@blogic-cz/agent-tools 0.17.0 → 0.17.2

package/README.md

@@ -436,6 +436,47 @@ Secrets are **never** stored in the config file. The `db-tool` config references
 }
 ```
 
+#### Endpoint overrides: `hostEnvVar` and `portEnvVar`
+
+A database environment can also take its `host` and `port` from environment variables:
+
+| Field        | Effect                                                                     |
+| ------------ | -------------------------------------------------------------------------- |
+| `hostEnvVar` | Name of an environment variable that overrides the literal `host` when set |
+| `portEnvVar` | Name of an environment variable that overrides the literal `port` when set |
+
+These are **overrides with fallback**, not requirements — the opposite of `passwordEnvVar`, which fails when its variable is unset:
+
+- variable set to a value → that value wins over the literal in the config;
+- variable unset or empty → the literal `host` / `port` in the config is used, and no error is raised;
+- `portEnvVar` set to something that is not an integer between 1 and 65535 → the command **fails**. It never falls back to the literal, because that would query a different database while you believe the override applied.
+
+The variable is read from the process environment first (Bun loads `.env` files into it), then from `~/.zshrc` exports.
+
+The typical use is a repository where every git worktree runs its own database container on its own host port, published by that worktree's `.env`:
+
+```json5
+{
+  database: {
+    default: {
+      environments: {
+        local: {
+          host: "127.0.0.1",
+          port: 40543, // the main checkout's database
+          user: "app",
+          database: "app",
+          portEnvVar: "APP_POSTGRES_PORT", // a worktree's .env sets this to e.g. 40643
+          hostEnvVar: "APP_POSTGRES_HOST", // optional, same fallback rule
+          prerequisites: [],
+        },
+      },
+    },
+  },
+}
+```
+
+Run from the main checkout, where `APP_POSTGRES_PORT` is unset, `db-tool` connects to `127.0.0.1:40543`. Run from a worktree whose `.env` sets `APP_POSTGRES_PORT=40643`, the same config connects to `127.0.0.1:40643` — so `db-tool` and `job-tool` inspect that worktree's own database instead of the main checkout's.
+
 Database VPN prerequisites can be set at the database profile or environment level. If an environment declares `vpn` or `prerequisites`, that environment config replaces the profile prerequisites; `prerequisites: []` explicitly disables inherited VPN setup. DB commands try the query directly first and only connect VPN prerequisites if direct access fails. Package-managed VPNs remain reusable for `idleDisconnectMs` (default 30000) after the last lease; `0` restores immediate cleanup. Preconnected or `leave-running` connections are treated as external and never stopped automatically. If runtime state is corrupt, unknown, or contains legacy artifacts, first stop all agent-tools processes using the VPN, then remove that VPN state directory under `~/.agent-tools/runtime/vpn-prerequisites`.
 
 ```json5

package/dist/az-tool/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/az-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAkB,MAAM,QAAQ,CAAC;AAEhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI5C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAGzF,OAAO,EAAE,aAAa,EAAiB,MAAM,SAAS,CAAC;;yBAK9B,CACnB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,GAAG,cAAc,GAAG,YAAY,CAAC;wBACxE,CAClB,MAAM,EAAE,YAAY,KACjB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc,GAAG,cAAc,GAAG,YAAY,CAAC;;AATjG,qBAAa,SAAU,SAAQ,cAWF;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,yFA6MnB;CACH;AAED,eAAO,MAAM,cAAc,wFAAkB,CAAC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/az-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAkB,MAAM,QAAQ,CAAC;AAEhE,OAAO,KAAK,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAI5C,OAAO,EAAE,eAAe,EAAE,cAAc,EAAE,cAAc,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAGzF,OAAO,EAAE,aAAa,EAAiB,MAAM,SAAS,CAAC;;yBAM9B,CACnB,GAAG,EAAE,MAAM,EACX,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,eAAe,GAAG,cAAc,GAAG,cAAc,GAAG,YAAY,CAAC;wBACxE,CAClB,MAAM,EAAE,YAAY,KACjB,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,eAAe,GAAG,cAAc,GAAG,cAAc,GAAG,YAAY,CAAC;;AATjG,qBAAa,SAAU,SAAQ,cAWF;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,yFAmNnB;CACH;AAED,eAAO,MAAM,cAAc,wFAAkB,CAAC"}

package/dist/config/loader.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAgB,KAAK,EAAU,MAAM,QAAQ,CAAC;AAE9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AA2NlE,wBAAgB,YAAY,CAC1B,MAAM,EAAE,OAAO,EACf,UAAU,GAAE,MAA4B,GACvC,gBAAgB,CAmClB;AAmFD,wBAAsB,UAAU,IAAI,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAcxE;;AAED,qBAAa,aAAc,SAAQ,kBAElC;CAAG;;;;AAEJ,qBAAa,eAAgB,SAAQ,qBAAoC;IACvE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;CAAG;AAEL,eAAO,MAAM,kBAAkB,oDAM9B,CAAC;AAEF,KAAK,eAAe,GAAG,MAAM,IAAI,CAC/B,gBAAgB,EAChB,OAAO,GAAG,YAAY,GAAG,UAAU,GAAG,eAAe,GAAG,MAAM,CAC/D,CAAC;AAEF,wBAAgB,aAAa,CAAC,CAAC,EAC7B,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,CAAC,GAAG,SAAS,CAkCf;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAE9F;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,OAAO,CAAC,EAAE,MAAM,GACf,gBAAgB,GAAG,SAAS,CAc9B;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM,GAAG,SAAS,CAqBpB"}
+{"version":3,"file":"loader.d.ts","sourceRoot":"","sources":["../../src/config/loader.ts"],"names":[],"mappings":"AAEA,OAAO,EAAE,OAAO,EAAgB,KAAK,EAAU,MAAM,QAAQ,CAAC;AAE9D,OAAO,KAAK,EAAE,gBAAgB,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AA6NlE,wBAAgB,YAAY,CAC1B,MAAM,EAAE,OAAO,EACf,UAAU,GAAE,MAA4B,GACvC,gBAAgB,CAmClB;AAmFD,wBAAsB,UAAU,IAAI,OAAO,CAAC,gBAAgB,GAAG,SAAS,CAAC,CAcxE;;AAED,qBAAa,aAAc,SAAQ,kBAElC;CAAG;;;;AAEJ,qBAAa,eAAgB,SAAQ,qBAAoC;IACvE,QAAQ,CAAC,KAAK,EAAE,OAAO,CAAC;CACzB,CAAC;CAAG;AAEL,eAAO,MAAM,kBAAkB,oDAM9B,CAAC;AAEF,KAAK,eAAe,GAAG,MAAM,IAAI,CAC/B,gBAAgB,EAChB,OAAO,GAAG,YAAY,GAAG,UAAU,GAAG,eAAe,GAAG,MAAM,CAC/D,CAAC;AAEF,wBAAgB,aAAa,CAAC,CAAC,EAC7B,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,OAAO,EAAE,eAAe,EACxB,OAAO,CAAC,EAAE,MAAM,GACf,CAAC,GAAG,SAAS,CAkCf;AAED,wBAAgB,qBAAqB,CAAC,MAAM,EAAE,gBAAgB,GAAG,SAAS,GAAG,MAAM,GAAG,SAAS,CAE9F;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,OAAO,CAAC,EAAE,MAAM,GACf,gBAAgB,GAAG,SAAS,CAc9B;AAED,wBAAgB,uBAAuB,CACrC,MAAM,EAAE,gBAAgB,GAAG,SAAS,EACpC,MAAM,CAAC,EAAE,MAAM,GAAG,IAAI,GACrB,MAAM,GAAG,SAAS,CAqBpB"}

package/dist/config/types.d.ts

@@ -77,6 +77,23 @@ export type DbEnvConfig = ProfilePrerequisites & {
     password?: string;
     /** Name of environment variable holding the password, e.g. "DB_TEST_PWD" */
     passwordEnvVar?: string;
+    /**
+     * Name of an environment variable that overrides `host`, e.g. "APP_POSTGRES_HOST".
+     *
+     * Override with fallback, deliberately unlike `passwordEnvVar`: an unset or empty variable is
+     * not an error, it keeps the literal `host` above. The variable usually exists only in a
+     * per-worktree environment, and the main checkout must keep working from the literal.
+     */
+    hostEnvVar?: string;
+    /**
+     * Name of an environment variable that overrides `port`, e.g. "APP_POSTGRES_PORT".
+     *
+     * Same override-with-fallback rule as `hostEnvVar`: unset or empty keeps the literal `port`,
+     * because only a worktree environment publishes its own port. A variable that *is* set but is
+     * not an integer in 1..65535 fails instead of falling back — a silent fallback would query the
+     * wrong database while the caller believes the override applied.
+     */
+    portEnvVar?: string;
 };
 /** SQL mutation operation that can be explicitly allowed for a database environment. */
 export declare const DbMutationOperationSchema: Schema.Literals<readonly ["insert", "update", "delete"]>;

package/dist/config/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,yCAAyC;AACzC,MAAM,MAAM,WAAW,GAAG;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAEhE,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,KAAK,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,aAAa,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB,0BAA0B,GAC1B,yBAAyB,GACzB,6BAA6B,CAAC;AAElC,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wFAAwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,0BAA0B,CAAC;QACpC,KAAK,CAAC,EAAE,yBAAyB,CAAC;QAClC,KAAK,CAAC,EAAE,6BAA6B,CAAC;KACvC,CAAC;IACF,uGAAuG;IACvG,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,aAAa,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,SAAS,GAAG,oBAAoB,GAAG;IAC7C,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,qDAAqD;AACrD,MAAM,MAAM,WAAW,GAAG,oBAAoB,GAAG;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,0DAAkD,CAAC;AACzF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACvF,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAE/F,qCAAqC;AACrC,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG;IAClD,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C,+GAA+G;IAC/G,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC,CAAC;IAClE,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAClE,OAAO,CAAC,EAAE;QACR,+DAA+D;QAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,iCAAiC;AACjC,MAAM,MAAM,UAAU,GAAG,oBAAoB,GAAG;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,0CAA0C;AAC1C,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CACtD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,8DAA8D;AAC9D,MAAM,MAAM,qBAAqB,GAAG;IAClC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,yBAAyB,CAAC,EAAE,eAAe,EAAE,CAAC;IAC9C,+BAA+B,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,sGAAsG;IACtG,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,8CAA8C;IAC9C,OAAO,CAAC,EAAE;QACR,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,sFAAsF;IACtF,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/config/types.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAEhC,yCAAyC;AACzC,MAAM,MAAM,WAAW,GAAG;IACxB,YAAY,EAAE,MAAM,CAAC;IACrB,cAAc,EAAE,MAAM,CAAC;IACvB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,aAAa,GAAG,eAAe,GAAG,iBAAiB,CAAC;AAEhE,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,KAAK,CAAC;IACZ,GAAG,EAAE,MAAM,CAAC;IACZ,OAAO,CAAC,EAAE,aAAa,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,0BAA0B,GAAG;IACvC,IAAI,EAAE,cAAc,CAAC;IACrB,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,0FAA0F;IAC1F,YAAY,CAAC,EAAE,MAAM,CAAC;CACvB,CAAC;AAEF,MAAM,MAAM,yBAAyB,GAAG;IACtC,IAAI,EAAE,aAAa,CAAC;IACpB,cAAc,CAAC,EAAE,MAAM,CAAC;CACzB,CAAC;AAEF,MAAM,MAAM,6BAA6B,GAAG;IAC1C,IAAI,EAAE,iBAAiB,CAAC;IACxB,SAAS,CAAC,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,MAAM,MAAM,eAAe,GACvB,0BAA0B,GAC1B,yBAAyB,GACzB,6BAA6B,CAAC;AAElC,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;IACb,mFAAmF;IACnF,IAAI,CAAC,EAAE,OAAO,CAAC;IACf,cAAc,CAAC,EAAE,aAAa,CAAC;IAC/B,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,6DAA6D;IAC7D,mBAAmB,CAAC,EAAE,MAAM,CAAC;IAC7B,mGAAmG;IACnG,gBAAgB,CAAC,EAAE,MAAM,CAAC;IAC1B,wFAAwF;IACxF,YAAY,CAAC,EAAE,MAAM,CAAC;IACtB,OAAO,CAAC,EAAE;QACR,MAAM,CAAC,EAAE,0BAA0B,CAAC;QACpC,KAAK,CAAC,EAAE,yBAAyB,CAAC;QAClC,KAAK,CAAC,EAAE,6BAA6B,CAAC;KACvC,CAAC;IACF,uGAAuG;IACvG,MAAM,CAAC,EAAE,eAAe,CAAC;CAC1B,CAAC;AAEF,MAAM,MAAM,oBAAoB,GAAG;IACjC,aAAa,CAAC,EAAE,SAAS,eAAe,EAAE,CAAC;IAC3C,4EAA4E;IAC5E,GAAG,CAAC,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,SAAS,GAAG,oBAAoB,GAAG;IAC7C,+DAA+D;IAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,EAAE,MAAM,CAAC;IAClB,0EAA0E;IAC1E,UAAU,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;IACnC,SAAS,CAAC,EAAE,MAAM,CAAC;IACnB;;;;;OAKG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,qDAAqD;AACrD,MAAM,MAAM,WAAW,GAAG,oBAAoB,GAAG;IAC/C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,mGAAmG;IACnG,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,4EAA4E;IAC5E,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB;;;;;;OAMG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB;;;;;;;OAOG;IACH,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,wFAAwF;AACxF,eAAO,MAAM,yBAAyB,0DAAkD,CAAC;AACzF,MAAM,MAAM,mBAAmB,GAAG,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,OAAO,yBAAyB,CAAC,CAAC;AACvF,MAAM,MAAM,wBAAwB,GAAG,OAAO,CAAC,MAAM,CAAC,mBAAmB,EAAE,SAAS,MAAM,EAAE,CAAC,CAAC,CAAC;AAE/F,qCAAqC;AACrC,MAAM,MAAM,cAAc,GAAG,oBAAoB,GAAG;IAClD,mFAAmF;IACnF,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IAC1C,+GAA+G;IAC/G,gBAAgB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,mBAAmB,EAAE,CAAC,CAAC;IAClE,sBAAsB,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,wBAAwB,CAAC,CAAC;IAClE,OAAO,CAAC,EAAE;QACR,+DAA+D;QAC/D,UAAU,CAAC,EAAE,MAAM,CAAC;QACpB,OAAO,EAAE,MAAM,CAAC;QAChB,SAAS,EAAE,MAAM,CAAC;QAClB,OAAO,CAAC,EAAE,MAAM,CAAC;KAClB,CAAC;IACF,eAAe,CAAC,EAAE,MAAM,CAAC;IACzB;;;;;;;OAOG;IACH,iBAAiB,CAAC,EAAE,MAAM,CAAC;IAC3B,UAAU,CAAC,EAAE,MAAM,CAAC;CACrB,CAAC;AAEF,iCAAiC;AACjC,MAAM,MAAM,UAAU,GAAG,oBAAoB,GAAG;IAC9C,QAAQ,EAAE,MAAM,CAAC;IACjB,UAAU,EAAE,MAAM,CAAC;IACnB,iBAAiB,CAAC,EAAE,MAAM,CAAC;CAC5B,CAAC;AAEF,0DAA0D;AAC1D,MAAM,MAAM,sBAAsB,GAAG;IACnC,GAAG,EAAE,MAAM,CAAC;IACZ,WAAW,CAAC,EAAE,MAAM,CAAC;IACrB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,0CAA0C;AAC1C,MAAM,MAAM,mBAAmB,GAAG;IAChC,YAAY,EAAE,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAAC;CACtD,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,MAAM,CAAC;IACb,UAAU,EAAE,MAAM,CAAC;CACpB,CAAC;AAEF,8DAA8D;AAC9D,MAAM,MAAM,qBAAqB,GAAG;IAClC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,sBAAsB,CAAC,EAAE,MAAM,EAAE,CAAC;IAClC,yBAAyB,CAAC,EAAE,eAAe,EAAE,CAAC;IAC9C,+BAA+B,CAAC,EAAE,MAAM,EAAE,CAAC;CAC5C,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,aAAa,CAAC,EAAE,MAAM,CAAC;IACvB,MAAM,CAAC,EAAE,MAAM,CAAC;CACjB,CAAC;AAEF,6CAA6C;AAC7C,MAAM,MAAM,mBAAmB,GAAG;IAChC,OAAO,EAAE,MAAM,CAAC;IAChB,QAAQ,EAAE,MAAM,CAAC;IACjB,OAAO,CAAC,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,gBAAgB,GAAG;IAC7B,KAAK,EAAE,MAAM,CAAC;IACd,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,CAAC,EAAE,mBAAmB,CAAC;CAC/B,CAAC;AAEF;;;;;;;;GAQG;AACH,MAAM,MAAM,gBAAgB,GAAG;IAC7B,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,oGAAoG;IACpG,KAAK,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,WAAW,CAAC,CAAC;IACpC,iEAAiE;IACjE,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACjC,iFAAiF;IACjF,UAAU,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC,CAAC;IACvC,yEAAyE;IACzE,QAAQ,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,cAAc,CAAC,CAAC;IAC1C,oFAAoF;IACpF,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,UAAU,CAAC,CAAC;IAClC,sGAAsG;IACtG,aAAa,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,mBAAmB,CAAC,CAAC;IACpD,8CAA8C;IAC9C,OAAO,CAAC,EAAE;QACR,WAAW,EAAE,MAAM,CAAC;KACrB,CAAC;IACF,KAAK,CAAC,EAAE,WAAW,CAAC;IACpB,sFAAsF;IACtF,eAAe,CAAC,EAAE,qBAAqB,CAAC;IACxC,uGAAuG;IACvG,kBAAkB,CAAC,EAAE,MAAM,CAAC;IAC5B,wFAAwF;IACxF,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,gBAAgB,CAAC,CAAC;CAC3C,CAAC"}

package/dist/db-tool/service.d.ts

@@ -5,6 +5,29 @@ import { ConfigService } from "#config";
 import { DbConfigService } from "./config-service";
 import { DbSqlClient } from "./sql-client";
 import { type DbError } from "./errors";
+export type ResolvedPortOverride = {
+    readonly ok: true;
+    readonly port: number;
+} | {
+    readonly ok: false;
+    readonly message: string;
+};
+/**
+ * Applies a `portEnvVar` override to the literal `port` of a database environment.
+ *
+ * Override with fallback: no variable name, or a variable that is unset or blank, keeps
+ * `literalPort`, because the variable exists only in environments that publish their own port
+ * (a per-repository worktree) while the main checkout runs from the literal. A variable that is
+ * set but does not hold an integer in 1..65535 fails instead of falling back, since falling back
+ * would silently query the main checkout's database while the caller believes the override applied.
+ */
+export declare function resolvePortOverride(env: string, literalPort: number, portEnvVar: string | undefined, value: string | undefined): ResolvedPortOverride;
+/**
+ * Applies a `hostEnvVar` override to the literal `host` of a database environment.
+ * Unset or blank keeps `literalHost`; every non-blank value is a usable host, so there is no
+ * failure case here, unlike {@link resolvePortOverride}.
+ */
+export declare function resolveHostOverride(literalHost: string, hostEnvVar: string | undefined, value: string | undefined): string;
 export declare function resolveDbAccessMode(env: string, host: string, hasKubectlConfig: boolean, allowedMutations?: readonly DbMutationOperation[]): Pick<DbConfig, "allowMutations" | "allowedMutations" | "host" | "needsTunnel">;
 export declare function isFullyReadOnly(config: Pick<DbConfig, "allowMutations" | "allowedMutations" | "allowedMutationTargets">): boolean;
 export { buildApiProbeArgs } from "#shared/k8s-probe";

package/dist/db-tool/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/db-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAS,OAAO,EAAY,MAAM,EAAE,KAAK,EAAuB,MAAM,QAAQ,CAAC;AAEtF,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAOxC,OAAO,EAAE,eAAe,EAA4B,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,UAAU,CAAC;AAoBlB,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,OAAO,EACzB,gBAAgB,GAAE,SAAS,mBAAmB,EAAO,GACpD,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,MAAM,GAAG,aAAa,CAAC,CAUhF;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,wBAAwB,CAAC,GACvF,OAAO,CAMT;AAGD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;;2BAK3B,CACrB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;iCACX,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,EAChB,KAAK,CAAC,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;;AAZ5C,qBAAa,SAAU,SAAQ,cAcF;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,yHA4rBnB;CACH"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/db-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAS,OAAO,EAAY,MAAM,EAAE,KAAK,EAAuB,MAAM,QAAQ,CAAC;AAEtF,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAOxC,OAAO,EAAE,eAAe,EAA4B,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,UAAU,CAAC;AA8BlB,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,oBAAoB,CAqBtB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAOR;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,OAAO,EACzB,gBAAgB,GAAE,SAAS,mBAAmB,EAAO,GACpD,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,MAAM,GAAG,aAAa,CAAC,CAUhF;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,wBAAwB,CAAC,GACvF,OAAO,CAMT;AAGD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;;2BAK3B,CACrB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;iCACX,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,EAChB,KAAK,CAAC,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;;AAZ5C,qBAAa,SAAU,SAAQ,cAcF;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,yHAuuBnB;CACH"}

package/dist/db-tool/types.d.ts

@@ -9,6 +9,8 @@ export type DbConfig = ProfilePrerequisites & {
     database: string;
     password?: string;
     passwordEnvVar?: string;
+    hostEnvVar?: string;
+    portEnvVar?: string;
     port: number;
     needsTunnel: boolean;
     allowMutations: boolean;

package/dist/db-tool/types.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/db-tool/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEzD,YAAY,EAAE,mBAAmB,EAAE,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAE1C,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,eAAe,CAAC;AAEzE,MAAM,MAAM,QAAQ,GAAG,oBAAoB,GAAG;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,sBAAsB,EAAE,wBAAwB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,iBAAiB,GAAG,kBAAkB,GAAG,IAAI,CAAC;IACpD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC"}
+{"version":3,"file":"types.d.ts","sourceRoot":"","sources":["../../src/db-tool/types.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EACV,wBAAwB,EACxB,mBAAmB,EACnB,oBAAoB,EACrB,MAAM,eAAe,CAAC;AACvB,OAAO,KAAK,EAAE,WAAW,EAAE,YAAY,EAAE,MAAM,SAAS,CAAC;AAEzD,YAAY,EAAE,mBAAmB,EAAE,CAAC;AACpC,YAAY,EAAE,WAAW,EAAE,YAAY,EAAE,CAAC;AAE1C,MAAM,MAAM,UAAU,GAAG,QAAQ,GAAG,SAAS,GAAG,MAAM,GAAG,eAAe,CAAC;AAEzE,MAAM,MAAM,QAAQ,GAAG,oBAAoB,GAAG;IAC5C,IAAI,EAAE,MAAM,CAAC;IACb,IAAI,EAAE,MAAM,CAAC;IACb,QAAQ,EAAE,MAAM,CAAC;IACjB,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,cAAc,CAAC,EAAE,MAAM,CAAC;IACxB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,IAAI,EAAE,MAAM,CAAC;IACb,WAAW,EAAE,OAAO,CAAC;IACrB,cAAc,EAAE,OAAO,CAAC;IACxB,gBAAgB,EAAE,SAAS,mBAAmB,EAAE,CAAC;IACjD,sBAAsB,EAAE,wBAAwB,CAAC;CAClD,CAAC;AAEF,MAAM,MAAM,WAAW,GAAG;IACxB,OAAO,EAAE,OAAO,CAAC;IACjB,IAAI,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACjC,OAAO,CAAC,EAAE,MAAM,CAAC;IACjB,KAAK,CAAC,EAAE,MAAM,CAAC;IACf,QAAQ,CAAC,EAAE,MAAM,CAAC;IAClB,eAAe,EAAE,MAAM,CAAC;IACxB,eAAe,CAAC,EAAE,MAAM,EAAE,CAAC;IAC3B,gBAAgB,CAAC,EAAE,MAAM,EAAE,CAAC;IAC5B,IAAI,CAAC,EAAE,MAAM,CAAC;IACd,UAAU,CAAC,EAAE,MAAM,CAAC;IACpB,SAAS,CAAC,EAAE,OAAO,CAAC;IACpB,KAAK,CAAC,EAAE,MAAM,CAAC;CAChB,CAAC;AAEF,MAAM,MAAM,eAAe,GAAG;IAC5B,IAAI,EAAE,iBAAiB,GAAG,kBAAkB,GAAG,IAAI,CAAC;IACpD,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;IAC3B,SAAS,EAAE,MAAM,GAAG,IAAI,CAAC;CAC1B,CAAC"}

package/dist/k8s-tool/context.d.ts

@@ -0,0 +1,26 @@
+/** Kept free of I/O so the caller spawns kubectl itself instead of piping through sh, jq and head. */
+type KubeContextEntry = {
+    readonly name?: unknown;
+    readonly context?: {
+        readonly cluster?: unknown;
+    };
+};
+type KubeClusterEntry = {
+    readonly name?: unknown;
+    readonly cluster?: {
+        readonly server?: unknown;
+    };
+};
+type KubeConfigView = {
+    readonly contexts?: readonly KubeContextEntry[];
+    readonly clusters?: readonly KubeClusterEntry[];
+};
+export declare const parseKubeConfigView: (stdout: string) => KubeConfigView | undefined;
+/**
+ * Two strategies, in the same order the previous jq pipelines used:
+ * an exact context.cluster match first, then a cluster whose server URL contains the id.
+ * Returns the first match so a multi-context kubeconfig resolves the same way it did before.
+ */
+export declare const selectKubeContext: (view: KubeConfigView | undefined, clusterId: string) => string | undefined;
+export {};
+//# sourceMappingURL=context.d.ts.map

package/dist/k8s-tool/context.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"context.d.ts","sourceRoot":"","sources":["../../src/k8s-tool/context.ts"],"names":[],"mappings":"AAAA,sGAAsG;AAEtG,KAAK,gBAAgB,GAAG;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,OAAO,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CACnD,CAAC;AAEF,KAAK,gBAAgB,GAAG;IACtB,QAAQ,CAAC,IAAI,CAAC,EAAE,OAAO,CAAC;IACxB,QAAQ,CAAC,OAAO,CAAC,EAAE;QAAE,QAAQ,CAAC,MAAM,CAAC,EAAE,OAAO,CAAA;KAAE,CAAC;CAClD,CAAC;AAEF,KAAK,cAAc,GAAG;IACpB,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;IAChD,QAAQ,CAAC,QAAQ,CAAC,EAAE,SAAS,gBAAgB,EAAE,CAAC;CACjD,CAAC;AAKF,eAAO,MAAM,mBAAmB,GAAI,QAAQ,MAAM,KAAG,cAAc,GAAG,SAOrE,CAAC;AAEF;;;;GAIG;AACH,eAAO,MAAM,iBAAiB,GAC5B,MAAM,cAAc,GAAG,SAAS,EAChC,WAAW,MAAM,KAChB,MAAM,GAAG,SAmCX,CAAC"}

package/dist/k8s-tool/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/k8s-tool/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAuB,MAAM,QAAQ,CAAC;AAErE,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EACL,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,eAAe,EAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAiB,MAAM,SAAS,CAAC;;yBAc9B,CACnB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,WAAW,EAChB,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAChB,MAAM,EACN,eAAe,GAAG,eAAe,GAAG,eAAe,GAAG,wBAAwB,CAC/E;yBACoB,CACnB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,EACf,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAChB,aAAa,EACb,eAAe,GAAG,eAAe,GAAG,eAAe,GAAG,wBAAwB,CAC/E;yBACoB,CACnB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAChB,aAAa,EACb,eAAe,GAAG,eAAe,GAAG,eAAe,GAAG,wBAAwB,CAC/E;;AA5BL,qBAAa,UAAW,SAAQ,eA8BF;IAC5B,MAAM,CAAC,QAAQ,CAAC,KAAK,0FAwdnB;CACH;AAED,eAAO,MAAM,eAAe,yFAAmB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/k8s-tool/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAe,MAAM,QAAQ,CAAC;AAE7D,OAAO,KAAK,EAAE,aAAa,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAE1D,OAAO,EACL,eAAe,EACf,eAAe,EACf,wBAAwB,EACxB,eAAe,EAChB,MAAM,UAAU,CAAC;AAClB,OAAO,EAAE,aAAa,EAAiB,MAAM,SAAS,CAAC;;yBAe9B,CACnB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,WAAW,EAChB,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAChB,MAAM,EACN,eAAe,GAAG,eAAe,GAAG,eAAe,GAAG,wBAAwB,CAC/E;yBACoB,CACnB,GAAG,EAAE,MAAM,EACX,MAAM,EAAE,OAAO,EACf,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAChB,aAAa,EACb,eAAe,GAAG,eAAe,GAAG,eAAe,GAAG,wBAAwB,CAC/E;yBACoB,CACnB,GAAG,EAAE,MAAM,EACX,QAAQ,EAAE,MAAM,EAChB,IAAI,EAAE,MAAM,EACZ,KAAK,EAAE,MAAM,EACb,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAChB,aAAa,EACb,eAAe,GAAG,eAAe,GAAG,eAAe,GAAG,wBAAwB,CAC/E;;AA5BL,qBAAa,UAAW,SAAQ,eA8BF;IAC5B,MAAM,CAAC,QAAQ,CAAC,KAAK,0FA2bnB;CACH;AAED,eAAO,MAAM,eAAe,yFAAmB,CAAC;AAEhD,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC"}

package/dist/logs-tool/service.d.ts

@@ -1,4 +1,3 @@
-import { ChildProcessSpawner } from "effect/unstable/process";
 import { Context, Effect, Layer } from "effect";
 import type { Environment, LogFile, ReadOptions } from "./types";
 import { K8sService } from "#k8s/service";
@@ -6,18 +5,13 @@ import { ConfigService } from "#config/loader";
 import { type LogsError } from "./errors";
 export declare const parseLogFiles: (output: string) => LogFile[];
 export declare const formatPrettyOutput: (output: string) => string;
-/**
- * Sanitize a string for safe use in shell commands by escaping single quotes
- * and wrapping in single quotes. This prevents shell injection.
- */
-export declare const sanitizeShellArg: (input: string) => string;
 declare const LogsService_base: Context.ServiceClass<LogsService, "@agent-tools/LogsService", {
     readonly listLogs: (env: Environment, profile?: string) => Effect.Effect<LogFile[], LogsError>;
     readonly readLogs: (env: Environment, options: ReadOptions, profile?: string) => Effect.Effect<string, LogsError>;
 }>;
 export declare class LogsService extends LogsService_base {
-    static readonly layer: Layer.Layer<LogsService, never, ConfigService | ChildProcessSpawner.ChildProcessSpawner | K8sService>;
+    static readonly layer: Layer.Layer<LogsService, never, ConfigService | K8sService>;
 }
-export declare const LogsServiceLayer: Layer.Layer<LogsService, import("#config/loader").ConfigLoadError, ChildProcessSpawner.ChildProcessSpawner>;
+export declare const LogsServiceLayer: Layer.Layer<LogsService, import("#config/loader").ConfigLoadError, import("effect/unstable/process/ChildProcessSpawner").ChildProcessSpawner>;
 export {};
 //# sourceMappingURL=service.d.ts.map

package/dist/logs-tool/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/logs-tool/service.ts"],"names":[],"mappings":"AAEA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,QAAQ,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEjE,OAAO,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAqC,MAAM,gBAAgB,CAAC;AAElF,OAAO,EAAoC,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAI5E,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,OAAO,EAarD,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,KAAG,MAYnD,CAAC;AAEF;;;GAGG;AACH,eAAO,MAAM,gBAAgB,GAAI,OAAO,MAAM,KAAG,MAA6C,CAAC;;uBAkCxE,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC;uBAC3E,CACjB,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;;AARzC,qBAAa,WAAY,SAAQ,gBAUF;IAC7B,MAAM,CAAC,QAAQ,CAAC,KAAK,wGA8RnB;CACH;AAED,eAAO,MAAM,gBAAgB,6GAG5B,CAAC"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/logs-tool/service.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,QAAQ,CAAC;AAExD,OAAO,KAAK,EAAE,WAAW,EAAE,OAAO,EAAE,WAAW,EAAE,MAAM,SAAS,CAAC;AAEjE,OAAO,EAAE,UAAU,EAAmB,MAAM,cAAc,CAAC;AAC3D,OAAO,EAAE,aAAa,EAAqC,MAAM,gBAAgB,CAAC;AAElF,OAAO,EAAoC,KAAK,SAAS,EAAE,MAAM,UAAU,CAAC;AAG5E,eAAO,MAAM,aAAa,GAAI,QAAQ,MAAM,KAAG,OAAO,EAarD,CAAC;AAEF,eAAO,MAAM,kBAAkB,GAAI,QAAQ,MAAM,KAAG,MAYnD,CAAC;;uBAiEqB,CAAC,GAAG,EAAE,WAAW,EAAE,OAAO,CAAC,EAAE,MAAM,KAAK,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,EAAE,SAAS,CAAC;uBAC3E,CACjB,GAAG,EAAE,WAAW,EAChB,OAAO,EAAE,WAAW,EACpB,OAAO,CAAC,EAAE,MAAM,KACb,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,SAAS,CAAC;;AARzC,qBAAa,WAAY,SAAQ,gBAUF;IAC7B,MAAM,CAAC,QAAQ,CAAC,KAAK,8DA6PnB;CACH;AAED,eAAO,MAAM,gBAAgB,+IAG5B,CAAC"}

package/dist/shared/bun.d.ts

@@ -1,5 +1,4 @@
 import type { CommandOptions, CommandResult } from "./types";
 export declare function expandPath(path: string): string;
 export declare function runCommand(cmd: string[], options?: CommandOptions): Promise<CommandResult>;
-export declare function runShellCommand(command: string, options?: CommandOptions): Promise<CommandResult>;
 //# sourceMappingURL=bun.d.ts.map

package/dist/shared/bun.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"bun.d.ts","sourceRoot":"","sources":["../../src/shared/bun.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7D,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS/C;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EAAE,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAmCxB;AAED,wBAAgB,eAAe,CAC7B,OAAO,EAAE,MAAM,EACf,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAExB"}
+{"version":3,"file":"bun.d.ts","sourceRoot":"","sources":["../../src/shared/bun.ts"],"names":[],"mappings":"AAAA,OAAO,KAAK,EAAE,cAAc,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAE7D,wBAAgB,UAAU,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAS/C;AAED,wBAAsB,UAAU,CAC9B,GAAG,EAAE,MAAM,EAAE,EACb,OAAO,GAAE,cAAmB,GAC3B,OAAO,CAAC,aAAa,CAAC,CAmCxB"}

package/dist/shared/exec.d.ts

@@ -13,11 +13,18 @@ export declare const collectProcessOutput: (process: ChildProcessSpawner.ChildPr
     stderr: string;
     exitCode: ChildProcessSpawner.ExitCode;
 }, import("effect/PlatformError").PlatformError, never>;
-export declare const execEffect: (commandStr: string, timeoutMs?: number) => Effect.Effect<{
+export declare const execEffect: (executable: string, args?: readonly string[], timeoutMs?: number) => Effect.Effect<{
     stdout: string;
     stderr: string;
     exitCode: number;
 }, ExecError, ChildProcessSpawner.ChildProcessSpawner>;
 export declare const quoteShellArg: (value: string) => string;
+/**
+ * Split a command line the way a POSIX shell would word-split it, without running one.
+ * Quotes group a value into a single argument and are removed; nothing else is interpreted,
+ * so a metacharacter reaches the child as literal text instead of shell syntax.
+ */
+export declare const tokenizeCommandLine: (commandLine: string) => string[];
+export declare const renderCommandLine: (argv: readonly string[]) => string;
 export {};
 //# sourceMappingURL=exec.d.ts.map

package/dist/shared/exec.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/shared/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;;;;;;;AAIhD,qBAAa,SAAU,SAAQ,cAK7B;CAAG;AAEL,eAAO,MAAM,oBAAoB,GAAI,SAAS,mBAAmB,CAAC,kBAAkB;;;;uDAUhF,CAAC;AAEL,eAAO,MAAM,UAAU,GACrB,YAAY,MAAM,EAClB,YAAW,MAA2B,KACrC,MAAM,CAAC,MAAM,CACd;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACpD,SAAS,EACT,mBAAmB,CAAC,mBAAmB,CAsCtC,CAAC;AAEJ,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,WAA0C,CAAC"}
+{"version":3,"file":"exec.d.ts","sourceRoot":"","sources":["../../src/shared/exec.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,MAAM,EAAE,MAAM,EAAU,MAAM,QAAQ,CAAC;;;;;;;AAIhD,qBAAa,SAAU,SAAQ,cAK7B;CAAG;AAEL,eAAO,MAAM,oBAAoB,GAAI,SAAS,mBAAmB,CAAC,kBAAkB;;;;uDAUhF,CAAC;AAEL,eAAO,MAAM,UAAU,GACrB,YAAY,MAAM,EAClB,OAAM,SAAS,MAAM,EAAO,EAC5B,YAAW,MAA2B,KACrC,MAAM,CAAC,MAAM,CACd;IAAE,MAAM,EAAE,MAAM,CAAC;IAAC,MAAM,EAAE,MAAM,CAAC;IAAC,QAAQ,EAAE,MAAM,CAAA;CAAE,EACpD,SAAS,EACT,mBAAmB,CAAC,mBAAmB,CAyCxC,CAAC;AAEF,eAAO,MAAM,aAAa,GAAI,OAAO,MAAM,WAA0C,CAAC;AAEtF;;;;GAIG;AACH,eAAO,MAAM,mBAAmB,GAAI,aAAa,MAAM,KAAG,MAAM,EAwC/D,CAAC;AAEF,eAAO,MAAM,iBAAiB,GAAI,MAAM,SAAS,MAAM,EAAE,KAAG,MACmC,CAAC"}

package/dist/shared/index.d.ts

@@ -1,11 +1,11 @@
 export type { BaseResult, CommandOptions, CommandResult, Environment, OutputFormat, ToolResult, } from "./types";
 export { formatAny, formatOption, formatOutput, logFormatted } from "./format";
-export { expandPath, runCommand, runShellCommand } from "./bun";
+export { expandPath, runCommand } from "./bun";
 export { commonArgOptions, parseCommonArgs } from "./cli";
 export { renderCauseToStderr } from "./error-renderer";
 export { dumpCommandSchema, makeSchemaCommand, type CommandSchema } from "./schema-dump";
 export declare const VERSION: string;
-export { execEffect, type ExecError } from "./exec";
+export { execEffect, renderCommandLine, tokenizeCommandLine, type ExecError } from "./exec";
 export { createThrottle, type ThrottleError } from "./throttle";
 export { aggregateByField, deduplicateLines, formatCountSummary, parseTextTable, stripEmptyColumns, truncateRows, } from "./transform";
 export { transformLogOutput } from "./log-transform";

package/dist/shared/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/shared/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,cAAc,EACd,aAAa,EACb,WAAW,EACX,YAAY,EACZ,UAAU,GACX,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE/E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAEhE,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAIzF,eAAO,MAAM,OAAO,QAAc,CAAC;AAEnC,OAAO,EAAE,UAAU,EAAE,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AAEpD,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/shared/index.ts"],"names":[],"mappings":"AAAA,YAAY,EACV,UAAU,EACV,cAAc,EACd,aAAa,EACb,WAAW,EACX,YAAY,EACZ,UAAU,GACX,MAAM,SAAS,CAAC;AAEjB,OAAO,EAAE,SAAS,EAAE,YAAY,EAAE,YAAY,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAE/E,OAAO,EAAE,UAAU,EAAE,UAAU,EAAE,MAAM,OAAO,CAAC;AAE/C,OAAO,EAAE,gBAAgB,EAAE,eAAe,EAAE,MAAM,OAAO,CAAC;AAE1D,OAAO,EAAE,mBAAmB,EAAE,MAAM,kBAAkB,CAAC;AAEvD,OAAO,EAAE,iBAAiB,EAAE,iBAAiB,EAAE,KAAK,aAAa,EAAE,MAAM,eAAe,CAAC;AAIzF,eAAO,MAAM,OAAO,QAAc,CAAC;AAEnC,OAAO,EAAE,UAAU,EAAE,iBAAiB,EAAE,mBAAmB,EAAE,KAAK,SAAS,EAAE,MAAM,QAAQ,CAAC;AAE5F,OAAO,EAAE,cAAc,EAAE,KAAK,aAAa,EAAE,MAAM,YAAY,CAAC;AAEhE,OAAO,EACL,gBAAgB,EAChB,gBAAgB,EAChB,kBAAkB,EAClB,cAAc,EACd,iBAAiB,EACjB,YAAY,GACb,MAAM,aAAa,CAAC;AAErB,OAAO,EAAE,kBAAkB,EAAE,MAAM,iBAAiB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "0.17.0",
+  "version": "0.17.2",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/schemas/agent-tools.schema.json

@@ -209,6 +209,14 @@
           "description": "Name of the environment variable holding the database password.",
           "type": "string"
         },
+        "hostEnvVar": {
+          "description": "Name of an environment variable that overrides host when it is set. Unset or empty keeps the literal host.",
+          "type": "string"
+        },
+        "portEnvVar": {
+          "description": "Name of an environment variable that overrides port when it is set. Unset or empty keeps the literal port; a value that is not an integer between 1 and 65535 is an error, never a silent fallback.",
+          "type": "string"
+        },
         "prerequisites": {
           "description": "Ordered prerequisite references for this database environment. Declaring this or vpn overrides profile-level database prerequisites; an empty array explicitly disables inherited prerequisites.",
           "type": "array",

package/src/az-tool/service.ts

@@ -9,6 +9,7 @@ import { AzSecurityError, AzCommandError, AzTimeoutError, AzParseError } from ".
 import { isCommandAllowed, isInvokeAllowed } from "./security";
 import { transformCmdOutput } from "./transformers";
 import { ConfigService, getToolConfig } from "#config";
+import { renderCommandLine, tokenizeCommandLine } from "#shared/exec";
 
 export class AzService extends Context.Service<
   AzService,
@@ -43,10 +44,10 @@ export class AzService extends Context.Service<
 
       const executor = yield* ChildProcessSpawner.ChildProcessSpawner;
 
-      const runShellCommand = (fullCommand: string, timeoutMs: number) =>
+      const runAzCommand = (argv: readonly string[], timeoutMs: number) =>
         Effect.scoped(
           Effect.gen(function* () {
-            const command = ChildProcess.make("sh", ["-c", fullCommand], {
+            const command = ChildProcess.make("az", argv, {
               stdout: "pipe",
               stderr: "pipe",
             });
@@ -68,7 +69,7 @@ export class AzService extends Context.Service<
             (platformError) =>
               new AzCommandError({
                 message: `Command execution failed: ${platformError.message}`,
-                command: fullCommand,
+                command: renderCommandLine(["az", ...argv]),
                 exitCode: -1,
                 hint: "Check that the az CLI is installed and authenticated",
                 nextCommand: "az login",
@@ -112,17 +113,22 @@ export class AzService extends Context.Service<
           firstWord as (typeof STANDALONE_AZ_COMMANDS)[number],
         );
 
-        let fullCommand: string;
+        const cmdArgv = tokenizeCommandLine(cmd);
+        const scopeArgv = [
+          "--organization",
+          azConfig.organization,
+          "--project",
+          projectName,
+        ] as const;
 
-        if (isStandaloneCommand) {
-          fullCommand = `az ${cmd}`;
-        } else if (isDirectCommand) {
-          fullCommand = `az ${cmd} --organization "${azConfig.organization}" --project "${projectName}"`;
-        } else {
-          fullCommand = `az devops ${cmd} --organization "${azConfig.organization}" --project "${projectName}"`;
-        }
+        const argv = isStandaloneCommand
+          ? cmdArgv
+          : isDirectCommand
+            ? [...cmdArgv, ...scopeArgv]
+            : ["devops", ...cmdArgv, ...scopeArgv];
 
-        const resultOption = yield* runShellCommand(fullCommand, azConfig.timeoutMs ?? 60000);
+        const fullCommand = renderCommandLine(["az", ...argv]);
+        const resultOption = yield* runAzCommand(argv, azConfig.timeoutMs ?? 60000);
 
         if (Option.isNone(resultOption)) {
           return yield* new AzTimeoutError({
@@ -165,7 +171,7 @@ export class AzService extends Context.Service<
           });
         }
 
-        let fullCommand = `az devops invoke --area ${params.area} --resource ${params.resource}`;
+        const argv = ["devops", "invoke", "--area", params.area, "--resource", params.resource];
 
         const projectName = resolveProject(params.project);
 
@@ -175,22 +181,23 @@ export class AzService extends Context.Service<
         };
 
         if (Object.keys(routeParameters).length > 0) {
-          const routeParams = Object.entries(routeParameters)
-            .map(([k, v]) => `${k}=${v}`)
-            .join(" ");
-          fullCommand += ` --route-parameters ${routeParams}`;
+          argv.push(
+            "--route-parameters",
+            ...Object.entries(routeParameters).map(([k, v]) => `${k}=${v}`),
+          );
         }
 
         if (params.queryParameters) {
-          const queryParams = Object.entries(params.queryParameters)
-            .map(([k, v]) => `${k}=${v}`)
-            .join(" ");
-          fullCommand += ` --query-parameters ${queryParams}`;
+          argv.push(
+            "--query-parameters",
+            ...Object.entries(params.queryParameters).map(([k, v]) => `${k}=${v}`),
+          );
         }
 
-        fullCommand += ` --organization "${azConfig.organization}" --output json`;
+        argv.push("--organization", azConfig.organization, "--output", "json");
 
-        const resultOption = yield* runShellCommand(fullCommand, azConfig.timeoutMs ?? 60000);
+        const fullCommand = renderCommandLine(["az", ...argv]);
+        const resultOption = yield* runAzCommand(argv, azConfig.timeoutMs ?? 60000);
 
         if (Option.isNone(resultOption)) {
           return yield* new AzTimeoutError({

package/src/config/loader.ts

@@ -105,6 +105,8 @@ const DbEnvConfigSchema = Schema.Struct({
   database: Schema.String,
   password: Schema.optionalKey(Schema.String),
   passwordEnvVar: Schema.optionalKey(Schema.String),
+  hostEnvVar: Schema.optionalKey(Schema.String),
+  portEnvVar: Schema.optionalKey(Schema.String),
   prerequisites: Schema.optionalKey(PrerequisitesSchema),
   vpn: Schema.optionalKey(Schema.String),
 });

package/src/config/types.ts

@@ -91,6 +91,23 @@ export type DbEnvConfig = ProfilePrerequisites & {
   password?: string;
   /** Name of environment variable holding the password, e.g. "DB_TEST_PWD" */
   passwordEnvVar?: string;
+  /**
+   * Name of an environment variable that overrides `host`, e.g. "APP_POSTGRES_HOST".
+   *
+   * Override with fallback, deliberately unlike `passwordEnvVar`: an unset or empty variable is
+   * not an error, it keeps the literal `host` above. The variable usually exists only in a
+   * per-worktree environment, and the main checkout must keep working from the literal.
+   */
+  hostEnvVar?: string;
+  /**
+   * Name of an environment variable that overrides `port`, e.g. "APP_POSTGRES_PORT".
+   *
+   * Same override-with-fallback rule as `hostEnvVar`: unset or empty keeps the literal `port`,
+   * because only a worktree environment publishes its own port. A variable that *is* set but is
+   * not an integer in 1..65535 fails instead of falling back — a silent fallback would query the
+   * wrong database while the caller believes the override applied.
+   */
+  portEnvVar?: string;
 };
 
 /** SQL mutation operation that can be explicitly allowed for a database environment. */

package/src/db-tool/service.ts

@@ -38,6 +38,75 @@ import { transformQueryResult } from "./transformers";
 
 const LOCALHOST_HOSTS = new Set(["localhost", "127.0.0.1"]);
 
+const MIN_TCP_PORT = 1;
+const MAX_TCP_PORT = 65535;
+const INTEGER_ONLY = /^\d+$/;
+
+// Bun.env is the primary source: it carries the values Bun loads from a .env file, which is where
+// a per-worktree host/port lives. It aliases process.env, which is also the only one that exists
+// when this module runs outside Bun (the vitest runner).
+const readProcessEnv = (envVar: string): string | undefined =>
+  (typeof Bun === "undefined" ? process.env : Bun.env)[envVar];
+
+export type ResolvedPortOverride =
+  | { readonly ok: true; readonly port: number }
+  | { readonly ok: false; readonly message: string };
+
+/**
+ * Applies a `portEnvVar` override to the literal `port` of a database environment.
+ *
+ * Override with fallback: no variable name, or a variable that is unset or blank, keeps
+ * `literalPort`, because the variable exists only in environments that publish their own port
+ * (a per-repository worktree) while the main checkout runs from the literal. A variable that is
+ * set but does not hold an integer in 1..65535 fails instead of falling back, since falling back
+ * would silently query the main checkout's database while the caller believes the override applied.
+ */
+export function resolvePortOverride(
+  env: string,
+  literalPort: number,
+  portEnvVar: string | undefined,
+  value: string | undefined,
+): ResolvedPortOverride {
+  if (!portEnvVar) {
+    return { ok: true, port: literalPort };
+  }
+
+  const trimmed = value?.trim() ?? "";
+  if (trimmed === "") {
+    return { ok: true, port: literalPort };
+  }
+
+  const parsed = Number(trimmed);
+  if (!INTEGER_ONLY.test(trimmed) || parsed < MIN_TCP_PORT || parsed > MAX_TCP_PORT) {
+    return {
+      ok: false,
+      message:
+        `Environment variable ${portEnvVar} (override for the 'port' config field) is set to ` +
+        `"${value}" in environment ${env}, which is not an integer port between ${MIN_TCP_PORT} and ${MAX_TCP_PORT}.`,
+    };
+  }
+
+  return { ok: true, port: parsed };
+}
+
+/**
+ * Applies a `hostEnvVar` override to the literal `host` of a database environment.
+ * Unset or blank keeps `literalHost`; every non-blank value is a usable host, so there is no
+ * failure case here, unlike {@link resolvePortOverride}.
+ */
+export function resolveHostOverride(
+  literalHost: string,
+  hostEnvVar: string | undefined,
+  value: string | undefined,
+): string {
+  if (!hostEnvVar) {
+    return literalHost;
+  }
+
+  const trimmed = value?.trim() ?? "";
+  return trimmed === "" ? literalHost : trimmed;
+}
+
 export function resolveDbAccessMode(
   env: string,
   host: string,
@@ -204,15 +273,56 @@ export class DbService extends Context.Service<
           });
         });
 
+        const lookupEnvOverride = (envVar: string, zshrcEnv: Record<string, string>) =>
+          readProcessEnv(envVar) ?? zshrcEnv[envVar];
+
         const resolveDbConfig = Effect.fn("DbService.resolveDbConfig")(function* (
           config: DbConfig,
           env: string,
         ) {
           const needsEnvResolution =
-            envTemplateRegex.test(config.user) || envTemplateRegex.test(config.database);
+            envTemplateRegex.test(config.user) ||
+            envTemplateRegex.test(config.database) ||
+            config.hostEnvVar !== undefined ||
+            config.portEnvVar !== undefined;
           const zshrcEnv = needsEnvResolution ? yield* loadEnvFromZshrc() : {};
+
+          const host = resolveHostOverride(
+            config.host,
+            config.hostEnvVar,
+            config.hostEnvVar ? lookupEnvOverride(config.hostEnvVar, zshrcEnv) : undefined,
+          );
+          const portOverride = resolvePortOverride(
+            env,
+            config.port,
+            config.portEnvVar,
+            config.portEnvVar ? lookupEnvOverride(config.portEnvVar, zshrcEnv) : undefined,
+          );
+
+          if (!portOverride.ok) {
+            return yield* new DbConnectionError({
+              message: portOverride.message,
+              environment: env,
+            });
+          }
+
+          // A host override can flip the tunnel decision (a forwarded localhost port vs a directly
+          // reachable host), so re-derive the access mode whenever the override changed the host.
+          const needsTunnel =
+            host === config.host
+              ? config.needsTunnel
+              : resolveDbAccessMode(
+                  env,
+                  host,
+                  dbConfig.kubectl !== undefined,
+                  config.allowedMutations,
+                ).needsTunnel;
+
           return {
             ...config,
+            host,
+            port: portOverride.port,
+            needsTunnel,
             user: yield* resolveConfigString(config.user, env, "user", zshrcEnv),
             database: yield* resolveConfigString(config.database, env, "database", zshrcEnv),
           };
@@ -646,6 +756,8 @@ export class DbService extends Context.Service<
             database: envConfig.database,
             password: envConfig.password,
             passwordEnvVar: envConfig.passwordEnvVar,
+            hostEnvVar: envConfig.hostEnvVar,
+            portEnvVar: envConfig.portEnvVar,
             ...resolveEnvironmentScopedPrerequisites(dbConfig, envConfig),
             port: envConfig.port,
             needsTunnel: accessMode.needsTunnel,

package/src/db-tool/types.ts

@@ -16,6 +16,8 @@ export type DbConfig = ProfilePrerequisites & {
   database: string;
   password?: string;
   passwordEnvVar?: string;
+  hostEnvVar?: string;
+  portEnvVar?: string;
   port: number;
   needsTunnel: boolean;
   allowMutations: boolean;

package/src/k8s-tool/context.ts

@@ -0,0 +1,73 @@
+/** Kept free of I/O so the caller spawns kubectl itself instead of piping through sh, jq and head. */
+
+type KubeContextEntry = {
+  readonly name?: unknown;
+  readonly context?: { readonly cluster?: unknown };
+};
+
+type KubeClusterEntry = {
+  readonly name?: unknown;
+  readonly cluster?: { readonly server?: unknown };
+};
+
+type KubeConfigView = {
+  readonly contexts?: readonly KubeContextEntry[];
+  readonly clusters?: readonly KubeClusterEntry[];
+};
+
+const asString = (value: unknown): string | undefined =>
+  typeof value === "string" && value !== "" ? value : undefined;
+
+export const parseKubeConfigView = (stdout: string): KubeConfigView | undefined => {
+  try {
+    const parsed: unknown = JSON.parse(stdout);
+    return typeof parsed === "object" && parsed !== null ? (parsed as KubeConfigView) : undefined;
+  } catch {
+    return undefined;
+  }
+};
+
+/**
+ * Two strategies, in the same order the previous jq pipelines used:
+ * an exact context.cluster match first, then a cluster whose server URL contains the id.
+ * Returns the first match so a multi-context kubeconfig resolves the same way it did before.
+ */
+export const selectKubeContext = (
+  view: KubeConfigView | undefined,
+  clusterId: string,
+): string | undefined => {
+  if (!view) {
+    return undefined;
+  }
+
+  const contexts = view.contexts ?? [];
+
+  for (const entry of contexts) {
+    const name = asString(entry.name);
+    if (name !== undefined && asString(entry.context?.cluster) === clusterId) {
+      return name;
+    }
+  }
+
+  const clusters = view.clusters ?? [];
+
+  for (const entry of contexts) {
+    const name = asString(entry.name);
+    const clusterName = asString(entry.context?.cluster);
+    if (name === undefined || clusterName === undefined) {
+      continue;
+    }
+
+    const matchesServer = clusters.some(
+      (cluster) =>
+        asString(cluster.name) === clusterName &&
+        (asString(cluster.cluster?.server) ?? "").includes(clusterId),
+    );
+
+    if (matchesServer) {
+      return name;
+    }
+  }
+
+  return undefined;
+};

package/src/k8s-tool/service.ts

@@ -1,7 +1,7 @@
 import { posix } from "node:path";
 
 import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
-import { Context, Effect, Layer, Option, Ref, Stream } from "effect";
+import { Context, Effect, Layer, Option, Ref } from "effect";
 
 import type { CommandResult, Environment } from "./types";
 
@@ -21,6 +21,7 @@ import { normalizeProfilePrerequisites } from "#shared/prerequisites/config";
 import { runWithProfilePrerequisites } from "#shared/prerequisites/runtime";
 import { buildApiProbeArgs } from "#shared/k8s-probe";
 import { isKubectlCommandAllowed, isSafeLogPath } from "./security";
+import { parseKubeConfigView, selectKubeContext } from "./context";
 
 export class K8sService extends Context.Service<
   K8sService,
@@ -98,41 +99,31 @@ export class K8sService extends Context.Service<
           );
         });
 
-        const withKubeconfig = (command: string, kubeconfig: string | undefined) =>
-          kubeconfig ? `KUBECONFIG=${quoteShellArg(kubeconfig)} ${command}` : command;
         const renderArg = (arg: string) =>
           /^[A-Za-z0-9_./:=,@+-]+$/.test(arg) ? arg : quoteShellArg(arg);
-        const renderKubectlCommand = (context: string, argv: readonly string[]) =>
-          ["kubectl", "--context", context, ...argv].map(renderArg).join(" ");
+        const renderKubectlCommand = (context: string | undefined, argv: readonly string[]) =>
+          ["kubectl", ...(context ? ["--context", context] : []), ...argv].map(renderArg).join(" ");
 
         // Cache context by selected profile/cluster instead of a single default profile.
         const contextRef = yield* Ref.make<Record<string, string>>({});
 
         // Helper that uses executor.spawn() to avoid ChildProcessSpawner requirement in return type
-        const runShellCommand = (commandStr: string, timeoutMs: number) =>
+        const runKubectlCapture = (
+          argv: readonly string[],
+          kubeconfig: string | undefined,
+          timeoutMs: number,
+          renderedCommand: string,
+        ) =>
           Effect.scoped(
             Effect.gen(function* () {
-              const command = ChildProcess.make("sh", ["-c", commandStr], {
+              const command = ChildProcess.make("kubectl", argv, {
                 stdout: "pipe",
                 stderr: "pipe",
+                ...(kubeconfig ? { env: { KUBECONFIG: kubeconfig }, extendEnv: true } : {}),
               });
               const process = yield* executor.spawn(command);
 
-              const stdoutChunk = yield* process.stdout.pipe(
-                Stream.decodeText(),
-                Stream.runCollect,
-              );
-              const stdout = stdoutChunk.join("");
-
-              const stderrChunk = yield* process.stderr.pipe(
-                Stream.decodeText(),
-                Stream.runCollect,
-              );
-              const stderr = stderrChunk.join("");
-
-              const exitCode = yield* process.exitCode;
-
-              return { stdout, stderr, exitCode };
+              return yield* collectProcessOutput(process);
             }),
           ).pipe(
             Effect.timeoutOption(timeoutMs),
@@ -140,7 +131,7 @@ export class K8sService extends Context.Service<
               const missing = missingBinaryFromSpawnFailure("kubectl", String(platformError));
               return new K8sCommandError({
                 message: `Command execution failed: ${String(platformError)}`,
-                command: commandStr,
+                command: renderedCommand,
                 exitCode: -1,
                 stderr: String(platformError),
                 ...(missing ? { hint: missing.hint } : {}),
@@ -214,56 +205,37 @@ export class K8sService extends Context.Service<
             return { context: cachedContext, kubeconfig };
           }
 
-          const jqCommand = withKubeconfig(
-            `kubectl config view -o json | jq -r '.contexts[] | select(.context.cluster == "${k8sConfig.clusterId}") | .name' | head -1`,
+          const viewCommand = renderKubectlCommand(undefined, ["config", "view", "-o", "json"]);
+          const viewResultOption = yield* runKubectlCapture(
+            ["config", "view", "-o", "json"],
             kubeconfig,
+            timeoutMs,
+            viewCommand,
           );
 
-          const contextResultOption = yield* runShellCommand(jqCommand, timeoutMs);
-
-          if (Option.isNone(contextResultOption)) {
+          if (Option.isNone(viewResultOption)) {
             return yield* new K8sTimeoutError({
               message: `Context resolution timed out after ${timeoutMs}ms`,
-              command: jqCommand,
+              command: viewCommand,
               timeoutMs,
             });
           }
 
-          const contextResult = contextResultOption.value;
-
-          if (contextResult.exitCode === 0 && contextResult.stdout.trim()) {
-            const resolvedContextValue = contextResult.stdout.trim();
-            yield* Ref.update(contextRef, (contexts) => ({
-              ...contexts,
-              [cacheKey]: resolvedContextValue,
-            }));
-            return { context: resolvedContextValue, kubeconfig };
-          }
-
-          const fallbackCommand = withKubeconfig(
-            `kubectl config view -o json | jq -r '.contexts[] as $ctx | .clusters[] | select(.name == $ctx.context.cluster and (.cluster.server | contains("${k8sConfig.clusterId}"))) | $ctx.name' | head -1`,
-            kubeconfig,
-          );
+          const viewResult = viewResultOption.value;
 
-          const fallbackResultOption = yield* runShellCommand(fallbackCommand, timeoutMs);
-
-          if (Option.isNone(fallbackResultOption)) {
-            return yield* new K8sTimeoutError({
-              message: `Context resolution timed out after ${timeoutMs}ms`,
-              command: fallbackCommand,
-              timeoutMs,
-            });
-          }
-
-          const fallbackResult = fallbackResultOption.value;
+          if (viewResult.exitCode === 0) {
+            const resolvedContextValue = selectKubeContext(
+              parseKubeConfigView(viewResult.stdout),
+              k8sConfig.clusterId,
+            );
 
-          if (fallbackResult.exitCode === 0 && fallbackResult.stdout.trim()) {
-            const resolvedContextValue = fallbackResult.stdout.trim();
-            yield* Ref.update(contextRef, (contexts) => ({
-              ...contexts,
-              [cacheKey]: resolvedContextValue,
-            }));
-            return { context: resolvedContextValue, kubeconfig };
+            if (resolvedContextValue !== undefined) {
+              yield* Ref.update(contextRef, (contexts) => ({
+                ...contexts,
+                [cacheKey]: resolvedContextValue,
+              }));
+              return { context: resolvedContextValue, kubeconfig };
+            }
           }
 
           return yield* new K8sContextError({

package/src/logs-tool/service.ts

@@ -1,6 +1,6 @@
-import { isAbsolute, posix, relative, resolve } from "node:path";
+import { readFile, readdir, realpath, stat } from "node:fs/promises";
+import { isAbsolute, join, posix, relative, resolve } from "node:path";
 
-import { ChildProcess, ChildProcessSpawner } from "effect/unstable/process";
 import { Context, Effect, Layer, Result } from "effect";
 
 import type { Environment, LogFile, ReadOptions } from "./types";
@@ -9,7 +9,6 @@ import { K8sService, K8sServiceLayer } from "#k8s/service";
 import { ConfigService, ConfigServiceLayer, getToolConfig } from "#config/loader";
 import type { LogsConfig } from "#config/types";
 import { LogsNotFoundError, LogsReadError, type LogsError } from "./errors";
-import { collectProcessOutput } from "#shared/exec";
 import { transformLogOutput } from "./transformers";
 
 export const parseLogFiles = (output: string): LogFile[] => {
@@ -41,11 +40,36 @@ export const formatPrettyOutput = (output: string): string => {
     .join("\n---\n");
 };
 
-/**
- * Sanitize a string for safe use in shell commands by escaping single quotes
- * and wrapping in single quotes. This prevents shell injection.
- */
-export const sanitizeShellArg = (input: string): string => `'${input.replace(/'/g, "'\\''")}'`;
+const errorText = (error: unknown): string =>
+  error instanceof Error ? error.message : String(error);
+
+const takeLastLines = (contents: string, lines: number): string => {
+  const all = contents.split("\n");
+  const withoutTrailingBlank = all.at(-1) === "" ? all.slice(0, -1) : all;
+  return withoutTrailingBlank.slice(-lines).join("\n");
+};
+
+/** Newest first, so callers can take the head as the latest log the way `ls -t` did. */
+const readLocalLogDirectory = async (localDir: string): Promise<LogFile[]> => {
+  const entries = await readdir(localDir, { withFileTypes: true });
+  const logs = entries.filter((entry) => !entry.isDirectory() && entry.name.endsWith(".log"));
+
+  const described = await Promise.all(
+    logs.map(async (entry) => {
+      const stats = await stat(join(localDir, entry.name));
+      return {
+        name: entry.name,
+        size: String(stats.size),
+        date: stats.mtime.toISOString(),
+        modifiedAtMs: stats.mtimeMs,
+      };
+    }),
+  );
+
+  return described
+    .toSorted((left, right) => right.modifiedAtMs - left.modifiedAtMs)
+    .map(({ name, size, date }) => ({ name, size, date }));
+};
 
 const readCommandOutput = (output: unknown): string => (typeof output === "string" ? output : "");
 const filterLogLines = (output: string, grep: string | undefined): string => {
@@ -91,45 +115,8 @@ export class LogsService extends Context.Service<
     LogsService,
     Effect.gen(function* () {
       const k8s = yield* K8sService;
-      const executor = yield* ChildProcessSpawner.ChildProcessSpawner;
       const config = yield* ConfigService;
 
-      const runShellCommand = (commandStr: string) =>
-        Effect.scoped(
-          Effect.gen(function* () {
-            const command = ChildProcess.make("sh", ["-c", commandStr], {
-              stdout: "pipe",
-              stderr: "pipe",
-            });
-            const process = yield* executor.spawn(command);
-            return yield* collectProcessOutput(process);
-          }),
-        ).pipe(
-          Effect.catch((platformError) =>
-            Effect.succeed({
-              stdout: "",
-              stderr: String(platformError),
-              exitCode: -1,
-            }),
-          ),
-        );
-
-      const runDirectCommand = (executable: string, args: readonly string[]) =>
-        Effect.scoped(
-          Effect.gen(function* () {
-            const command = ChildProcess.make(executable, args, {
-              stdout: "pipe",
-              stderr: "pipe",
-            });
-            const process = yield* executor.spawn(command);
-            return yield* collectProcessOutput(process);
-          }),
-        ).pipe(
-          Effect.catch((platformError) =>
-            Effect.succeed({ stdout: "", stderr: String(platformError), exitCode: -1 }),
-          ),
-        );
-
       const getLogsConfig = (profile?: string): LogsConfig | undefined =>
         getToolConfig<LogsConfig>(config, "logs", profile);
 
@@ -137,16 +124,16 @@ export class LogsService extends Context.Service<
         logsConfig: LogsConfig,
       ) {
         const localDir = logsConfig.localDir;
-        const result = yield* runShellCommand(`ls -la ${localDir}`);
-
-        if (result.exitCode !== 0) {
-          return yield* new LogsReadError({
-            message: result.stderr.trim() || "Failed to list local logs",
-            source: localDir,
-          });
-        }
+        const files = yield* Effect.tryPromise(() => readLocalLogDirectory(localDir)).pipe(
+          Effect.mapError(
+            (error) =>
+              new LogsReadError({
+                message: errorText(error) || "Failed to list local logs",
+                source: localDir,
+              }),
+          ),
+        );
 
-        const files = parseLogFiles(result.stdout);
         if (files.length === 0) {
           return yield* new LogsNotFoundError({
             message: "No log files found",
@@ -213,24 +200,25 @@ export class LogsService extends Context.Service<
         let logFile = options.file;
 
         if (!logFile) {
-          const latest = yield* runShellCommand(`ls -t ${localDir}/*.log 2>/dev/null | head -1`);
-
-          if (latest.exitCode !== 0) {
-            return yield* new LogsReadError({
-              message: latest.stderr.trim() || "Failed to find latest log",
-              source: localDir,
-            });
-          }
+          const files = yield* Effect.tryPromise(() => readLocalLogDirectory(localDir)).pipe(
+            Effect.mapError(
+              (error) =>
+                new LogsReadError({
+                  message: errorText(error) || "Failed to find latest log",
+                  source: localDir,
+                }),
+            ),
+          );
 
-          const latestPath = latest.stdout.trim();
-          if (!latestPath) {
+          const latest = files[0];
+          if (!latest) {
             return yield* new LogsNotFoundError({
               message: "No log files found",
               path: localDir,
             });
           }
 
-          logFile = latestPath.split("/").pop() ?? latestPath;
+          logFile = latest.name;
         }
 
         const lexicalPath = resolveLocalLogPath(localDir, logFile);
@@ -240,20 +228,22 @@ export class LogsService extends Context.Service<
             source: localDir,
           });
         }
-        const realpathResult = yield* runDirectCommand("realpath", [localDir, lexicalPath]);
-        if (realpathResult.exitCode !== 0) {
-          return yield* new LogsReadError({
-            message:
-              realpathResult.stderr.trim() ||
-              `realpath failed with exit code ${realpathResult.exitCode}`,
-            source: lexicalPath,
-          });
-        }
-        const [canonicalBase, canonicalPath] = realpathResult.stdout.trim().split("\n");
+        const canonical = yield* Effect.tryPromise(async () => ({
+          base: await realpath(localDir),
+          path: await realpath(lexicalPath),
+        })).pipe(
+          Effect.mapError(
+            (error) =>
+              new LogsReadError({
+                message: errorText(error) || "Failed to canonicalize the log path",
+                source: lexicalPath,
+              }),
+          ),
+        );
+
+        const canonicalPath = canonical.path;
         if (
-          canonicalBase === undefined ||
-          canonicalPath === undefined ||
-          resolveLocalLogPath(canonicalBase, canonicalPath) !== canonicalPath ||
+          resolveLocalLogPath(canonical.base, canonicalPath) !== canonicalPath ||
           !canonicalPath.endsWith(".log")
         ) {
           return yield* new LogsReadError({
@@ -261,17 +251,18 @@ export class LogsService extends Context.Service<
             source: localDir,
           });
         }
-        const command = `tail -${options.tail} ${sanitizeShellArg(canonicalPath)}`;
-        const result = yield* runShellCommand(command);
 
-        if (result.exitCode !== 0) {
-          return yield* new LogsReadError({
-            message: result.stderr.trim() || `Command failed with exit code ${result.exitCode}`,
-            source: canonicalPath,
-          });
-        }
+        const contents = yield* Effect.tryPromise(() => readFile(canonicalPath, "utf8")).pipe(
+          Effect.mapError(
+            (error) =>
+              new LogsReadError({
+                message: errorText(error) || "Failed to read the log file",
+                source: canonicalPath,
+              }),
+          ),
+        );
 
-        const output = filterLogLines(result.stdout, options.grep).trim();
+        const output = filterLogLines(takeLastLines(contents, options.tail), options.grep).trim();
         if (!output) {
           return "(no matching lines)";
         }

package/src/shared/bun.ts

@@ -50,10 +50,3 @@ export async function runCommand(
     executionTimeMs: Date.now() - startTime,
   };
 }
-
-export function runShellCommand(
-  command: string,
-  options: CommandOptions = {},
-): Promise<CommandResult> {
-  return runCommand(["sh", "-c", command], options);
-}

package/src/shared/exec.ts

@@ -23,18 +23,21 @@ export const collectProcessOutput = (process: ChildProcessSpawner.ChildProcessHa
   });
 
 export const execEffect = (
-  commandStr: string,
+  executable: string,
+  args: readonly string[] = [],
   timeoutMs: number = DEFAULT_TIMEOUT_MS,
 ): Effect.Effect<
   { stdout: string; stderr: string; exitCode: number },
   ExecError,
   ChildProcessSpawner.ChildProcessSpawner
-> =>
-  Effect.scoped(
+> => {
+  const commandStr = renderCommandLine([executable, ...args]);
+
+  return Effect.scoped(
     Effect.gen(function* () {
       const executor = yield* ChildProcessSpawner.ChildProcessSpawner;
 
-      const command = ChildProcess.make("sh", ["-c", commandStr], {
+      const command = ChildProcess.make(executable, args, {
         stdout: "pipe",
         stderr: "pipe",
       });
@@ -67,5 +70,56 @@ export const execEffect = (
       ),
     ),
   );
+};
 
 export const quoteShellArg = (value: string) => `'${value.replaceAll("'", "'\\''")}'`;
+
+/**
+ * Split a command line the way a POSIX shell would word-split it, without running one.
+ * Quotes group a value into a single argument and are removed; nothing else is interpreted,
+ * so a metacharacter reaches the child as literal text instead of shell syntax.
+ */
+export const tokenizeCommandLine = (commandLine: string): string[] => {
+  const tokens: string[] = [];
+  let current = "";
+  let started = false;
+  let quote: '"' | "'" | undefined;
+
+  for (const character of commandLine) {
+    if (quote) {
+      if (character === quote) {
+        quote = undefined;
+      } else {
+        current += character;
+      }
+      continue;
+    }
+
+    if (character === '"' || character === "'") {
+      quote = character;
+      started = true;
+      continue;
+    }
+
+    if (/\s/.test(character)) {
+      if (started) {
+        tokens.push(current);
+        current = "";
+        started = false;
+      }
+      continue;
+    }
+
+    current += character;
+    started = true;
+  }
+
+  if (started) {
+    tokens.push(current);
+  }
+
+  return tokens;
+};
+
+export const renderCommandLine = (argv: readonly string[]): string =>
+  argv.map((arg) => (/^[A-Za-z0-9_./:=,@+-]+$/.test(arg) ? arg : quoteShellArg(arg))).join(" ");

package/src/shared/index.ts

@@ -9,7 +9,7 @@ export type {
 
 export { formatAny, formatOption, formatOutput, logFormatted } from "./format";
 
-export { expandPath, runCommand, runShellCommand } from "./bun";
+export { expandPath, runCommand } from "./bun";
 
 export { commonArgOptions, parseCommonArgs } from "./cli";
 
@@ -21,7 +21,7 @@ export { dumpCommandSchema, makeSchemaCommand, type CommandSchema } from "./sche
 import pkg from "../../package.json" with { type: "json" };
 export const VERSION = pkg.version;
 
-export { execEffect, type ExecError } from "./exec";
+export { execEffect, renderCommandLine, tokenizeCommandLine, type ExecError } from "./exec";
 
 export { createThrottle, type ThrottleError } from "./throttle";