@blogic-cz/agent-tools 1.5.3 → 1.5.5

package/README.md

@@ -27,10 +27,10 @@ These tools wrap each CLI with:
 bun add -d @blogic-cz/agent-tools
 ```
 
-`effect` is a peer dependency pinned to an exact version, and package managers install
-it for you. If your project depends on `effect` too, pin it to the same exact version.
-Two copies of `effect` are structurally incompatible types, so the values this package
-exports stop typechecking in your project when the versions drift.
+`effect` is a peer dependency with the range `^4.0.0-rc.117`, which matches
+`@effect/platform-bun`. If your project depends on `effect` too, use a version in this
+range. Two copies of `effect` are structurally incompatible types, so the values this
+package exports stop typechecking in your project when the versions drift.
 
 ### Skill installation
 
@@ -634,8 +634,9 @@ Claude Code uses shell command hooks. The package ships a ready-made wrapper scr
 
 That's it. The hook reads tool input from stdin, runs the guard, and exits with code 2 (blocked + reason on stderr) or 0 (allowed).
 
-The guard permits static `printenv` reads only for exact names in `credentialGuard.allowedEnvironmentVariables`. The default list is empty. Multiple names are allowed only when each name is approved.
-It recognizes `rtk` and `rtk proxy` prefixes and checks each command in a pipeline or chain.
+The guard permits static `printenv` reads and simple `echo`/`printf` expansions only for exact names in `credentialGuard.allowedEnvironmentVariables`. The default list is empty. Multiple names are allowed only when each name is approved. Leading standalone literal assignments such as `F=README.md; cat "$F"` work in supported static commands. Conditional assignments, loop variables, mutation such as `printf -v`, and unknown commands cannot establish that proof. Use a literal path or a leading semicolon-terminated assignment for these cases. Approved environment values may be displayed, but redirecting their pipeline or passing them to an executor stays blocked.
+Ordinary navigation operands such as `cd "$HOME"` and `git -C "$WORKTREE_ROOT" status --short` do not need display permission. This does not authorize printing those values, using them as code/options, or reading unknown file paths. In `printf`, approved values belong in data arguments after a fixed nonmutating format, for example `printf -- '%s' "$WORKSPACE_LABEL"`.
+It recognizes `rtk`, `rtk proxy`, `command`, and supported `env` prefixes and checks each command in a pipeline or chain. Quoted filenames, comments, and redirects retain the sensitive-path checks. Jq object selectors and inline awk programs qualify only when their actual program and options establish passive behavior.
 Literal environment-command text in `rg`, `grep`, `git grep`, `echo`, and `printf` is allowed. In pipelines, every other command must be a known passive text command or an approved static environment read.
 Each pipeline is checked separately from statements joined by `;`, `&&`, or `||`.
 Execution options, other environment reads, and environment reads in dynamic or unsupported shell syntax stay blocked. Custom dangerous-command patterns still apply to the complete input.

package/dist/audit-tool/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env bun
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/audit-tool/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/audit-tool/main.ts"],"names":[],"mappings":""}

package/dist/az-tool/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env bun
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/az-tool/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/az-tool/main.ts"],"names":[],"mappings":""}

package/dist/azdo-tool/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env bun
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/azdo-tool/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/azdo-tool/main.ts"],"names":[],"mappings":""}

package/dist/credential-guard/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAM5E,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AAgsBF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAuNrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UAj8BD,SAAS,UAAU,UAAU,KAAK,IAi8BM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YAn8BC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IAm8BjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aAr8BE,MAAM,KAAK,OAq8BgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAv8BE,MAAM,KAAK,OAu8BgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAz8BC,MAAM,KAAK,OAy8B0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YA38BC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IA28Bf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YA78BC,MAAM,KAAK,OA68BsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YA/8BC,MAAM,KAAK,MAAM,GAAG,IA+8Ba,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/credential-guard/index.ts"],"names":[],"mappings":"AAAA;;;;;;;;;;;;;;GAcG;AAEH,OAAO,KAAK,EAAmB,qBAAqB,EAAE,MAAM,eAAe,CAAC;AAM5E,8CAA8C;AAC9C,MAAM,MAAM,SAAS,GAAG;IACtB,IAAI,EAAE,MAAM,CAAC;CACd,CAAC;AAEF,+CAA+C;AAC/C,MAAM,MAAM,UAAU,GAAG;IACvB,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,CAAC;CAC/B,CAAC;AAQF,+CAA+C;AAC/C,MAAM,MAAM,eAAe,GAAG;IAC5B,uBAAuB,EAAE,CAAC,KAAK,EAAE,SAAS,EAAE,MAAM,EAAE,UAAU,KAAK,IAAI,CAAC;IACxE,aAAa,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,KAAK,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IAC3E,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,aAAa,EAAE,CAAC,QAAQ,EAAE,MAAM,KAAK,OAAO,CAAC;IAC7C,sBAAsB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACrD,iBAAiB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,OAAO,EAAE,MAAM,CAAA;KAAE,GAAG,IAAI,CAAC;IACjF,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,OAAO,CAAC;IACjD,kBAAkB,EAAE,CAAC,OAAO,EAAE,MAAM,KAAK,MAAM,GAAG,IAAI,CAAC;CACxD,CAAC;AA6nCF,6CAA6C;AAC7C,wBAAgB,eAAe,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAErE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAED,2CAA2C;AAC3C,wBAAgB,cAAc,CAAC,IAAI,EAAE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,GAAG,MAAM,CAEpE;AAMD;;;;;GAKG;AACH,wBAAgB,qBAAqB,CAAC,MAAM,CAAC,EAAE,qBAAqB,GAAG,eAAe,CAoPrF;AAQD,kEAAkE;AAClE,eAAO,MAAM,uBAAuB,UA35CD,SAAS,UAAU,UAAU,KAAK,IA25CM,CAAC;AAE5E,oDAAoD;AACpD,eAAO,MAAM,aAAa,YA75CC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,KAAK,EAAE,MAAM,CAAA;CAAE,GAAG,IA65CjB,CAAC;AAExD,yEAAyE;AACzE,eAAO,MAAM,aAAa,aA/5CE,MAAM,KAAK,OA+5CgB,CAAC;AAExD,yDAAyD;AACzD,eAAO,MAAM,aAAa,aAj6CE,MAAM,KAAK,OAi6CgB,CAAC;AAExD,oEAAoE;AACpE,eAAO,MAAM,sBAAsB,YAn6CC,MAAM,KAAK,OAm6C0B,CAAC;AAE1E,iDAAiD;AACjD,eAAO,MAAM,iBAAiB,YAr6CC,MAAM,KAAK;IAAE,IAAI,EAAE,MAAM,CAAC;IAAC,OAAO,EAAE,MAAM,CAAA;CAAE,GAAG,IAq6Cf,CAAC;AAEhE,wDAAwD;AACxD,eAAO,MAAM,kBAAkB,YAv6CC,MAAM,KAAK,OAu6CsB,CAAC;AAElE,8EAA8E;AAC9E,eAAO,MAAM,kBAAkB,YAz6CC,MAAM,KAAK,MAAM,GAAG,IAy6Ca,CAAC"}

package/dist/db-tool/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env bun
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/db-tool/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/db-tool/main.ts"],"names":[],"mappings":""}

package/dist/gh-tool/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env bun
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/gh-tool/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/gh-tool/main.ts"],"names":[],"mappings":""}

package/dist/gh-tool/pr/core.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,MAAM,EAAkB,MAAM,QAAQ,CAAC;AAE1E,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,iBAAiB,EAEjB,WAAW,EACX,aAAa,EACb,MAAM,EAGN,iBAAiB,EAIlB,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAuL5C,eAAO,MAAM,qBAAqB,QAAwB,CAAC;AAS3D,eAAO,MAAM,iBAAiB,gIAiB5B,CAAC;AA8IH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;iBAYuC,MAAM;;;gDAMnE,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;iBAR4C,MAAM;;;gDAuBnE,CAAC;AAEH,eAAO,MAAM,cAAc;UAiBf,MAAM;cACI,cAAc,EAAE;;;;;UAkI1B,QAAQ;QACK,MAAM;;;;;UAKrB,UAAU;;kGAGlB,CAAC;AAEH,eAAO,MAAM,OAAO;WACX,MAAM;WACN,MAAM;YACL,MAAM,GAAG,IAAI;UACf,MAAM,GAAG,IAAI;UACb,MAAM,GAAG,IAAI;YACX,MAAM,GAAG,IAAI;2EAkBrB,CAAC;AAMH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;iBAtNkC,MAAM;;;gDAqPnE,CAAC;AAEH,eAAO,MAAM,QAAQ;UACb,MAAM,GAAG,IAAI;WACZ,MAAM;UACP,MAAM;WACL,OAAO;UACR,MAAM,GAAG,IAAI;yEA8FnB,CAAC;AAkFH,eAAO,MAAM,OAAO;QACd,MAAM;cACA,aAAa;kBACT,OAAO;aACZ,OAAO;iGAqThB,CAAC;AAEH,eAAO,MAAM,OAAO;QACd,MAAM;aACD,MAAM,GAAG,IAAI;kBACR,OAAO;;;;;;;;;;;;;;;;;iBA1uBwC,MAAM;;;gDA2vBnE,CAAC;AAEH,eAAO,MAAM,OAAO;QAAkD,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;iBA7vBpB,MAAM;;;;gDA4wBnE,CAAC;AAEH,eAAO,MAAM,MAAM;QACb,MAAM;WACH,MAAM,GAAG,IAAI;UACd,MAAM,GAAG,IAAI;UACb,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;iBAlxB0C,MAAM;;;gDA40BnE,CAAC;AAEH,eAAO,MAAM,WAAW,wMA+FtB,CAAC;AAIH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;gDA2DxB,CAAC;AAEH,eAAO,MAAM,sBAAsB,GAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,WAChD,CAAC,WACD,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,WACtC,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,aACpC,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,KAC1C,MAAM,CAAC,MAAM,CAAC;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAU5D,CAAC;AAEL,eAAO,MAAM,iBAAiB;;iBAlpCJ,MAAM,GAAG,IAAI;iBAAW,MAAM,GAAG,IAAI;;;;;QA2HzD,KAAK;QACL,MAAM;QACN,OAAO;QACP,MAAM;;;;;;gDAijCV,CAAC;AAEH,eAAO,MAAM,qBAAqB;;iBAjrCR,MAAM,GAAG,IAAI;iBAAW,MAAM,GAAG,IAAI;;;;;QA2HzD,KAAK;QACL,MAAM;QACN,OAAO;QACP,MAAM;;;;;;6EAmlCV,CAAC;AAqBH,eAAO,MAAM,QAAQ;qBAES,MAAM;oBAAkB,MAAM;YAAU,UAAU;iBAChE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,uFAwM7D,CAAC;AAmEH,eAAO,MAAM,WAAW;YAGH,OAAO;qBAAmB,MAAM;gGAwLnD,CAAC"}
+{"version":3,"file":"core.d.ts","sourceRoot":"","sources":["../../../src/gh-tool/pr/core.ts"],"names":[],"mappings":"AAAA,OAAO,EAA4B,MAAM,EAAkB,MAAM,QAAQ,CAAC;AAE1E,OAAO,KAAK,EACV,cAAc,EACd,WAAW,EACX,iBAAiB,EAEjB,WAAW,EACX,aAAa,EACb,MAAM,EAGN,iBAAiB,EAIlB,MAAM,WAAW,CAAC;AAEnB,OAAO,KAAK,EAAE,eAAe,EAAE,mBAAmB,EAAE,MAAM,YAAY,CAAC;AACvE,OAAO,EAAE,kBAAkB,EAAE,gBAAgB,EAAE,MAAM,YAAY,CAAC;AAClE,OAAO,EAAE,aAAa,EAAE,MAAM,aAAa,CAAC;AAuO5C,eAAO,MAAM,qBAAqB,QAAwB,CAAC;AAS3D,eAAO,MAAM,iBAAiB,gIAiB5B,CAAC;AA8IH,eAAO,MAAM,WAAW;;;;;;;;;;;;;;;;iBAYuC,MAAM;;;gDAMnE,CAAC;AAEH,eAAO,MAAM,MAAM;;;;;;;;;;;;;;;;iBAR4C,MAAM;;;gDAuBnE,CAAC;AAEH,eAAO,MAAM,cAAc;UAiBf,MAAM;cACI,cAAc,EAAE;;;;;UAkI1B,QAAQ;QACK,MAAM;;;;;UAKrB,UAAU;;kGAGlB,CAAC;AAEH,eAAO,MAAM,OAAO;WACX,MAAM;WACN,MAAM;YACL,MAAM,GAAG,IAAI;UACf,MAAM,GAAG,IAAI;UACb,MAAM,GAAG,IAAI;YACX,MAAM,GAAG,IAAI;2EAkBrB,CAAC;AAMH,eAAO,MAAM,gBAAgB;;;;;;;;;;;;;;;;iBAtNkC,MAAM;;;gDAqPnE,CAAC;AAEH,eAAO,MAAM,QAAQ;UACb,MAAM,GAAG,IAAI;WACZ,MAAM;UACP,MAAM;WACL,OAAO;UACR,MAAM,GAAG,IAAI;yEA8FnB,CAAC;AAkFH,eAAO,MAAM,OAAO;QACd,MAAM;cACA,aAAa;kBACT,OAAO;aACZ,OAAO;iGAuThB,CAAC;AAEH,eAAO,MAAM,OAAO;QACd,MAAM;aACD,MAAM,GAAG,IAAI;kBACR,OAAO;;;;;;;;;;;;;;;;;iBA5uBwC,MAAM;;;gDA6vBnE,CAAC;AAEH,eAAO,MAAM,OAAO;QAAkD,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;iBA/vBpB,MAAM;;;;gDA8wBnE,CAAC;AAEH,eAAO,MAAM,MAAM;QACb,MAAM;WACH,MAAM,GAAG,IAAI;UACd,MAAM,GAAG,IAAI;UACb,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;iBApxB0C,MAAM;;;gDA80BnE,CAAC;AAEH,eAAO,MAAM,WAAW,wMA+FtB,CAAC;AAIH,eAAO,MAAM,aAAa;;;;;;;;;;;;;;;;;;;;;;;;gDA2DxB,CAAC;AAEH,eAAO,MAAM,sBAAsB,GAAI,CAAC,EAAE,CAAC,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,EAAE,WAChD,CAAC,WACD,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,WACtC,CAAC,KAAK,EAAE,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,CAAC,EAAE,EAAE,EAAE,EAAE,CAAC,aACpC,CAAC,MAAM,EAAE,CAAC,EAAE,KAAK,EAAE,CAAC,KAAK,OAAO,KAC1C,MAAM,CAAC,MAAM,CAAC;IAAE,KAAK,EAAE,CAAC,CAAC;IAAC,KAAK,EAAE,CAAC,CAAA;CAAE,GAAG,IAAI,EAAE,EAAE,GAAG,EAAE,EAAE,EAAE,GAAG,EAAE,CAU5D,CAAC;AAEL,eAAO,MAAM,iBAAiB;;iBAppCJ,MAAM,GAAG,IAAI;iBAAW,MAAM,GAAG,IAAI;;;;;QA2HzD,KAAK;QACL,MAAM;QACN,OAAO;QACP,MAAM;;;;;;gDAmjCV,CAAC;AAEH,eAAO,MAAM,qBAAqB;;iBAnrCR,MAAM,GAAG,IAAI;iBAAW,MAAM,GAAG,IAAI;;;;;QA2HzD,KAAK;QACL,MAAM;QACN,OAAO;QACP,MAAM;;;;;;6EAqlCV,CAAC;AAqBH,eAAO,MAAM,QAAQ;qBAES,MAAM;oBAAkB,MAAM;YAAU,UAAU;iBAChE,MAAM,CAAC,MAAM,EAAE,OAAO,CAAC,KAAK,MAAM,CAAC,MAAM,CAAC,IAAI,CAAC,uFAwM7D,CAAC;AAmEH,eAAO,MAAM,WAAW;YAGH,OAAO;qBAAmB,MAAM;gGAwLnD,CAAC"}

package/dist/gh-tool/workflow.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/gh-tool/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAY,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIlD,OAAO,EAAsB,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,EAAsC,YAAY,EAAE,MAAM,SAAS,CAAC;AAwChF,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAqKF,eAAO,MAAM,gBAAgB;cACjB,MAAM;SACX,MAAM;YACH,aAAa,CAAC,MAAM,CAAC;UACvB,MAAM,GAAG,IAAI;;;;;;;8CAsBnB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAKF,eAAO,MAAM,kBAAkB;cACnB,MAAM;SACX,MAAM;UACL,MAAM,GAAG,IAAI;6GAyBnB,CAAC;AAKH,eAAO,MAAM,qBAAqB;cACtB,MAAM;SACX,MAAM;UACL,MAAM,GAAG,IAAI;iBACN,WAAW,CAAC,MAAM,CAAC;kHAShC,CAAC;AAMH,eAAO,MAAM,gBAAgB,UACpB,MAAM,cACD;IACV,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAClF,eACY,MAAM,GAAG,IAAI,UAClB,OAAO,kBACC,MAAM;;;;;;;;;;CAiBtB,CAAC;AAmHH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOjD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,EAAE,CAsBvD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAa5D;AAgBD,eAAO,MAAM,kBAAkB,YAAa,SAAS,QAAQ,EAAE,KAAG,YA0CjE,CAAC;AA0DF,eAAO,MAAM,YAAY;WAChB,MAAM;SACR,MAAM;YACH,MAAM,GAAG,IAAI;sBACH,SAAS,MAAM,EAAE,GAAG,IAAI;qBACzB,OAAO;eACb,OAAO;YACV,MAAM;UACR,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;8CA8DnB,CAAC;AAMH,eAAO,MAAM,mBAAmB;;;;;;;kDA8C/B,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;kDAaqD,CAAC;AAEtF,eAAO,MAAM,mBAAmB;;;;kDAa+C,CAAC;AAEhF,eAAO,MAAM,mBAAmB;;;;;kDAsB2D,CAAC;AAE5F,eAAO,MAAM,oBAAoB;;;;;kDAiBoD,CAAC;AAEtF,eAAO,MAAM,qBAAqB;;;;kDAamC,CAAC;AAEtE,eAAO,MAAM,kBAAkB;;;;;;kDAgD6C,CAAC;AAE7E,eAAO,MAAM,oBAAoB;;;;;;kDA4BiE,CAAC;AAEnG,eAAO,MAAM,sBAAsB;;;;;;;kDAwClC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;kDAyBtC,CAAC"}
+{"version":3,"file":"workflow.d.ts","sourceRoot":"","sources":["../../src/gh-tool/workflow.ts"],"names":[],"mappings":"AAAA,OAAO,EAAE,OAAO,EAAe,MAAM,qBAAqB,CAAC;AAC3D,OAAO,EAAY,MAAM,EAAE,MAAM,EAAE,MAAM,QAAQ,CAAC;AAIlD,OAAO,EAAsB,mBAAmB,EAAE,MAAM,UAAU,CAAC;AACnE,OAAO,EAAE,aAAa,EAAE,MAAM,WAAW,CAAC;AAC1C,OAAO,KAAK,EAAsC,YAAY,EAAE,MAAM,SAAS,CAAC;AAwChF,MAAM,MAAM,QAAQ,GAAG;IACrB,IAAI,EAAE,MAAM,CAAC;IACb,OAAO,EAAE,MAAM,CAAC;CACjB,CAAC;AAqKF,eAAO,MAAM,gBAAgB;cACjB,MAAM;SACX,MAAM;YACH,aAAa,CAAC,MAAM,CAAC;UACvB,MAAM,GAAG,IAAI;;;;;;;8CAsBnB,CAAC;AAEH,MAAM,MAAM,aAAa,GAAG;IAC1B,UAAU,EAAE,MAAM,CAAC;IACnB,OAAO,EAAE,MAAM,CAAC;IAChB,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,GAAG,EAAE,MAAM,CAAC;CACb,CAAC;AAKF,eAAO,MAAM,kBAAkB;cACnB,MAAM;SACX,MAAM;UACL,MAAM,GAAG,IAAI;6GAyBnB,CAAC;AAKH,eAAO,MAAM,qBAAqB;cACtB,MAAM;SACX,MAAM;UACL,MAAM,GAAG,IAAI;iBACN,WAAW,CAAC,MAAM,CAAC;kHAShC,CAAC;AAMH,eAAO,MAAM,gBAAgB,UACpB,MAAM,cACD;IACV,MAAM,EAAE,MAAM,CAAC;IACf,UAAU,EAAE,MAAM,GAAG,IAAI,CAAC;IAC1B,IAAI,EAAE,aAAa,CAAC;QAAE,IAAI,EAAE,MAAM,CAAC;QAAC,MAAM,EAAE,MAAM,CAAC;QAAC,UAAU,EAAE,MAAM,GAAG,IAAI,CAAA;KAAE,CAAC,CAAC;CAClF,eACY,MAAM,GAAG,IAAI,UAClB,OAAO,kBACC,MAAM;;;;;;;;;;CAiBtB,CAAC;AAmHH,wBAAgB,YAAY,CAAC,IAAI,EAAE,MAAM,GAAG,MAAM,CAOjD;AAED,wBAAgB,eAAe,CAAC,GAAG,EAAE,MAAM,GAAG,QAAQ,EAAE,CAsBvD;AAED,wBAAgB,gBAAgB,CAAC,OAAO,EAAE,QAAQ,EAAE,GAAG,MAAM,CAa5D;AAgBD,eAAO,MAAM,kBAAkB,YAAa,SAAS,QAAQ,EAAE,KAAG,YA0CjE,CAAC;AA0DF,eAAO,MAAM,YAAY;WAChB,MAAM;SACR,MAAM;YACH,MAAM,GAAG,IAAI;sBACH,SAAS,MAAM,EAAE,GAAG,IAAI;qBACzB,OAAO;eACb,OAAO;YACV,MAAM;UACR,MAAM,GAAG,IAAI;;;;;;;;;;;;;;;;;;;;;;8CA8DnB,CAAC;AAMH,eAAO,MAAM,mBAAmB;;;;;;;kDA8C/B,CAAC;AAEF,eAAO,MAAM,mBAAmB;;;;kDAaqD,CAAC;AAEtF,eAAO,MAAM,mBAAmB;;;;kDAa+C,CAAC;AAEhF,eAAO,MAAM,mBAAmB;;;;;kDAsB2D,CAAC;AAE5F,eAAO,MAAM,oBAAoB;;;;;kDAiBoD,CAAC;AAEtF,eAAO,MAAM,qBAAqB;;;;kDAamC,CAAC;AAEtE,eAAO,MAAM,kBAAkB;;;;;;kDAgD6C,CAAC;AAE7E,eAAO,MAAM,oBAAoB;;;;;;kDA6BiE,CAAC;AAEnG,eAAO,MAAM,sBAAsB;;;;;;;kDAwClC,CAAC;AAEF,eAAO,MAAM,0BAA0B;;;;;kDAyBtC,CAAC"}

package/dist/k8s-tool/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env bun
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/k8s-tool/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/k8s-tool/main.ts"],"names":[],"mappings":""}

package/dist/logs-tool/index.d.ts

@@ -1,21 +1,3 @@
 #!/usr/bin/env bun
-/**
- * Application Logs Tool for Coding Agents
- *
- * Reads application logs from local development or test/prod environments.
- * For test/prod, uses k8s-tool internally to access logs from PVC.
- *
- * Run with --help for full usage documentation.
- *
- * IMPORTANT FOR AI AGENTS:
- * Use this tool to investigate application behavior and errors.
- * Always start with --list to see available log files.
- * Use --format toon for LLM-optimized output (fewer tokens).
- */
-import { Command } from "effect/unstable/cli";
-import { Effect } from "effect";
-import { ConfigService } from "#config";
-import { LogsConfigError } from "./errors";
-import { LogsService } from "./service";
-export declare const run: (input: ReadonlyArray<string>) => Effect.Effect<void, LogsConfigError | import("effect/unstable/cli/CliError").CliError, ConfigService | LogsService | Command.Environment>;
+export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/logs-tool/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/logs-tool/index.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAQ,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,MAAM,EAAyB,MAAM,QAAQ,CAAC;AAavD,OAAO,EAAE,aAAa,EAA6C,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,eAAe,EAAsD,MAAM,UAAU,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAoB,MAAM,WAAW,CAAC;AAsM1D,eAAO,MAAM,GAAG,6KAEd,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/logs-tool/index.ts"],"names":[],"mappings":""}

package/dist/logs-tool/main.d.ts

@@ -0,0 +1,21 @@
+#!/usr/bin/env bun
+/**
+ * Application Logs Tool for Coding Agents
+ *
+ * Reads application logs from local development or test/prod environments.
+ * For test/prod, uses k8s-tool internally to access logs from PVC.
+ *
+ * Run with --help for full usage documentation.
+ *
+ * IMPORTANT FOR AI AGENTS:
+ * Use this tool to investigate application behavior and errors.
+ * Always start with --list to see available log files.
+ * Use --format toon for LLM-optimized output (fewer tokens).
+ */
+import { Command } from "effect/unstable/cli";
+import { Effect } from "effect";
+import { ConfigService } from "#config";
+import { LogsConfigError } from "./errors";
+import { LogsService } from "./service";
+export declare const run: (input: ReadonlyArray<string>) => Effect.Effect<void, LogsConfigError | import("effect/unstable/cli/CliError").CliError, ConfigService | LogsService | Command.Environment>;
+//# sourceMappingURL=main.d.ts.map

package/dist/logs-tool/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/logs-tool/main.ts"],"names":[],"mappings":";AAEA;;;;;;;;;;;;GAYG;AAEH,OAAO,EAAE,OAAO,EAAQ,MAAM,qBAAqB,CAAC;AAEpD,OAAO,EAAE,MAAM,EAAyB,MAAM,QAAQ,CAAC;AAavD,OAAO,EAAE,aAAa,EAA6C,MAAM,SAAS,CAAC;AACnF,OAAO,EAAE,eAAe,EAAsD,MAAM,UAAU,CAAC;AAC/F,OAAO,EAAE,WAAW,EAAoB,MAAM,WAAW,CAAC;AAsM1D,eAAO,MAAM,GAAG,6KAEd,CAAC"}

package/dist/observability-tool/main.d.ts

@@ -0,0 +1,3 @@
+#!/usr/bin/env bun
+export {};
+//# sourceMappingURL=main.d.ts.map

package/dist/observability-tool/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/observability-tool/main.ts"],"names":[],"mappings":""}

package/dist/session-tool/index.d.ts

@@ -1,13 +1,3 @@
 #!/usr/bin/env bun
-/**
- * OpenCode Session Tool for Coding Agents
- *
- * Lists, searches, and reads OpenCode session history.
- * Uses current project scope by default, or all projects with --all.
- */
-import { Command } from "effect/unstable/cli";
-import { Effect } from "effect";
-import { ResolvedPaths } from "./config";
-import { SessionService } from "./service";
-export declare const run: (input: ReadonlyArray<string>) => Effect.Effect<void, import("effect/unstable/cli/CliError").CliError, ResolvedPaths | SessionService | Command.Environment>;
+export {};
 //# sourceMappingURL=index.d.ts.map

package/dist/session-tool/index.d.ts.map

@@ -1 +1 @@
-{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session-tool/index.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAEH,OAAO,EAAY,OAAO,EAAQ,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EAAE,MAAM,EAAiB,MAAM,QAAQ,CAAC;AAQ/C,OAAO,EAAE,aAAa,EAAsB,MAAM,UAAU,CAAC;AAE7D,OAAO,EAAc,cAAc,EAAuB,MAAM,WAAW,CAAC;AAgT5E,eAAO,MAAM,GAAG,8JAEd,CAAC"}
+{"version":3,"file":"index.d.ts","sourceRoot":"","sources":["../../src/session-tool/index.ts"],"names":[],"mappings":""}

package/dist/session-tool/main.d.ts

@@ -0,0 +1,13 @@
+#!/usr/bin/env bun
+/**
+ * OpenCode Session Tool for Coding Agents
+ *
+ * Lists, searches, and reads OpenCode session history.
+ * Uses current project scope by default, or all projects with --all.
+ */
+import { Command } from "effect/unstable/cli";
+import { Effect } from "effect";
+import { ResolvedPaths } from "./config";
+import { SessionService } from "./service";
+export declare const run: (input: ReadonlyArray<string>) => Effect.Effect<void, import("effect/unstable/cli/CliError").CliError, ResolvedPaths | SessionService | Command.Environment>;
+//# sourceMappingURL=main.d.ts.map

package/dist/session-tool/main.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"main.d.ts","sourceRoot":"","sources":["../../src/session-tool/main.ts"],"names":[],"mappings":";AAEA;;;;;GAKG;AAEH,OAAO,EAAY,OAAO,EAAQ,MAAM,qBAAqB,CAAC;AAE9D,OAAO,EAAE,MAAM,EAAiB,MAAM,QAAQ,CAAC;AAQ/C,OAAO,EAAE,aAAa,EAAsB,MAAM,UAAU,CAAC;AAE7D,OAAO,EAAc,cAAc,EAAuB,MAAM,WAAW,CAAC;AAgT5E,eAAO,MAAM,GAAG,8JAEd,CAAC"}

package/dist/shared/effect-version.d.ts

@@ -0,0 +1,4 @@
+export declare const EFFECT_VERSION_RANGE: string;
+export declare const effectVersionError: (version: string | undefined) => string | undefined;
+export declare const checkEffectVersion: () => Promise<boolean>;
+//# sourceMappingURL=effect-version.d.ts.map

package/dist/shared/effect-version.d.ts.map

@@ -0,0 +1 @@
+{"version":3,"file":"effect-version.d.ts","sourceRoot":"","sources":["../../src/shared/effect-version.ts"],"names":[],"mappings":"AAKA,eAAO,MAAM,oBAAoB,QAA8B,CAAC;AAEhE,eAAO,MAAM,kBAAkB,YAAa,MAAM,GAAG,SAAS,KAAG,MAAM,GAAG,SAOzE,CAAC;AAEF,eAAO,MAAM,kBAAkB,QAAa,OAAO,CAAC,OAAO,CAe1D,CAAC"}

package/package.json

@@ -1,6 +1,6 @@
 {
   "name": "@blogic-cz/agent-tools",
-  "version": "1.5.3",
+  "version": "1.5.5",
   "description": "CLI tools for AI coding agent workflows — GitHub, database, Kubernetes, Azure platform, Azure DevOps, logs, sessions, and audit",
   "keywords": [
     "agent",
@@ -162,7 +162,7 @@
     "vitest": "5.0.1"
   },
   "peerDependencies": {
-    "effect": "4.0.0-rc.117"
+    "effect": "^4.0.0-rc.117"
   },
   "overrides": {
     "@effect/platform-node-shared": "4.0.0-rc.117"

package/src/audit-tool/index.ts

@@ -1,111 +1,5 @@
 #!/usr/bin/env bun
-import { Command, Flag } from "effect/unstable/cli";
-import { BunRuntime, BunServices } from "@effect/platform-bun";
-import { Effect, Layer, Option } from "effect";
+import { checkEffectVersion } from "#shared/effect-version";
 
-import {
-  makeSchemaCommand,
-  formatOption,
-  formatOutput,
-  logText,
-  renderCauseToStderr,
-  VERSION,
-} from "#shared";
-import { AuditService, AuditServiceLayer, withAudit } from "#shared/audit";
-
-type AuditToolResult<T> = {
-  success: boolean;
-  executionTimeMs: number;
-  data?: T;
-  error?: string;
-};
-
-const commonFlags = {
-  format: formatOption,
-};
-
-const listCommand = Command.make(
-  "list",
-  {
-    ...commonFlags,
-    limit: Flag.Int("limit").pipe(
-      Flag.withDescription("Maximum number of recent audit entries to return"),
-      Flag.withDefault(20),
-    ),
-    project: Flag.optional(Flag.String("project")).pipe(
-      Flag.withDescription("Filter entries by exact working directory path"),
-    ),
-    tool: Flag.optional(Flag.String("tool")).pipe(
-      Flag.withDescription("Filter entries by tool name (gh, k8s, db, az, logs, session, audit)"),
-    ),
-  },
-  ({ format, limit, project, tool }) =>
-    Effect.gen(function* () {
-      const startTime = Date.now();
-      const audit = yield* AuditService;
-      const entries = yield* audit.listRecent(limit);
-      const toolFilteredEntries = Option.match(tool, {
-        onNone: () => entries,
-        onSome: (value) => entries.filter((entry) => entry.tool === value),
-      });
-      const filteredEntries = Option.match(project, {
-        onNone: () => toolFilteredEntries,
-        onSome: (value) => toolFilteredEntries.filter((entry) => entry.project === value),
-      });
-
-      const result: AuditToolResult<typeof filteredEntries> = {
-        success: true,
-        executionTimeMs: Date.now() - startTime,
-        data: filteredEntries,
-      };
-
-      yield* logText(formatOutput(result, format));
-    }),
-).pipe(Command.withDescription("List recent audit log entries"));
-
-const purgeCommand = Command.make(
-  "purge",
-  {
-    ...commonFlags,
-    days: Flag.Int("days").pipe(
-      Flag.withDescription("Delete audit entries older than this many days"),
-      Flag.withDefault(90),
-    ),
-  },
-  ({ days, format }) =>
-    Effect.gen(function* () {
-      const startTime = Date.now();
-      const audit = yield* AuditService;
-      const deleted = yield* audit.purgeOlderThanDays(days);
-
-      const result: AuditToolResult<{ deleted: number; days: number }> = {
-        success: true,
-        executionTimeMs: Date.now() - startTime,
-        data: { deleted, days },
-      };
-
-      yield* logText(formatOutput(result, format));
-    }),
-).pipe(Command.withDescription("Delete old audit log entries"));
-
-const commandsCommand = makeSchemaCommand(() => mainCommand);
-
-const mainCommand = Command.make("audit-tool", {}).pipe(
-  Command.withDescription("Audit log inspection and maintenance for agent-tools"),
-  Command.withSubcommands([listCommand, purgeCommand, commandsCommand]),
-);
-
-const cli = Command.run(mainCommand, {
-  version: VERSION,
-});
-
-const MainLayer = AuditServiceLayer.pipe(Layer.provideMerge(BunServices.layer));
-
-const program = withAudit("audit", cli).pipe(
-  Effect.provide(MainLayer),
-  Effect.tapCause(renderCauseToStderr),
-);
-
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+if (await checkEffectVersion()) await import("./main");
+else process.exitCode = 1;

package/src/audit-tool/main.ts

@@ -0,0 +1,111 @@
+#!/usr/bin/env bun
+import { Command, Flag } from "effect/unstable/cli";
+import { BunRuntime, BunServices } from "@effect/platform-bun";
+import { Effect, Layer, Option } from "effect";
+
+import {
+  makeSchemaCommand,
+  formatOption,
+  formatOutput,
+  logText,
+  renderCauseToStderr,
+  VERSION,
+} from "#shared";
+import { AuditService, AuditServiceLayer, withAudit } from "#shared/audit";
+
+type AuditToolResult<T> = {
+  success: boolean;
+  executionTimeMs: number;
+  data?: T;
+  error?: string;
+};
+
+const commonFlags = {
+  format: formatOption,
+};
+
+const listCommand = Command.make(
+  "list",
+  {
+    ...commonFlags,
+    limit: Flag.Int("limit").pipe(
+      Flag.withDescription("Maximum number of recent audit entries to return"),
+      Flag.withDefault(20),
+    ),
+    project: Flag.optional(Flag.String("project")).pipe(
+      Flag.withDescription("Filter entries by exact working directory path"),
+    ),
+    tool: Flag.optional(Flag.String("tool")).pipe(
+      Flag.withDescription("Filter entries by tool name (gh, k8s, db, az, logs, session, audit)"),
+    ),
+  },
+  ({ format, limit, project, tool }) =>
+    Effect.gen(function* () {
+      const startTime = Date.now();
+      const audit = yield* AuditService;
+      const entries = yield* audit.listRecent(limit);
+      const toolFilteredEntries = Option.match(tool, {
+        onNone: () => entries,
+        onSome: (value) => entries.filter((entry) => entry.tool === value),
+      });
+      const filteredEntries = Option.match(project, {
+        onNone: () => toolFilteredEntries,
+        onSome: (value) => toolFilteredEntries.filter((entry) => entry.project === value),
+      });
+
+      const result: AuditToolResult<typeof filteredEntries> = {
+        success: true,
+        executionTimeMs: Date.now() - startTime,
+        data: filteredEntries,
+      };
+
+      yield* logText(formatOutput(result, format));
+    }),
+).pipe(Command.withDescription("List recent audit log entries"));
+
+const purgeCommand = Command.make(
+  "purge",
+  {
+    ...commonFlags,
+    days: Flag.Int("days").pipe(
+      Flag.withDescription("Delete audit entries older than this many days"),
+      Flag.withDefault(90),
+    ),
+  },
+  ({ days, format }) =>
+    Effect.gen(function* () {
+      const startTime = Date.now();
+      const audit = yield* AuditService;
+      const deleted = yield* audit.purgeOlderThanDays(days);
+
+      const result: AuditToolResult<{ deleted: number; days: number }> = {
+        success: true,
+        executionTimeMs: Date.now() - startTime,
+        data: { deleted, days },
+      };
+
+      yield* logText(formatOutput(result, format));
+    }),
+).pipe(Command.withDescription("Delete old audit log entries"));
+
+const commandsCommand = makeSchemaCommand(() => mainCommand);
+
+const mainCommand = Command.make("audit-tool", {}).pipe(
+  Command.withDescription("Audit log inspection and maintenance for agent-tools"),
+  Command.withSubcommands([listCommand, purgeCommand, commandsCommand]),
+);
+
+const cli = Command.run(mainCommand, {
+  version: VERSION,
+});
+
+const MainLayer = AuditServiceLayer.pipe(Layer.provideMerge(BunServices.layer));
+
+const program = withAudit("audit", cli).pipe(
+  Effect.provide(MainLayer),
+  Effect.tapCause(renderCauseToStderr),
+);
+
+BunRuntime.runMain(program, {
+  disableErrorReporting: true,
+});

package/src/az-tool/index.ts

@@ -1,153 +1,5 @@
 #!/usr/bin/env bun
-import { Command, Flag } from "effect/unstable/cli";
-import { BunRuntime, BunServices } from "@effect/platform-bun";
-import { Effect, Layer, Option } from "effect";
+import { checkEffectVersion } from "#shared/effect-version";
 
-import {
-  makeSchemaCommand,
-  formatAny,
-  formatOption,
-  logText,
-  renderCauseToStderr,
-  VERSION,
-} from "#shared";
-import { AuditServiceLayer, withAudit } from "#shared/audit";
-import { AzService, AzServiceLayer } from "./service";
-import { ConfigServiceLayer } from "#config";
-
-const profileFlag = Flag.optional(Flag.String("profile")).pipe(
-  Flag.withDescription("Azure platform profile name (from agent-tools config)"),
-);
-
-const commonFlags = {
-  format: formatOption,
-  profile: profileFlag,
-};
-
-/** Run a fixed read-only command through the same security gate as `cmd`. */
-const runFixed = (cmd: string, profile: Option.Option<string>, format: "toon" | "json") =>
-  Effect.gen(function* () {
-    const az = yield* AzService;
-    const result = yield* az.runCommand(cmd, Option.getOrUndefined(profile));
-    yield* logText(formatAny(result.data, format));
-  });
-
-// ---------------------------------------------------------------------------
-// Typed subcommands
-// ---------------------------------------------------------------------------
-
-const subscriptionCommand = Command.make("subscription", commonFlags, ({ format, profile }) =>
-  runFixed("account show", profile, format),
-).pipe(Command.withDescription("Show the subscription every command in this profile is pinned to"));
-
-const groupsCommand = Command.make("groups", commonFlags, ({ format, profile }) =>
-  runFixed("group list", profile, format),
-).pipe(Command.withDescription("List resource groups in the pinned subscription"));
-
-const resourcesCommand = Command.make(
-  "resources",
-  {
-    ...commonFlags,
-    group: Flag.optional(Flag.String("group")).pipe(
-      Flag.withDescription("Limit the listing to one resource group"),
-    ),
-  },
-  ({ format, group, profile }) =>
-    Effect.gen(function* () {
-      const groupName = Option.getOrUndefined(group);
-      const cmd = groupName ? `resource list --resource-group ${groupName}` : "resource list";
-      yield* runFixed(cmd, profile, format);
-    }),
-).pipe(Command.withDescription("List resources, optionally scoped to one resource group"));
-
-// ---------------------------------------------------------------------------
-// Raw command passthrough
-// ---------------------------------------------------------------------------
-
-const cmdCommand = Command.make(
-  "cmd",
-  {
-    ...commonFlags,
-    cmd: Flag.String("cmd").pipe(Flag.withDescription("az command (without the 'az' prefix)")),
-    dryRun: Flag.Boolean("dry-run").pipe(
-      Flag.withDescription("Show the command that would run, after security checks"),
-      Flag.withDefault(false),
-    ),
-  },
-  ({ cmd, dryRun, format, profile }) =>
-    Effect.gen(function* () {
-      const az = yield* AzService;
-      const profileName = Option.getOrUndefined(profile);
-
-      if (dryRun) {
-        const rendered = yield* az.renderCommand(cmd, profileName);
-        yield* logText(`[DRY-RUN] Would execute: ${rendered}`);
-        return;
-      }
-
-      const result = yield* az.runCommand(cmd, profileName);
-      yield* logText(formatAny(result.data, format));
-    }),
-).pipe(
-  Command.withDescription(
-    `Execute a read-only Azure platform command.
-
-The subscription is pinned by the selected profile — passing --subscription is rejected.
-Mutating verbs, unknown verbs, credential reads, and shell syntax are all blocked.
-
-EXAMPLES:
-  az-tool cmd --cmd "vm list"
-  az-tool cmd --cmd "webapp show --name my-app --resource-group my-rg"
-  az-tool cmd --cmd "aks list --query \\"[].{name:name,version:kubernetesVersion}\\""
-  az-tool cmd --cmd "storage account list" --profile prod --dry-run`,
-  ),
-);
-
-// ---------------------------------------------------------------------------
-// Main command
-// ---------------------------------------------------------------------------
-
-const commandsCommand = makeSchemaCommand(() => mainCommand);
-
-const mainCommand = Command.make("az-tool", {}).pipe(
-  Command.withDescription(
-    `Azure Platform Tool for Coding Agents (READ-ONLY)
-
-Inspects Azure PaaS resources — vm, webapp, storage, aks, acr, monitor, and the rest.
-For Azure DevOps pipelines, builds, and repos use azdo-tool instead.
-
-Typed subcommands:
-  az-tool subscription
-  az-tool groups
-  az-tool resources --group my-rg
-
-Raw az wrapper:
-  az-tool cmd --cmd "webapp list"`,
-  ),
-  Command.withSubcommands([
-    subscriptionCommand,
-    groupsCommand,
-    resourcesCommand,
-    cmdCommand,
-    commandsCommand,
-  ]),
-);
-
-const cli = Command.run(mainCommand, {
-  version: VERSION,
-});
-
-const MainLayer = AzServiceLayer.pipe(
-  Layer.provideMerge(ConfigServiceLayer),
-  Layer.provideMerge(BunServices.layer),
-  Layer.provideMerge(AuditServiceLayer),
-);
-
-const program = withAudit("az", cli).pipe(
-  Effect.provide(MainLayer),
-  Effect.tapCause(renderCauseToStderr),
-);
-
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+if (await checkEffectVersion()) await import("./main");
+else process.exitCode = 1;