@blogic-cz/agent-tools 1.14.4 → 1.14.6

package/src/azdo-tool/index.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
 
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;

package/src/azdo-tool/main.ts

@@ -184,7 +184,7 @@ EXAMPLES:
 
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
-const mainCommand = Command.make("azdo-tool", {}).pipe(
+export const mainCommand = Command.make("azdo-tool", {}).pipe(
   Command.withDescription(
     `Azure DevOps Tool for Coding Agents (READ-ONLY)
 
@@ -219,6 +219,15 @@ const program = withRedactedOutput(withAudit("azdo", cli)).pipe(
   Effect.tapCause(renderCauseToStderr),
 );
 
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+export const runMain = () =>
+  BunRuntime.runMain(program, {
+    disableErrorReporting: true,
+  });
+
+export const runProgram = (args: readonly string[]) =>
+  withRedactedOutput(
+    withAudit(
+      "azdo",
+      Command.runWith(mainCommand, { version: VERSION, renderErrors: false })(args),
+    ),
+  ).pipe(Effect.provide(MainLayer), Effect.tapCause(renderCauseToStderr));

package/src/credential-guard/issue-227.test.ts

@@ -0,0 +1,69 @@
+import { expect, it } from "vitest";
+import { createCredentialGuard } from "./index";
+import { parseBash } from "./bash";
+import { judge } from "./policy";
+
+const bash = (command: string) => judge(parseBash(command), { cwd: "/repo", home: "/users/test" });
+
+it.each([
+  `sed -i '' 's/"x": "\\^1\\.14\\.[0-9]*"/"x": "^1.14.4"/' package.json`,
+  "sed -i '' 's/a*/b/' package.json",
+  "sed -i 's/[0-9]/x/' notes.txt",
+  "sed -n '/[0-9]*/p' notes.txt",
+])("keeps sed scripts out of write targets: %s", (command) => {
+  expect(bash(command)).toEqual({ kind: "pass" });
+  expect(() =>
+    createCredentialGuard().handleToolExecuteBefore({ tool: "Bash" }, { args: { command } }),
+  ).not.toThrow();
+});
+
+it.each([
+  "cd ~/.claude && printf x > comm?nds/x.md",
+  "cd ~/.claude && printf x | tee comm?nds/x.md",
+  "cd ~/.claude && printf x > sk?lls/x/SKILL.md",
+  "cd ~/.claude && cp /tmp/x sk?lls/foo/SKILL.md",
+  "cd ~/.claude && cp /tmp/x hoo?s/x.sh",
+  "cd ~/.claude && tee ag?nts/x.md < /tmp/x",
+  "cd ~/.claude && touch comm?nds/x.md",
+  "cd ~/.claude && truncate -s 0 comm?nds/x.md",
+  "cd ~/.claude && cat /tmp/x >> comm*/x.md",
+  "cd ~/.agents && printf x > sk?lls/x/SKILL.md",
+  "cd ~/.agents && cp /tmp/x sk*/x/SKILL.md",
+  "cd /repo/.claude && printf x > comm*/x.md",
+  "cd ~/.claude/ && printf x > ./comm?nds/x.md",
+  "cd ~/.claude/commands && printf x > ../sk?lls/x.md",
+  "cd .claude && cp f c*/x.md",
+  "cd .claude && echo x > c*/x.md",
+  "cd /repo/.claude && cp f ./c*/x.md",
+  "cd /repo/.claude && cp f s*/x/SKILL.md",
+  "cd /repo/.agents && cp f s*/x/SKILL.md",
+  "sed -i 's/x/y/' AGENT?.md",
+  "sed -i 's/x/y/' AGENT[]S].md",
+  "sed -i 's/x/y/' AGENT[S].md",
+  "sed -i 's/x/y/' .cl?ude/agents/task.md",
+  "sed -i 's/x/y/' .claude/a*/task.md",
+  "sed -i 's/x/y/' .claude//a*/task.md",
+  "sed -i 's/x/y/' .claude/./a*/task.md",
+  "sed -i 's/x/y/' .claude/notes/../a*/task.md",
+  "sed -i 's/x/y/' .claude/c*/task.md",
+  "sed -i 's/x/y/' .cod?x/prompts/task.md",
+  "sed -i 's/x/y/' .agents/s*/task.md",
+  "tar -vW create -f AGENTS.md src",
+  "tar -vW append -f AGENTS.md src",
+  "tar -kW create -f AGENTS.md src",
+  "tar -vWappend -f AGENTS.md src",
+  "tar -A -f AGENTS.md x.tar",
+  "tar --catenate -f AGENTS.md x.tar",
+  "tar --delete -f AGENTS.md member",
+])("refuses protected write targets: %s", (command) => {
+  expect(bash(command)).toMatchObject({
+    findings: expect.arrayContaining([expect.objectContaining({ rule: "agent-config-write" })]),
+  });
+});
+
+it.each(["tar --delete -f /tmp/x.tar member", "tar -xf x.tar AGENTS.md"])(
+  "keeps documented archive limits: %s",
+  (command) => {
+    expect(bash(command)).toEqual({ kind: "pass" });
+  },
+);

package/src/credential-guard/policy.ts

@@ -1,4 +1,5 @@
 import { formatLiteralPrintf } from "./literal-output";
+import { posix } from "node:path";
 import { splitXargsInput } from "./xargs";
 import { parseBash } from "./bash";
 import { parsePowerShell } from "./powershell";
@@ -98,12 +99,12 @@ function mentions(value: Value): readonly string[] {
 }
 function agentConfigGlob(value: Value): boolean {
   return mentions(value).some((text) =>
-    text
-      .replace(/\\/g, "/")
+    posix
+      .normalize(text.replace(/\\/g, "/"))
       .split("/")
-      .some((part) => {
+      .some((part, index, parts) => {
         if (!/[*?[]/.test(part)) return false;
-        if (part.replace(/\[[A-Za-z0-9._]\]/g, "").includes("[")) return true;
+        if (part.replace(/\[(?:[A-Za-z0-9._]|0-9)\]/g, "").includes("[")) return true;
         const pattern = new RegExp(
           `^${part
             .replace(/[.+^${}()|\\]/g, "\\$&")
@@ -112,22 +113,24 @@ function agentConfigGlob(value: Value): boolean {
             .replace(/\?/g, ".")}$`,
           "i",
         );
-        return [
-          "AGENTS.md",
-          "CLAUDE.md",
-          ".mcp.json",
-          ".claude",
-          ".claude.json",
-          ".codex",
-          ".agents",
-          "config.toml",
-          "settings.json",
-          "settings.local.json",
-          "commands",
-          "agents",
-          "skills",
-          "hooks",
-        ].some((name) => pattern.test(name));
+        const names = [".claude", ".codex", ".agents"];
+        if (index === parts.length - 1 || (index === parts.length - 2 && parts.at(-1) === ""))
+          names.push(
+            "AGENTS.md",
+            "CLAUDE.md",
+            ".mcp.json",
+            ".claude.json",
+            "config.toml",
+            "settings.json",
+            "settings.local.json",
+          );
+        if (
+          /^\.claude$/i.test(parts[index - 1] ?? "") ||
+          (!posix.isAbsolute(text) && (index === 0 || parts[index - 1] === ".."))
+        )
+          names.push("commands", "agents", "skills", "hooks");
+        if (/^\.agents$/i.test(parts[index - 1] ?? "")) names.push("skills");
+        return names.some((name) => pattern.test(name));
       }),
   );
 }

package/src/credential-guard/registry.ts

@@ -1164,6 +1164,78 @@ export const EXECUTABLES: readonly ExecutableEntry[] = [
     operands: [path],
     startup: ["JAVA_TOOL_OPTIONS", "JDK_JAVA_OPTIONS", "CLASSPATH", "_JAVA_OPTIONS", "JAVA_HOME"],
   },
+  {
+    name: "hc",
+    rejectsAbbreviations: true,
+    options: {
+      ...flags("--json", "--help", "-h", "--version", "-V", "--skill", "--licenses"),
+    },
+    operands: [data],
+    subcommands: {
+      ...Object.fromEntries(
+        [
+          "get",
+          "keys",
+          "interrupt",
+          "attach",
+          "kill",
+          "rm",
+          "label",
+          "keep",
+          "ls",
+          "read",
+          "wait",
+          "templates",
+          "events",
+          "schema",
+          "connect",
+          "server",
+        ].map((name) => [
+          name,
+          {
+            operands: [data],
+            options: {
+              ...flags("--all", "--off", "--wait", "--force"),
+              "--lines": arg(data),
+              "--output": arg(data),
+              "--children": arg(data),
+              "--timeout": arg(data),
+            },
+          },
+        ]),
+      ),
+      send: {
+        operands: [data, path],
+        options: {
+          ...flags("--force", "--json", "--wait"),
+          "--if": arg(data),
+          "--timeout": arg(data),
+        },
+      },
+      run: {
+        operands: [data],
+        options: {
+          ...flags("--bg", "--outlive-parent", "--no-parent", "--no-notify", "--rm", "--keep"),
+          "--name": arg(data),
+          "--cwd": arg(path),
+          "--on": arg(data),
+          "--label": arg(data),
+          "--parent": arg(data),
+          "--timeout": arg(data),
+        },
+      },
+      exec: {
+        operands: [data],
+        options: {
+          ...flags("-i", "--stdin"),
+          "--cwd": arg(path),
+          "--on": arg(data),
+          "--env": { roles: [data], issue: unknown("hc environment override") },
+          "--timeout": arg(data),
+        },
+      },
+    },
+  },
   {
     name: "herdr",
     options: {
@@ -3119,6 +3191,7 @@ export const EXECUTABLES: readonly ExecutableEntry[] = [
         "-A",
         "--catenate",
         "--concatenate",
+        "--delete",
         "-t",
         "--list",
         "-v",
@@ -4205,21 +4278,18 @@ function classifyInvocation(
     entry.name === "tar" &&
     argv.slice(1).some((word, index) => {
       if (word === undefined) return false;
-      const longOption =
-        word === "-W"
-          ? argv[index + 2]?.split("=", 1)[0]
-          : word.startsWith("-W")
-            ? word.slice(2).split("=", 1)[0]
-            : undefined;
+      const longOption = /^-[^-]*W/.test(word)
+        ? (word.slice(word.indexOf("W") + 1) || argv[index + 2])?.split("=", 1)[0]
+        : undefined;
       if (
         longOption &&
-        ["create", "append", "update", "catenate", "concatenate"].some((option) =>
+        ["create", "append", "update", "catenate", "concatenate", "delete"].some((option) =>
           option.startsWith(longOption),
         )
       )
         return true;
       if (word.startsWith("--"))
-        return ["--create", "--append", "--update", "--catenate", "--concatenate"].some(
+        return ["--create", "--append", "--update", "--catenate", "--concatenate", "--delete"].some(
           (option) => word.length > 2 && option.startsWith(word.split("=")[0] ?? word),
         );
       const cluster =
@@ -4233,7 +4303,11 @@ function classifyInvocation(
     }
     const a = argv[position];
     if (a === undefined) {
-      if (["env", "forward", "timeout", "xargs"].includes(entry.semantics ?? ""))
+      if (
+        ["env", "forward", "timeout", "xargs"].includes(entry.semantics ?? "") ||
+        (entry.name === "hc" &&
+          (mode === entry.subcommands?.run || mode === entry.subcommands?.exec))
+      )
         issues.push({
           kind: "missing-knowledge",
           rule: "opaque-executable",
@@ -4459,8 +4533,8 @@ function classifyInvocation(
         (attached ?? argv[position + 1]) === undefined
       )
         issues.push(unknown("Bun option operand is not literal"));
-      if (entry.name === "bun" && optionName === "--cwd") {
-        if (cwdOperands.length) issues.push(unknown("repeated Bun working directory"));
+      if (["bun", "hc"].includes(entry.name) && optionName === "--cwd") {
+        if (cwdOperands.length) issues.push(unknown(`repeated ${entry.name} working directory`));
         cwdOperands.push({
           index: attached === undefined ? position + 1 : position,
           ...(attached !== undefined ? { literal: attached } : {}),
@@ -4583,6 +4657,18 @@ function classifyInvocation(
       position++;
       continue;
     }
+    if (
+      entry.name === "hc" &&
+      (mode === entry.subcommands?.run || mode === entry.subcommands?.exec)
+    ) {
+      if (mode === entry.subcommands?.run && position === argv.length - 1) {
+        roles.push({ index: position, role: code("bash") });
+        roles.push({ index: position, role: path });
+        issues.push(...unknownOperandIssues([a]));
+        codeSeen = true;
+      } else child(position);
+      break;
+    }
     if (entry.name === "git" && mode === entry.subcommands?.bisect?.subcommands?.run) {
       child(position);
       break;
@@ -4671,6 +4757,8 @@ function classifyInvocation(
   if (effect && effect !== "none") issues.push(effect);
   if (!positional.length && !children.length && !codeSeen && entry.bare) issues.push(entry.bare);
   roles.push(...optionRoles);
+  if (entry.name === "hc" && mode === entry.subcommands?.send)
+    issues.push(...unknownOperandIssues(positional.slice(1).map((index) => argv[index])));
   const operands =
     (filterOption && ["sed", "awk"].includes(entry.semantics ?? "")) ||
     (filterOption &&

package/src/db-tool/index.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
 
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;

package/src/db-tool/main.ts

@@ -225,7 +225,7 @@ const grantsCommand = makeDiagnosticCommand(
 
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
-const mainCommand = Command.make("db-tool", {}).pipe(
+export const mainCommand = Command.make("db-tool", {}).pipe(
   Command.withDescription("Database Query Tool for Coding Agents"),
   Command.withSubcommands([
     sqlCommand,
@@ -261,6 +261,12 @@ const program = withRedactedOutput(withAudit("db", cli)).pipe(
   Effect.tapCause(renderCauseToStderr),
 );
 
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+export const runMain = () =>
+  BunRuntime.runMain(program, {
+    disableErrorReporting: true,
+  });
+
+export const runProgram = (args: readonly string[]) =>
+  withRedactedOutput(
+    withAudit("db", Command.runWith(mainCommand, { version: VERSION, renderErrors: false })(args)),
+  ).pipe(Effect.provide(MainLayer), Effect.tapCause(renderCauseToStderr));

package/src/db-tool/service.ts

@@ -133,6 +133,10 @@ export function isFullyReadOnly(
 // Re-exported from the shared probe so existing `#db/service` consumers keep working.
 export { buildApiProbeArgs } from "#shared/k8s-probe";
 
+export const DbGuardianInProcess = Context.Reference<boolean>("@agent-tools/DbGuardianInProcess", {
+  defaultValue: () => false,
+});
+
 export class DbService extends Context.Service<
   DbService,
   {
@@ -156,6 +160,7 @@ export class DbService extends Context.Service<
         const sqlClient = yield* DbSqlClient;
         const secretEnvResolver = yield* SecretEnvResolver;
         const agentToolsConfig = yield* ConfigService;
+        const runGuardianInProcess = yield* DbGuardianInProcess;
         const dbConfig = yield* DbConfigService;
 
         if (!dbConfig) {
@@ -364,7 +369,7 @@ export class DbService extends Context.Service<
             prerequisiteConfig,
             (command, _label) => executeShellCommand(command),
             effect,
-            { tryWithoutPrerequisites: true },
+            { tryWithoutPrerequisites: true, runGuardianInProcess },
           ).pipe(
             Effect.mapError((error) =>
               isPrerequisiteRunError(error)

package/src/gh-tool/index.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
 
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;

package/src/gh-tool/main.ts

@@ -222,7 +222,7 @@ const gistCommand = Command.make("gist", {}).pipe(
 
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
-const mainCommand = Command.make("gh-tool", {}).pipe(
+export const mainCommand = Command.make("gh-tool", {}).pipe(
   Command.withDescription(
     `GitHub CLI Tool for Coding Agents
 
@@ -307,6 +307,7 @@ const observed = Effect.gen(function* () {
 });
 const program = observed.pipe(Effect.provide(MainLayer), Effect.tapCause(renderCauseToStderr));
 
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+export const runMain = () =>
+  BunRuntime.runMain(program, {
+    disableErrorReporting: true,
+  });

package/src/gh-tool/pr/commands.ts

@@ -405,16 +405,19 @@ export const fetchReviewTriage = Effect.fn("pr.fetchReviewTriage")(function* (
   const { info, value } = yield* withStableHead(
     prNumber,
     (number, headSha) =>
-      Effect.all([
-        fetchThreads(number, false, false, headSha),
-        fetchDiscussionSummary(number),
-        fetchCheckReport(number),
-        fetchReviews(number, null, null, null, headSha),
-        fetchComments(number, null, headSha),
-      ]),
+      Effect.gen(function* () {
+        const allThreads = yield* fetchThreads(number, false, false, headSha);
+        const [summary, checkReport, reviews, inlineComments] = yield* Effect.all([
+          fetchDiscussionSummary(number, allThreads),
+          fetchCheckReport(number),
+          fetchReviews(number, null, null, null, headSha),
+          fetchComments(number, null, headSha),
+        ]);
+        return { allThreads, summary, checkReport, reviews, inlineComments };
+      }),
     { operation: "review triage", command: "gh-tool pr review-triage" },
   );
-  const [allThreads, summary, checkReport, reviews, inlineComments] = value;
+  const { allThreads, summary, checkReport, reviews, inlineComments } = value;
   const checks = checkReport.checks ?? [];
   const unresolvedThreads = allThreads.filter((thread) => !thread.isResolved);
   const visibleOpenThreads = allThreads.filter((thread) => thread.isVisibleOpen);
@@ -483,6 +486,60 @@ export const fetchReviewTriage = Effect.fn("pr.fetchReviewTriage")(function* (
   };
 });
 
+type CompactReviewTriage = {
+  readonly pr: number;
+  readonly classification: ReviewTriageClassification;
+  readonly visibleOpenReviewThreadsCount: number;
+  readonly unrepliedReviewThreadsCount: number;
+  readonly unresolvedReviewThreadsCount: number;
+  readonly visibleOpenThreadIds: readonly string[];
+};
+
+const compactReviewTriage = (
+  pr: number,
+  result: {
+    readonly classification: ReviewTriageClassification;
+    readonly summary: ReviewTriageSummary;
+    readonly visibleOpenThreads: ReadonlyArray<{ readonly threadId: string }>;
+  },
+): CompactReviewTriage => ({
+  pr,
+  classification: result.classification,
+  visibleOpenReviewThreadsCount: result.summary.visibleOpenReviewThreadsCount,
+  unrepliedReviewThreadsCount: result.summary.unrepliedReviewThreadsCount,
+  unresolvedReviewThreadsCount: result.summary.unresolvedReviewThreadsCount,
+  visibleOpenThreadIds: result.visibleOpenThreads.map((thread) => thread.threadId),
+});
+
+export const fetchReviewTriageBatch = Effect.fn("pr.fetchReviewTriageBatch")(function* (
+  prs: readonly number[],
+) {
+  return yield* Effect.forEach(
+    prs,
+    (pr) =>
+      fetchReviewTriage(pr).pipe(
+        Effect.map((result) => compactReviewTriage(pr, result)),
+        Effect.catch((error) =>
+          Effect.succeed({
+            pr,
+            error: error instanceof Error ? error.message : String(error),
+          }),
+        ),
+      ),
+    { concurrency: 5 },
+  );
+});
+
+const reviewTriageBatchError = (
+  errors: readonly { readonly pr: number; readonly error: string }[],
+) =>
+  new GitHubCommandError({
+    message: `Failed to fetch review triage for PRs: ${errors.map(({ pr, error }) => `#${pr}: ${error}`).join("; ")}`,
+    command: "gh-tool pr review-triage --prs",
+    exitCode: 1,
+    stderr: "",
+  });
+
 export const prViewCommand = Command.make(
   "view",
   {
@@ -1715,12 +1772,30 @@ export const prReviewTriageCommand = Command.make(
       Flag.withDescription("PR number (default: current branch PR)"),
       Flag.optional,
     ),
+    prs: Flag.String("prs").pipe(
+      Flag.withDescription(
+        "Comma-separated PR numbers for a compact batch summary (overrides --pr)",
+      ),
+      Flag.optional,
+    ),
     repo: repoOption,
   },
-  ({ format, omit, pr, repo }) =>
+  ({ format, omit, pr, prs, repo }) =>
     withRepo(
       repo,
       Effect.gen(function* () {
+        const batch = Option.getOrNull(prs);
+        if (batch !== null) {
+          const numbers = yield* parsePrNumbers(batch);
+          const results = yield* fetchReviewTriageBatch(numbers);
+          yield* logFormatted({ count: results.length, prs: results }, format);
+          const errors = results.filter(
+            (result): result is Extract<(typeof results)[number], { readonly error: string }> =>
+              "error" in result,
+          );
+          if (errors.length > 0) return yield* reviewTriageBatchError(errors);
+          return;
+        }
         const prNumber = Option.getOrNull(pr);
         const result = yield* fetchReviewTriage(prNumber);
         yield* logFormatted(
@@ -1731,7 +1806,7 @@ export const prReviewTriageCommand = Command.make(
     ),
 ).pipe(
   Command.withDescription(
-    "Composite: PR info + merge-readiness verdict + unresolved threads + visible-open threads + discussion summary + checks status in one call",
+    "Composite: PR info + merge-readiness verdict + unresolved and visible-open threads + discussion summary + checks status; use --prs for a compact batch summary",
   ),
 );
 

package/src/gh-tool/pr/review.ts

@@ -430,11 +430,12 @@ export const postIssueComment = Effect.fn("pr.postIssueComment")(function* (
 
 export const fetchDiscussionSummary = Effect.fn("pr.fetchDiscussionSummary")(function* (
   pr: number | null,
+  collectedThreads?: readonly ReviewThread[],
 ) {
   const [issueComments, reviewComments, threads] = yield* Effect.all([
     fetchIssueComments(pr, null, null, null),
     fetchComments(pr, null),
-    fetchThreads(pr, false),
+    collectedThreads === undefined ? fetchThreads(pr, false) : Effect.succeed(collectedThreads),
   ]);
 
   const latestIssueComment =

package/src/gh-tool/read/store.ts

@@ -87,11 +87,13 @@ export class FileStore {
   private constructor(
     readonly directory: string,
     readonly identity: string,
+    private readonly contentionTimeoutMs: number,
   ) {}
 
   static async open(
     identity: string,
     directory = process.env["GH_TOOL_CACHE_DIR"] ?? defaultCacheDirectory(),
+    options: { contentionTimeoutMs?: number } = {},
   ): Promise<FileStore> {
     const uid = process.getuid?.();
     if (uid === undefined) throw new Error("Cache ownership cannot be verified");
@@ -116,7 +118,11 @@ export class FileStore {
         await checkDirectory(path);
       }),
     );
-    const store = new FileStore(join(directory, "gh-read-v1"), identity);
+    const store = new FileStore(
+      join(directory, "gh-read-v1"),
+      identity,
+      options.contentionTimeoutMs ?? 2000,
+    );
     await mkdir(store.ghCacheDirectory, { recursive: true, mode: 0o700 });
     await checkDirectory(store.ghCacheDirectory);
     await store.readClock();
@@ -226,7 +232,7 @@ export class FileStore {
           }
         },
         25,
-        2000,
+        this.contentionTimeoutMs,
       );
       try {
         return await body();

package/src/k8s-tool/index.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
 
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;

package/src/k8s-tool/main.ts

@@ -457,7 +457,7 @@ const topCommand = Command.make(
 
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
-const mainCommand = Command.make("k8s-tool", {}).pipe(
+export const mainCommand = Command.make("k8s-tool", {}).pipe(
   Command.withDescription("Kubernetes CLI Tool for Coding Agents"),
   Command.withSubcommands([
     kubectlCommand,
@@ -486,6 +486,12 @@ const program = withRedactedOutput(withAudit("k8s", cli)).pipe(
   Effect.tapCause(renderCauseToStderr),
 );
 
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+export const runMain = () =>
+  BunRuntime.runMain(program, {
+    disableErrorReporting: true,
+  });
+
+export const runProgram = (args: readonly string[]) =>
+  withRedactedOutput(
+    withAudit("k8s", Command.runWith(mainCommand, { version: VERSION, renderErrors: false })(args)),
+  ).pipe(Effect.provide(MainLayer), Effect.tapCause(renderCauseToStderr));

package/src/logs-tool/index.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
 
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;