@blogic-cz/agent-tools 1.10.1 → 1.11.1

package/README.md

@@ -547,6 +547,8 @@ Each tool uses its own auth method — no unified token store:
 | `api-tool`           | Caller capability and proxy HTTPS origin in client configuration                             |
 | `api-proxy`          | Private operator store and policy under a separated service identity                         |
 
+Set `tokenEnvVar` and `passwordEnvVar` to names that match `^[A-Z_][A-Z0-9_]*$`.
+
 The REST proxy uses its separate private operator store described in [REST proxy setup](docs/rest-api-proxy.md). Other tool configs reference credential sources. Provider secrets are **never** stored in the caller client config file. The `db-tool` config references env var **names** only:
 
 ```json5
@@ -574,7 +576,8 @@ These are **overrides with fallback**, not requirements — the opposite of `pas
 - variable unset or empty → the literal `host` / `port` in the config is used, and no error is raised;
 - `portEnvVar` set to something that is not an integer between 1 and 65535 → the command **fails**. It never falls back to the literal, because that would query a different database while you believe the override applied.
 
-The variable is read from the process environment first (Bun loads `.env` files into it), then from `~/.zshrc` exports.
+The variable is read from the process environment first (Bun loads `.env` files into it), then from the interactive zsh environment.
+The zsh child receives only `PATH`, `HOME`, `USER`, `LOGNAME`, `SHELL`, `TERM`, `LANG`, `LC_ALL`, `TMPDIR`, `XDG_CONFIG_HOME`, and `ZDOTDIR`. If an rc file needs another parent process variable to select or load a value, that value will not resolve.
 
 The typical use is a repository where every git worktree runs its own database container on its own host port, published by that worktree's `.env`:
 

package/dist/db-tool/service.d.ts

@@ -2,6 +2,7 @@ import { ChildProcessSpawner } from "effect/process";
 import { Context, Effect, Layer } from "effect";
 import type { DbConfig, DbMutationOperation, QueryResult, SchemaMode } from "./types";
 import { ConfigService } from "#config";
+import { SecretEnvResolver } from "#shared/secret-env";
 import { DbConfigService } from "./config-service";
 import { DbSqlClient } from "./sql-client";
 import { type DbError } from "./errors";
@@ -36,6 +37,6 @@ declare const DbService_base: Context.ServiceClass<DbService, "@agent-tools/DbSe
     readonly executeSchemaQuery: (env: string, mode: SchemaMode, table?: string) => Effect.Effect<QueryResult, DbError>;
 }>;
 export declare class DbService extends DbService_base {
-    static readonly layer: Layer.Layer<DbService, never, ChildProcessSpawner.ChildProcessSpawner | ConfigService | DbConfigService | DbSqlClient>;
+    static readonly layer: Layer.Layer<DbService, never, ChildProcessSpawner.ChildProcessSpawner | ConfigService | DbConfigService | DbSqlClient | SecretEnvResolver>;
 }
 //# sourceMappingURL=service.d.ts.map

package/dist/db-tool/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/db-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAS,OAAO,EAAY,MAAM,EAAE,KAAK,EAAuB,MAAM,QAAQ,CAAC;AAEtF,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAQxC,OAAO,EAAE,eAAe,EAA4B,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,UAAU,CAAC;AA8BlB,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,oBAAoB,CAqBtB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAOR;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,OAAO,EACzB,gBAAgB,GAAE,SAAS,mBAAmB,EAAO,GACpD,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,MAAM,GAAG,aAAa,CAAC,CAUhF;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,wBAAwB,CAAC,GACvF,OAAO,CAMT;AAGD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;;2BAK3B,CACrB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;iCACX,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,EAChB,KAAK,CAAC,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;;AAZ5C,qBAAa,SAAU,SAAQ,cAcF;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,yHAgwBnB;CACH"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/db-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAS,OAAO,EAAY,MAAM,EAAE,KAAK,EAAkB,MAAM,QAAQ,CAAC;AAEjF,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAIxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAKvD,OAAO,EAAE,eAAe,EAA4B,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,UAAU,CAAC;AAwBlB,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,oBAAoB,CAqBtB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAOR;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,OAAO,EACzB,gBAAgB,GAAE,SAAS,mBAAmB,EAAO,GACpD,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,MAAM,GAAG,aAAa,CAAC,CAUhF;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,wBAAwB,CAAC,GACvF,OAAO,CAMT;AAGD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;;2BAK3B,CACrB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;iCACX,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,EAChB,KAAK,CAAC,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;;AAZ5C,qBAAa,SAAU,SAAQ,cAcF;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,6IAmvBnB;CACH"}

package/dist/db-tool/sql-client.d.ts

@@ -14,6 +14,7 @@ export type DbQueryOutcome = {
     readonly command: string;
 };
 export declare const toErrorMessage: (cause: unknown) => string;
+export declare const toDbQueryError: (cause: unknown, sql: string) => DbQueryError;
 declare const DbSqlClient_base: Context.ServiceClass<DbSqlClient, "@agent-tools/DbSqlClient", {
     readonly run: (connection: DbConnection, sql: string) => Effect.Effect<DbQueryOutcome, DbQueryError>;
 }>;

package/dist/db-tool/sql-client.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"sql-client.d.ts","sourceRoot":"","sources":["../../src/db-tool/sql-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAExC,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAIF,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,MACQ,CAAC;;kBAkDvC,CACZ,UAAU,EAAE,YAAY,EACxB,GAAG,EAAE,MAAM,KACR,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC;;AANpD,qBAAa,WAAY,SAAQ,gBAQF;IAC7B,MAAM,CAAC,QAAQ,CAAC,KAAK,yCAAsD;CAC5E"}
+{"version":3,"file":"sql-client.d.ts","sourceRoot":"","sources":["../../src/db-tool/sql-client.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAEhD,OAAO,EAAE,YAAY,EAAE,MAAM,UAAU,CAAC;AAGxC,MAAM,MAAM,YAAY,GAAG;IACzB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,QAAQ,EAAE,OAAO,CAAC;CAC5B,CAAC;AAEF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,EAAE,CAAC;IACzC,QAAQ,CAAC,QAAQ,EAAE,MAAM,CAAC;IAC1B,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAC;CAC1B,CAAC;AAIF,eAAO,MAAM,cAAc,UAAW,OAAO,KAAG,MACQ,CAAC;AAEzD,eAAO,MAAM,cAAc,UAAW,OAAO,OAAO,MAAM,KAAG,YAG5D,CAAC;;kBA+CgB,CACZ,UAAU,EAAE,YAAY,EACxB,GAAG,EAAE,MAAM,KACR,MAAM,CAAC,MAAM,CAAC,cAAc,EAAE,YAAY,CAAC;;AANpD,qBAAa,WAAY,SAAQ,gBAQF;IAC7B,MAAM,CAAC,QAAQ,CAAC,KAAK,yCAAsD;CAC5E"}

package/dist/observability-tool/logs.d.ts

@@ -18,5 +18,5 @@ export declare function extractLogsFromDsQuery(response: {
         };
     };
 }): LogLine[];
-export declare const logsCommand: Command.Command<"logs", {} | {}, {}, never, import("../config").ConfigService>;
+export declare const logsCommand: Command.Command<"logs", {} | {}, {}, never, import("../config").ConfigService | import("../shared/secret-env").SecretEnvResolver>;
 //# sourceMappingURL=logs.d.ts.map

package/dist/observability-tool/logs.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../src/observability-tool/logs.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,OAAO,EAAQ,MAAM,YAAY,CAAC;AAarD,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AA6C1D,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE;IAC/C,OAAO,EAAE;QACP,CAAC,EAAE;YACD,MAAM,CAAC,EAAE,KAAK,CAAC;gBACb,MAAM,EAAE;oBAAE,MAAM,EAAE,KAAK,CAAC;wBAAE,IAAI,EAAE,MAAM,CAAC;wBAAC,IAAI,CAAC,EAAE,MAAM,CAAC;wBAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;qBAAE,CAAC,CAAA;iBAAE,CAAC;gBAC5F,IAAI,EAAE;oBAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAA;iBAAE,CAAC;aAC/B,CAAC,CAAC;SACJ,CAAC;KACH,CAAC;CACH,GAAG,OAAO,EAAE,CAiCZ;AA4ED,eAAO,MAAM,WAAW,gFAGvB,CAAC"}
+{"version":3,"file":"logs.d.ts","sourceRoot":"","sources":["../../src/observability-tool/logs.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,OAAO,EAAQ,MAAM,YAAY,CAAC;AAarD,OAAO,KAAK,EAAE,OAAO,EAAqB,MAAM,SAAS,CAAC;AA6C1D,wBAAgB,sBAAsB,CAAC,QAAQ,EAAE;IAC/C,OAAO,EAAE;QACP,CAAC,EAAE;YACD,MAAM,CAAC,EAAE,KAAK,CAAC;gBACb,MAAM,EAAE;oBAAE,MAAM,EAAE,KAAK,CAAC;wBAAE,IAAI,EAAE,MAAM,CAAC;wBAAC,IAAI,CAAC,EAAE,MAAM,CAAC;wBAAC,MAAM,CAAC,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAA;qBAAE,CAAC,CAAA;iBAAE,CAAC;gBAC5F,IAAI,EAAE;oBAAE,MAAM,EAAE,OAAO,EAAE,EAAE,CAAA;iBAAE,CAAC;aAC/B,CAAC,CAAC;SACJ,CAAC;KACH,CAAC;CACH,GAAG,OAAO,EAAE,CAiCZ;AA4ED,eAAO,MAAM,WAAW,mIAGvB,CAAC"}

package/dist/observability-tool/metrics.d.ts

@@ -1,3 +1,3 @@
 import { Command } from "effect/cli";
-export declare const metricsCommand: Command.Command<"metrics", {} | {}, {}, never, import("../config").ConfigService>;
+export declare const metricsCommand: Command.Command<"metrics", {} | {}, {}, never, import("../config").ConfigService | import("../shared/secret-env").SecretEnvResolver>;
 //# sourceMappingURL=metrics.d.ts.map

package/dist/observability-tool/metrics.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/observability-tool/metrics.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,OAAO,EAAQ,MAAM,YAAY,CAAC;AA4HrD,eAAO,MAAM,cAAc,mFAG1B,CAAC"}
+{"version":3,"file":"metrics.d.ts","sourceRoot":"","sources":["../../src/observability-tool/metrics.ts"],"names":[],"mappings":"AACA,OAAO,EAAY,OAAO,EAAQ,MAAM,YAAY,CAAC;AA4HrD,eAAO,MAAM,cAAc,sIAG1B,CAAC"}

package/dist/observability-tool/shared.d.ts

@@ -2,6 +2,7 @@ import { Effect, Option } from "effect";
 import { Flag } from "effect/cli";
 import { ConfigService } from "#config";
 import { ObservabilityToolError } from "./errors";
+import { SecretEnvResolver } from "#shared/secret-env";
 import type { DsQueryOpts, DsQueryResponse, ObservabilityEnvConfig } from "./types";
 export declare function formatObservabilityError(error: unknown): string;
 export declare const envOption: Flag.Flag<string>;
@@ -11,7 +12,7 @@ export declare const profileOption: Flag.Flag<Option.Option<string>>;
  * building a request against an undefined datasource UID.
  */
 export declare function requireTempoUid(config: ObservabilityEnvConfig): Effect.Effect<string, ObservabilityToolError>;
-export declare const resolveConfig: (env: string, profile: Option.Option<string>) => Effect.Effect<ObservabilityEnvConfig, ObservabilityToolError, ConfigService>;
+export declare const resolveConfig: (env: string, profile: Option.Option<string>) => Effect.Effect<ObservabilityEnvConfig, ObservabilityToolError, ConfigService | SecretEnvResolver>;
 export declare function buildHeaders(token?: string): Headers;
 export declare function observabilityFetch<T>(config: ObservabilityEnvConfig, path: string, init?: RequestInit): Effect.Effect<T, ObservabilityToolError>;
 export declare function observabilityDsQuery(config: ObservabilityEnvConfig, datasourceUid: string, datasourceType: "prometheus" | "loki", expr: string, options?: DsQueryOpts): Effect.Effect<DsQueryResponse, ObservabilityToolError>;

package/dist/observability-tool/shared.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/observability-tool/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC,OAAO,EAAE,aAAa,EAAiB,MAAM,SAAS,CAAC;AAGvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAElD,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAEf,sBAAsB,EACvB,MAAM,SAAS,CAAC;AAOjB,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAe/D;AAED,eAAO,MAAM,SAAS,mBAGrB,CAAC;AAEF,eAAO,MAAM,aAAa,kCAMzB,CAAC;AAmCF;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,sBAAsB,GAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAU/C;AAyDD,eAAO,MAAM,aAAa,QAAS,MAAM,WAAW,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,iFA4BrE,CAAC;AAEL,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAWpD;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,MAAM,EAAE,sBAAsB,EAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,WAAW,GACjB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAgE1C;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,sBAAsB,EAC9B,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,YAAY,GAAG,MAAM,EACrC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,WAAW,GACpB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAkCxD"}
+{"version":3,"file":"shared.d.ts","sourceRoot":"","sources":["../../src/observability-tool/shared.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AACxC,OAAO,EAAE,IAAI,EAAE,MAAM,YAAY,CAAC;AAElC,OAAO,EAAE,aAAa,EAAiB,MAAM,SAAS,CAAC;AAGvD,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAElD,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AACvD,OAAO,KAAK,EACV,WAAW,EACX,eAAe,EAEf,sBAAsB,EACvB,MAAM,SAAS,CAAC;AAOjB,wBAAgB,wBAAwB,CAAC,KAAK,EAAE,OAAO,GAAG,MAAM,CAe/D;AAED,eAAO,MAAM,SAAS,mBAGrB,CAAC;AAEF,eAAO,MAAM,aAAa,kCAMzB,CAAC;AAkCF;;;GAGG;AACH,wBAAgB,eAAe,CAC7B,MAAM,EAAE,sBAAsB,GAC7B,MAAM,CAAC,MAAM,CAAC,MAAM,EAAE,sBAAsB,CAAC,CAU/C;AA0DD,eAAO,MAAM,aAAa,QAAS,MAAM,WAAW,MAAM,CAAC,MAAM,CAAC,MAAM,CAAC,qGAiCrE,CAAC;AAEL,wBAAgB,YAAY,CAAC,KAAK,CAAC,EAAE,MAAM,GAAG,OAAO,CAWpD;AAED,wBAAgB,kBAAkB,CAAC,CAAC,EAClC,MAAM,EAAE,sBAAsB,EAC9B,IAAI,EAAE,MAAM,EACZ,IAAI,CAAC,EAAE,WAAW,GACjB,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,sBAAsB,CAAC,CAgE1C;AAED,wBAAgB,oBAAoB,CAClC,MAAM,EAAE,sBAAsB,EAC9B,aAAa,EAAE,MAAM,EACrB,cAAc,EAAE,YAAY,GAAG,MAAM,EACrC,IAAI,EAAE,MAAM,EACZ,OAAO,CAAC,EAAE,WAAW,GACpB,MAAM,CAAC,MAAM,CAAC,eAAe,EAAE,sBAAsB,CAAC,CAkCxD"}

package/dist/observability-tool/trace.d.ts

@@ -4,5 +4,5 @@ import { ObservabilityToolError } from "./errors";
 import type { ObservabilityEnvConfig, SearchWindow, TempoSearchResponse, TraceSearchHit } from "./types";
 export declare function summarizeSearchHits(response: TempoSearchResponse): TraceSearchHit[];
 export declare function searchTempoByQuery(config: ObservabilityEnvConfig, query: string, window: SearchWindow, limit: number): Effect.Effect<TempoSearchResponse, ObservabilityToolError>;
-export declare const traceCommand: Command.Command<"trace", {} | {}, {}, never, import("../config").ConfigService>;
+export declare const traceCommand: Command.Command<"trace", {} | {}, {}, never, import("../config").ConfigService | import("../shared/secret-env").SecretEnvResolver>;
 //# sourceMappingURL=trace.d.ts.map

package/dist/observability-tool/trace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trace.d.ts","sourceRoot":"","sources":["../../src/observability-tool/trace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAe,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAY,OAAO,EAAQ,MAAM,YAAY,CAAC;AAKrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAWlD,OAAO,KAAK,EAEV,sBAAsB,EAItB,YAAY,EAEZ,mBAAmB,EAEnB,cAAc,EAEf,MAAM,SAAS,CAAC;AAuVjB,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,cAAc,EAAE,CAsBnF;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CA4C5D;AAoPD,eAAO,MAAM,YAAY,iFAGxB,CAAC"}
+{"version":3,"file":"trace.d.ts","sourceRoot":"","sources":["../../src/observability-tool/trace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAe,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAY,OAAO,EAAQ,MAAM,YAAY,CAAC;AAKrD,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAWlD,OAAO,KAAK,EAEV,sBAAsB,EAItB,YAAY,EAEZ,mBAAmB,EAEnB,cAAc,EAEf,MAAM,SAAS,CAAC;AAuVjB,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,cAAc,EAAE,CAsBnF;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CA4C5D;AAoPD,eAAO,MAAM,YAAY,oIAGxB,CAAC"}

package/dist/shared/content-security.d.ts

@@ -1,5 +1,7 @@
 /** Redact a credential a tool resolved outside a sensitively named environment variable. */
-export declare const registerResolvedSecret: (value: string) => void;
+export declare const registerResolvedSecret: (value: string, options?: {
+    readonly allowShort?: boolean;
+}) => void;
 export declare function unsafeOutboundTextReason(text: string, environment?: Record<string, string | undefined>): string | null;
 /** Remove recognized secret spans and known sensitive process-environment values. */
 export declare function redactSensitiveText(text: string, environment?: Record<string, string | undefined>): string;

package/dist/shared/content-security.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"content-security.d.ts","sourceRoot":"","sources":["../../src/shared/content-security.ts"],"names":[],"mappings":"AAaA,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,UAAW,MAAM,SAEnD,CAAC;AAUF,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAC5D,MAAM,GAAG,IAAI,CAcf;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAC5D,MAAM,CAuBR;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,KAAK,EAAE,CAAC,EACR,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAC5D,CAAC,CAqBH"}
+{"version":3,"file":"content-security.d.ts","sourceRoot":"","sources":["../../src/shared/content-security.ts"],"names":[],"mappings":"AAaA,4FAA4F;AAC5F,eAAO,MAAM,sBAAsB,UAC1B,MAAM,YACJ;IAAE,QAAQ,CAAC,UAAU,CAAC,EAAE,OAAO,CAAA;CAAE,SAK3C,CAAC;AAUF,wBAAgB,wBAAwB,CACtC,IAAI,EAAE,MAAM,EACZ,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAC5D,MAAM,GAAG,IAAI,CAcf;AAED,qFAAqF;AACrF,wBAAgB,mBAAmB,CACjC,IAAI,EAAE,MAAM,EACZ,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAC5D,MAAM,CAuBR;AAED,oFAAoF;AACpF,wBAAgB,oBAAoB,CAAC,CAAC,EACpC,KAAK,EAAE,CAAC,EACR,WAAW,GAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,SAAS,CAAe,GAC5D,CAAC,CAqBH"}

package/dist/shared/secret-env.d.ts

@@ -0,0 +1,22 @@
+import { Context, Layer } from "effect";
+export type LookupResult = {
+    readonly _tag: "found";
+    readonly value: string;
+} | {
+    readonly _tag: "absent";
+} | {
+    readonly _tag: "failed";
+    readonly reason: string;
+};
+export type ZshRunner = (name: string, timeoutMs: number) => Promise<LookupResult>;
+declare const SecretEnvResolver_base: Context.ServiceClass<SecretEnvResolver, "@agent-tools/SecretEnvResolver", {
+    readonly resolveSecretEnv: (name: string) => Promise<string>;
+    readonly lookupConfigEnv: (name: string) => Promise<LookupResult>;
+}>;
+export declare class SecretEnvResolver extends SecretEnvResolver_base {
+    static get liveLayer(): Layer.Layer<SecretEnvResolver, never, never>;
+    static readonly testLayer: (runner?: ZshRunner) => Layer.Layer<SecretEnvResolver, never, never>;
+}
+export declare function makeSecretEnvResolverLayer(runner?: ZshRunner, timeoutMs?: number): Layer.Layer<SecretEnvResolver, never, never>;
+export {};
+//# sourceMappingURL=secret-env.d.ts.map

package/dist/shared/secret-env.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"secret-env.d.ts","sourceRoot":"","sources":["../../src/shared/secret-env.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAqBxC,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;;+BAmJpD,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;8BAClC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC;;AAJrE,qBAAa,iBAAkB,SAAQ,sBAMF;IACnC,MAAM,KAAK,SAAS,iDAEnB;IACD,MAAM,CAAC,QAAQ,CAAC,SAAS,YAAY,SAAS,kDACT;CACtC;AAED,wBAAgB,0BAA0B,CACxC,MAAM,GAAE,SAA6B,EACrC,SAAS,SAAqB,gDAwC/B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.10.1",
+  "version": "1.11.1",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/src/db-tool/main.ts

@@ -14,6 +14,7 @@ import {
   VERSION,
 } from "#shared";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
+import { SecretEnvResolver } from "#shared/secret-env";
 import { withRedactedOutput } from "#shared/output-boundary";
 import { ConfigService, ConfigServiceLayer, getDefaultEnvironment } from "#config";
 import { DbConfigService, makeDbConfigLayer } from "./config-service";
@@ -248,6 +249,7 @@ const MainLayer = DbService.layer.pipe(
   // provideMerge (not provide) so DbConfigService stays in the program context for the `envs` command,
   // which reads it directly rather than going through DbService.
   Layer.provideMerge(DbSqlClient.layer),
+  Layer.provideMerge(SecretEnvResolver.liveLayer),
   Layer.provideMerge(dbConfigLayer),
   Layer.provideMerge(ConfigServiceLayer),
   Layer.provideMerge(BunServices.layer),

package/src/db-tool/service.ts

@@ -1,5 +1,5 @@
 import { ChildProcess, ChildProcessSpawner } from "effect/process";
-import { Clock, Context, Duration, Effect, Layer, Ref, Result, Stream } from "effect";
+import { Clock, Context, Duration, Effect, Layer, Result, Stream } from "effect";
 
 import type { DbConfig, DbMutationOperation, QueryResult, SchemaMode } from "./types";
 
@@ -7,6 +7,7 @@ import { ConfigService } from "#config";
 import { isPrerequisiteRunError } from "#shared/prerequisites/errors";
 import { resolveEnvTemplate } from "#shared/env-template";
 import { registerResolvedSecret, unsafeOutboundTextReason } from "#shared/content-security";
+import { SecretEnvResolver } from "#shared/secret-env";
 import { resolveEnvironmentScopedPrerequisites } from "#shared/prerequisites/config";
 import { runWithProfilePrerequisites } from "#shared/prerequisites/runtime";
 import { buildApiProbeArgs } from "#shared/k8s-probe";
@@ -43,12 +44,6 @@ const MIN_TCP_PORT = 1;
 const MAX_TCP_PORT = 65535;
 const INTEGER_ONLY = /^\d+$/;
 
-// Bun.env is the primary source: it carries the values Bun loads from a .env file, which is where
-// a per-worktree host/port lives. It aliases process.env, which is also the only one that exists
-// when this module runs outside Bun (the vitest runner).
-const readProcessEnv = (envVar: string): string | undefined =>
-  (typeof Bun === "undefined" ? process.env : Bun.env)[envVar];
-
 export type ResolvedPortOverride =
   | { readonly ok: true; readonly port: number }
   | { readonly ok: false; readonly message: string };
@@ -159,6 +154,7 @@ export class DbService extends Context.Service<
       Effect.gen(function* () {
         const executor = yield* ChildProcessSpawner.ChildProcessSpawner;
         const sqlClient = yield* DbSqlClient;
+        const secretEnvResolver = yield* SecretEnvResolver;
         const agentToolsConfig = yield* ConfigService;
         const dbConfig = yield* DbConfigService;
 
@@ -185,152 +181,138 @@ export class DbService extends Context.Service<
         const apiProbeTimeoutMs = dbConfig.apiProbeTimeoutMs ?? 2000;
         const remotePort = dbConfig.remotePort ?? 5432;
 
-        const zshrcEnvCache = yield* Ref.make<Record<string, string> | null>(null);
         const envTemplateRegex = /^\$\{([A-Za-z0-9_]+)\}$/;
+        const lookupConfigEnv = (name: string) =>
+          Effect.tryPromise({
+            try: () => secretEnvResolver.lookupConfigEnv(name),
+            catch: () => new Error(`${name} lookup failed`),
+          });
 
-        const loadEnvFromZshrc = Effect.fn("DbService.loadEnvFromZshrc")(function* () {
-          const cached = yield* Ref.get(zshrcEnvCache);
-          if (cached !== null) {
-            return cached;
-          }
-
-          const home = process.env.HOME;
-          if (!home || home.trim() === "") {
-            yield* Ref.set(zshrcEnvCache, {});
-            return {};
-          }
-
-          const zshrcPath = `${home}/.zshrc`;
-          const content = yield* Effect.tryPromise(async () => {
-            const file = Bun.file(zshrcPath);
-            if (!(await file.exists())) {
-              return "";
+        const resolvePassword = (config: DbConfig, env: string) =>
+          Effect.gen(function* () {
+            if (config.password) {
+              registerResolvedSecret(config.password);
+              return config.password;
             }
-            return await file.text();
-          }).pipe(Effect.orElseSucceed(() => ""));
 
-          const envVars: Record<string, string> = {};
-          const regex = /^export\s+([A-Z_][A-Z0-9_]*)=["']?([^"'\n]+)["']?/gm;
-          let match = regex.exec(content);
-
-          while (match !== null) {
-            envVars[match[1]] = match[2];
-            match = regex.exec(content);
-          }
-
-          yield* Ref.set(zshrcEnvCache, envVars);
-          return envVars;
-        });
+            const passwordEnvVar = config.passwordEnvVar;
+            if (passwordEnvVar) {
+              return yield* Effect.tryPromise({
+                try: () => secretEnvResolver.resolveSecretEnv(passwordEnvVar),
+                catch: () =>
+                  new Error(
+                    `${passwordEnvVar} is not in the environment or in the interactive zsh`,
+                  ),
+              }).pipe(
+                Effect.mapError(
+                  () =>
+                    new DbConnectionError({
+                      message: `${passwordEnvVar} is not in the environment or in the interactive zsh`,
+                      environment: env,
+                    }),
+                ),
+              );
+            }
 
-        const resolvePassword = Effect.fn("DbService.resolvePassword")(function* (
-          config: DbConfig,
-          env: string,
-        ) {
-          if (config.password) {
-            registerResolvedSecret(config.password);
-            return config.password;
-          }
+            // Local databases typically don't need a password
+            return "";
+          });
 
-          if (config.passwordEnvVar) {
-            const fromEnv = process.env[config.passwordEnvVar];
-            if (fromEnv) {
-              registerResolvedSecret(fromEnv);
-              return fromEnv;
+        const resolveConfigString = (value: string, env: string, label: string) =>
+          Effect.gen(function* () {
+            const match = value.match(envTemplateRegex);
+            if (!match) return value;
+
+            const envVar = match[1];
+            const result = yield* lookupConfigEnv(envVar).pipe(
+              Effect.mapError(
+                () =>
+                  new DbConnectionError({
+                    message: `${envVar} lookup failed (required for '${label}' config field) in environment ${env}.`,
+                    environment: env,
+                  }),
+              ),
+            );
+            if (result._tag === "failed") {
+              return yield* new DbConnectionError({
+                message: `${envVar} lookup failed (required for '${label}' config field) in environment ${env}.`,
+                environment: env,
+              });
             }
-
-            const zshrcEnv = yield* loadEnvFromZshrc();
-            const fromZsh = zshrcEnv[config.passwordEnvVar];
-            if (fromZsh) {
-              registerResolvedSecret(fromZsh);
-              return fromZsh;
+            if (result._tag === "absent") {
+              return yield* new DbConnectionError({
+                message: `${envVar} is not in the environment or in the interactive zsh (required for '${label}' config field) in environment ${env}.`,
+                environment: env,
+              });
             }
-
-            return yield* new DbConnectionError({
-              message: `Environment variable ${config.passwordEnvVar} is not set.`,
-              environment: env,
-            });
-          }
-
-          // Local databases typically don't need a password
-          return "";
-        });
-
-        const resolveConfigString = Effect.fn("DbService.resolveConfigString")(function* (
-          value: string,
-          env: string,
-          label: string,
-          zshrcEnv: Record<string, string>,
-        ) {
-          const match = value.match(envTemplateRegex);
-          if (!match) return value;
-
-          const envVar = match[1];
-          const fromEnv = Bun.env[envVar];
-          if (fromEnv !== undefined) return fromEnv;
-
-          const fromZsh = zshrcEnv[envVar];
-          if (fromZsh !== undefined) return fromZsh;
-
-          return yield* new DbConnectionError({
-            message: `Environment variable ${envVar} (required for '${label}' config field) is not set in environment ${env}.`,
-            environment: env,
+            return result.value;
           });
-        });
 
-        const lookupEnvOverride = (envVar: string, zshrcEnv: Record<string, string>) =>
-          readProcessEnv(envVar) ?? zshrcEnv[envVar];
-
-        const resolveDbConfig = Effect.fn("DbService.resolveDbConfig")(function* (
-          config: DbConfig,
-          env: string,
-        ) {
-          const needsEnvResolution =
-            envTemplateRegex.test(config.user) ||
-            envTemplateRegex.test(config.database) ||
-            config.hostEnvVar !== undefined ||
-            config.portEnvVar !== undefined;
-          const zshrcEnv = needsEnvResolution ? yield* loadEnvFromZshrc() : {};
-
-          const host = resolveHostOverride(
-            config.host,
-            config.hostEnvVar,
-            config.hostEnvVar ? lookupEnvOverride(config.hostEnvVar, zshrcEnv) : undefined,
-          );
-          const portOverride = resolvePortOverride(
-            env,
-            config.port,
-            config.portEnvVar,
-            config.portEnvVar ? lookupEnvOverride(config.portEnvVar, zshrcEnv) : undefined,
-          );
+        const resolveDbConfig = (config: DbConfig, env: string) =>
+          Effect.gen(function* () {
+            const resolveOverride = (name: string | undefined) => {
+              if (!name) return Effect.succeed(undefined);
+              return lookupConfigEnv(name).pipe(
+                Effect.flatMap((result) => {
+                  if (result._tag === "absent") return Effect.succeed(undefined);
+                  if (result._tag === "failed") {
+                    return Effect.fail(
+                      new DbConnectionError({
+                        message: `${name} lookup failed in environment ${env}.`,
+                        environment: env,
+                      }),
+                    );
+                  }
+                  return Effect.succeed(result.value);
+                }),
+                Effect.mapError(
+                  () =>
+                    new DbConnectionError({
+                      message: `${name} lookup failed in environment ${env}.`,
+                      environment: env,
+                    }),
+                ),
+              );
+            };
+            const hostValue = yield* resolveOverride(config.hostEnvVar);
+            const portValue = yield* resolveOverride(config.portEnvVar);
+
+            const host = resolveHostOverride(config.host, config.hostEnvVar, hostValue);
+            const portOverride = resolvePortOverride(
+              env,
+              config.port,
+              config.portEnvVar,
+              portValue,
+            );
 
-          if (!portOverride.ok) {
-            return yield* new DbConnectionError({
-              message: portOverride.message,
-              environment: env,
-            });
-          }
+            if (!portOverride.ok) {
+              return yield* new DbConnectionError({
+                message: portOverride.message,
+                environment: env,
+              });
+            }
 
-          // A host override can flip the tunnel decision (a forwarded localhost port vs a directly
-          // reachable host), so re-derive the access mode whenever the override changed the host.
-          const needsTunnel =
-            host === config.host
-              ? config.needsTunnel
-              : resolveDbAccessMode(
-                  env,
-                  host,
-                  dbConfig.kubectl !== undefined,
-                  config.allowedMutations,
-                ).needsTunnel;
+            // A host override can flip the tunnel decision (a forwarded localhost port vs a directly
+            // reachable host), so re-derive the access mode whenever the override changed the host.
+            const needsTunnel =
+              host === config.host
+                ? config.needsTunnel
+                : resolveDbAccessMode(
+                    env,
+                    host,
+                    dbConfig.kubectl !== undefined,
+                    config.allowedMutations,
+                  ).needsTunnel;
 
-          return {
-            ...config,
-            host,
-            port: portOverride.port,
-            needsTunnel,
-            user: yield* resolveConfigString(config.user, env, "user", zshrcEnv),
-            database: yield* resolveConfigString(config.database, env, "database", zshrcEnv),
-          };
-        });
+            return {
+              ...config,
+              host,
+              port: portOverride.port,
+              needsTunnel,
+              user: yield* resolveConfigString(config.user, env, "user"),
+              database: yield* resolveConfigString(config.database, env, "database"),
+            };
+          });
 
         const executeShellCommand = (command: ChildProcess.Command) =>
           Effect.scoped(

package/src/db-tool/sql-client.ts

@@ -1,6 +1,7 @@
 import { Context, Effect, Layer } from "effect";
 
 import { DbQueryError } from "./errors";
+import { redactSensitiveText } from "#shared/content-security";
 
 export type DbConnection = {
   readonly host: string;
@@ -22,6 +23,11 @@ type BunQueryResult = unknown[] & { count?: number; command?: string };
 export const toErrorMessage = (cause: unknown): string =>
   cause instanceof Error ? cause.message : String(cause);
 
+export const toDbQueryError = (cause: unknown, sql: string): DbQueryError => {
+  const message = redactSensitiveText(toErrorMessage(cause));
+  return new DbQueryError({ message, sql, stderr: message });
+};
+
 const runWithBunSql = (connection: DbConnection, sql: string) =>
   Effect.tryPromise({
     try: async (): Promise<DbQueryOutcome> => {
@@ -61,10 +67,7 @@ const runWithBunSql = (connection: DbConnection, sql: string) =>
         await client.close().catch(() => undefined);
       }
     },
-    catch: (cause) => {
-      const message = toErrorMessage(cause);
-      return new DbQueryError({ message, sql, stderr: message });
-    },
+    catch: (cause) => toDbQueryError(cause, sql),
   });
 
 export class DbSqlClient extends Context.Service<

package/src/observability-tool/main.ts

@@ -7,6 +7,7 @@ import { Command } from "effect/cli";
 import { ConfigServiceLayer } from "#config";
 import { AuditServiceLayer, withAudit } from "#shared/audit";
 import { withRedactedOutput } from "#shared/output-boundary";
+import { SecretEnvResolver } from "#shared/secret-env";
 import { makeSchemaCommand, renderCauseToStderr, VERSION } from "#shared";
 
 import { metricsCommand } from "./metrics";
@@ -24,7 +25,12 @@ const mainCommand = Command.make("observability-tool", {}).pipe(
 
 const cli = Command.run(mainCommand, { version: VERSION, renderErrors: false });
 
-const MainLayer = Layer.mergeAll(BunServices.layer, ConfigServiceLayer, AuditServiceLayer);
+const MainLayer = Layer.mergeAll(
+  BunServices.layer,
+  ConfigServiceLayer,
+  AuditServiceLayer,
+  SecretEnvResolver.liveLayer,
+);
 
 const program = withRedactedOutput(withAudit("observability", cli)).pipe(
   Effect.provide(MainLayer),

package/src/observability-tool/shared.ts

@@ -5,7 +5,8 @@ import { ConfigService, getToolConfig } from "#config";
 import type { ObservabilityConfig } from "#config";
 
 import { ObservabilityToolError } from "./errors";
-import { registerResolvedSecret, unsafeOutboundTextReason } from "#shared/content-security";
+import { redactSensitiveText, unsafeOutboundTextReason } from "#shared/content-security";
+import { SecretEnvResolver } from "#shared/secret-env";
 import type {
   DsQueryOpts,
   DsQueryResponse,
@@ -48,18 +49,15 @@ export const profileOption = Flag.optional(
   ),
 );
 
-function resolveToken(tokenEnvVar?: string): string | undefined {
+function resolveToken(
+  resolver: SecretEnvResolver["Service"],
+  tokenEnvVar?: string,
+): Promise<string | undefined> {
   if (!tokenEnvVar) {
-    return undefined;
-  }
-
-  const token = process.env[tokenEnvVar];
-  if (!token) {
-    throw new Error(`${tokenEnvVar} environment variable is not set`);
+    return Promise.resolve(undefined);
   }
 
-  registerResolvedSecret(token);
-  return token;
+  return resolver.resolveSecretEnv(tokenEnvVar);
 }
 
 async function discoverDatasources(url: string, token?: string): Promise<GrafanaDatasource[]> {
@@ -68,7 +66,9 @@ async function discoverDatasources(url: string, token?: string): Promise<Grafana
 
   if (!response.ok) {
     const body = await response.text().catch(() => "");
-    throw new Error(`Grafana API ${response.status}: /api/datasources — ${body}`);
+    throw new Error(
+      redactSensitiveText(`Grafana API ${response.status}: /api/datasources — ${body}`),
+    );
   }
 
   return (await response.json()) as GrafanaDatasource[];
@@ -102,13 +102,14 @@ export function requireTempoUid(
 async function resolveFromProfile(
   profile: ObservabilityConfig | undefined,
   env: string,
+  resolver: SecretEnvResolver["Service"],
 ): Promise<ObservabilityEnvConfig | undefined> {
   const environment = profile?.environments[env];
   if (!environment) {
     return undefined;
   }
 
-  const token = resolveToken(environment.tokenEnvVar);
+  const token = await resolveToken(resolver, environment.tokenEnvVar);
   const datasources = await discoverDatasources(environment.url, token);
 
   // Tempo is optional: metrics/logs work on Grafana instances without it (e.g. Percona PMM).
@@ -157,6 +158,7 @@ function resolveFromEnv(
 export const resolveConfig = (env: string, profile: Option.Option<string>) =>
   Effect.gen(function* () {
     const config = yield* ConfigService;
+    const secretEnvResolver = yield* SecretEnvResolver;
     const profileName = Option.getOrUndefined(profile);
     const observabilityConfig = getToolConfig<ObservabilityConfig>(
       config,
@@ -166,7 +168,11 @@ export const resolveConfig = (env: string, profile: Option.Option<string>) =>
 
     return yield* Effect.tryPromise({
       try: async () => {
-        const profileResolved = await resolveFromProfile(observabilityConfig, env);
+        const profileResolved = await resolveFromProfile(
+          observabilityConfig,
+          env,
+          secretEnvResolver,
+        );
         if (profileResolved) {
           return profileResolved;
         }
@@ -258,7 +264,7 @@ export function observabilityFetch<T>(
 
       if (!response.ok) {
         const body = await response.text().catch(() => "");
-        throw new Error(`Grafana API ${response.status}: ${path} — ${body}`);
+        throw new Error(redactSensitiveText(`Grafana API ${response.status}: ${path} — ${body}`));
       }
 
       return (await response.json()) as T;

package/src/shared/content-security.ts

@@ -12,8 +12,13 @@ const MIN_SECRET_LENGTH = 8;
 const resolvedSecrets = new Set<string>();
 
 /** Redact a credential a tool resolved outside a sensitively named environment variable. */
-export const registerResolvedSecret = (value: string) => {
-  if (value.length >= MIN_SECRET_LENGTH) resolvedSecrets.add(value);
+export const registerResolvedSecret = (
+  value: string,
+  options: { readonly allowShort?: boolean } = {},
+) => {
+  if (value.length > 0 && (options.allowShort === true || value.length >= MIN_SECRET_LENGTH)) {
+    resolvedSecrets.add(value);
+  }
 };
 
 const sensitiveEnvironmentValues = (environment: Record<string, string | undefined>) =>

package/src/shared/secret-env.ts

@@ -0,0 +1,230 @@
+import { spawn } from "node:child_process";
+import { tmpdir } from "node:os";
+import { relative, resolve as resolvePath } from "node:path";
+import { Context, Layer } from "effect";
+
+import { registerResolvedSecret } from "./content-security";
+
+const SECRET_NAME_PATTERN = /^[A-Z_][A-Z0-9_]*$/;
+const CONFIG_NAME_PATTERN = /^[A-Za-z0-9_]+$/;
+const DEFAULT_TIMEOUT_MS = 10_000;
+const STARTUP_ENV_NAMES = [
+  "PATH",
+  "HOME",
+  "USER",
+  "LOGNAME",
+  "SHELL",
+  "TERM",
+  "LANG",
+  "LC_ALL",
+  "TMPDIR",
+  "XDG_CONFIG_HOME",
+  "ZDOTDIR",
+] as const;
+
+export type LookupResult =
+  | { readonly _tag: "found"; readonly value: string }
+  | { readonly _tag: "absent" }
+  | { readonly _tag: "failed"; readonly reason: string };
+
+export type ZshRunner = (name: string, timeoutMs: number) => Promise<LookupResult>;
+
+const failed = (name: string): LookupResult => ({ _tag: "failed", reason: name });
+
+type FrameInspection =
+  | { readonly _tag: "incomplete" }
+  | { readonly _tag: "malformed" }
+  | { readonly _tag: "complete"; readonly result: LookupResult };
+
+const inspectFrame = (frame: Buffer): FrameInspection => {
+  const firstNewline = frame.indexOf(10);
+  if (firstNewline < 0) {
+    const prefix = frame.toString("ascii");
+    return "set".startsWith(prefix) || "unset".startsWith(prefix)
+      ? { _tag: "incomplete" }
+      : { _tag: "malformed" };
+  }
+
+  const state = frame.subarray(0, firstNewline).toString("ascii");
+  if (state === "unset") {
+    return firstNewline === frame.length - 1
+      ? { _tag: "complete", result: { _tag: "absent" } }
+      : { _tag: "malformed" };
+  }
+  if (state !== "set") return { _tag: "malformed" };
+
+  const lengthEnd = frame.indexOf(10, firstNewline + 1);
+  if (lengthEnd < 0) {
+    const lengthPrefix = frame.subarray(firstNewline + 1).toString("ascii");
+    if (/^(0|[1-9][0-9]*)$/.test(lengthPrefix) || lengthPrefix === "") {
+      return { _tag: "incomplete" };
+    }
+    return { _tag: "malformed" };
+  }
+  const lengthText = frame.subarray(firstNewline + 1, lengthEnd).toString("ascii");
+  if (!/^(0|[1-9][0-9]*)$/.test(lengthText)) return { _tag: "malformed" };
+
+  const length = Number(lengthText);
+  const start = lengthEnd + 1;
+  if (!Number.isSafeInteger(length)) return { _tag: "malformed" };
+  if (start + length < frame.length) return { _tag: "malformed" };
+  if (start + length > frame.length) return { _tag: "incomplete" };
+  return {
+    _tag: "complete",
+    result: { _tag: "found", value: frame.subarray(start).toString("utf8") },
+  };
+};
+
+const runInteractiveZsh: ZshRunner = (name, timeoutMs) =>
+  new Promise((resolve) => {
+    if (process.env.VITEST !== undefined) {
+      const home = process.env.HOME;
+      const zdotdir = process.env.ZDOTDIR;
+      const relativeZdotdir = zdotdir ? relative(tmpdir(), resolvePath(zdotdir)) : "..";
+      if (
+        !home ||
+        !zdotdir ||
+        resolvePath(home) !== resolvePath(zdotdir) ||
+        relativeZdotdir === ".." ||
+        relativeZdotdir.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)
+      ) {
+        resolve(failed(name));
+        return;
+      }
+    }
+
+    const childEnv = Object.fromEntries(
+      STARTUP_ENV_NAMES.flatMap((key) => {
+        const value = process.env[key];
+        return value === undefined ? [] : [[key, value]];
+      }),
+    );
+    const script = `export LC_ALL=C; if (( \${+parameters[$1]} )); then value=\${(P)1}; print -ru3 -- "set"; print -ru3 -- "\${#value}"; print -rn -- "$value" >&3; else print -ru3 -- "unset"; fi`;
+
+    let child: ReturnType<typeof spawn>;
+    try {
+      child = spawn("zsh", ["-i", "-c", script, "agent-tools-secret-env", name], {
+        detached: true,
+        env: childEnv,
+        stdio: ["ignore", "ignore", "ignore", "pipe"],
+      });
+    } catch {
+      resolve(failed(name));
+      return;
+    }
+
+    const stream = child.stdio[3];
+    if (!stream || typeof stream === "number") {
+      child.kill("SIGKILL");
+      resolve(failed(name));
+      return;
+    }
+
+    const chunks: Buffer[] = [];
+    let exited = false;
+    let ended = false;
+    let exitCode: number | null = null;
+    let settled = false;
+    const killProcessGroup = () => {
+      if (child.pid === undefined) return;
+      try {
+        process.kill(-child.pid, "SIGKILL");
+      } catch {
+        // The process group may already have exited.
+      }
+    };
+    const finish = (result: LookupResult) => {
+      if (settled) return;
+      settled = true;
+      clearTimeout(timer);
+      stream.destroy();
+      killProcessGroup();
+      resolve(result);
+    };
+    const checkFrame = () => {
+      if (settled) return;
+      const inspection = inspectFrame(Buffer.concat(chunks));
+      if (inspection._tag === "malformed") return finish(failed(name));
+      if (!exited) return;
+      if (exitCode !== 0) return finish(failed(name));
+      if (inspection._tag === "complete") finish(inspection.result);
+      else if (ended) finish(failed(name));
+    };
+    const timer = setTimeout(() => {
+      finish(failed(name));
+    }, timeoutMs);
+
+    stream.on("data", (chunk: Buffer | string) => {
+      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+      checkFrame();
+    });
+    stream.on("end", () => {
+      ended = true;
+      checkFrame();
+    });
+    stream.on("error", () => finish(failed(name)));
+    child.on("error", () => finish(failed(name)));
+    child.on("exit", (code) => {
+      exited = true;
+      exitCode = code;
+      checkFrame();
+    });
+  });
+
+export class SecretEnvResolver extends Context.Service<
+  SecretEnvResolver,
+  {
+    readonly resolveSecretEnv: (name: string) => Promise<string>;
+    readonly lookupConfigEnv: (name: string) => Promise<LookupResult>;
+  }
+>()("@agent-tools/SecretEnvResolver") {
+  static get liveLayer() {
+    return makeSecretEnvResolverLayer();
+  }
+  static readonly testLayer = (runner: ZshRunner = () => Promise.resolve({ _tag: "absent" })) =>
+    makeSecretEnvResolverLayer(runner);
+}
+
+export function makeSecretEnvResolverLayer(
+  runner: ZshRunner = runInteractiveZsh,
+  timeoutMs = DEFAULT_TIMEOUT_MS,
+) {
+  return Layer.sync(SecretEnvResolver, () => {
+    const cache = new Map<string, Promise<LookupResult>>();
+    const lookup = (name: string, emptyProcessValueWins: boolean): Promise<LookupResult> => {
+      const fromProcess = process.env[name];
+      if (fromProcess !== undefined && (emptyProcessValueWins || fromProcess !== "")) {
+        return Promise.resolve({ _tag: "found", value: fromProcess });
+      }
+
+      let result = cache.get(name);
+      if (!result) {
+        result = Promise.resolve()
+          .then(() => runner(name, timeoutMs))
+          .catch(() => failed(name));
+        cache.set(name, result);
+      }
+      return result;
+    };
+    const lookupConfigEnv = (name: string): Promise<LookupResult> => {
+      if (!CONFIG_NAME_PATTERN.test(name)) return Promise.resolve(failed(name));
+      return lookup(name, true);
+    };
+    const resolveSecretEnv = async (name: string): Promise<string> => {
+      if (!SECRET_NAME_PATTERN.test(name)) {
+        throw new Error(`Invalid environment variable name: ${name}`);
+      }
+      const result = await lookup(name, false);
+      if (result._tag !== "found") {
+        throw new Error(`${name} is not in the environment or in the interactive zsh`);
+      }
+      if (result.value.length < 4) {
+        throw new Error(`${name} is too short to redact safely`);
+      }
+      registerResolvedSecret(result.value, { allowShort: true });
+      return result.value;
+    };
+
+    return SecretEnvResolver.of({ resolveSecretEnv, lookupConfigEnv });
+  });
+}