@blogic-cz/agent-tools 1.14.5 → 1.14.6

package/README.md

@@ -361,16 +361,8 @@ Membership comes from GitHub's stacks API, never from chaining `baseRefName` to
 That chain both over-reports (a promotion PR whose head is `main` adopts every ordinary PR as a
 child) and under-reports (a PR based on a stack member's branch need not be in the stack).
 
-A live end-to-end proof lives in `tests/e2e/stack-merge.e2e.ts`. It is excluded from
-`bun run check` because it creates and mutates a throwaway GitHub repository:
-
-```bash
-AGENT_TOOLS_E2E=1 bun tests/e2e/stack-merge.e2e.ts
-```
-
-It builds a real three-deep stack and asserts the thing no mock can prove — that each
-squash commit on the trunk adds only its own PR's changes, so a squashed parent is not
-replayed inside its child.
+Stack-merge tests run in-process with synthetic GitHub responses. They do not prove
+that GitHub squash commits exclude changes from an already squashed parent.
 
 ### gh-tool machine contracts
 

package/dist/api-tool/main.d.ts

@@ -1,2 +1,7 @@
-export {};
+import { Command } from "effect/cli";
+import { Effect } from "effect";
+import { ApiError } from "./errors";
+export declare const mainCommand: Command.Command<"api-tool", {} | {}, {}, ApiError, never>;
+export declare const runMain: () => void;
+export declare const runProgram: (args: readonly string[]) => Effect.Effect<void, ApiError | import("effect/cli/CliError").CliError, never>;
 //# sourceMappingURL=main.d.ts.map

package/dist/api-tool/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/api-tool/main.ts"],"names":[],"mappings":""}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/api-tool/main.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,YAAY,CAAC;AAE3C,OAAO,EAAW,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGzC,OAAO,EAAE,QAAQ,EAAuB,MAAM,UAAU,CAAC;AAyCzD,eAAO,MAAM,WAAW,2DAEvB,CAAC;AACF,eAAO,MAAM,OAAO,YAWjB,CAAC;AAEJ,eAAO,MAAM,UAAU,SAAU,SAAS,MAAM,EAAE,kFAQ/C,CAAC"}

package/dist/audit-tool/main.d.ts

@@ -1,3 +1,8 @@
 #!/usr/bin/env bun
-export {};
+import { Command } from "effect/cli";
+import { Effect } from "effect";
+import { AuditService } from "#shared/audit";
+export declare const mainCommand: Command.Command<"audit-tool", {} | {}, {}, never, AuditService>;
+export declare const runMain: () => void;
+export declare const runProgram: (args: readonly string[]) => Effect.Effect<void, import("effect/cli/CliError").CliError, never>;
 //# sourceMappingURL=main.d.ts.map

package/dist/audit-tool/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/audit-tool/main.ts"],"names":[],"mappings":""}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/audit-tool/main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAQ,MAAM,YAAY,CAAC;AAE3C,OAAO,EAAE,MAAM,EAAiB,MAAM,QAAQ,CAAC;AAU/C,OAAO,EAAE,YAAY,EAAgC,MAAM,eAAe,CAAC;AAgF3E,eAAO,MAAM,WAAW,iEAGvB,CAAC;AAcF,eAAO,MAAM,OAAO,YAGhB,CAAC;AAEL,eAAO,MAAM,UAAU,SAAU,SAAS,MAAM,EAAE,uEAMuB,CAAC"}

package/dist/az-tool/main.d.ts

@@ -1,3 +1,8 @@
 #!/usr/bin/env bun
-export {};
+import { Command } from "effect/cli";
+import { Effect } from "effect";
+import { AzService } from "./service";
+export declare const mainCommand: Command.Command<"az-tool", {} | {}, {}, import("./errors").AzCommandError | import("./errors").AzParseError | import("./errors").AzProfileError | import("./errors").AzSecurityError | import("./errors").AzTimeoutError, AzService>;
+export declare const runMain: () => void;
+export declare const runProgram: (args: readonly string[]) => Effect.Effect<void, import("./errors").AzCommandError | import("./errors").AzParseError | import("./errors").AzProfileError | import("./errors").AzSecurityError | import("./errors").AzTimeoutError | import("../config/loader").ConfigLoadError | import("effect/cli/CliError").CliError, never>;
 //# sourceMappingURL=main.d.ts.map

package/dist/az-tool/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/az-tool/main.ts"],"names":[],"mappings":""}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/az-tool/main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAQ,MAAM,YAAY,CAAC;AAE3C,OAAO,EAAE,MAAM,EAAiB,MAAM,QAAQ,CAAC;AAY/C,OAAO,EAAE,SAAS,EAAkB,MAAM,WAAW,CAAC;AAiGtD,eAAO,MAAM,WAAW,sOAsBvB,CAAC;AAkBF,eAAO,MAAM,OAAO,YAGhB,CAAC;AAEL,eAAO,MAAM,UAAU,SAAU,SAAS,MAAM,EAAE,uSAGuB,CAAC"}

package/dist/azdo-tool/main.d.ts

@@ -1,3 +1,8 @@
 #!/usr/bin/env bun
-export {};
+import { Command } from "effect/cli";
+import { Effect } from "effect";
+import { AzdoService } from "./service";
+export declare const mainCommand: Command.Command<"azdo-tool", {} | {}, {}, import("./errors").AzdoCommandError | import("./errors").AzdoParseError | import("./errors").AzdoSecurityError | import("./errors").AzdoTimeoutError, AzdoService>;
+export declare const runMain: () => void;
+export declare const runProgram: (args: readonly string[]) => Effect.Effect<void, import("./errors").AzdoCommandError | import("./errors").AzdoParseError | import("./errors").AzdoSecurityError | import("./errors").AzdoTimeoutError | import("../config/loader").ConfigLoadError | import("effect/cli/CliError").CliError, never>;
 //# sourceMappingURL=main.d.ts.map

package/dist/azdo-tool/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/azdo-tool/main.ts"],"names":[],"mappings":""}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/azdo-tool/main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAQ,MAAM,YAAY,CAAC;AAE3C,OAAO,EAAE,MAAM,EAAiB,MAAM,QAAQ,CAAC;AAoB/C,OAAO,EAAE,WAAW,EAAoB,MAAM,WAAW,CAAC;AAmK1D,eAAO,MAAM,WAAW,8MAiBvB,CAAC;AAkBF,eAAO,MAAM,OAAO,YAGhB,CAAC;AAEL,eAAO,MAAM,UAAU,SAAU,SAAS,MAAM,EAAE,2QAMuB,CAAC"}

package/dist/credential-guard/registry.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/credential-guard/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAK1C,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,YAAY,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;AAChF,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,MAAM,GACN,SAAS,GACT,cAAc,GACd,eAAe,GACf,OAAO,GACP,UAAU,GACV,QAAQ,GACR,aAAa,GACb,QAAQ,GACR,SAAS,GACT,OAAO,GACP,YAAY,GACZ;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAChC,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,mBAAmB,CAAC;IACjD,QAAQ,CAAC,IAAI,EACT,eAAe,GACf,kBAAkB,GAClB,aAAa,GACb,aAAa,GACb,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,oBAAoB,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,MAAM,GAAG;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AACF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EACf,cAAc,GACd,cAAc,GACd,UAAU,GACV,OAAO,GACP,SAAS,GACT,QAAQ,GACR,KAAK,GACL,SAAS,GACT,SAAS,GACT,OAAO,GACP,MAAM,GACN,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,KAAK,GACL,IAAI,GACJ,OAAO,GACP,MAAM,GACN,IAAI,GACJ,KAAK,GACL,SAAS,GACT,MAAM,GACN,cAAc,GACd,MAAM,CAAC;IACX,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;CACpD,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvD,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;QAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;QAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;KACnC,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,SAAS;QACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;KAC7B,EAAE,CAAC;IACJ,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACxF,CAAC;AA8IF,eAAO,MAAM,WAAW,EAAE,SAAS,eAAe,EA+kGjD,CAAC;AAEF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAInD;AACD,wBAAgB,aAAa,CAC3B,OAAO,GAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAO,GAC9E,QAAQ,CAyCV;AA+ID,wBAAgB,QAAQ,CACtB,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,MAAM,GAAG,YAAqB,EACvC,cAAc,UAAQ,GACrB,cAAc,CAEhB;AA8kDD,wBAAgB,WAAW,CACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC,EAClD,IAAI,EAAE,MAAM,GACX,SAAS,KAAK,EAAE,CAYlB"}
+{"version":3,"file":"registry.d.ts","sourceRoot":"","sources":["../../src/credential-guard/registry.ts"],"names":[],"mappings":"AACA,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAK1C,MAAM,MAAM,QAAQ,GAAG,MAAM,GAAG,YAAY,GAAG,IAAI,GAAG,KAAK,GAAG,KAAK,GAAG,SAAS,CAAC;AAChF,MAAM,MAAM,WAAW,GACnB,MAAM,GACN,MAAM,GACN,SAAS,GACT,cAAc,GACd,eAAe,GACf,OAAO,GACP,UAAU,GACV,QAAQ,GACR,aAAa,GACb,QAAQ,GACR,SAAS,GACT,OAAO,GACP,YAAY,GACZ;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,CAAC;AAChC,MAAM,MAAM,KAAK,GAAG;IAClB,QAAQ,CAAC,IAAI,EAAE,WAAW,GAAG,mBAAmB,CAAC;IACjD,QAAQ,CAAC,IAAI,EACT,eAAe,GACf,kBAAkB,GAClB,aAAa,GACb,aAAa,GACb,mBAAmB,GACnB,iBAAiB,GACjB,kBAAkB,GAClB,uBAAuB,GACvB,oBAAoB,CAAC;IACzB,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAC;CACzB,CAAC;AACF,MAAM,MAAM,MAAM,GAAG;IACnB,QAAQ,CAAC,KAAK,EAAE,SAAS,WAAW,EAAE,CAAC;IACvC,QAAQ,CAAC,KAAK,CAAC,EAAE,KAAK,CAAC;IACvB,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,CAAC;CACjC,CAAC;AACF,MAAM,MAAM,eAAe,GAAG;IAC5B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IACtB,QAAQ,CAAC,oBAAoB,CAAC,EAAE,OAAO,CAAC;IACxC,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,WAAW,CAAC,EAAE,OAAO,CAAC;IAC/B,QAAQ,CAAC,YAAY,CAAC,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,aAAa,CAAC,EAAE,OAAO,CAAC;IACjC,QAAQ,CAAC,qBAAqB,CAAC,EAAE,OAAO,CAAC;IACzC,QAAQ,CAAC,aAAa,CAAC,EAAE,MAAM,GAAG,QAAQ,CAAC;IAC3C,QAAQ,CAAC,gBAAgB,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC9C,QAAQ,CAAC,WAAW,CAAC,EAAE,MAAM,CAAC;IAC9B,QAAQ,CAAC,QAAQ,EAAE,SAAS,WAAW,EAAE,CAAC;IAC1C,QAAQ,CAAC,OAAO,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;IACpD,QAAQ,CAAC,WAAW,CAAC,EAAE,QAAQ,CAAC,MAAM,CAAC,MAAM,EAAE,IAAI,CAAC,eAAe,EAAE,MAAM,CAAC,CAAC,CAAC,CAAC;IAC/E,QAAQ,CAAC,MAAM,CAAC,EAAE,KAAK,GAAG,MAAM,CAAC;IACjC,QAAQ,CAAC,IAAI,CAAC,EAAE,KAAK,CAAC;IACtB,QAAQ,CAAC,OAAO,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IACrC,QAAQ,CAAC,YAAY,CAAC,EAAE,SAAS,MAAM,EAAE,CAAC;IAC1C,QAAQ,CAAC,SAAS,CAAC,EACf,cAAc,GACd,cAAc,GACd,UAAU,GACV,OAAO,GACP,SAAS,GACT,QAAQ,GACR,KAAK,GACL,SAAS,GACT,SAAS,GACT,OAAO,GACP,MAAM,GACN,IAAI,GACJ,KAAK,GACL,IAAI,GACJ,KAAK,GACL,KAAK,GACL,IAAI,GACJ,OAAO,GACP,MAAM,GACN,IAAI,GACJ,KAAK,GACL,SAAS,GACT,MAAM,GACN,cAAc,GACd,MAAM,CAAC;IACX,QAAQ,CAAC,MAAM,CAAC,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;CACpD,CAAC;AACF,MAAM,MAAM,QAAQ,GAAG;IACrB,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,eAAe,CAAC,CAAC;IACvD,QAAQ,CAAC,gBAAgB,EAAE,WAAW,CAAC,MAAM,CAAC,CAAC;IAC/C,QAAQ,CAAC,OAAO,EAAE,WAAW,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC;CAC/C,CAAC;AACF,MAAM,MAAM,cAAc,GAAG;IAC3B,QAAQ,CAAC,MAAM,EAAE,OAAO,CAAC;IACzB,QAAQ,CAAC,UAAU,EAAE,UAAU,GAAG,IAAI,CAAC;IACvC,QAAQ,CAAC,KAAK,EAAE,SAAS;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,IAAI,EAAE,WAAW,CAAC;QAC3B,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAC;KAC3B,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,EAAE,SAAS,KAAK,EAAE,CAAC;IAClC,QAAQ,CAAC,QAAQ,EAAE,SAAS;QAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;QACrB,QAAQ,CAAC,WAAW,EAAE,OAAO,CAAC;QAC9B,QAAQ,CAAC,WAAW,EAAE,MAAM,GAAG,IAAI,CAAC;QACpC,QAAQ,CAAC,SAAS,EAAE,SAAS,MAAM,EAAE,GAAG,IAAI,CAAC;QAC7C,QAAQ,CAAC,cAAc,CAAC,EAAE,OAAO,CAAC;KACnC,EAAE,CAAC;IACJ,QAAQ,CAAC,WAAW,EAAE,SAAS;QAC7B,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;QACtB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;KACxB,EAAE,CAAC;IACJ,QAAQ,CAAC,MAAM,EAAE,QAAQ,GAAG,WAAW,GAAG,OAAO,CAAC;IAClD,QAAQ,CAAC,KAAK,EAAE,MAAM,GAAG,IAAI,GAAG,QAAQ,CAAC;IACzC,QAAQ,CAAC,SAAS,EAAE,QAAQ,GAAG,IAAI,CAAC;IACpC,QAAQ,CAAC,mBAAmB,EAAE,OAAO,CAAC;IACtC,QAAQ,CAAC,aAAa,EAAE,OAAO,CAAC;IAChC,QAAQ,CAAC,YAAY,EAAE,SAAS,MAAM,EAAE,CAAC;IACzC,QAAQ,CAAC,eAAe,EAAE,OAAO,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,SAAS;QACjC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QACvB,QAAQ,CAAC,OAAO,EAAE,SAAS,MAAM,EAAE,CAAC;QACpC,QAAQ,CAAC,SAAS,EAAE,OAAO,CAAC;KAC7B,EAAE,CAAC;IACJ,QAAQ,CAAC,mBAAmB,EAAE,MAAM,GAAG,IAAI,CAAC;IAC5C,QAAQ,CAAC,cAAc,EAAE,QAAQ,CAAC;IAClC,QAAQ,CAAC,eAAe,EAAE,SAAS,MAAM,EAAE,CAAC;IAC5C,QAAQ,CAAC,WAAW,EAAE,SAAS;QAAE,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;QAAC,QAAQ,CAAC,OAAO,CAAC,EAAE,MAAM,CAAA;KAAE,EAAE,CAAC;CACxF,CAAC;AA8IF,eAAO,MAAM,WAAW,EAAE,SAAS,eAAe,EAupGjD,CAAC;AAEF,wBAAgB,aAAa,CAAC,KAAK,EAAE,MAAM,GAAG,OAAO,CAEpD;AAED,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAInD;AACD,wBAAgB,aAAa,CAC3B,OAAO,GAAE,SAAS;IAAE,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAC;IAAC,QAAQ,CAAC,UAAU,EAAE,MAAM,CAAA;CAAE,EAAO,GAC9E,QAAQ,CAyCV;AA+ID,wBAAgB,QAAQ,CACtB,IAAI,EAAE,SAAS,CAAC,MAAM,GAAG,SAAS,CAAC,EAAE,EACrC,QAAQ,EAAE,QAAQ,EAClB,OAAO,GAAE,MAAM,GAAG,YAAqB,EACvC,cAAc,UAAQ,GACrB,cAAc,CAEhB;AAgmDD,wBAAgB,WAAW,CACzB,QAAQ,EAAE,OAAO,CAAC,QAAQ,EAAE,MAAM,GAAG,YAAY,CAAC,EAClD,IAAI,EAAE,MAAM,GACX,SAAS,KAAK,EAAE,CAYlB"}

package/dist/db-tool/main.d.ts

@@ -1,3 +1,10 @@
 #!/usr/bin/env bun
-export {};
+import { Command } from "effect/cli";
+import { Effect } from "effect";
+import { ConfigService } from "#config";
+import { DbConfigService } from "./config-service";
+import { DbService } from "./service";
+export declare const mainCommand: Command.Command<"db-tool", {} | {}, {}, import("./errors").DbError, ConfigService | DbConfigService | DbService>;
+export declare const runMain: () => void;
+export declare const runProgram: (args: readonly string[]) => Effect.Effect<void, import("../config/loader").ConfigLoadError | import("effect/cli/CliError").CliError | import("./errors").DbError, never>;
 //# sourceMappingURL=main.d.ts.map

package/dist/db-tool/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/db-tool/main.ts"],"names":[],"mappings":""}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/db-tool/main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAQ,MAAM,YAAY,CAAC;AAE3C,OAAO,EAAE,MAAM,EAAiB,MAAM,QAAQ,CAAC;AAe/C,OAAO,EAAE,aAAa,EAA6C,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,eAAe,EAAqB,MAAM,kBAAkB,CAAC;AAEtE,OAAO,EAAE,SAAS,EAAE,MAAM,WAAW,CAAC;AA8MtC,eAAO,MAAM,WAAW,kHAWvB,CAAC;AAyBF,eAAO,MAAM,OAAO,YAGhB,CAAC;AAEL,eAAO,MAAM,UAAU,SAAU,SAAS,MAAM,EAAE,iJAGuB,CAAC"}

package/dist/db-tool/service.d.ts

@@ -32,6 +32,7 @@ export declare function resolveHostOverride(literalHost: string, hostEnvVar: str
 export declare function resolveDbAccessMode(env: string, host: string, hasKubectlConfig: boolean, allowedMutations?: readonly DbMutationOperation[]): Pick<DbConfig, "allowMutations" | "allowedMutations" | "host" | "needsTunnel">;
 export declare function isFullyReadOnly(config: Pick<DbConfig, "allowMutations" | "allowedMutations" | "allowedMutationTargets">): boolean;
 export { buildApiProbeArgs } from "#shared/k8s-probe";
+export declare const DbGuardianInProcess: Context.Reference<boolean>;
 declare const DbService_base: Context.ServiceClass<DbService, "@agent-tools/DbService", {
     readonly executeQuery: (env: string, sql: string, limit?: number) => Effect.Effect<QueryResult, DbError>;
     readonly executeSchemaQuery: (env: string, mode: SchemaMode, table?: string) => Effect.Effect<QueryResult, DbError>;

package/dist/db-tool/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/db-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAS,OAAO,EAAY,MAAM,EAAE,KAAK,EAAkB,MAAM,QAAQ,CAAC;AAEjF,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAIxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAKvD,OAAO,EAAE,eAAe,EAA4B,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,UAAU,CAAC;AAwBlB,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,oBAAoB,CAqBtB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAOR;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,OAAO,EACzB,gBAAgB,GAAE,SAAS,mBAAmB,EAAO,GACpD,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,MAAM,GAAG,aAAa,CAAC,CAUhF;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,wBAAwB,CAAC,GACvF,OAAO,CAMT;AAGD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;;2BAK3B,CACrB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;iCACX,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,EAChB,KAAK,CAAC,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;;AAZ5C,qBAAa,SAAU,SAAQ,cAcF;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,6IAmvBnB;CACH"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/db-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,gBAAgB,CAAC;AACnE,OAAO,EAAS,OAAO,EAAY,MAAM,EAAE,KAAK,EAAkB,MAAM,QAAQ,CAAC;AAEjF,OAAO,KAAK,EAAE,QAAQ,EAAE,mBAAmB,EAAE,WAAW,EAAE,UAAU,EAAE,MAAM,SAAS,CAAC;AAEtF,OAAO,EAAE,aAAa,EAAE,MAAM,SAAS,CAAC;AAIxC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AAKvD,OAAO,EAAE,eAAe,EAA4B,MAAM,kBAAkB,CAAC;AAC7E,OAAO,EAAE,WAAW,EAAqB,MAAM,cAAc,CAAC;AAC9D,OAAO,EAKL,KAAK,OAAO,EACb,MAAM,UAAU,CAAC;AAwBlB,MAAM,MAAM,oBAAoB,GAC5B;IAAE,QAAQ,CAAC,EAAE,EAAE,IAAI,CAAC;IAAC,QAAQ,CAAC,IAAI,EAAE,MAAM,CAAA;CAAE,GAC5C;IAAE,QAAQ,CAAC,EAAE,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,OAAO,EAAE,MAAM,CAAA;CAAE,CAAC;AAErD;;;;;;;;GAQG;AACH,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,oBAAoB,CAqBtB;AAED;;;;GAIG;AACH,wBAAgB,mBAAmB,CACjC,WAAW,EAAE,MAAM,EACnB,UAAU,EAAE,MAAM,GAAG,SAAS,EAC9B,KAAK,EAAE,MAAM,GAAG,SAAS,GACxB,MAAM,CAOR;AAED,wBAAgB,mBAAmB,CACjC,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,MAAM,EACZ,gBAAgB,EAAE,OAAO,EACzB,gBAAgB,GAAE,SAAS,mBAAmB,EAAO,GACpD,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,MAAM,GAAG,aAAa,CAAC,CAUhF;AAED,wBAAgB,eAAe,CAC7B,MAAM,EAAE,IAAI,CAAC,QAAQ,EAAE,gBAAgB,GAAG,kBAAkB,GAAG,wBAAwB,CAAC,GACvF,OAAO,CAMT;AAGD,OAAO,EAAE,iBAAiB,EAAE,MAAM,mBAAmB,CAAC;AAEtD,eAAO,MAAM,mBAAmB,4BAE9B,CAAC;;2BAKwB,CACrB,GAAG,EAAE,MAAM,EACX,GAAG,EAAE,MAAM,EACX,KAAK,CAAC,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;iCACX,CAC3B,GAAG,EAAE,MAAM,EACX,IAAI,EAAE,UAAU,EAChB,KAAK,CAAC,EAAE,MAAM,KACX,MAAM,CAAC,MAAM,CAAC,WAAW,EAAE,OAAO,CAAC;;AAZ5C,qBAAa,SAAU,SAAQ,cAcF;IAC3B,MAAM,CAAC,QAAQ,CAAC,KAAK,6IAovBnB;CACH"}

package/dist/gh-tool/main.d.ts

@@ -1,3 +1,6 @@
 #!/usr/bin/env bun
-export {};
+import { Command } from "effect/cli";
+import { GitHubService } from "./read/transport";
+export declare const mainCommand: Command.Command<"gh-tool", {} | {}, {}, any, import("effect/process/ChildProcessSpawner").ChildProcessSpawner | GitHubService>;
+export declare const runMain: () => void;
 //# sourceMappingURL=main.d.ts.map

package/dist/gh-tool/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/gh-tool/main.ts"],"names":[],"mappings":""}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/gh-tool/main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAkFrC,OAAO,EAAE,aAAa,EAAE,MAAM,kBAAkB,CAAC;AA6IjD,eAAO,MAAM,WAAW,gIAiDvB,CAAC;AAoCF,eAAO,MAAM,OAAO,YAGhB,CAAC"}

package/dist/gh-tool/read/store.d.ts

@@ -40,11 +40,14 @@ export declare const defaultCacheDirectory: () => string;
 export declare class FileStore {
     readonly directory: string;
     readonly identity: string;
+    private readonly contentionTimeoutMs;
     private readonly counters;
     private readonly statsId;
     private statsWrite;
     private constructor();
-    static open(identity: string, directory?: string): Promise<FileStore>;
+    static open(identity: string, directory?: string, options?: {
+        contentionTimeoutMs?: number;
+    }): Promise<FileStore>;
     readClock(): Promise<ReadFence>;
     private clockUnderLock;
     get ghCacheDirectory(): string;

package/dist/gh-tool/read/store.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/read/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,MAAM,EAAE,MAAM,QAAQ,CAAC;AAKlD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAEpD,QAAA,MAAM,WAAW;;;EAAuE,CAAC;AACzF,MAAM,MAAM,SAAS,GAAG,OAAO,WAAW,CAAC,IAAI,CAAC;AAEhD,QAAA,MAAM,WAAW;;;;;;;;;;;;EASf,CAAC;AAIH,KAAK,KAAK,GAAG,IAAI,CAAC,OAAO,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,GAAG;IAAE,cAAc,EAAE,SAAS,CAAA;CAAE,CAAC;AAC7F,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAChE,MAAM,MAAM,QAAQ,CAAC,CAAC,IAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC3C;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,GAAG;QAAE,KAAK,EAAE,CAAC,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CAClD,CAAC;AA4CN,eAAO,MAAM,qBAAqB,QAAO,MACc,CAAC;AACxD,qBAAa,SAAS;IAKlB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM;IAL3B,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,eAGH;IAEJ,OAAa,IAAI,CACf,QAAQ,EAAE,MAAM,EAChB,SAAS,SAA8D,GACtE,OAAO,CAAC,SAAS,CAAC,CA8BpB;IAED,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,CAE9B;YAEa,cAAc;IAoC5B,IAAI,gBAAgB,IAAI,MAAM,CAE7B;YAEa,KAAK;YA+BL,MAAM;YAwCN,gBAAgB;YAyBhB,aAAa;IAmBrB,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAW9C;IAEK,MAAM,CACV,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,OAAO,GACvE,OAAO,CAAC,IAAI,CAAC,CASf;IAEK,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,CAoBjC;YAEa,KAAK;IAuBnB,OAAO,CAAC,CAAC,EACP,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,EAC7B,cAAc,GAAE,CAAC,KAAK,EAAE,CAAC,KAAK,UAAyB,EACvD,KAAK,UAAQ,GACZ,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAmDtB;IAED,GAAG,CAAC,CAAC,EACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,EACjD,KAAK,EAAE,CAAC,EACR,SAAS,EAAE,OAAO,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAmClB;IAED,aAAa,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAcpF;IAEK,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYvD;IAEK,KAAK,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/C;CACF"}
+{"version":3,"file":"store.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/read/store.ts"],"names":[],"mappings":"AAAA,OAAO,EAAoB,MAAM,EAAE,MAAM,QAAQ,CAAC;AAKlD,OAAO,KAAK,EAAE,UAAU,EAAE,MAAM,WAAW,CAAC;AAE5C,OAAO,KAAK,EAAE,OAAO,EAAE,OAAO,EAAE,GAAG,EAAE,MAAM,QAAQ,CAAC;AAEpD,QAAA,MAAM,WAAW;;;EAAuE,CAAC;AACzF,MAAM,MAAM,SAAS,GAAG,OAAO,WAAW,CAAC,IAAI,CAAC;AAEhD,QAAA,MAAM,WAAW;;;;;;;;;;;;EASf,CAAC;AAIH,KAAK,KAAK,GAAG,IAAI,CAAC,OAAO,WAAW,CAAC,IAAI,EAAE,gBAAgB,CAAC,GAAG;IAAE,cAAc,EAAE,SAAS,CAAA;CAAE,CAAC;AAC7F,MAAM,MAAM,UAAU,GAAG,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,CAAC,CAAC,CAAC;AAChE,MAAM,MAAM,QAAQ,CAAC,CAAC,IAClB;IAAE,QAAQ,CAAC,IAAI,EAAE,KAAK,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAC3C;IACE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IACvB,QAAQ,CAAC,GAAG,EAAE,MAAM,CAAC;IACrB,QAAQ,CAAC,OAAO,EAAE,OAAO,CAAC;IAC1B,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAC;IACvB,QAAQ,CAAC,cAAc,EAAE,SAAS,CAAC;IACnC,QAAQ,CAAC,QAAQ,EAAE,CAAC,KAAK,GAAG;QAAE,KAAK,EAAE,CAAC,CAAA;KAAE,CAAC,GAAG,IAAI,CAAC;CAClD,CAAC;AA4CN,eAAO,MAAM,qBAAqB,QAAO,MACc,CAAC;AACxD,qBAAa,SAAS;IAKlB,QAAQ,CAAC,SAAS,EAAE,MAAM;IAC1B,QAAQ,CAAC,QAAQ,EAAE,MAAM;IACzB,OAAO,CAAC,QAAQ,CAAC,mBAAmB;IANtC,OAAO,CAAC,QAAQ,CAAC,QAAQ,CAAkB;IAC3C,OAAO,CAAC,QAAQ,CAAC,OAAO,CAAyC;IACjE,OAAO,CAAC,UAAU,CAAqB;IACvC,OAAO,eAIH;IAEJ,OAAa,IAAI,CACf,QAAQ,EAAE,MAAM,EAChB,SAAS,SAA8D,EACvE,OAAO,GAAE;QAAE,mBAAmB,CAAC,EAAE,MAAM,CAAA;KAAO,GAC7C,OAAO,CAAC,SAAS,CAAC,CAkCpB;IAED,SAAS,IAAI,OAAO,CAAC,SAAS,CAAC,CAE9B;YAEa,cAAc;IAoC5B,IAAI,gBAAgB,IAAI,MAAM,CAE7B;YAEa,KAAK;YA+BL,MAAM;YAwCN,gBAAgB;YAyBhB,aAAa;IAmBrB,IAAI,CAAC,IAAI,EAAE,SAAS,GAAG,EAAE,GAAG,OAAO,CAAC,IAAI,CAAC,CAW9C;IAEK,MAAM,CACV,EAAE,EAAE,MAAM,EACV,OAAO,EAAE,KAAK,GAAG,OAAO,GAAG,MAAM,GAAG,aAAa,GAAG,UAAU,GAAG,OAAO,GACvE,OAAO,CAAC,IAAI,CAAC,CASf;IAEK,KAAK,IAAI,OAAO,CAAC,UAAU,CAAC,CAoBjC;YAEa,KAAK;IAuBnB,OAAO,CAAC,CAAC,EACP,OAAO,EAAE,OAAO,EAChB,MAAM,EAAE,UAAU,EAClB,MAAM,EAAE,CAAC,KAAK,EAAE,OAAO,KAAK,CAAC,EAC7B,cAAc,GAAE,CAAC,KAAK,EAAE,CAAC,KAAK,UAAyB,EACvD,KAAK,UAAQ,GACZ,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,CAAC,CAmDtB;IAED,GAAG,CAAC,CAAC,EACH,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,EACjD,KAAK,EAAE,CAAC,EACR,SAAS,EAAE,OAAO,EAClB,IAAI,CAAC,EAAE,MAAM,GACZ,OAAO,CAAC,OAAO,CAAC,CAmClB;IAED,aAAa,CAAC,CAAC,EAAE,QAAQ,EAAE,OAAO,CAAC,QAAQ,CAAC,CAAC,CAAC,EAAE;QAAE,IAAI,EAAE,OAAO,CAAA;KAAE,CAAC,GAAG,OAAO,CAAC,OAAO,CAAC,CAcpF;IAEK,OAAO,CAAC,GAAG,EAAE,MAAM,EAAE,KAAK,EAAE,MAAM,GAAG,OAAO,CAAC,IAAI,CAAC,CAYvD;IAEK,KAAK,CAAC,IAAI,EAAE,OAAO,GAAG,IAAI,GAAG,OAAO,CAAC,IAAI,CAAC,CAc/C;CACF"}

package/dist/k8s-tool/main.d.ts

@@ -1,3 +1,10 @@
 #!/usr/bin/env bun
-export {};
+import { Command } from "effect/cli";
+import { Effect } from "effect";
+import { K8sService } from "./service";
+import { ConfigService } from "#config";
+import { K8sContextError } from "./errors";
+export declare const mainCommand: Command.Command<"k8s-tool", {} | {}, {}, K8sContextError, ConfigService | K8sService>;
+export declare const runMain: () => void;
+export declare const runProgram: (args: readonly string[]) => Effect.Effect<void, import("../config/loader").ConfigLoadError | K8sContextError | import("effect/cli/CliError").CliError, never>;
 //# sourceMappingURL=main.d.ts.map

package/dist/k8s-tool/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/k8s-tool/main.ts"],"names":[],"mappings":""}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/k8s-tool/main.ts"],"names":[],"mappings":";AACA,OAAO,EAAE,OAAO,EAAQ,MAAM,YAAY,CAAC;AAE3C,OAAO,EAAE,MAAM,EAAiB,MAAM,QAAQ,CAAC;AAc/C,OAAO,EAAE,UAAU,EAAmB,MAAM,WAAW,CAAC;AACxD,OAAO,EAAE,aAAa,EAA4D,MAAM,SAAS,CAAC;AAElG,OAAO,EAAE,eAAe,EAAE,MAAM,UAAU,CAAC;AAub3C,eAAO,MAAM,WAAW,uFAWvB,CAAC;AAkBF,eAAO,MAAM,OAAO,YAGhB,CAAC;AAEL,eAAO,MAAM,UAAU,SAAU,SAAS,MAAM,EAAE,sIAGuB,CAAC"}

package/dist/logs-tool/main.d.ts

@@ -12,9 +12,13 @@
  * Always start with --list to see available log files.
  * Use --format toon for LLM-optimized output (fewer tokens).
  */
+import { Command } from "effect/cli";
 import { Effect } from "effect";
 import { ConfigService } from "#config";
 import { LogsConfigError } from "./errors";
 import { LogsService } from "./service";
+export declare const mainCommand: Command.Command<"logs-tool", {} | {}, {}, LogsConfigError, ConfigService | LogsService>;
 export declare const run: (args: ReadonlyArray<string>) => Effect.Effect<void, LogsConfigError | import("effect/cli/CliError").CliError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner | ConfigService | import("effect/FileSystem").FileSystem | LogsService | import("effect/Path").Path | import("effect/Stdio").Stdio | import("effect/Terminal").Terminal>;
+export declare const runMain: () => void;
+export declare const runProgram: (args: readonly string[]) => Effect.Effect<void, import("../config/loader").ConfigLoadError | LogsConfigError | import("effect/cli/CliError").CliError, never>;
 //# sourceMappingURL=main.d.ts.map

package/dist/logs-tool/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/logs-tool/main.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;GAYG;AAIH,OAAO,EAAE,MAAM,EAAyB,MAAM,QAAQ,CAAC;AAcvD,OAAO,EAAE,aAAa,EAA6C,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,eAAe,EAAsD,MAAM,UAAU,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAoB,MAAM,WAAW,CAAC;AA2M1D,eAAO,MAAM,GAAG,SAAU,aAAa,CAAC,MAAM,CAAC,4TAC6C,CAAC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/logs-tool/main.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAQ,MAAM,YAAY,CAAC;AAE3C,OAAO,EAAE,MAAM,EAAyB,MAAM,QAAQ,CAAC;AAcvD,OAAO,EAAE,aAAa,EAA6C,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,eAAe,EAAsD,MAAM,UAAU,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAoB,MAAM,WAAW,CAAC;AA6L1D,eAAO,MAAM,WAAW,yFAGvB,CAAC;AAWF,eAAO,MAAM,GAAG,SAAU,aAAa,CAAC,MAAM,CAAC,4TAC6C,CAAC;AAa7F,eAAO,MAAM,OAAO,YAGhB,CAAC;AAEL,eAAO,MAAM,UAAU,SAAU,SAAS,MAAM,EAAE,sIAMuB,CAAC"}

package/dist/observability-tool/main.d.ts

@@ -1,3 +1,8 @@
 #!/usr/bin/env bun
-export {};
+import { Effect } from "effect";
+import { Command } from "effect/cli";
+import { SecretEnvResolver } from "#shared/secret-env";
+export declare const mainCommand: Command.Command<"observability-tool", {} | {}, {}, never, import("#config").ConfigService | SecretEnvResolver>;
+export declare const runMain: () => void;
+export declare const runProgram: (args: readonly string[]) => Effect.Effect<void, import("../config/loader").ConfigLoadError | import("effect/cli/CliError").CliError, never>;
 //# sourceMappingURL=main.d.ts.map

package/dist/observability-tool/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/observability-tool/main.ts"],"names":[],"mappings":""}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/observability-tool/main.ts"],"names":[],"mappings":";AAGA,OAAO,EAAE,MAAM,EAAS,MAAM,QAAQ,CAAC;AACvC,OAAO,EAAE,OAAO,EAAE,MAAM,YAAY,CAAC;AAKrC,OAAO,EAAE,iBAAiB,EAAE,MAAM,oBAAoB,CAAC;AASvD,eAAO,MAAM,WAAW,gHAKvB,CAAC;AAgBF,eAAO,MAAM,OAAO,YAAqE,CAAC;AAE1F,eAAO,MAAM,UAAU,SAAU,SAAS,MAAM,EAAE,oHAMuB,CAAC"}

package/dist/session-tool/main.d.ts

@@ -5,8 +5,12 @@
  * Lists, searches, and reads OpenCode session history.
  * Uses current project scope by default, or all projects with --all.
  */
+import { Command } from "effect/cli";
 import { Effect } from "effect";
 import { ResolvedPaths } from "./config";
 import { SessionService } from "./service";
+export declare const mainCommand: Command.Command<"session-tool", {} | {}, {}, never, ResolvedPaths | SessionService>;
 export declare const run: (args: ReadonlyArray<string>) => Effect.Effect<void, import("effect/cli/CliError").CliError, import("effect/process/ChildProcessSpawner").ChildProcessSpawner | import("effect/FileSystem").FileSystem | import("effect/Path").Path | ResolvedPaths | SessionService | import("effect/Stdio").Stdio | import("effect/Terminal").Terminal>;
+export declare const runProgram: (args: readonly string[]) => Effect.Effect<void, import("effect/cli/CliError").CliError | undefined, never>;
+export declare const runMain: () => void;
 //# sourceMappingURL=main.d.ts.map

package/dist/session-tool/main.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/session-tool/main.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAIH,OAAO,EAAE,MAAM,EAAiB,MAAM,QAAQ,CAAC;AAgB/C,OAAO,EAAE,aAAa,EAAsB,MAAM,UAAU,CAAC;AAE7D,OAAO,EAAc,cAAc,EAAuB,MAAM,WAAW,CAAC;AAqT5E,eAAO,MAAM,GAAG,SAAU,aAAa,CAAC,MAAM,CAAC,6SAC6C,CAAC"}
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/session-tool/main.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAEH,OAAO,EAAY,OAAO,EAAQ,MAAM,YAAY,CAAC;AAErD,OAAO,EAAE,MAAM,EAAiB,MAAM,QAAQ,CAAC;AAgB/C,OAAO,EAAE,aAAa,EAAsB,MAAM,UAAU,CAAC;AAE7D,OAAO,EAAc,cAAc,EAAuB,MAAM,WAAW,CAAC;AAuS5E,eAAO,MAAM,WAAW,qFAGvB,CAAC;AAMF,eAAO,MAAM,GAAG,SAAU,aAAa,CAAC,MAAM,CAAC,6SAC6C,CAAC;AAO7F,eAAO,MAAM,UAAU,SAAU,SAAS,MAAM,EAAE,mFAI/C,CAAC;AAEJ,eAAO,MAAM,OAAO,YAGhB,CAAC"}

package/dist/shared/secret-env.d.ts

@@ -1,3 +1,4 @@
+import { spawn, type SpawnOptions } from "node:child_process";
 import { Context, Layer } from "effect";
 export type LookupResult = {
     readonly _tag: "found";
@@ -9,6 +10,14 @@ export type LookupResult = {
     readonly reason: string;
 };
 export type ZshRunner = (name: string, timeoutMs: number) => Promise<LookupResult>;
+type ZshProcess = Pick<ReturnType<typeof spawn>, "pid" | "stdio" | "kill"> & {
+    on: {
+        (event: "error", listener: () => void): unknown;
+        (event: "exit", listener: (code: number | null) => void): unknown;
+    };
+};
+export type ZshLauncher = (command: string, args: readonly string[], options: SpawnOptions) => ZshProcess;
+export declare const makeZshRunner: (launch?: ZshLauncher, terminate?: (pid: number) => void) => ZshRunner;
 declare const SecretEnvResolver_base: Context.ServiceClass<SecretEnvResolver, "@agent-tools/SecretEnvResolver", {
     readonly resolveSecretEnv: (name: string) => Promise<string>;
     readonly lookupConfigEnv: (name: string) => Promise<LookupResult>;

package/dist/shared/secret-env.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"secret-env.d.ts","sourceRoot":"","sources":["../../src/shared/secret-env.ts"],"names":[],"mappings":"AAGA,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAqBxC,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;;+BAmJpD,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;8BAClC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC;;AAJrE,qBAAa,iBAAkB,SAAQ,sBAMF;IACnC,MAAM,KAAK,SAAS,iDAEnB;IACD,MAAM,CAAC,QAAQ,CAAC,SAAS,YAAY,SAAS,kDACT;CACtC;AAED,wBAAgB,0BAA0B,CACxC,MAAM,GAAE,SAA6B,EACrC,SAAS,SAAqB,gDAwC/B"}
+{"version":3,"file":"secret-env.d.ts","sourceRoot":"","sources":["../../src/shared/secret-env.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,KAAK,EAAE,KAAK,YAAY,EAAE,MAAM,oBAAoB,CAAC;AAG9D,OAAO,EAAE,OAAO,EAAE,KAAK,EAAE,MAAM,QAAQ,CAAC;AAqBxC,MAAM,MAAM,YAAY,GACpB;IAAE,QAAQ,CAAC,IAAI,EAAE,OAAO,CAAC;IAAC,QAAQ,CAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAClD;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAA;CAAE,GAC3B;IAAE,QAAQ,CAAC,IAAI,EAAE,QAAQ,CAAC;IAAC,QAAQ,CAAC,MAAM,EAAE,MAAM,CAAA;CAAE,CAAC;AAEzD,MAAM,MAAM,SAAS,GAAG,CAAC,IAAI,EAAE,MAAM,EAAE,SAAS,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC,CAAC;AAgDnF,KAAK,UAAU,GAAG,IAAI,CAAC,UAAU,CAAC,OAAO,KAAK,CAAC,EAAE,KAAK,GAAG,OAAO,GAAG,MAAM,CAAC,GAAG;IAC3E,EAAE,EAAE;QACF,CAAC,KAAK,EAAE,OAAO,EAAE,QAAQ,EAAE,MAAM,IAAI,GAAG,OAAO,CAAC;QAChD,CAAC,KAAK,EAAE,MAAM,EAAE,QAAQ,EAAE,CAAC,IAAI,EAAE,MAAM,GAAG,IAAI,KAAK,IAAI,GAAG,OAAO,CAAC;KACnE,CAAC;CACH,CAAC;AACF,MAAM,MAAM,WAAW,GAAG,CACxB,OAAO,EAAE,MAAM,EACf,IAAI,EAAE,SAAS,MAAM,EAAE,EACvB,OAAO,EAAE,YAAY,KAClB,UAAU,CAAC;AAChB,eAAO,MAAM,aAAa,YAEd,WAAW,cACR,CAAC,GAAG,EAAE,MAAM,KAAK,IAAI,KAG/B,SA+FC,CAAC;;+BAOwB,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,MAAM,CAAC;8BAClC,CAAC,IAAI,EAAE,MAAM,KAAK,OAAO,CAAC,YAAY,CAAC;;AAJrE,qBAAa,iBAAkB,SAAQ,sBAMF;IACnC,MAAM,KAAK,SAAS,iDAEnB;IACD,MAAM,CAAC,QAAQ,CAAC,SAAS,YAAY,SAAS,kDACT;CACtC;AAED,wBAAgB,0BAA0B,CACxC,MAAM,GAAE,SAA6B,EACrC,SAAS,SAAqB,gDAwC/B"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.14.5",
+  "version": "1.14.6",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",
@@ -158,7 +158,7 @@
     "session-tool": "bun src/session-tool/index.ts",
     "update:packages": "bun update -i -r",
     "update:skills": "bun run .agents/skills/update-packages/references/skills-update-local.ts",
-    "test": "vitest run",
+    "test": "bun --bun node_modules/vitest/vitest.mjs run",
     "api-tool": "bun src/api-tool/index.ts",
     "api-proxy": "bun src/api-tool/proxy-entry.ts"
   },

package/src/api-tool/index.ts

@@ -1,4 +1,4 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;

package/src/api-tool/main.ts

@@ -44,15 +44,28 @@ const requestCommand = Command.make(
 ).pipe(
   Command.withDescription("Send a JSON REST request through an operator-owned credential proxy"),
 );
-const command = Command.make("api-tool", {}).pipe(Command.withSubcommands([requestCommand]));
-BunRuntime.runMain(
-  Command.run(command, { version: VERSION, renderErrors: false }).pipe(
+export const mainCommand = Command.make("api-tool", {}).pipe(
+  Command.withSubcommands([requestCommand]),
+);
+export const runMain = () =>
+  BunRuntime.runMain(
+    Command.run(mainCommand, { version: VERSION, renderErrors: false }).pipe(
+      Effect.provide(BunServices.layer),
+      Effect.tapError((error) =>
+        Console.error(
+          JSON.stringify(error instanceof ApiError ? safeError(error) : apiError("CONFIG_INVALID")),
+        ),
+      ),
+    ),
+    { disableErrorReporting: true },
+  );
+
+export const runProgram = (args: readonly string[]) =>
+  Command.runWith(mainCommand, { version: VERSION, renderErrors: false })(args).pipe(
     Effect.provide(BunServices.layer),
     Effect.tapError((error) =>
       Console.error(
         JSON.stringify(error instanceof ApiError ? safeError(error) : apiError("CONFIG_INVALID")),
       ),
     ),
-  ),
-  { disableErrorReporting: true },
-);
+  );

package/src/audit-tool/index.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
 
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;

package/src/audit-tool/main.ts

@@ -91,7 +91,7 @@ const purgeCommand = Command.make(
 
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
-const mainCommand = Command.make("audit-tool", {}).pipe(
+export const mainCommand = Command.make("audit-tool", {}).pipe(
   Command.withDescription("Audit log inspection and maintenance for agent-tools"),
   Command.withSubcommands([listCommand, purgeCommand, commandsCommand]),
 );
@@ -108,6 +108,15 @@ const program = withRedactedOutput(withAudit("audit", cli)).pipe(
   Effect.tapCause(renderCauseToStderr),
 );
 
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+export const runMain = () =>
+  BunRuntime.runMain(program, {
+    disableErrorReporting: true,
+  });
+
+export const runProgram = (args: readonly string[]) =>
+  withRedactedOutput(
+    withAudit(
+      "audit",
+      Command.runWith(mainCommand, { version: VERSION, renderErrors: false })(args),
+    ),
+  ).pipe(Effect.provide(MainLayer), Effect.tapCause(renderCauseToStderr));

package/src/az-tool/index.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
 
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;

package/src/az-tool/main.ts

@@ -110,7 +110,7 @@ EXAMPLES:
 
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
-const mainCommand = Command.make("az-tool", {}).pipe(
+export const mainCommand = Command.make("az-tool", {}).pipe(
   Command.withDescription(
     `Azure Platform Tool for Coding Agents (READ-ONLY)
 
@@ -150,6 +150,12 @@ const program = withRedactedOutput(withAudit("az", cli)).pipe(
   Effect.tapCause(renderCauseToStderr),
 );
 
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+export const runMain = () =>
+  BunRuntime.runMain(program, {
+    disableErrorReporting: true,
+  });
+
+export const runProgram = (args: readonly string[]) =>
+  withRedactedOutput(
+    withAudit("az", Command.runWith(mainCommand, { version: VERSION, renderErrors: false })(args)),
+  ).pipe(Effect.provide(MainLayer), Effect.tapCause(renderCauseToStderr));

package/src/azdo-tool/index.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
 
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;

package/src/azdo-tool/main.ts

@@ -184,7 +184,7 @@ EXAMPLES:
 
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
-const mainCommand = Command.make("azdo-tool", {}).pipe(
+export const mainCommand = Command.make("azdo-tool", {}).pipe(
   Command.withDescription(
     `Azure DevOps Tool for Coding Agents (READ-ONLY)
 
@@ -219,6 +219,15 @@ const program = withRedactedOutput(withAudit("azdo", cli)).pipe(
   Effect.tapCause(renderCauseToStderr),
 );
 
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+export const runMain = () =>
+  BunRuntime.runMain(program, {
+    disableErrorReporting: true,
+  });
+
+export const runProgram = (args: readonly string[]) =>
+  withRedactedOutput(
+    withAudit(
+      "azdo",
+      Command.runWith(mainCommand, { version: VERSION, renderErrors: false })(args),
+    ),
+  ).pipe(Effect.provide(MainLayer), Effect.tapCause(renderCauseToStderr));

package/src/credential-guard/registry.ts

@@ -1164,6 +1164,78 @@ export const EXECUTABLES: readonly ExecutableEntry[] = [
     operands: [path],
     startup: ["JAVA_TOOL_OPTIONS", "JDK_JAVA_OPTIONS", "CLASSPATH", "_JAVA_OPTIONS", "JAVA_HOME"],
   },
+  {
+    name: "hc",
+    rejectsAbbreviations: true,
+    options: {
+      ...flags("--json", "--help", "-h", "--version", "-V", "--skill", "--licenses"),
+    },
+    operands: [data],
+    subcommands: {
+      ...Object.fromEntries(
+        [
+          "get",
+          "keys",
+          "interrupt",
+          "attach",
+          "kill",
+          "rm",
+          "label",
+          "keep",
+          "ls",
+          "read",
+          "wait",
+          "templates",
+          "events",
+          "schema",
+          "connect",
+          "server",
+        ].map((name) => [
+          name,
+          {
+            operands: [data],
+            options: {
+              ...flags("--all", "--off", "--wait", "--force"),
+              "--lines": arg(data),
+              "--output": arg(data),
+              "--children": arg(data),
+              "--timeout": arg(data),
+            },
+          },
+        ]),
+      ),
+      send: {
+        operands: [data, path],
+        options: {
+          ...flags("--force", "--json", "--wait"),
+          "--if": arg(data),
+          "--timeout": arg(data),
+        },
+      },
+      run: {
+        operands: [data],
+        options: {
+          ...flags("--bg", "--outlive-parent", "--no-parent", "--no-notify", "--rm", "--keep"),
+          "--name": arg(data),
+          "--cwd": arg(path),
+          "--on": arg(data),
+          "--label": arg(data),
+          "--parent": arg(data),
+          "--timeout": arg(data),
+        },
+      },
+      exec: {
+        operands: [data],
+        options: {
+          ...flags("-i", "--stdin"),
+          "--cwd": arg(path),
+          "--on": arg(data),
+          "--env": { roles: [data], issue: unknown("hc environment override") },
+          "--timeout": arg(data),
+        },
+      },
+    },
+  },
   {
     name: "herdr",
     options: {
@@ -4231,7 +4303,11 @@ function classifyInvocation(
     }
     const a = argv[position];
     if (a === undefined) {
-      if (["env", "forward", "timeout", "xargs"].includes(entry.semantics ?? ""))
+      if (
+        ["env", "forward", "timeout", "xargs"].includes(entry.semantics ?? "") ||
+        (entry.name === "hc" &&
+          (mode === entry.subcommands?.run || mode === entry.subcommands?.exec))
+      )
         issues.push({
           kind: "missing-knowledge",
           rule: "opaque-executable",
@@ -4457,8 +4533,8 @@ function classifyInvocation(
         (attached ?? argv[position + 1]) === undefined
       )
         issues.push(unknown("Bun option operand is not literal"));
-      if (entry.name === "bun" && optionName === "--cwd") {
-        if (cwdOperands.length) issues.push(unknown("repeated Bun working directory"));
+      if (["bun", "hc"].includes(entry.name) && optionName === "--cwd") {
+        if (cwdOperands.length) issues.push(unknown(`repeated ${entry.name} working directory`));
         cwdOperands.push({
           index: attached === undefined ? position + 1 : position,
           ...(attached !== undefined ? { literal: attached } : {}),
@@ -4581,6 +4657,18 @@ function classifyInvocation(
       position++;
       continue;
     }
+    if (
+      entry.name === "hc" &&
+      (mode === entry.subcommands?.run || mode === entry.subcommands?.exec)
+    ) {
+      if (mode === entry.subcommands?.run && position === argv.length - 1) {
+        roles.push({ index: position, role: code("bash") });
+        roles.push({ index: position, role: path });
+        issues.push(...unknownOperandIssues([a]));
+        codeSeen = true;
+      } else child(position);
+      break;
+    }
     if (entry.name === "git" && mode === entry.subcommands?.bisect?.subcommands?.run) {
       child(position);
       break;
@@ -4669,6 +4757,8 @@ function classifyInvocation(
   if (effect && effect !== "none") issues.push(effect);
   if (!positional.length && !children.length && !codeSeen && entry.bare) issues.push(entry.bare);
   roles.push(...optionRoles);
+  if (entry.name === "hc" && mode === entry.subcommands?.send)
+    issues.push(...unknownOperandIssues(positional.slice(1).map((index) => argv[index])));
   const operands =
     (filterOption && ["sed", "awk"].includes(entry.semantics ?? "")) ||
     (filterOption &&

package/src/db-tool/index.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
 
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;

package/src/db-tool/main.ts

@@ -225,7 +225,7 @@ const grantsCommand = makeDiagnosticCommand(
 
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
-const mainCommand = Command.make("db-tool", {}).pipe(
+export const mainCommand = Command.make("db-tool", {}).pipe(
   Command.withDescription("Database Query Tool for Coding Agents"),
   Command.withSubcommands([
     sqlCommand,
@@ -261,6 +261,12 @@ const program = withRedactedOutput(withAudit("db", cli)).pipe(
   Effect.tapCause(renderCauseToStderr),
 );
 
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+export const runMain = () =>
+  BunRuntime.runMain(program, {
+    disableErrorReporting: true,
+  });
+
+export const runProgram = (args: readonly string[]) =>
+  withRedactedOutput(
+    withAudit("db", Command.runWith(mainCommand, { version: VERSION, renderErrors: false })(args)),
+  ).pipe(Effect.provide(MainLayer), Effect.tapCause(renderCauseToStderr));

package/src/db-tool/service.ts

@@ -133,6 +133,10 @@ export function isFullyReadOnly(
 // Re-exported from the shared probe so existing `#db/service` consumers keep working.
 export { buildApiProbeArgs } from "#shared/k8s-probe";
 
+export const DbGuardianInProcess = Context.Reference<boolean>("@agent-tools/DbGuardianInProcess", {
+  defaultValue: () => false,
+});
+
 export class DbService extends Context.Service<
   DbService,
   {
@@ -156,6 +160,7 @@ export class DbService extends Context.Service<
         const sqlClient = yield* DbSqlClient;
         const secretEnvResolver = yield* SecretEnvResolver;
         const agentToolsConfig = yield* ConfigService;
+        const runGuardianInProcess = yield* DbGuardianInProcess;
         const dbConfig = yield* DbConfigService;
 
         if (!dbConfig) {
@@ -364,7 +369,7 @@ export class DbService extends Context.Service<
             prerequisiteConfig,
             (command, _label) => executeShellCommand(command),
             effect,
-            { tryWithoutPrerequisites: true },
+            { tryWithoutPrerequisites: true, runGuardianInProcess },
           ).pipe(
             Effect.mapError((error) =>
               isPrerequisiteRunError(error)

package/src/gh-tool/index.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
 
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;

package/src/gh-tool/main.ts

@@ -222,7 +222,7 @@ const gistCommand = Command.make("gist", {}).pipe(
 
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
-const mainCommand = Command.make("gh-tool", {}).pipe(
+export const mainCommand = Command.make("gh-tool", {}).pipe(
   Command.withDescription(
     `GitHub CLI Tool for Coding Agents
 
@@ -307,6 +307,7 @@ const observed = Effect.gen(function* () {
 });
 const program = observed.pipe(Effect.provide(MainLayer), Effect.tapCause(renderCauseToStderr));
 
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+export const runMain = () =>
+  BunRuntime.runMain(program, {
+    disableErrorReporting: true,
+  });

package/src/gh-tool/read/store.ts

@@ -87,11 +87,13 @@ export class FileStore {
   private constructor(
     readonly directory: string,
     readonly identity: string,
+    private readonly contentionTimeoutMs: number,
   ) {}
 
   static async open(
     identity: string,
     directory = process.env["GH_TOOL_CACHE_DIR"] ?? defaultCacheDirectory(),
+    options: { contentionTimeoutMs?: number } = {},
   ): Promise<FileStore> {
     const uid = process.getuid?.();
     if (uid === undefined) throw new Error("Cache ownership cannot be verified");
@@ -116,7 +118,11 @@ export class FileStore {
         await checkDirectory(path);
       }),
     );
-    const store = new FileStore(join(directory, "gh-read-v1"), identity);
+    const store = new FileStore(
+      join(directory, "gh-read-v1"),
+      identity,
+      options.contentionTimeoutMs ?? 2000,
+    );
     await mkdir(store.ghCacheDirectory, { recursive: true, mode: 0o700 });
     await checkDirectory(store.ghCacheDirectory);
     await store.readClock();
@@ -226,7 +232,7 @@ export class FileStore {
           }
         },
         25,
-        2000,
+        this.contentionTimeoutMs,
       );
       try {
         return await body();

package/src/k8s-tool/index.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
 
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;

package/src/k8s-tool/main.ts

@@ -457,7 +457,7 @@ const topCommand = Command.make(
 
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
-const mainCommand = Command.make("k8s-tool", {}).pipe(
+export const mainCommand = Command.make("k8s-tool", {}).pipe(
   Command.withDescription("Kubernetes CLI Tool for Coding Agents"),
   Command.withSubcommands([
     kubectlCommand,
@@ -486,6 +486,12 @@ const program = withRedactedOutput(withAudit("k8s", cli)).pipe(
   Effect.tapCause(renderCauseToStderr),
 );
 
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+export const runMain = () =>
+  BunRuntime.runMain(program, {
+    disableErrorReporting: true,
+  });
+
+export const runProgram = (args: readonly string[]) =>
+  withRedactedOutput(
+    withAudit("k8s", Command.runWith(mainCommand, { version: VERSION, renderErrors: false })(args)),
+  ).pipe(Effect.provide(MainLayer), Effect.tapCause(renderCauseToStderr));

package/src/logs-tool/index.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
 
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;

package/src/logs-tool/main.ts

@@ -221,7 +221,7 @@ const readCommand = Command.make(
 
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
-const mainCommand = Command.make("logs-tool", {}).pipe(
+export const mainCommand = Command.make("logs-tool", {}).pipe(
   Command.withDescription("Application Logs Tool for Coding Agents"),
   Command.withSubcommands([listCommand, readCommand, commandsCommand]),
 );
@@ -249,6 +249,15 @@ const program = withRedactedOutput(withAudit("logs", cli)).pipe(
   Effect.tapCause(renderCauseToStderr),
 );
 
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+export const runMain = () =>
+  BunRuntime.runMain(program, {
+    disableErrorReporting: true,
+  });
+
+export const runProgram = (args: readonly string[]) =>
+  withRedactedOutput(
+    withAudit(
+      "logs",
+      Command.runWith(mainCommand, { version: VERSION, renderErrors: false })(args),
+    ),
+  ).pipe(Effect.provide(MainLayer), Effect.tapCause(renderCauseToStderr));

package/src/observability-tool/index.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
 
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;

package/src/observability-tool/main.ts

@@ -16,7 +16,7 @@ import { traceCommand } from "./trace";
 
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
-const mainCommand = Command.make("observability-tool", {}).pipe(
+export const mainCommand = Command.make("observability-tool", {}).pipe(
   Command.withDescription(
     "LGTM observability queries — Tempo traces, Loki logs, Prometheus metrics",
   ),
@@ -37,4 +37,12 @@ const program = withRedactedOutput(withAudit("observability", cli)).pipe(
   Effect.tapCause(renderCauseToStderr),
 );
 
-BunRuntime.runMain(program, { disableErrorReporting: true });
+export const runMain = () => BunRuntime.runMain(program, { disableErrorReporting: true });
+
+export const runProgram = (args: readonly string[]) =>
+  withRedactedOutput(
+    withAudit(
+      "observability",
+      Command.runWith(mainCommand, { version: VERSION, renderErrors: false })(args),
+    ),
+  ).pipe(Effect.provide(MainLayer), Effect.tapCause(renderCauseToStderr));

package/src/session-tool/index.ts

@@ -1,5 +1,5 @@
 #!/usr/bin/env bun
 import { checkEffectVersion } from "#shared/effect-version";
 
-if (await checkEffectVersion()) await import("./main");
+if (await checkEffectVersion()) (await import("./main")).runMain();
 else process.exitCode = 1;

package/src/session-tool/main.ts

@@ -322,16 +322,11 @@ const readCommand = Command.make(
 
 const commandsCommand = makeSchemaCommand(() => mainCommand);
 
-const mainCommand = Command.make("session-tool", {}).pipe(
+export const mainCommand = Command.make("session-tool", {}).pipe(
   Command.withDescription("OpenCode session history tool"),
   Command.withSubcommands([listCommand, readCommand, searchCommand, commandsCommand]),
 );
 
-const cli = Command.run(mainCommand, {
-  version: VERSION,
-  renderErrors: false,
-});
-
 const runWithErrorsDisabled = Command.runWith(mainCommand, {
   version: VERSION,
   renderErrors: false,
@@ -344,11 +339,13 @@ const MainLayer = AppLayer.pipe(
   Layer.provideMerge(AuditServiceLayer),
 );
 
-const program = withRedactedOutput(withAudit("session", cli)).pipe(
-  Effect.provide(MainLayer),
-  Effect.tapCause(renderCauseToStderr),
-);
+export const runProgram = (args: readonly string[]) =>
+  withRedactedOutput(withAudit("session", runWithErrorsDisabled(args))).pipe(
+    Effect.provide(MainLayer),
+    Effect.tapCause(renderCauseToStderr),
+  );
 
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+export const runMain = () =>
+  BunRuntime.runMain(runProgram(process.argv.slice(2)), {
+    disableErrorReporting: true,
+  });

package/src/shared/secret-env.ts

@@ -1,4 +1,4 @@
-import { spawn } from "node:child_process";
+import { spawn, type SpawnOptions } from "node:child_process";
 import { tmpdir } from "node:os";
 import { relative, resolve as resolvePath } from "node:path";
 import { Context, Layer } from "effect";
@@ -75,101 +75,121 @@ const inspectFrame = (frame: Buffer): FrameInspection => {
   };
 };
 
-const runInteractiveZsh: ZshRunner = (name, timeoutMs) =>
-  new Promise((resolve) => {
-    if (process.env.VITEST !== undefined) {
-      const home = process.env.HOME;
-      const zdotdir = process.env.ZDOTDIR;
-      const relativeZdotdir = zdotdir ? relative(tmpdir(), resolvePath(zdotdir)) : "..";
-      if (
-        !home ||
-        !zdotdir ||
-        resolvePath(home) !== resolvePath(zdotdir) ||
-        relativeZdotdir === ".." ||
-        relativeZdotdir.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)
-      ) {
-        resolve(failed(name));
-        return;
+type ZshProcess = Pick<ReturnType<typeof spawn>, "pid" | "stdio" | "kill"> & {
+  on: {
+    (event: "error", listener: () => void): unknown;
+    (event: "exit", listener: (code: number | null) => void): unknown;
+  };
+};
+export type ZshLauncher = (
+  command: string,
+  args: readonly string[],
+  options: SpawnOptions,
+) => ZshProcess;
+export const makeZshRunner =
+  (
+    launch: ZshLauncher = spawn,
+    terminate: (pid: number) => void = (pid) => {
+      process.kill(pid, "SIGKILL");
+    },
+  ): ZshRunner =>
+  (name, timeoutMs) =>
+    new Promise((resolve) => {
+      if (process.env.VITEST !== undefined) {
+        const home = process.env.HOME;
+        const zdotdir = process.env.ZDOTDIR;
+        const relativeZdotdir = zdotdir ? relative(tmpdir(), resolvePath(zdotdir)) : "..";
+        if (
+          !home ||
+          !zdotdir ||
+          resolvePath(home) !== resolvePath(zdotdir) ||
+          relativeZdotdir === ".." ||
+          relativeZdotdir.startsWith(`..${process.platform === "win32" ? "\\" : "/"}`)
+        ) {
+          resolve(failed(name));
+          return;
+        }
       }
-    }
 
-    const childEnv = Object.fromEntries(
-      STARTUP_ENV_NAMES.flatMap((key) => {
-        const value = process.env[key];
-        return value === undefined ? [] : [[key, value]];
-      }),
-    );
-    const script = `export LC_ALL=C; if (( \${+parameters[$1]} )); then value=\${(P)1}; print -ru3 -- "set"; print -ru3 -- "\${#value}"; print -rn -- "$value" >&3; else print -ru3 -- "unset"; fi`;
-
-    let child: ReturnType<typeof spawn>;
-    try {
-      child = spawn("zsh", ["-i", "-c", script, "agent-tools-secret-env", name], {
-        detached: true,
-        env: childEnv,
-        stdio: ["ignore", "ignore", "ignore", "pipe"],
-      });
-    } catch {
-      resolve(failed(name));
-      return;
-    }
+      const childEnv = Object.fromEntries(
+        STARTUP_ENV_NAMES.flatMap((key) => {
+          const value = process.env[key];
+          return value === undefined ? [] : [[key, value]];
+        }),
+      );
+      const script = `export LC_ALL=C; if (( \${+parameters[$1]} )); then value=\${(P)1}; print -ru3 -- "set"; print -ru3 -- "\${#value}"; print -rn -- "$value" >&3; else print -ru3 -- "unset"; fi`;
 
-    const stream = child.stdio[3];
-    if (!stream || typeof stream === "number") {
-      child.kill("SIGKILL");
-      resolve(failed(name));
-      return;
-    }
-
-    const chunks: Buffer[] = [];
-    let exited = false;
-    let ended = false;
-    let exitCode: number | null = null;
-    let settled = false;
-    const killProcessGroup = () => {
-      if (child.pid === undefined) return;
+      let child: ZshProcess;
       try {
-        process.kill(-child.pid, "SIGKILL");
+        child = launch("zsh", ["-i", "-c", script, "agent-tools-secret-env", name], {
+          detached: true,
+          env: childEnv,
+          stdio: ["ignore", "ignore", "ignore", "pipe"],
+        });
       } catch {
-        // The process group may already have exited.
+        resolve(failed(name));
+        return;
       }
-    };
-    const finish = (result: LookupResult) => {
-      if (settled) return;
-      settled = true;
-      clearTimeout(timer);
-      stream.destroy();
-      killProcessGroup();
-      resolve(result);
-    };
-    const checkFrame = () => {
-      if (settled) return;
-      const inspection = inspectFrame(Buffer.concat(chunks));
-      if (inspection._tag === "malformed") return finish(failed(name));
-      if (!exited) return;
-      if (exitCode !== 0) return finish(failed(name));
-      if (inspection._tag === "complete") finish(inspection.result);
-      else if (ended) finish(failed(name));
-    };
-    const timer = setTimeout(() => {
-      finish(failed(name));
-    }, timeoutMs);
 
-    stream.on("data", (chunk: Buffer | string) => {
-      chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
-      checkFrame();
-    });
-    stream.on("end", () => {
-      ended = true;
-      checkFrame();
-    });
-    stream.on("error", () => finish(failed(name)));
-    child.on("error", () => finish(failed(name)));
-    child.on("exit", (code) => {
-      exited = true;
-      exitCode = code;
-      checkFrame();
+      const stream = child.stdio[3];
+      if (!stream || typeof stream === "number") {
+        child.kill("SIGKILL");
+        resolve(failed(name));
+        return;
+      }
+
+      const chunks: Buffer[] = [];
+      let exited = false;
+      let ended = false;
+      let exitCode: number | null = null;
+      let settled = false;
+      const killProcessGroup = () => {
+        if (child.pid === undefined) return;
+        try {
+          terminate(-child.pid);
+        } catch {
+          // The process group may already have exited.
+        }
+      };
+      const finish = (result: LookupResult) => {
+        if (settled) return;
+        settled = true;
+        clearTimeout(timer);
+        stream.destroy();
+        killProcessGroup();
+        resolve(result);
+      };
+      const checkFrame = () => {
+        if (settled) return;
+        const inspection = inspectFrame(Buffer.concat(chunks));
+        if (inspection._tag === "malformed") return finish(failed(name));
+        if (!exited) return;
+        if (exitCode !== 0) return finish(failed(name));
+        if (inspection._tag === "complete") finish(inspection.result);
+        else if (ended) finish(failed(name));
+      };
+      const timer = setTimeout(() => {
+        finish(failed(name));
+      }, timeoutMs);
+
+      stream.on("data", (chunk: Buffer | string) => {
+        chunks.push(Buffer.isBuffer(chunk) ? chunk : Buffer.from(chunk));
+        checkFrame();
+      });
+      stream.on("end", () => {
+        ended = true;
+        checkFrame();
+      });
+      stream.on("error", () => finish(failed(name)));
+      child.on("error", () => finish(failed(name)));
+      child.on("exit", (code) => {
+        exited = true;
+        exitCode = code;
+        checkFrame();
+      });
     });
-  });
+
+const runInteractiveZsh = makeZshRunner();
 
 export class SecretEnvResolver extends Context.Service<
   SecretEnvResolver,