@blogic-cz/agent-tools 1.5.2 → 1.5.4

package/src/azdo-tool/main.ts

@@ -0,0 +1,222 @@
+#!/usr/bin/env bun
+import { Command, Flag } from "effect/unstable/cli";
+import { BunRuntime, BunServices } from "@effect/platform-bun";
+import { Effect, Layer, Option } from "effect";
+
+import {
+  makeSchemaCommand,
+  formatAny,
+  formatOption,
+  formatOutput,
+  logText,
+  renderCauseToStderr,
+  VERSION,
+} from "#shared";
+import { AuditServiceLayer, withAudit } from "#shared/audit";
+import {
+  findFailedJobs,
+  getBuildJobSummary,
+  getBuildLogContent,
+  getBuildLogs,
+  getBuildTimeline,
+} from "./build";
+import { AzdoService, AzdoServiceLayer } from "./service";
+import { ConfigServiceLayer } from "#config";
+
+// ---------------------------------------------------------------------------
+// Common flags shared across build subcommands
+// ---------------------------------------------------------------------------
+
+const commonBuildFlags = {
+  format: formatOption,
+  profile: Flag.optional(Flag.String("profile")).pipe(
+    Flag.withDescription("Azure DevOps profile name (from agent-tools config)"),
+  ),
+};
+
+// ---------------------------------------------------------------------------
+// Build subcommands
+// ---------------------------------------------------------------------------
+
+const buildTimelineCommand = Command.make(
+  "timeline",
+  {
+    ...commonBuildFlags,
+    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
+  },
+  ({ buildId, format, profile: _profile }) =>
+    Effect.gen(function* () {
+      const result = yield* getBuildTimeline(buildId);
+      yield* logText(formatAny(result, format));
+    }),
+).pipe(Command.withDescription("Get build timeline with all records (jobs, stages, tasks)"));
+
+const buildFailedJobsCommand = Command.make(
+  "failed-jobs",
+  {
+    ...commonBuildFlags,
+    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
+  },
+  ({ buildId, format, profile: _profile }) =>
+    Effect.gen(function* () {
+      const failedJobs = yield* findFailedJobs(buildId);
+      yield* logText(formatAny({ buildId, failedJobs }, format));
+    }),
+).pipe(Command.withDescription("Find failed or canceled jobs in a build"));
+
+const buildLogsCommand = Command.make(
+  "logs",
+  {
+    ...commonBuildFlags,
+    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
+  },
+  ({ buildId, format, profile: _profile }) =>
+    Effect.gen(function* () {
+      const result = yield* getBuildLogs(buildId);
+      yield* logText(formatAny(result, format));
+    }),
+).pipe(Command.withDescription("Get list of build logs"));
+
+const buildLogContentCommand = Command.make(
+  "log-content",
+  {
+    ...commonBuildFlags,
+    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
+    logId: Flag.Int("log-id").pipe(Flag.withDescription("Log ID")),
+  },
+  ({ buildId, format, logId, profile: _profile }) =>
+    Effect.gen(function* () {
+      const content = yield* getBuildLogContent(buildId, logId);
+      yield* logText(formatAny({ buildId, logId, content }, format));
+    }),
+).pipe(Command.withDescription("Get specific log content by log ID"));
+
+const buildSummaryCommand = Command.make(
+  "summary",
+  {
+    ...commonBuildFlags,
+    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
+  },
+  ({ buildId, format, profile: _profile }) =>
+    Effect.gen(function* () {
+      const summary = yield* getBuildJobSummary(buildId);
+      yield* logText(formatAny({ buildId, summary }, format));
+    }),
+).pipe(Command.withDescription("Get job summaries with duration and status information"));
+
+// ---------------------------------------------------------------------------
+// Build parent command
+// ---------------------------------------------------------------------------
+
+const buildCommand = Command.make("build", {}).pipe(
+  Command.withDescription("Build helpers for Azure DevOps pipelines"),
+  Command.withSubcommands([
+    buildTimelineCommand,
+    buildFailedJobsCommand,
+    buildLogsCommand,
+    buildLogContentCommand,
+    buildSummaryCommand,
+  ]),
+);
+
+// ---------------------------------------------------------------------------
+// Raw command subcommand (preserves existing --cmd behavior)
+// ---------------------------------------------------------------------------
+
+const cmdCommand = Command.make(
+  "cmd",
+  {
+    profile: Flag.optional(Flag.String("profile")).pipe(
+      Flag.withDescription("Azure DevOps profile name (from agent-tools config)"),
+    ),
+    project: Flag.optional(Flag.String("project")).pipe(
+      Flag.withDescription("Azure DevOps project name (overrides config default)"),
+    ),
+    cmd: Flag.String("cmd").pipe(Flag.withDescription("az command (without 'az' prefix)")),
+    dryRun: Flag.Boolean("dry-run").pipe(
+      Flag.withDescription("Show command without executing"),
+      Flag.withDefault(false),
+    ),
+    format: formatOption,
+  },
+  ({ profile: _profile, project, cmd, dryRun, format }) =>
+    Effect.gen(function* () {
+      const projectName = project ? Option.getOrUndefined(project) : undefined;
+
+      if (dryRun) {
+        const fullCommand = `az ${cmd}`;
+        yield* logText(`[DRY-RUN] Would execute: ${fullCommand}`);
+        return;
+      }
+
+      const az = yield* AzdoService;
+
+      const startTime = Date.now();
+      const output = yield* az.runCommand(cmd, projectName);
+      const executionTimeMs = Date.now() - startTime;
+
+      yield* logText(
+        formatOutput(
+          {
+            success: true,
+            data: output,
+            executionTimeMs,
+          },
+          format,
+        ),
+      );
+    }),
+).pipe(
+  Command.withDescription(
+    `Execute raw az CLI commands directly.
+
+EXAMPLES:
+  agent-tools-azdo cmd --cmd "pipelines list"
+  agent-tools-azdo cmd --cmd "repos list" --project my-project
+  agent-tools-azdo cmd --cmd "pipelines runs list --output json"`,
+  ),
+);
+
+// ---------------------------------------------------------------------------
+// Main command with subcommands
+// ---------------------------------------------------------------------------
+
+const commandsCommand = makeSchemaCommand(() => mainCommand);
+
+const mainCommand = Command.make("azdo-tool", {}).pipe(
+  Command.withDescription(
+    `Azure DevOps Tool for Coding Agents (READ-ONLY)
+
+For Azure platform (PaaS) resources — vm, webapp, storage, aks, keyvault — use az-tool instead.
+
+Typed build subcommands:
+  azdo-tool build timeline --build-id 123
+  azdo-tool build failed-jobs --build-id 123
+  azdo-tool build logs --build-id 123
+  azdo-tool build log-content --build-id 123 --log-id 45
+  azdo-tool build summary --build-id 123
+
+Raw az wrapper:
+  azdo-tool cmd --cmd "pipelines list"`,
+  ),
+  Command.withSubcommands([buildCommand, cmdCommand, commandsCommand]),
+);
+
+const cli = Command.run(mainCommand, {
+  version: VERSION,
+});
+
+const MainLayer = AzdoServiceLayer.pipe(
+  Layer.provideMerge(ConfigServiceLayer),
+  Layer.provideMerge(BunServices.layer),
+  Layer.provideMerge(AuditServiceLayer),
+);
+
+const program = withAudit("azdo", cli).pipe(
+  Effect.provide(MainLayer),
+  Effect.tapCause(renderCauseToStderr),
+);
+
+BunRuntime.runMain(program, {
+  disableErrorReporting: true,
+});

package/src/credential-guard/index.ts

@@ -361,6 +361,15 @@ function hasArgumentBraceExpansion(text: string): boolean {
 }
 
 function hasCommandArgumentBraceExpansion(argv: string[]): boolean {
+  // LogQL is data for this wrapper; its quoted label selectors are never shell-evaluated.
+  if (
+    argv[0]?.split("/").at(-1) === "bun" &&
+    argv[1] === "run" &&
+    argv[2] === "observability-tool" &&
+    argv[3] === "logs" &&
+    argv[4] === "query"
+  )
+    return false;
   return (argv[0]?.split("/").at(-1) === "awk" && !isAwkExecution(argv)) ||
     isJqObjectConstruction(argv)
     ? false
@@ -492,9 +501,7 @@ function hasStaticEnvironmentRead(argv: string[], allowedNames: Set<string>): bo
   }
   if (isPassiveTextCommand(argv)) return false;
   // Any command may re-parse an argument as shell code (trap, find -exec, awk system()).
-  return (
-    hasArgumentBraceExpansion(argv.slice(1).join(" ")) || mentionsEnvironmentRead(argv.join(" "))
-  );
+  return hasCommandArgumentBraceExpansion(argv) || mentionsEnvironmentRead(argv.join(" "));
 }
 
 function isStaticHerdrPrompt(command: string): boolean {
@@ -626,7 +633,98 @@ function hasSensitiveFileRead(command: string): boolean {
       if (inspectedArgv === null) return false;
       const inspected = unwrapStaticCommand(inspectedArgv);
       const name = inspected[0]?.split("/").at(-1) ?? "";
-      return readers.test(name) && inspected.slice(1).some(isSensitivePath);
+      if (!readers.test(name)) return false;
+      if (name === "rg" || name === "grep") {
+        const args = inspected.slice(1);
+        const paths: string[] = [];
+        let hasPattern = false;
+        let options = true;
+        let filesOnly = false;
+        for (let i = 0; i < args.length; i++) {
+          const arg = args[i] ?? "";
+          if (options && arg === "--") {
+            options = false;
+            continue;
+          }
+          if (
+            options &&
+            (arg === "--pre" ||
+              arg.startsWith("--pre=") ||
+              arg === "--hostname-bin" ||
+              arg.startsWith("--hostname-bin="))
+          )
+            return true;
+          if (options && (arg.startsWith("--file=") || /^-f.+/.test(arg))) {
+            paths.push(arg.startsWith("--file=") ? arg.slice(7) : arg.slice(2));
+            hasPattern = true;
+            continue;
+          }
+          if (options && (arg.startsWith("--regexp=") || /^-e.+/.test(arg))) {
+            hasPattern = true;
+            continue;
+          }
+          if (
+            options &&
+            (arg.startsWith("--glob=") ||
+              arg.startsWith("--iglob=") ||
+              arg.startsWith("--include=") ||
+              /^-g.+/.test(arg))
+          ) {
+            const glob = arg.startsWith("--iglob=")
+              ? arg.slice(8)
+              : arg.startsWith("--include=")
+                ? arg.slice(10)
+                : arg.startsWith("--glob=")
+                  ? arg.slice(7)
+                  : arg.slice(2);
+            if (isSensitivePath(glob)) paths.push(glob);
+            continue;
+          }
+          if (
+            options &&
+            ["-e", "--regexp", "-f", "--file", "-g", "--glob", "--iglob", "--include"].includes(arg)
+          ) {
+            const value = args[++i];
+            if (arg === "-f" || arg === "--file") paths.push(value ?? "");
+            if (
+              (arg === "-g" || arg === "--glob" || arg === "--iglob" || arg === "--include") &&
+              value &&
+              isSensitivePath(value)
+            )
+              paths.push(value);
+            if (arg === "-e" || arg === "--regexp" || arg === "-f" || arg === "--file")
+              hasPattern = true;
+            continue;
+          }
+          if (options && (arg === "--files" || (arg === "-l" && name === "grep"))) {
+            filesOnly = arg === "--files";
+            if (filesOnly) continue;
+          }
+          if (options && arg.startsWith("-")) {
+            if (/^-[A-Za-z]+[fg]$/.test(arg)) {
+              const value = args[++i];
+              if (value && isSensitivePath(value)) paths.push(value);
+              if (arg.endsWith("f")) hasPattern = true;
+              continue;
+            }
+            const combinedPatternFile = arg.match(/^-[A-Za-z]*f(.+)$/)?.[1];
+            if (combinedPatternFile) {
+              if (isSensitivePath(combinedPatternFile)) paths.push(combinedPatternFile);
+              hasPattern = true;
+            }
+            const optionValue = arg.includes("=") ? arg.slice(arg.indexOf("=") + 1) : null;
+            if (optionValue && isSensitivePath(optionValue)) paths.push(optionValue);
+            continue;
+          }
+          if (!hasPattern && !filesOnly) {
+            hasPattern = true;
+            continue;
+          }
+          paths.push(arg);
+        }
+        return paths.some(isSensitivePath);
+      }
+      return inspected.slice(1).some(isSensitivePath);
     });
   }
   const unquoted = command.replace(/'(?:\\.|[^'])*'/g, " ").replace(/"(?:\\.|[^"$`])*"/g, " ");

package/src/db-tool/index.ts

@@ -1,262 +1,5 @@
 #!/usr/bin/env bun
-import { Command, Flag } from "effect/unstable/cli";
-import { BunRuntime, BunServices } from "@effect/platform-bun";
-import { Effect, Layer, Option } from "effect";
+import { checkEffectVersion } from "#shared/effect-version";
 
-import type { SchemaMode } from "./types";
-
-import {
-  makeSchemaCommand,
-  formatOption,
-  formatOutput,
-  logText,
-  renderCauseToStderr,
-  VERSION,
-} from "#shared";
-import { AuditServiceLayer, withAudit } from "#shared/audit";
-import { ConfigService, ConfigServiceLayer, getDefaultEnvironment } from "#config";
-import { DbConfigService, makeDbConfigLayer } from "./config-service";
-import { DbConnectionError } from "./errors";
-import { DbService } from "./service";
-import { DbSqlClient } from "./sql-client";
-
-// Extract --profile from argv before @effect/cli parsing
-// so we can build the correct config layer.
-const profileIndex = process.argv.indexOf("--profile");
-const profileArg = profileIndex !== -1 ? process.argv[profileIndex + 1] : undefined;
-
-/**
- * Resolve environment from explicit --env flag, config defaultEnvironment, or fail with hint.
- */
-const resolveEnv = (envOption: Option.Option<string>) =>
-  Effect.gen(function* () {
-    const explicit = Option.getOrUndefined(envOption);
-    if (explicit) return explicit;
-
-    const config = yield* ConfigService;
-    const defaultEnv = getDefaultEnvironment(config);
-
-    if (defaultEnv === "prod") {
-      return yield* new DbConnectionError({
-        message:
-          "Implicit prod access blocked. Config defaultEnvironment is 'prod' but --env was not passed explicitly.",
-        environment: "(prod-safety)",
-        hint: "Pass --env prod explicitly to confirm production access, or change defaultEnvironment to a non-prod value.",
-        nextCommand: 'agent-tools-db sql --env prod --sql "SELECT 1"',
-      });
-    }
-
-    if (defaultEnv) return defaultEnv;
-
-    return yield* new DbConnectionError({
-      message:
-        "No environment specified. Use --env <name> or set defaultEnvironment in agent-tools.json5.",
-      environment: "(not specified)",
-      hint: 'Set defaultEnvironment in agent-tools.json5 (e.g. defaultEnvironment: "local") or pass --env explicitly.',
-      nextCommand: 'agent-tools-db sql --env local --sql "SELECT 1"',
-    });
-  });
-
-const sqlCommand = Command.make(
-  "sql",
-  {
-    env: Flag.optional(Flag.String("env")).pipe(
-      Flag.withDescription(
-        "Target database environment name (e.g. local, test, prod). Falls back to defaultEnvironment in config.",
-      ),
-    ),
-    sql: Flag.String("sql").pipe(Flag.withDescription("SQL query to execute")),
-    limit: Flag.optional(Flag.Int("limit")).pipe(
-      Flag.withDescription(
-        "Max rows to return (default 50). Use 0 for no cap. Prefer a SQL LIMIT for large tables.",
-      ),
-    ),
-    format: formatOption,
-    profile: Flag.optional(Flag.String("profile")).pipe(
-      Flag.withDescription("Database profile name from agent-tools.json5 (if multiple configured)"),
-    ),
-  },
-  ({ env, sql, limit, format }) =>
-    Effect.gen(function* () {
-      const resolvedEnv = yield* resolveEnv(env);
-      const db = yield* DbService;
-      const result = yield* db.executeQuery(resolvedEnv, sql, Option.getOrUndefined(limit));
-      yield* logText(formatOutput(result, format));
-    }),
-).pipe(Command.withDescription("Execute a SQL query"));
-
-const schemaCommand = Command.make(
-  "schema",
-  {
-    env: Flag.optional(Flag.String("env")).pipe(
-      Flag.withDescription(
-        "Target database environment name (e.g. local, test, prod). Falls back to defaultEnvironment in config.",
-      ),
-    ),
-    mode: Flag.Literals("mode", ["tables", "columns", "full", "relationships"]).pipe(
-      Flag.withDescription(
-        "Schema introspection mode: tables (list all), columns (show columns for --table), full (all tables with columns), relationships (foreign keys)",
-      ),
-    ),
-    table: Flag.String("table").pipe(
-      Flag.withDescription("Table name (required for --mode columns)"),
-      Flag.optional,
-    ),
-    format: formatOption,
-    profile: Flag.optional(Flag.String("profile")).pipe(
-      Flag.withDescription("Database profile name from agent-tools.json5 (if multiple configured)"),
-    ),
-  },
-  ({ env, mode, table, format }) =>
-    Effect.gen(function* () {
-      const resolvedEnv = yield* resolveEnv(env);
-      const db = yield* DbService;
-      const result = yield* db.executeSchemaQuery(
-        resolvedEnv,
-        mode as SchemaMode,
-        Option.getOrUndefined(table),
-      );
-      yield* logText(formatOutput(result, format));
-    }),
-).pipe(Command.withDescription("Introspect database schema (tables, columns, relationships)"));
-
-const envsCommand = Command.make(
-  "envs",
-  {
-    format: formatOption,
-    profile: Flag.optional(Flag.String("profile")).pipe(
-      Flag.withDescription("Database profile name from agent-tools.json5 (if multiple configured)"),
-    ),
-  },
-  ({ format }) =>
-    Effect.gen(function* () {
-      const config = yield* ConfigService;
-      const dbConfig = yield* DbConfigService;
-      const environments = dbConfig ? Object.keys(dbConfig.environments) : [];
-      const result = {
-        success: true as const,
-        environments,
-        default: getDefaultEnvironment(config) ?? null,
-        message: `${environments.length} environment(s) configured`,
-        executionTimeMs: 0,
-      };
-      yield* logText(formatOutput(result, format));
-    }),
-).pipe(
-  Command.withDescription("List configured database environments and the default (no network)"),
-);
-
-const ACTIVITY_SQL = `SELECT pid, usename AS "user", state,
-  date_trunc('second', now() - xact_start) AS xact_age,
-  date_trunc('second', now() - query_start) AS query_age,
-  wait_event_type, wait_event, left(query, 200) AS query
-FROM pg_stat_activity
-WHERE pid <> pg_backend_pid() AND state IS NOT NULL
-ORDER BY xact_start ASC NULLS LAST`;
-
-const LOCKS_SQL = `SELECT blocking.pid AS blocking_pid, blocking.usename AS blocking_user,
-  left(blocking.query, 150) AS blocking_query,
-  blocked.pid AS blocked_pid, blocked.usename AS blocked_user,
-  left(blocked.query, 150) AS blocked_query
-FROM pg_stat_activity blocked
-JOIN pg_stat_activity blocking ON blocking.pid = ANY(pg_blocking_pids(blocked.pid))
-ORDER BY blocking.pid, blocked.pid`;
-
-const GRANTS_SQL = `SELECT grantee, table_schema AS schema, 'table' AS kind, table_name AS object,
-  string_agg(privilege_type, ', ' ORDER BY privilege_type) AS privileges
-FROM information_schema.role_table_grants
-WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
-GROUP BY grantee, table_schema, table_name
-UNION ALL
-SELECT grantee, object_schema AS schema, 'sequence' AS kind, object_name AS object,
-  string_agg(privilege_type, ', ' ORDER BY privilege_type) AS privileges
-FROM information_schema.role_usage_grants
-WHERE object_type = 'SEQUENCE' AND object_schema NOT IN ('pg_catalog', 'information_schema')
-GROUP BY grantee, object_schema, object_name
-ORDER BY grantee, schema, kind, object`;
-
-const makeDiagnosticCommand = (name: string, description: string, sql: string) =>
-  Command.make(
-    name,
-    {
-      env: Flag.optional(Flag.String("env")).pipe(
-        Flag.withDescription(
-          "Target database environment name (e.g. local, test, prod). Falls back to defaultEnvironment in config.",
-        ),
-      ),
-      limit: Flag.optional(Flag.Int("limit")).pipe(
-        Flag.withDescription("Max rows to return (default 50). Use 0 for no cap."),
-      ),
-      format: formatOption,
-      profile: Flag.optional(Flag.String("profile")).pipe(
-        Flag.withDescription(
-          "Database profile name from agent-tools.json5 (if multiple configured)",
-        ),
-      ),
-    },
-    ({ env, limit, format }) =>
-      Effect.gen(function* () {
-        const resolvedEnv = yield* resolveEnv(env);
-        const db = yield* DbService;
-        const result = yield* db.executeQuery(resolvedEnv, sql, Option.getOrUndefined(limit));
-        yield* logText(formatOutput(result, format));
-      }),
-  ).pipe(Command.withDescription(description));
-
-const activityCommand = makeDiagnosticCommand(
-  "activity",
-  "Show live sessions from pg_stat_activity (state, transaction/query age, wait event), longest-running first",
-  ACTIVITY_SQL,
-);
-
-const locksCommand = makeDiagnosticCommand(
-  "locks",
-  "Show blocking chains (blocker -> blocked) from pg_blocking_pids + pg_stat_activity",
-  LOCKS_SQL,
-);
-
-const grantsCommand = makeDiagnosticCommand(
-  "grants",
-  "Show per-role table/sequence privileges by schema (excludes system schemas)",
-  GRANTS_SQL,
-);
-
-const commandsCommand = makeSchemaCommand(() => mainCommand);
-
-const mainCommand = Command.make("db-tool", {}).pipe(
-  Command.withDescription("Database Query Tool for Coding Agents"),
-  Command.withSubcommands([
-    sqlCommand,
-    schemaCommand,
-    activityCommand,
-    locksCommand,
-    grantsCommand,
-    envsCommand,
-    commandsCommand,
-  ]),
-);
-
-const cli = Command.run(mainCommand, {
-  version: VERSION,
-});
-
-const dbConfigLayer = makeDbConfigLayer(profileArg);
-
-const MainLayer = DbService.layer.pipe(
-  // provideMerge (not provide) so DbConfigService stays in the program context for the `envs` command,
-  // which reads it directly rather than going through DbService.
-  Layer.provideMerge(DbSqlClient.layer),
-  Layer.provideMerge(dbConfigLayer),
-  Layer.provideMerge(ConfigServiceLayer),
-  Layer.provideMerge(BunServices.layer),
-  Layer.provideMerge(AuditServiceLayer),
-);
-
-const program = withAudit("db", cli).pipe(
-  Effect.provide(MainLayer),
-  Effect.tapCause(renderCauseToStderr),
-);
-
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+if (await checkEffectVersion()) await import("./main");
+else process.exitCode = 1;