: errorText(error) || "Failed to canonicalize the log path",
+                source: lexicalPath,
+              }),
+          ),
+        );
+
+        const canonicalPath = canonical.path;
         if (
-          canonicalBase === undefined ||
-          canonicalPath === undefined ||
-          resolveLocalLogPath(canonicalBase, canonicalPath) !== canonicalPath ||
+          resolveLocalLogPath(canonical.base, canonicalPath) !== canonicalPath ||
           !canonicalPath.endsWith(".log")
         ) {
           return yield* new LogsReadError({
@@ -261,17 +251,18 @@ export class LogsService extends Context.Service<
             source: localDir,
           });
         }
-        const command = `tail -${options.tail} ${sanitizeShellArg(canonicalPath)}`;
-        const result = yield* runShellCommand(command);
 
-        if (result.exitCode !== 0) {
-          return yield* new LogsReadError({
-            message: result.stderr.trim() || `Command failed with exit code ${result.exitCode}`,
-            source: canonicalPath,
-          });
-        }
+        const contents = yield* Effect.tryPromise(() => readFile(canonicalPath, "utf8")).pipe(
+          Effect.mapError(
+            (error) =>
+              new LogsReadError({
+                message: errorText(error) || "Failed to read the log file",
+                source: canonicalPath,
+              }),
+          ),
+        );
 
-        const output = filterLogLines(result.stdout, options.grep).trim();
+        const output = filterLogLines(takeLastLines(contents, options.tail), options.grep).trim();
         if (!output) {
           return "(no matching lines)";
         }

package/src/shared/bun.ts

@@ -50,10 +50,3 @@ export async function runCommand(
     executionTimeMs: Date.now() - startTime,
   };
 }
-
-export function runShellCommand(
-  command: string,
-  options: CommandOptions = {},
-): Promise<CommandResult> {
-  return runCommand(["sh", "-c", command], options);
-}

package/src/shared/exec.ts

@@ -23,18 +23,21 @@ export const collectProcessOutput = (process: ChildProcessSpawner.ChildProcessHa
   });
 
 export const execEffect = (
-  commandStr: string,
+  executable: string,
+  args: readonly string[] = [],
   timeoutMs: number = DEFAULT_TIMEOUT_MS,
 ): Effect.Effect<
   { stdout: string; stderr: string; exitCode: number },
   ExecError,
   ChildProcessSpawner.ChildProcessSpawner
-> =>
-  Effect.scoped(
+> => {
+  const commandStr = renderCommandLine([executable, ...args]);
+
+  return Effect.scoped(
     Effect.gen(function* () {
       const executor = yield* ChildProcessSpawner.ChildProcessSpawner;
 
-      const command = ChildProcess.make("sh", ["-c", commandStr], {
+      const command = ChildProcess.make(executable, args, {
         stdout: "pipe",
         stderr: "pipe",
       });
@@ -67,5 +70,56 @@ export const execEffect = (
       ),
     ),
   );
+};
 
 export const quoteShellArg = (value: string) => `'${value.replaceAll("'", "'\\''")}'`;
+
+/**
+ * Split a command line the way a POSIX shell would word-split it, without running one.
+ * Quotes group a value into a single argument and are removed; nothing else is interpreted,
+ * so a metacharacter reaches the child as literal text instead of shell syntax.
+ */
+export const tokenizeCommandLine = (commandLine: string): string[] => {
+  const tokens: string[] = [];
+  let current = "";
+  let started = false;
+  let quote: '"' | "'" | undefined;
+
+  for (const character of commandLine) {
+    if (quote) {
+      if (character === quote) {
+        quote = undefined;
+      } else {
+        current += character;
+      }
+      continue;
+    }
+
+    if (character === '"' || character === "'") {
+      quote = character;
+      started = true;
+      continue;
+    }
+
+    if (/\s/.test(character)) {
+      if (started) {
+        tokens.push(current);
+        current = "";
+        started = false;
+      }
+      continue;
+    }
+
+    current += character;
+    started = true;
+  }
+
+  if (started) {
+    tokens.push(current);
+  }
+
+  return tokens;
+};
+
+export const renderCommandLine = (argv: readonly string[]): string =>
+  argv.map((arg) => (/^[A-Za-z0-9_./:=,@+-]+$/.test(arg) ? arg : quoteShellArg(arg))).join(" ");

package/src/shared/index.ts

@@ -9,7 +9,7 @@ export type {
 
 export { formatAny, formatOption, formatOutput, logFormatted } from "./format";
 
-export { expandPath, runCommand, runShellCommand } from "./bun";
+export { expandPath, runCommand } from "./bun";
 
 export { commonArgOptions, parseCommonArgs } from "./cli";
 
@@ -21,7 +21,7 @@ export { dumpCommandSchema, makeSchemaCommand, type CommandSchema } from "./sche
 import pkg from "../../package.json" with { type: "json" };
 export const VERSION = pkg.version;
 
-export { execEffect, type ExecError } from "./exec";
+export { execEffect, renderCommandLine, tokenizeCommandLine, type ExecError } from "./exec";
 
 export { createThrottle, type ThrottleError } from "./throttle";