@blogic-cz/agent-tools 1.5.2 → 1.5.4

package/src/db-tool/main.ts

@@ -0,0 +1,262 @@
+#!/usr/bin/env bun
+import { Command, Flag } from "effect/unstable/cli";
+import { BunRuntime, BunServices } from "@effect/platform-bun";
+import { Effect, Layer, Option } from "effect";
+
+import type { SchemaMode } from "./types";
+
+import {
+  makeSchemaCommand,
+  formatOption,
+  formatOutput,
+  logText,
+  renderCauseToStderr,
+  VERSION,
+} from "#shared";
+import { AuditServiceLayer, withAudit } from "#shared/audit";
+import { ConfigService, ConfigServiceLayer, getDefaultEnvironment } from "#config";
+import { DbConfigService, makeDbConfigLayer } from "./config-service";
+import { DbConnectionError } from "./errors";
+import { DbService } from "./service";
+import { DbSqlClient } from "./sql-client";
+
+// Extract --profile from argv before @effect/cli parsing
+// so we can build the correct config layer.
+const profileIndex = process.argv.indexOf("--profile");
+const profileArg = profileIndex !== -1 ? process.argv[profileIndex + 1] : undefined;
+
+/**
+ * Resolve environment from explicit --env flag, config defaultEnvironment, or fail with hint.
+ */
+const resolveEnv = (envOption: Option.Option<string>) =>
+  Effect.gen(function* () {
+    const explicit = Option.getOrUndefined(envOption);
+    if (explicit) return explicit;
+
+    const config = yield* ConfigService;
+    const defaultEnv = getDefaultEnvironment(config);
+
+    if (defaultEnv === "prod") {
+      return yield* new DbConnectionError({
+        message:
+          "Implicit prod access blocked. Config defaultEnvironment is 'prod' but --env was not passed explicitly.",
+        environment: "(prod-safety)",
+        hint: "Pass --env prod explicitly to confirm production access, or change defaultEnvironment to a non-prod value.",
+        nextCommand: 'agent-tools-db sql --env prod --sql "SELECT 1"',
+      });
+    }
+
+    if (defaultEnv) return defaultEnv;
+
+    return yield* new DbConnectionError({
+      message:
+        "No environment specified. Use --env <name> or set defaultEnvironment in agent-tools.json5.",
+      environment: "(not specified)",
+      hint: 'Set defaultEnvironment in agent-tools.json5 (e.g. defaultEnvironment: "local") or pass --env explicitly.',
+      nextCommand: 'agent-tools-db sql --env local --sql "SELECT 1"',
+    });
+  });
+
+const sqlCommand = Command.make(
+  "sql",
+  {
+    env: Flag.optional(Flag.String("env")).pipe(
+      Flag.withDescription(
+        "Target database environment name (e.g. local, test, prod). Falls back to defaultEnvironment in config.",
+      ),
+    ),
+    sql: Flag.String("sql").pipe(Flag.withDescription("SQL query to execute")),
+    limit: Flag.optional(Flag.Int("limit")).pipe(
+      Flag.withDescription(
+        "Max rows to return (default 50). Use 0 for no cap. Prefer a SQL LIMIT for large tables.",
+      ),
+    ),
+    format: formatOption,
+    profile: Flag.optional(Flag.String("profile")).pipe(
+      Flag.withDescription("Database profile name from agent-tools.json5 (if multiple configured)"),
+    ),
+  },
+  ({ env, sql, limit, format }) =>
+    Effect.gen(function* () {
+      const resolvedEnv = yield* resolveEnv(env);
+      const db = yield* DbService;
+      const result = yield* db.executeQuery(resolvedEnv, sql, Option.getOrUndefined(limit));
+      yield* logText(formatOutput(result, format));
+    }),
+).pipe(Command.withDescription("Execute a SQL query"));
+
+const schemaCommand = Command.make(
+  "schema",
+  {
+    env: Flag.optional(Flag.String("env")).pipe(
+      Flag.withDescription(
+        "Target database environment name (e.g. local, test, prod). Falls back to defaultEnvironment in config.",
+      ),
+    ),
+    mode: Flag.Literals("mode", ["tables", "columns", "full", "relationships"]).pipe(
+      Flag.withDescription(
+        "Schema introspection mode: tables (list all), columns (show columns for --table), full (all tables with columns), relationships (foreign keys)",
+      ),
+    ),
+    table: Flag.String("table").pipe(
+      Flag.withDescription("Table name (required for --mode columns)"),
+      Flag.optional,
+    ),
+    format: formatOption,
+    profile: Flag.optional(Flag.String("profile")).pipe(
+      Flag.withDescription("Database profile name from agent-tools.json5 (if multiple configured)"),
+    ),
+  },
+  ({ env, mode, table, format }) =>
+    Effect.gen(function* () {
+      const resolvedEnv = yield* resolveEnv(env);
+      const db = yield* DbService;
+      const result = yield* db.executeSchemaQuery(
+        resolvedEnv,
+        mode as SchemaMode,
+        Option.getOrUndefined(table),
+      );
+      yield* logText(formatOutput(result, format));
+    }),
+).pipe(Command.withDescription("Introspect database schema (tables, columns, relationships)"));
+
+const envsCommand = Command.make(
+  "envs",
+  {
+    format: formatOption,
+    profile: Flag.optional(Flag.String("profile")).pipe(
+      Flag.withDescription("Database profile name from agent-tools.json5 (if multiple configured)"),
+    ),
+  },
+  ({ format }) =>
+    Effect.gen(function* () {
+      const config = yield* ConfigService;
+      const dbConfig = yield* DbConfigService;
+      const environments = dbConfig ? Object.keys(dbConfig.environments) : [];
+      const result = {
+        success: true as const,
+        environments,
+        default: getDefaultEnvironment(config) ?? null,
+        message: `${environments.length} environment(s) configured`,
+        executionTimeMs: 0,
+      };
+      yield* logText(formatOutput(result, format));
+    }),
+).pipe(
+  Command.withDescription("List configured database environments and the default (no network)"),
+);
+
+const ACTIVITY_SQL = `SELECT pid, usename AS "user", state,
+  date_trunc('second', now() - xact_start) AS xact_age,
+  date_trunc('second', now() - query_start) AS query_age,
+  wait_event_type, wait_event, left(query, 200) AS query
+FROM pg_stat_activity
+WHERE pid <> pg_backend_pid() AND state IS NOT NULL
+ORDER BY xact_start ASC NULLS LAST`;
+
+const LOCKS_SQL = `SELECT blocking.pid AS blocking_pid, blocking.usename AS blocking_user,
+  left(blocking.query, 150) AS blocking_query,
+  blocked.pid AS blocked_pid, blocked.usename AS blocked_user,
+  left(blocked.query, 150) AS blocked_query
+FROM pg_stat_activity blocked
+JOIN pg_stat_activity blocking ON blocking.pid = ANY(pg_blocking_pids(blocked.pid))
+ORDER BY blocking.pid, blocked.pid`;
+
+const GRANTS_SQL = `SELECT grantee, table_schema AS schema, 'table' AS kind, table_name AS object,
+  string_agg(privilege_type, ', ' ORDER BY privilege_type) AS privileges
+FROM information_schema.role_table_grants
+WHERE table_schema NOT IN ('pg_catalog', 'information_schema')
+GROUP BY grantee, table_schema, table_name
+UNION ALL
+SELECT grantee, object_schema AS schema, 'sequence' AS kind, object_name AS object,
+  string_agg(privilege_type, ', ' ORDER BY privilege_type) AS privileges
+FROM information_schema.role_usage_grants
+WHERE object_type = 'SEQUENCE' AND object_schema NOT IN ('pg_catalog', 'information_schema')
+GROUP BY grantee, object_schema, object_name
+ORDER BY grantee, schema, kind, object`;
+
+const makeDiagnosticCommand = (name: string, description: string, sql: string) =>
+  Command.make(
+    name,
+    {
+      env: Flag.optional(Flag.String("env")).pipe(
+        Flag.withDescription(
+          "Target database environment name (e.g. local, test, prod). Falls back to defaultEnvironment in config.",
+        ),
+      ),
+      limit: Flag.optional(Flag.Int("limit")).pipe(
+        Flag.withDescription("Max rows to return (default 50). Use 0 for no cap."),
+      ),
+      format: formatOption,
+      profile: Flag.optional(Flag.String("profile")).pipe(
+        Flag.withDescription(
+          "Database profile name from agent-tools.json5 (if multiple configured)",
+        ),
+      ),
+    },
+    ({ env, limit, format }) =>
+      Effect.gen(function* () {
+        const resolvedEnv = yield* resolveEnv(env);
+        const db = yield* DbService;
+        const result = yield* db.executeQuery(resolvedEnv, sql, Option.getOrUndefined(limit));
+        yield* logText(formatOutput(result, format));
+      }),
+  ).pipe(Command.withDescription(description));
+
+const activityCommand = makeDiagnosticCommand(
+  "activity",
+  "Show live sessions from pg_stat_activity (state, transaction/query age, wait event), longest-running first",
+  ACTIVITY_SQL,
+);
+
+const locksCommand = makeDiagnosticCommand(
+  "locks",
+  "Show blocking chains (blocker -> blocked) from pg_blocking_pids + pg_stat_activity",
+  LOCKS_SQL,
+);
+
+const grantsCommand = makeDiagnosticCommand(
+  "grants",
+  "Show per-role table/sequence privileges by schema (excludes system schemas)",
+  GRANTS_SQL,
+);
+
+const commandsCommand = makeSchemaCommand(() => mainCommand);
+
+const mainCommand = Command.make("db-tool", {}).pipe(
+  Command.withDescription("Database Query Tool for Coding Agents"),
+  Command.withSubcommands([
+    sqlCommand,
+    schemaCommand,
+    activityCommand,
+    locksCommand,
+    grantsCommand,
+    envsCommand,
+    commandsCommand,
+  ]),
+);
+
+const cli = Command.run(mainCommand, {
+  version: VERSION,
+});
+
+const dbConfigLayer = makeDbConfigLayer(profileArg);
+
+const MainLayer = DbService.layer.pipe(
+  // provideMerge (not provide) so DbConfigService stays in the program context for the `envs` command,
+  // which reads it directly rather than going through DbService.
+  Layer.provideMerge(DbSqlClient.layer),
+  Layer.provideMerge(dbConfigLayer),
+  Layer.provideMerge(ConfigServiceLayer),
+  Layer.provideMerge(BunServices.layer),
+  Layer.provideMerge(AuditServiceLayer),
+);
+
+const program = withAudit("db", cli).pipe(
+  Effect.provide(MainLayer),
+  Effect.tapCause(renderCauseToStderr),
+);
+
+BunRuntime.runMain(program, {
+  disableErrorReporting: true,
+});

package/src/gh-tool/api.ts

@@ -4,6 +4,7 @@ import { retryTransient } from "#shared/retry-transient";
 
 import { GitHubAuthError, GitHubCommandError, GitHubNotFoundError } from "./errors";
 import type { GitHubApiError } from "./errors";
+import { validateOutboundText } from "./text-input";
 
 // Direct HTTP, not `gh api`: the CLI collapses every failure into a non-zero exit and
 // loses the status code, but merge-async answers 202 (accepted), 200 (already merged or
@@ -66,9 +67,28 @@ export type GitHubApiRequest = {
 
 const MAX_API_RETRIES = 2;
 
+const outboundBodyText = (value: unknown): string => {
+  if (typeof value === "string") return value;
+  if (Array.isArray(value)) return value.map(outboundBodyText).join("\n");
+  if (value !== null && typeof value === "object")
+    return Object.values(value).map(outboundBodyText).join("\n");
+  return "";
+};
+
 const githubApiAttempt = Effect.fn("gh.githubApiAttempt")(function* <T>(opts: GitHubApiRequest) {
-  const token = yield* resolveGitHubToken();
   const method = opts.method ?? "GET";
+  const bodyText = yield* Effect.try({
+    try: () => outboundBodyText(opts.body),
+    catch: () =>
+      new GitHubCommandError({
+        command: `gh-tool ${method} ${opts.path}`,
+        exitCode: 1,
+        stderr: "Refusing to publish an invalid request body",
+        message: "Refusing to publish an invalid request body",
+      }),
+  });
+  yield* validateOutboundText(`${opts.path}\n${bodyText}`, `gh-tool ${method} ${opts.path}`);
+  const token = yield* resolveGitHubToken();
   const url = `${GITHUB_API_ROOT}/${opts.path.replace(/^\//, "")}`;
 
   const response = yield* Effect.tryPromise({

package/src/gh-tool/gist.ts

@@ -3,7 +3,7 @@ import { Effect, Option } from "effect";
 import { join } from "node:path";
 
 import { formatOption, logFormatted } from "#shared";
-import { isSensitivePath, resolveOptionalTextInput } from "#gh/text-input";
+import { isSensitivePath, resolveOptionalTextInput, validateOutboundFile } from "#gh/text-input";
 import { GitHubCommandError } from "./errors";
 import { GitHubService } from "./service";
 
@@ -294,6 +294,8 @@ export const createGist = Effect.fn("gist.createGist")(function* (opts: {
 }) {
   const gh = yield* GitHubService;
 
+  for (const path of opts.paths) yield* validateOutboundFile(path, "gh-tool gist create");
+
   const args = ["gist", "create", ...opts.paths];
 
   if (opts.description !== null) {
@@ -339,6 +341,10 @@ const editGist = Effect.fn("gist.editGist")(function* (opts: {
 }) {
   const gh = yield* GitHubService;
 
+  for (const path of [opts.sourcePath, opts.add]) {
+    if (path !== null) yield* validateOutboundFile(path, "gh-tool gist edit");
+  }
+
   const args = ["gist", "edit", opts.id];
   const changes: string[] = [];
 

package/src/gh-tool/index.ts

@@ -1,258 +1,5 @@
 #!/usr/bin/env bun
-import { Command } from "effect/unstable/cli";
-import { BunRuntime, BunServices } from "@effect/platform-bun";
-import { Effect, Layer } from "effect";
+import { checkEffectVersion } from "#shared/effect-version";
 
-import { makeSchemaCommand, renderCauseToStderr, VERSION } from "#shared";
-import { AuditServiceLayer, withAudit } from "#shared/audit";
-import { ConfigServiceLayer } from "#config";
-import {
-  issueCloseCommand,
-  issueCommentCommand,
-  issueCommentsCommand,
-  issueCreateCommand,
-  issueEditCommand,
-  issueListCommand,
-  issueReopenCommand,
-  issueSnapshotBatchCommand,
-  issueTriageCommand,
-  issueViewCommand,
-} from "./issue";
-import {
-  prViewCommand,
-  prStatusCommand,
-  prListCommand,
-  prCreateCommand,
-  prCloseCommand,
-  prEditCommand,
-  prMergeCommand,
-  prReadyCommand,
-  prStackCommand,
-  prRequestReviewCommand,
-  prThreadsCommand,
-  prCommentsCommand,
-  prIssueCommentsCommand,
-  prIssueCommentsLatestCommand,
-  prCommentCommand,
-  prDiscussionSummaryCommand,
-  prFeedbackCommand,
-  prReplyCommand,
-  prResolveCommand,
-  prReviewCommand,
-  prReviewsCommand,
-  prLastHumanReviewerCommand,
-  prSubmitReviewCommand,
-  prChecksCommand,
-  prChecksFailedCommand,
-  prRerunChecksCommand,
-  prTriggerChecksCommand,
-  prReplyAndResolveCommand,
-  prReviewTriageBatchCommand,
-  prReviewTriageCommand,
-  prWaitMergeableCommand,
-  prWatchCommand,
-} from "./pr/index";
-import { branchRenameCommand } from "./branch";
-import {
-  gistCreateCommand,
-  gistDeleteCommand,
-  gistEditCommand,
-  gistListCommand,
-  gistViewCommand,
-} from "./gist";
-import {
-  releaseCreateCommand,
-  releaseDeleteCommand,
-  releaseEditCommand,
-  releaseListCommand,
-  releaseStatusCommand,
-  releaseViewCommand,
-} from "./release";
-import { repoInfoCommand, repoListCommand, repoSearchCodeCommand } from "./repo";
-import { GitHubService } from "./service";
-import {
-  workflowAnnotationsCommand,
-  workflowCancelCommand,
-  workflowJobLogsCommand,
-  workflowJobsCommand,
-  workflowListCommand,
-  workflowLogsCommand,
-  workflowRerunCommand,
-  workflowRunCommand,
-  workflowViewCommand,
-  workflowWatchCommand,
-} from "./workflow";
-
-const prCommand = Command.make("pr", {}).pipe(
-  Command.withDescription("Pull request operations (view, create, merge, reviews, checks)"),
-  Command.withSubcommands([
-    prViewCommand,
-    prStatusCommand,
-    prListCommand,
-    prCreateCommand,
-    prCloseCommand,
-    prEditCommand,
-    prMergeCommand,
-    prReadyCommand,
-    prStackCommand,
-    prRequestReviewCommand,
-    prWaitMergeableCommand,
-    prThreadsCommand,
-    prCommentsCommand,
-    prReviewsCommand,
-    prLastHumanReviewerCommand,
-    prFeedbackCommand,
-    prIssueCommentsCommand,
-    prIssueCommentsLatestCommand,
-    prCommentCommand,
-    prDiscussionSummaryCommand,
-    prReplyCommand,
-    prResolveCommand,
-    prReviewCommand,
-    prSubmitReviewCommand,
-    prChecksCommand,
-    prChecksFailedCommand,
-    prWatchCommand,
-    prRerunChecksCommand,
-    prTriggerChecksCommand,
-    prReplyAndResolveCommand,
-    prReviewTriageCommand,
-    prReviewTriageBatchCommand,
-  ]),
-);
-
-const issueCommand = Command.make("issue", {}).pipe(
-  Command.withDescription(
-    "Issue operations (list, view, comments, triage, snapshot-batch, create, close, reopen, comment, edit)",
-  ),
-  Command.withSubcommands([
-    issueListCommand,
-    issueViewCommand,
-    issueCommentsCommand,
-    issueTriageCommand,
-    issueSnapshotBatchCommand,
-    issueCreateCommand,
-    issueCloseCommand,
-    issueReopenCommand,
-    issueCommentCommand,
-    issueEditCommand,
-  ]),
-);
-
-const branchCommand = Command.make("branch", {}).pipe(
-  Command.withDescription("Branch operations (rename)"),
-  Command.withSubcommands([branchRenameCommand]),
-);
-
-const repoCommand = Command.make("repo", {}).pipe(
-  Command.withDescription("Repository operations"),
-  Command.withSubcommands([repoInfoCommand, repoListCommand, repoSearchCodeCommand]),
-);
-
-const workflowCommand = Command.make("workflow", {}).pipe(
-  Command.withDescription(
-    "GitHub Actions workflow operations (run, list, view, jobs, logs, job-logs, annotations, rerun, cancel, watch)",
-  ),
-  Command.withSubcommands([
-    workflowRunCommand,
-    workflowListCommand,
-    workflowViewCommand,
-    workflowJobsCommand,
-    workflowLogsCommand,
-    workflowJobLogsCommand,
-    workflowAnnotationsCommand,
-    workflowRerunCommand,
-    workflowCancelCommand,
-    workflowWatchCommand,
-  ]),
-);
-
-const releaseCommand = Command.make("release", {}).pipe(
-  Command.withDescription("Release operations (create, list, view, edit, delete, status)"),
-  Command.withSubcommands([
-    releaseCreateCommand,
-    releaseListCommand,
-    releaseViewCommand,
-    releaseEditCommand,
-    releaseDeleteCommand,
-    releaseStatusCommand,
-  ]),
-);
-
-const gistCommand = Command.make("gist", {}).pipe(
-  Command.withDescription("Gist operations (list, view, create, edit, delete)"),
-  Command.withSubcommands([
-    gistListCommand,
-    gistViewCommand,
-    gistCreateCommand,
-    gistEditCommand,
-    gistDeleteCommand,
-  ]),
-);
-
-const commandsCommand = makeSchemaCommand(() => mainCommand);
-
-const mainCommand = Command.make("gh-tool", {}).pipe(
-  Command.withDescription(
-    `GitHub CLI Tool for Coding Agents
-
-Wraps the GitHub CLI (gh) with structured output for AI agents.
-Supports PR management, issue management, reviews, CI checks, and repo info.
-
-WORKFLOW FOR AI AGENTS:
-  1. Use 'pr view' to inspect current PR
-  2. Use 'pr discussion-summary' for overview (counts + latest discussion comment)
-  3. Use 'pr threads' and 'pr issue-comments-latest --author <username> --body-contains "Review"' for review context
-  4. Use 'pr reply', 'pr comment' and 'pr resolve' to handle feedback
-  4b. Use 'pr review --event request-changes|approve|comment --confirm' to post a verdict, or 'pr submit-review' for a pending one
-  5. Use 'pr checks' to monitor CI status; 'pr trigger-checks --workflow <file.yml>' when zero checks were reported
-  6. Use 'pr merge' to merge (dry-run by default)
-  7. Use 'issue list' to list open/closed issues
-  8. Use 'issue triage --issue N --verbosity full' to inspect one issue in one call
-  9. Use 'issue comments --issue N' to read issue discussion comments separately
-  10. Use 'issue close --issue N --comment "reason"' to close issues
-  11. Use 'issue comment --issue N --body "text"' to comment on issues
-  12. Use 'repo info' to get repository metadata
-  13. Use 'workflow run' to dispatch workflow_dispatch workflows
-  14. Use 'workflow list' to list recent workflow runs
-  15. Use 'workflow view --run N' to inspect a specific run with jobs/steps
-  16. Use 'workflow logs --run N' to get logs (failed jobs by default)
-  17. Use 'workflow job-logs --run N --job "build-web-app"' to get clean parsed logs for a specific job
-  18. Use 'workflow annotations --run N' to list CI annotations (errors, warnings, notices)
-  19. Use 'workflow watch --run N' to watch until completion
-  20. Use 'release status' to inspect latest release + repository context
-  21. Use 'release create --tag vX.Y.Z --generate-notes' to publish a release
-  22. Use 'release edit/view/list/delete' to maintain existing releases
-  23. Use 'branch rename --old-name X --new-name Y --confirm' to rename a branch
-  24. Use 'gist list/view' to read gists and 'gist create --files a.ts --desc "..."' to share snippets`,
-  ),
-  Command.withSubcommands([
-    prCommand,
-    issueCommand,
-    repoCommand,
-    branchCommand,
-    workflowCommand,
-    releaseCommand,
-    gistCommand,
-    commandsCommand,
-  ]),
-);
-
-const cli = Command.run(mainCommand, {
-  version: VERSION,
-});
-
-const MainLayer = GitHubService.layer.pipe(
-  Layer.provideMerge(BunServices.layer),
-  Layer.provideMerge(AuditServiceLayer),
-  Layer.provideMerge(ConfigServiceLayer),
-);
-
-const program = withAudit("gh", cli).pipe(
-  Effect.provide(MainLayer),
-  Effect.tapCause(renderCauseToStderr),
-);
-
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+if (await checkEffectVersion()) await import("./main");
+else process.exitCode = 1;