@blogic-cz/agent-tools 1.4.0 → 1.4.2

package/dist/gh-tool/repo.d.ts

@@ -1,21 +1,20 @@
 import { Command } from "effect/unstable/cli";
 import { Option } from "effect";
-import { GitHubCommandError } from "./errors";
 import { GitHubService } from "./service";
 export declare const repoInfoCommand: Command.Command<"info", {
     readonly format: "json" | "toon";
     readonly repo: Option.Option<string>;
-}, {}, GitHubCommandError | import("./errors").GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, {}, import("./service").GhError, GitHubService>;
 export declare const repoListCommand: Command.Command<"list", {
     readonly format: "json" | "toon";
     readonly limit: number;
     readonly org: string;
     readonly visibility: Option.Option<"public" | "all" | "private">;
-}, {}, GitHubCommandError | import("./errors").GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, {}, import("./service").GhError, GitHubService>;
 export declare const repoSearchCodeCommand: Command.Command<"search-code", {
     readonly format: "json" | "toon";
     readonly limit: number;
     readonly org: string;
     readonly query: string;
-}, {}, GitHubCommandError | import("./errors").GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, {}, import("./service").GhError, GitHubService>;
 //# sourceMappingURL=repo.d.ts.map

package/dist/gh-tool/repo.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../src/gh-tool/repo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAC;AAGxC,OAAO,EAAE,kBAAkB,EAAE,MAAM,UAAU,CAAC;AAC9C,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AA2F1C,eAAO,MAAM,eAAe;;;uHAcqE,CAAC;AAElG,eAAO,MAAM,eAAe;;;;;uHAyB3B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;uHAoB6C,CAAC"}
+{"version":3,"file":"repo.d.ts","sourceRoot":"","sources":["../../src/gh-tool/repo.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAQ,MAAM,qBAAqB,CAAC;AACpD,OAAO,EAAU,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIxC,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AA2F1C,eAAO,MAAM,eAAe;;;kDAcqE,CAAC;AAElG,eAAO,MAAM,eAAe;;;;;kDAyB3B,CAAC;AAEF,eAAO,MAAM,qBAAqB;;;;;kDAoB6C,CAAC"}

package/dist/gh-tool/service.d.ts

@@ -5,12 +5,12 @@ import type { RepoInfo } from "./types";
 import { GitHubAuthError, GitHubCommandError, GitHubNotFoundError } from "./errors";
 import type { GitHubApiRequest, GitHubApiResponse } from "./api";
 import { ConfigService } from "#config";
-type GhResult = {
+export type GhResult = {
     stdout: string;
     stderr: string;
     exitCode: number;
 };
-type GhError = GitHubCommandError | GitHubAuthError | GitHubNotFoundError;
+export type GhError = GitHubCommandError | GitHubAuthError | GitHubNotFoundError;
 declare const GitHubService_base: Context.ServiceClass<GitHubService, "@agent-tools/GitHubService", {
     readonly runGh: (args: string[]) => Effect.Effect<GhResult, GhError>;
     readonly runGhJson: <T>(args: string[]) => Effect.Effect<T, GhError>;

package/dist/gh-tool/service.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/gh-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,QAAQ,CAAC;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGxC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAGpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AACjE,OAAO,EAAE,aAAa,EAA4C,MAAM,SAAS,CAAC;AA2DlF,KAAK,QAAQ,GAAG;IACd,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,KAAK,OAAO,GAAG,kBAAkB,GAAG,eAAe,GAAG,mBAAmB,CAAC;;oBAKtD,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;wBAChD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC;yBAC/C,CACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,KAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;yBACf,CAAC,CAAC,EACrB,IAAI,EAAE,gBAAgB,KACnB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;4BACzB,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,GAAG,SAAS,EAAE,KAAK,CAAC;0BAC1D,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;6BACnC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,kBAAkB,EAAE,CAAC,CAAC;;AAjBpD,qBAAa,aAAc,SAAQ,kBAmBF;IAC/B,MAAM,CAAC,QAAQ,CAAC,KAAK,6FAsRnB;CACH"}
+{"version":3,"file":"service.d.ts","sourceRoot":"","sources":["../../src/gh-tool/service.ts"],"names":[],"mappings":"AAAA,OAAO,EAAgB,mBAAmB,EAAE,MAAM,yBAAyB,CAAC;AAC5E,OAAO,EAAE,OAAO,EAAE,MAAM,EAAE,KAAK,EAAU,MAAM,QAAQ,CAAC;AAExD,OAAO,KAAK,EAAE,gBAAgB,EAAE,MAAM,SAAS,CAAC;AAChD,OAAO,KAAK,EAAE,QAAQ,EAAE,MAAM,SAAS,CAAC;AAGxC,OAAO,EAAE,eAAe,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AAGpF,OAAO,KAAK,EAAE,gBAAgB,EAAE,iBAAiB,EAAE,MAAM,OAAO,CAAC;AACjE,OAAO,EAAE,aAAa,EAA4C,MAAM,SAAS,CAAC;AA2DlF,MAAM,MAAM,QAAQ,GAAG;IACrB,MAAM,EAAE,MAAM,CAAC;IACf,MAAM,EAAE,MAAM,CAAC;IACf,QAAQ,EAAE,MAAM,CAAC;CAClB,CAAC;AAEF,MAAM,MAAM,OAAO,GAAG,kBAAkB,GAAG,eAAe,GAAG,mBAAmB,CAAC;;oBAK7D,CAAC,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;wBAChD,CAAC,CAAC,EAAE,IAAI,EAAE,MAAM,EAAE,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,OAAO,CAAC;yBAC/C,CACnB,KAAK,EAAE,MAAM,EACb,SAAS,EAAE,MAAM,CAAC,MAAM,EAAE,MAAM,GAAG,MAAM,GAAG,IAAI,CAAC,KAC9C,MAAM,CAAC,MAAM,CAAC,OAAO,EAAE,OAAO,CAAC;yBACf,CAAC,CAAC,EACrB,IAAI,EAAE,gBAAgB,KACnB,MAAM,CAAC,MAAM,CAAC,iBAAiB,CAAC,CAAC,CAAC,EAAE,OAAO,CAAC;4BACzB,MAAM,MAAM,CAAC,MAAM,CAAC,gBAAgB,GAAG,SAAS,EAAE,KAAK,CAAC;0BAC1D,MAAM,MAAM,CAAC,MAAM,CAAC,QAAQ,EAAE,OAAO,CAAC;6BACnC,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,EAC/B,MAAM,EAAE,MAAM,GAAG,IAAI,EACrB,MAAM,EAAE,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,EAAE,CAAC,CAAC,KAC3B,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,CAAC,GAAG,kBAAkB,EAAE,CAAC,CAAC;;AAjBpD,qBAAa,aAAc,SAAQ,kBAmBF;IAC/B,MAAM,CAAC,QAAQ,CAAC,KAAK,6FAsRnB;CACH"}

package/dist/gh-tool/workflow.d.ts

@@ -1,6 +1,6 @@
 import { Command } from "effect/unstable/cli";
 import { Effect, Option } from "effect";
-import { GitHubCommandError, GitHubNotFoundError } from "./errors";
+import { GitHubNotFoundError } from "./errors";
 import { GitHubService } from "./service";
 import type { LogDiagnosis } from "./types";
 export type LogEntry = {
@@ -18,7 +18,7 @@ export declare const dispatchWorkflow: (opts: {
     ref: string;
     repo: string | null;
     fields: readonly string[];
-}, GitHubCommandError | GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, import("./service").GhError, GitHubService>;
 export type DispatchedRun = {
     databaseId: number;
     headSha: string;
@@ -90,7 +90,7 @@ export declare const fetchJobLogs: (opts: {
     formatted: string;
     diagnosis?: undefined;
     entries?: undefined;
-}, GitHubCommandError | GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, import("./service").GhError, GitHubService>;
 export declare const workflowListCommand: Command.Command<"list", {
     readonly branch: Option.Option<string>;
     readonly format: "json" | "toon";
@@ -98,48 +98,48 @@ export declare const workflowListCommand: Command.Command<"list", {
     readonly repo: Option.Option<string>;
     readonly status: Option.Option<"success" | "completed" | "skipped" | "failure" | "queued" | "in_progress" | "action_required" | "cancelled" | "neutral" | "stale" | "timed_out" | "waiting">;
     readonly workflow: Option.Option<string>;
-}, {}, GitHubCommandError | GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, {}, import("./service").GhError, GitHubService>;
 export declare const workflowViewCommand: Command.Command<"view", {
     readonly format: "json" | "toon";
     readonly repo: Option.Option<string>;
     readonly run: number;
-}, {}, GitHubCommandError | GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, {}, import("./service").GhError, GitHubService>;
 export declare const workflowJobsCommand: Command.Command<"jobs", {
     readonly format: "json" | "toon";
     readonly repo: Option.Option<string>;
     readonly run: number;
-}, {}, GitHubCommandError | GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, {}, import("./service").GhError, GitHubService>;
 export declare const workflowLogsCommand: Command.Command<"logs", {
     readonly failedOnly: boolean;
     readonly format: "json" | "toon";
     readonly repo: Option.Option<string>;
     readonly run: number;
-}, {}, GitHubCommandError | GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, {}, import("./service").GhError, GitHubService>;
 export declare const workflowRerunCommand: Command.Command<"rerun", {
     readonly failedOnly: boolean;
     readonly format: "json" | "toon";
     readonly repo: Option.Option<string>;
     readonly run: number;
-}, {}, GitHubCommandError | GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, {}, import("./service").GhError, GitHubService>;
 export declare const workflowCancelCommand: Command.Command<"cancel", {
     readonly format: "json" | "toon";
     readonly repo: Option.Option<string>;
     readonly run: number;
-}, {}, GitHubCommandError | GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, {}, import("./service").GhError, GitHubService>;
 export declare const workflowRunCommand: Command.Command<"run", {
     readonly field: readonly string[];
     readonly format: "json" | "toon";
     readonly ref: string;
     readonly repo: Option.Option<string>;
     readonly workflow: string;
-}, {}, GitHubCommandError | GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, {}, import("./service").GhError, GitHubService>;
 export declare const workflowWatchCommand: Command.Command<"watch", {
     readonly format: "json" | "toon";
     readonly frames: boolean;
     readonly repo: Option.Option<string>;
     readonly run: number;
     readonly timeout: number;
-}, {}, GitHubCommandError | GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, {}, import("./service").GhError, GitHubService>;
 export declare const workflowJobLogsCommand: Command.Command<"job-logs", {
     readonly diagnose: boolean;
     readonly failedStepsOnly: boolean;
@@ -147,11 +147,11 @@ export declare const workflowJobLogsCommand: Command.Command<"job-logs", {
     readonly job: string;
     readonly repo: Option.Option<string>;
     readonly run: number;
-}, {}, GitHubCommandError | GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, {}, import("./service").GhError, GitHubService>;
 export declare const workflowAnnotationsCommand: Command.Command<"annotations", {
     readonly format: "json" | "toon";
     readonly job: Option.Option<string>;
     readonly repo: Option.Option<string>;
     readonly run: number;
-}, {}, GitHubCommandError | GitHubNotFoundError | import("./errors").GitHubAuthError, GitHubService>;
+}, {}, import("./service").GhError, GitHubService>;
 //# sourceMappingURL=workflow.d.ts.map

package/dist/gh-tool/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/gh-tool/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAY,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIlD,OAAO,EAAE,kBAAkB,EAAE,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,EAAsC,YAAY,EAAE,MAAM,SAAS,CAAC;AAwChF,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAqKF,eAAO,MAAM,gBAAgB;cACjB,MAAM;SACX,MAAM;YACH,aAAa,CAAC,MAAM,CAAC;UACvB,MAAM,GAAG,IAAI;;;;;;;gGAsBnB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAKF,eAAO,MAAM,kBAAkB;cACnB,MAAM;SACX,MAAM;UACL,MAAM,GAAG,IAAI;6GAyBnB,CAAC;AAKH,eAAO,MAAM,qBAAqB;cACtB,MAAM;SACX,MAAM;UACL,MAAM,GAAG,IAAI;iBACN,WAAW,CAAC,MAAM,CAAC;kHAShC,CAAC;AAMH,eAAO,MAAM,gBAAgB,GAC3B,OAAO,MAAM,EACb,YAAY;IACV,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAClF,EACD,aAAa,MAAM,GAAG,IAAI,EAC1B,QAAQ,OAAO,EACf,gBAAgB,MAAM;;;;;;;;;;CAiBtB,CAAC;AAmHH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOjD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,EAAE,CAsBvD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAa5D;AAgBD,eAAO,MAAM,kBAAkB,GAAI,SAAS,SAAS,QAAQ,EAAE,KAAG,YA0CjE,CAAC;AA0DF,eAAO,MAAM,YAAY;WAChB,MAAM;SACR,MAAM;YACH,MAAM,GAAG,IAAI;sBACH,SAAS,MAAM,EAAE,GAAG,IAAI;qBACzB,OAAO;eACb,OAAO;YACV,MAAM;UACR,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;gGA8DnB,CAAC;AAMH,eAAO,MAAM,mBAAmB;;;;;;;oGA8C/B,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;oGAaqD,CAAC;AAEtF,eAAO,MAAM,mBAAmB;;;;oGAa+C,CAAC;AAEhF,eAAO,MAAM,mBAAmB;;;;;oGAsB2D,CAAC;AAE5F,eAAO,MAAM,oBAAoB;;;;;oGAiBoD,CAAC;AAEtF,eAAO,MAAM,qBAAqB;;;;oGAamC,CAAC;AAEtE,eAAO,MAAM,kBAAkB;;;;;;oGAgD6C,CAAC;AAE7E,eAAO,MAAM,oBAAoB;;;;;;oGA4BiE,CAAC;AAEnG,eAAO,MAAM,sBAAsB;;;;;;;oGAwClC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;oGAyBtC,CAAC"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/gh-tool/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAY,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIlD,OAAO,EAAsB,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,EAAsC,YAAY,EAAE,MAAM,SAAS,CAAC;AAwChF,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAqKF,eAAO,MAAM,gBAAgB;cACjB,MAAM;SACX,MAAM;YACH,aAAa,CAAC,MAAM,CAAC;UACvB,MAAM,GAAG,IAAI;;;;;;;8CAsBnB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAKF,eAAO,MAAM,kBAAkB;cACnB,MAAM;SACX,MAAM;UACL,MAAM,GAAG,IAAI;6GAyBnB,CAAC;AAKH,eAAO,MAAM,qBAAqB;cACtB,MAAM;SACX,MAAM;UACL,MAAM,GAAG,IAAI;iBACN,WAAW,CAAC,MAAM,CAAC;kHAShC,CAAC;AAMH,eAAO,MAAM,gBAAgB,GAC3B,OAAO,MAAM,EACb,YAAY;IACV,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAClF,EACD,aAAa,MAAM,GAAG,IAAI,EAC1B,QAAQ,OAAO,EACf,gBAAgB,MAAM;;;;;;;;;;CAiBtB,CAAC;AAmHH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOjD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,EAAE,CAsBvD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAa5D;AAgBD,eAAO,MAAM,kBAAkB,GAAI,SAAS,SAAS,QAAQ,EAAE,KAAG,YA0CjE,CAAC;AA0DF,eAAO,MAAM,YAAY;WAChB,MAAM;SACR,MAAM;YACH,MAAM,GAAG,IAAI;sBACH,SAAS,MAAM,EAAE,GAAG,IAAI;qBACzB,OAAO;eACb,OAAO;YACV,MAAM;UACR,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;8CA8DnB,CAAC;AAMH,eAAO,MAAM,mBAAmB;;;;;;;kDA8C/B,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;kDAaqD,CAAC;AAEtF,eAAO,MAAM,mBAAmB;;;;kDAa+C,CAAC;AAEhF,eAAO,MAAM,mBAAmB;;;;;kDAsB2D,CAAC;AAE5F,eAAO,MAAM,oBAAoB;;;;;kDAiBoD,CAAC;AAEtF,eAAO,MAAM,qBAAqB;;;;kDAamC,CAAC;AAEtE,eAAO,MAAM,kBAAkB;;;;;;kDAgD6C,CAAC;AAE7E,eAAO,MAAM,oBAAoB;;;;;;kDA4BiE,CAAC;AAEnG,eAAO,MAAM,sBAAsB;;;;;;;kDAwClC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;kDAyBtC,CAAC"}

package/dist/observability-tool/trace.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"trace.d.ts","sourceRoot":"","sources":["../../src/observability-tool/trace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAe,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAY,OAAO,EAAQ,MAAM,qBAAqB,CAAC;AAK9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAWlD,OAAO,KAAK,EAEV,sBAAsB,EAItB,YAAY,EAEZ,mBAAmB,EAEnB,cAAc,EAEf,MAAM,SAAS,CAAC;AAuVjB,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,cAAc,EAAE,CAsBnF;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CA4C5D;AAgPD,eAAO,MAAM,YAAY,iFAGxB,CAAC"}
+{"version":3,"file":"trace.d.ts","sourceRoot":"","sources":["../../src/observability-tool/trace.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,MAAM,EAAe,MAAM,QAAQ,CAAC;AAC7C,OAAO,EAAY,OAAO,EAAQ,MAAM,qBAAqB,CAAC;AAK9D,OAAO,EAAE,sBAAsB,EAAE,MAAM,UAAU,CAAC;AAWlD,OAAO,KAAK,EAEV,sBAAsB,EAItB,YAAY,EAEZ,mBAAmB,EAEnB,cAAc,EAEf,MAAM,SAAS,CAAC;AAuVjB,wBAAgB,mBAAmB,CAAC,QAAQ,EAAE,mBAAmB,GAAG,cAAc,EAAE,CAsBnF;AAED,wBAAgB,kBAAkB,CAChC,MAAM,EAAE,sBAAsB,EAC9B,KAAK,EAAE,MAAM,EACb,MAAM,EAAE,YAAY,EACpB,KAAK,EAAE,MAAM,GACZ,MAAM,CAAC,MAAM,CAAC,mBAAmB,EAAE,sBAAsB,CAAC,CA4C5D;AAoPD,eAAO,MAAM,YAAY,iFAGxB,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.4.0",
+  "version": "1.4.2",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",

package/schemas/agent-tools.schema.json

@@ -463,6 +463,14 @@
       "type": "object",
       "additionalProperties": false,
       "properties": {
+        "allowedEnvironmentVariables": {
+          "description": "Exact, case-sensitive environment names approved for static printenv reads. Empty by default.",
+          "type": "array",
+          "items": {
+            "type": "string",
+            "pattern": "^[A-Za-z_][A-Za-z0-9_]*$"
+          }
+        },
         "additionalBlockedPaths": {
           "description": "Additional blocked file path patterns.",
           "type": "array",

package/src/config/loader.ts

@@ -11,6 +11,7 @@ const CliToolOverrideSchema = Schema.Struct({
 });
 
 const CredentialGuardConfigSchema = Schema.Struct({
+  allowedEnvironmentVariables: Schema.optionalKey(Schema.Array(Schema.String)),
   additionalBlockedPaths: Schema.optionalKey(Schema.Array(Schema.String)),
   additionalAllowedPaths: Schema.optionalKey(Schema.Array(Schema.String)),
   additionalBlockedCliTools: Schema.optionalKey(Schema.Array(CliToolOverrideSchema)),

package/src/config/types.ts

@@ -185,6 +185,8 @@ export type CliToolOverride = {
 
 /** Credential guard config - merged with built-in defaults */
 export type CredentialGuardConfig = {
+  /** Exact, case-sensitive names approved for static printenv reads. Empty by default. */
+  allowedEnvironmentVariables?: string[];
   additionalBlockedPaths?: string[];
   additionalAllowedPaths?: string[];
   additionalBlockedCliTools?: CliToolOverride[];

package/src/credential-guard/claude-hook.ts

@@ -10,7 +10,9 @@
  *     "command": "bun node_modules/@blogic-cz/agent-tools/src/credential-guard/claude-hook.ts" }] }] } }
  */
 
-import { handleToolExecuteBefore } from "./index";
+import { loadConfig } from "#config/loader";
+
+import { createCredentialGuard } from "./index";
 
 const stdin = await Bun.stdin.text();
 
@@ -20,7 +22,11 @@ try {
     tool_input?: Record<string, unknown>;
   } = JSON.parse(stdin);
 
-  handleToolExecuteBefore({ tool: data.tool_name }, { args: data.tool_input ?? {} });
+  const config = await loadConfig();
+  createCredentialGuard(config?.credentialGuard).handleToolExecuteBefore(
+    { tool: data.tool_name },
+    { args: data.tool_input ?? {} },
+  );
 } catch (error: unknown) {
   const message = error instanceof Error ? error.message : String(error);
   process.stderr.write(message);

package/src/credential-guard/index.ts

@@ -143,8 +143,6 @@ const SECRET_PATTERNS = [
  * Dangerous bash patterns that might expose secrets.
  */
 const DEFAULT_DANGEROUS_BASH_PATTERNS: RegExp[] = [
-  /printenv/i,
-  /(?:^|&&|\||;)\s*env(?:\s|$)/i,
   /\bcat\s+\S*\.env/i,
   /\bcat\s+\S*\.pem/i,
   /\bcat\s+\S*\.key/i,
@@ -245,6 +243,201 @@ function escapeRegex(s: string): string {
   return s.replace(/[.*+?^${}()|[\]\\]/g, "\\$&");
 }
 
+/** Static shell words only. Never expand variables or execute a command. */
+function parseStaticShellCommands(
+  command: string,
+): { pipelines: string[][][] } | "brace-expansion" | undefined {
+  const pipelines: string[][][] = [];
+  let commands: string[][] = [];
+  let argv: string[] = [];
+  let word = "";
+  let started = false;
+  let quote: "'" | '"' | undefined;
+
+  const finishWord = () => {
+    if (started) argv.push(word);
+    word = "";
+    started = false;
+  };
+  const finishCommand = () => {
+    finishWord();
+    if (argv.length) commands.push(argv);
+    argv = [];
+  };
+  const finishPipeline = () => {
+    finishCommand();
+    if (commands.length) pipelines.push(commands);
+    commands = [];
+  };
+
+  for (let i = 0; i < command.length; i++) {
+    const char = command.charAt(i);
+    if (quote === "'") {
+      if (char === quote) quote = undefined;
+      else word += char;
+    } else if (char === "\\") {
+      const next = command[++i];
+      if (next === undefined || next === "\n" || next === "\r") return undefined;
+      if (quote === '"' && !/[\\$`"]/.test(next)) word += "\\";
+      word += next;
+      started = true;
+    } else if (char === "$" || char === "`") {
+      return undefined;
+    } else if (quote === '"') {
+      if (char === quote) quote = undefined;
+      else word += char;
+    } else if (char === "'" || char === '"') {
+      quote = char;
+      started = true;
+    } else if (char === "{" && /^\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(command.slice(i))) {
+      return "brace-expansion";
+    } else if (/[<>()]/.test(char) || (char === "#" && !started)) {
+      return undefined;
+    } else if (char === "|" && command[i - 1] !== "|" && command[i + 1] !== "|") {
+      finishCommand();
+      if (command[i + 1] === "&") i++;
+    } else if (/[;&|\r\n]/.test(char)) {
+      finishPipeline();
+    } else if (/\s/.test(char)) {
+      finishWord();
+    } else {
+      word += char;
+      started = true;
+    }
+  }
+
+  if (quote) return undefined;
+  finishPipeline();
+  return { pipelines };
+}
+
+function mentionsEnvironmentRead(text: string): boolean {
+  return /printenv|\benv\b/i.test(text.replace(/['"\\]/g, ""));
+}
+
+function hasBraceExpansion(text: string): boolean {
+  return /\{[^{}]*(?:,|\.\.)[^{}]*\}/.test(text);
+}
+
+function unwrapStaticCommand(words: string[]): string[] {
+  const argv = [...words];
+  const executable = () => argv[0]?.split("/").at(-1);
+  while (executable() === "rtk" || executable() === "command") {
+    const wrapper = executable();
+    argv.shift();
+    if (wrapper === "rtk" && argv[0] === "proxy") argv.shift();
+    if (wrapper === "command" && argv[0] === "--") argv.shift();
+  }
+  return argv;
+}
+
+function isAllowedEnvironmentRead(argv: string[], allowedNames: Set<string>): boolean {
+  if (argv[0]?.split("/").at(-1) !== "printenv") return false;
+  const args = argv.slice(1);
+  if (args[0] === "--") args.shift();
+  return args.length > 0 && args.every((name) => allowedNames.has(name));
+}
+
+function hasExecutionOption(args: string[], longOptions: string[], shortOption?: string): boolean {
+  return args.some((arg) => {
+    const flag = arg.split("=", 1)[0] ?? "";
+    if (flag.startsWith("--") && flag.length > 2) {
+      // Git supports long-option abbreviations. Refuse ambiguous prefixes too.
+      return longOptions.some((option) => option.startsWith(flag.slice(2)));
+    }
+    return shortOption !== undefined && /^-[^-]/.test(flag) && flag.includes(shortOption);
+  });
+}
+
+function isPassiveTextCommand(argv: string[]): boolean {
+  const name = argv[0]?.split("/").at(-1) ?? "";
+  const args = argv.slice(1);
+  // These commands consume literal text. Execution options are not exceptions.
+  if (["echo", "printf", "grep", "head"].includes(name)) {
+    return true;
+  }
+  if (name === "rg") return !hasExecutionOption(args, ["pre", "hostname-bin"]);
+  return (
+    name === "git" &&
+    args[0] === "grep" &&
+    !hasExecutionOption(args, ["open-files-in-pager", "textconv"], "O")
+  );
+}
+
+function hasStaticEnvironmentRead(argv: string[], allowedNames: Set<string>): boolean {
+  const name = argv[0]?.split("/").at(-1);
+  if (name === "printenv") return !isAllowedEnvironmentRead(argv, allowedNames);
+  if (name === "env") return true;
+  if (isPassiveTextCommand(argv)) return false;
+  if (
+    argv.some((arg) =>
+      ["sh", "bash", "zsh", "dash", "ksh", "fish", "csh", "tcsh", "eval"].includes(
+        arg.split("/").at(-1) ?? "",
+      ),
+    ) &&
+    hasBraceExpansion(argv.slice(1).join(" "))
+  ) {
+    return true;
+  }
+  return mentionsEnvironmentRead(argv.join(" "));
+}
+
+function hasEnvironmentRead(command: string, allowedNames: Set<string>): boolean {
+  if (isLiteralTextWrite(command)) return false;
+  // ponytail: complex shell syntax stays conservative; use a shell AST if more exceptions are needed.
+  const parsed = parseStaticShellCommands(command);
+  if (parsed === "brace-expansion") return true;
+  if (!parsed) return mentionsEnvironmentRead(command) || hasBraceExpansion(command);
+  const pipelines = parsed.pipelines.map((commands) => commands.map(unwrapStaticCommand));
+  const unwrapped = pipelines.flat();
+  if (unwrapped.some((argv) => hasStaticEnvironmentRead(argv, allowedNames))) return true;
+
+  // A literal producer can feed executable text to a shell, xargs, or an unknown consumer.
+  return pipelines.some(
+    (pipeline) =>
+      pipeline.length > 1 &&
+      pipeline.some(
+        (argv) =>
+          isAllowedEnvironmentRead(argv, allowedNames) ||
+          (isPassiveTextCommand(argv) &&
+            (mentionsEnvironmentRead(argv.join(" ")) || hasBraceExpansion(argv.join(" ")))),
+      ) &&
+      pipeline.some(
+        (argv) => !isPassiveTextCommand(argv) && !isAllowedEnvironmentRead(argv, allowedNames),
+      ),
+  );
+}
+
+/** A single literal writer cannot execute its body or feed another command. */
+function isLiteralTextWrite(command: string): boolean {
+  const lines = command.trimEnd().split(/\r?\n/);
+  const heredoc = /^(.*?)<<(-?)[ \t]*(['"]?)([A-Za-z_][A-Za-z0-9_]*)\3[ \t]*$/.exec(lines[0] ?? "");
+  let header = command;
+  let writers = ["echo", "printf"];
+  if (heredoc) {
+    const [, prefix, stripTabs, quote, delimiter] = heredoc;
+    const end = lines.findIndex(
+      (line, index) => index > 0 && (stripTabs ? line.replace(/^\t+/, "") : line) === delimiter,
+    );
+    // Only the first delimiter closes the body. No following commands are exceptions.
+    if (end < 0 || end !== lines.length - 1) return false;
+    const body = lines.slice(1, end).join("\n");
+    if (!quote && /[$`\\]/.test(body)) return false;
+    header = prefix ?? "";
+    writers = ["cat", "tee"];
+  } else if (!command.includes(">")) {
+    return false;
+  }
+
+  // Output redirection does not execute text. Other unsupported syntax still fails parsing.
+  const parsed = parseStaticShellCommands(header.replace(/>/g, " "));
+  if (!parsed || parsed === "brace-expansion" || parsed.pipelines.length !== 1) return false;
+  const pipeline = parsed.pipelines[0];
+  if (pipeline?.length !== 1) return false;
+  const argv = unwrapStaticCommand(pipeline[0] ?? []);
+  return writers.includes(argv[0]?.split("/").at(-1) ?? "");
+}
+
 /** Extract file path from hook arguments. */
 export function extractFilePath(args: Record<string, unknown>): string {
   return (args.filePath as string) || (args.file_path as string) || (args.path as string) || "";
@@ -271,6 +464,19 @@ export function extractCommand(args: Record<string, unknown>): string {
  * @returns Object with all guard functions bound to the merged pattern sets.
  */
 export function createCredentialGuard(config?: CredentialGuardConfig): CredentialGuard {
+  const names = config?.allowedEnvironmentVariables;
+  if (
+    names !== undefined &&
+    (!Array.isArray(names) || names.some((name) => typeof name !== "string"))
+  ) {
+    throw new Error("allowedEnvironmentVariables must be an array of strings");
+  }
+  const allowedEnvironmentVariables = new Set(names ?? []);
+  for (const name of allowedEnvironmentVariables) {
+    if (!/^[A-Za-z_][A-Za-z0-9_]*$/.test(name)) {
+      throw new Error(`Invalid allowed environment variable name: ${JSON.stringify(name)}`);
+    }
+  }
   const blockedPathPatterns = [
     ...DEFAULT_BLOCKED_PATH_PATTERNS,
     ...(config?.additionalBlockedPaths ?? []).map((p) => new RegExp(p)),
@@ -332,7 +538,10 @@ export function createCredentialGuard(config?: CredentialGuardConfig): Credentia
   }
 
   function isDangerousBashCommand(command: string): boolean {
-    return dangerousBashPatterns.some((pattern) => pattern.test(command));
+    return (
+      dangerousBashPatterns.some((pattern) => pattern.test(command)) ||
+      hasEnvironmentRead(command, allowedEnvironmentVariables)
+    );
   }
 
   function isGhCommandAllowed(command: string): boolean {

package/src/gh-tool/pr/core.ts

@@ -19,6 +19,7 @@ import type {
 import type { GitHubAuthError, GitHubNotFoundError } from "#gh/errors";
 import { GitHubCommandError, GitHubMergeError } from "#gh/errors";
 import { GitHubService } from "#gh/service";
+import type { GhResult } from "#gh/service";
 import { logText } from "#shared";
 
 import type { ButStatusJson, PRViewJsonResult } from "./helpers";
@@ -201,6 +202,13 @@ const fetchWorkflowRunFailureContext = Effect.fn("pr.fetchWorkflowRunFailureCont
 // `gh pr checks` exits 1 on an *empty* result ("no checks reported on the 'x' branch"). Zero checks
 // is an ordinary state, so map it to [] and keep the zero-check paths downstream reachable.
 export const NO_CHECKS_REPORTED_RE = /no checks reported/i;
+// `gh` reports "no checks reported" both for the seconds after a push, before its checks
+// register, and forever for a PR that has none — the message cannot tell them apart. So the
+// wait for registration gets its own short budget: long enough to cover the race (measured
+// at roughly 40s on blogic-cz/agent-tools#134), short enough that a check-less PR is not held
+// for the caller's whole --timeout.
+const CHECK_REGISTRATION_POLL_SECONDS = 5;
+const CHECK_REGISTRATION_GRACE_SECONDS = 60;
 
 export const fetchCheckResults = Effect.fn("pr.fetchCheckResults")(function* (pr: number | null) {
   const gh = yield* GitHubService;
@@ -1244,7 +1252,45 @@ export const fetchChecks = Effect.fn("pr.fetchChecks")(function* (
     // Block for the caller's requested --timeout (no artificial cap — blocking isn't the problem;
     // --timeout is validated >= 1s at the CLI boundary). On timeout return a snapshot, never
     // nothing — that was the actual token-wasting bug.
-    const watchOutcome = yield* gh.runGh(watchArgs).pipe(
+    // A push registers its checks a moment after the ref lands, and `gh pr checks --watch`
+    // exits non-zero in that window. A watch was asked to wait, so keep waiting: the outer
+    // timeout still bounds it, and a PR that genuinely has no checks returns an empty
+    // snapshot at that deadline rather than an error.
+    let watchResult: GhResult | null = null;
+    let registered = false;
+    let graceExpired = false;
+    const watchThroughRegistration = Effect.gen(function* () {
+      const graceStart = yield* Clock.currentTimeMillis;
+      const graceDeadlineMs =
+        Number(graceStart) + Math.min(CHECK_REGISTRATION_GRACE_SECONDS, timeoutSeconds) * 1000;
+      yield* Effect.whileLoop({
+        while: () => !registered && !graceExpired,
+        body: () =>
+          gh.runGh(watchArgs).pipe(
+            Effect.flatMap((result) => {
+              watchResult = result;
+              registered = true;
+              return Effect.void;
+            }),
+            Effect.catchTag("GitHubCommandError", (error) =>
+              NO_CHECKS_REPORTED_RE.test(error.stderr) || NO_CHECKS_REPORTED_RE.test(error.message)
+                ? Effect.gen(function* () {
+                    const now = yield* Clock.currentTimeMillis;
+                    if (Number(now) >= graceDeadlineMs) {
+                      graceExpired = true;
+                      return;
+                    }
+                    yield* Effect.sleep(Duration.seconds(CHECK_REGISTRATION_POLL_SECONDS));
+                  })
+                : Effect.fail(error),
+            ),
+          ),
+        step: () => undefined,
+      });
+      return watchResult;
+    });
+
+    const watchOutcome = yield* watchThroughRegistration.pipe(
       Effect.timeoutOrElse({
         duration: timeoutSeconds * 1000,
         orElse: () => Effect.succeed(null),
@@ -1252,7 +1298,15 @@ export const fetchChecks = Effect.fn("pr.fetchChecks")(function* (
     );
 
     const results = yield* fetchCheckResults(pr);
-    if (!quiet && watchOutcome === null && results.some((c) => c.bucket === "pending")) {
+    if (!quiet && graceExpired) {
+      const prRef = pr === null ? "<number>" : String(pr);
+      yield* Console.warn(
+        `ℹ️  No checks registered within ${CHECK_REGISTRATION_GRACE_SECONDS}s of watching; ` +
+          `returning the current snapshot. If this PR should have checks, the push event was ` +
+          `likely dropped, and re-watching will find nothing again — dispatch them on the PR ` +
+          `head instead:\n   agent-tools-gh pr trigger-checks --pr ${prRef} --workflow <file.yml>`,
+      );
+    } else if (!quiet && watchOutcome === null && results.some((c) => c.bucket === "pending")) {
       const pending = results.filter((c) => c.bucket === "pending").length;
       yield* Console.warn(
         `ℹ️  Watch timed out after ${timeoutSeconds}s; ${pending} check(s) still pending (snapshot returned). ` +

package/src/gh-tool/service.ts

@@ -68,13 +68,13 @@ const isSafeRetryRead = (args: readonly string[]): boolean => {
   return args.some((a) => READ_VERBS.has(a));
 };
 
-type GhResult = {
+export type GhResult = {
   stdout: string;
   stderr: string;
   exitCode: number;
 };
 
-type GhError = GitHubCommandError | GitHubAuthError | GitHubNotFoundError;
+export type GhError = GitHubCommandError | GitHubAuthError | GitHubNotFoundError;
 
 export class GitHubService extends Context.Service<
   GitHubService,

package/src/observability-tool/trace.ts

@@ -614,7 +614,11 @@ const findCommand = Command.make(
     profile: profileOption,
   },
   ({ id, format, env, profile }) => handleTraceGet(id, format, env, profile),
-).pipe(Command.withDescription("Alias for 'trace get' — resolve a trace by trace ID or span ID"));
+).pipe(
+  Command.withDescription(
+    "Alias for 'trace get' — resolves an id, and is not the TraceQL search; that is 'trace search'",
+  ),
+);
 
 const searchCommand = Command.make(
   "search",