@blogic-cz/agent-tools 1.5.3 → 1.5.5

package/src/az-tool/main.ts

@@ -0,0 +1,153 @@
+#!/usr/bin/env bun
+import { Command, Flag } from "effect/unstable/cli";
+import { BunRuntime, BunServices } from "@effect/platform-bun";
+import { Effect, Layer, Option } from "effect";
+
+import {
+  makeSchemaCommand,
+  formatAny,
+  formatOption,
+  logText,
+  renderCauseToStderr,
+  VERSION,
+} from "#shared";
+import { AuditServiceLayer, withAudit } from "#shared/audit";
+import { AzService, AzServiceLayer } from "./service";
+import { ConfigServiceLayer } from "#config";
+
+const profileFlag = Flag.optional(Flag.String("profile")).pipe(
+  Flag.withDescription("Azure platform profile name (from agent-tools config)"),
+);
+
+const commonFlags = {
+  format: formatOption,
+  profile: profileFlag,
+};
+
+/** Run a fixed read-only command through the same security gate as `cmd`. */
+const runFixed = (cmd: string, profile: Option.Option<string>, format: "toon" | "json") =>
+  Effect.gen(function* () {
+    const az = yield* AzService;
+    const result = yield* az.runCommand(cmd, Option.getOrUndefined(profile));
+    yield* logText(formatAny(result.data, format));
+  });
+
+// ---------------------------------------------------------------------------
+// Typed subcommands
+// ---------------------------------------------------------------------------
+
+const subscriptionCommand = Command.make("subscription", commonFlags, ({ format, profile }) =>
+  runFixed("account show", profile, format),
+).pipe(Command.withDescription("Show the subscription every command in this profile is pinned to"));
+
+const groupsCommand = Command.make("groups", commonFlags, ({ format, profile }) =>
+  runFixed("group list", profile, format),
+).pipe(Command.withDescription("List resource groups in the pinned subscription"));
+
+const resourcesCommand = Command.make(
+  "resources",
+  {
+    ...commonFlags,
+    group: Flag.optional(Flag.String("group")).pipe(
+      Flag.withDescription("Limit the listing to one resource group"),
+    ),
+  },
+  ({ format, group, profile }) =>
+    Effect.gen(function* () {
+      const groupName = Option.getOrUndefined(group);
+      const cmd = groupName ? `resource list --resource-group ${groupName}` : "resource list";
+      yield* runFixed(cmd, profile, format);
+    }),
+).pipe(Command.withDescription("List resources, optionally scoped to one resource group"));
+
+// ---------------------------------------------------------------------------
+// Raw command passthrough
+// ---------------------------------------------------------------------------
+
+const cmdCommand = Command.make(
+  "cmd",
+  {
+    ...commonFlags,
+    cmd: Flag.String("cmd").pipe(Flag.withDescription("az command (without the 'az' prefix)")),
+    dryRun: Flag.Boolean("dry-run").pipe(
+      Flag.withDescription("Show the command that would run, after security checks"),
+      Flag.withDefault(false),
+    ),
+  },
+  ({ cmd, dryRun, format, profile }) =>
+    Effect.gen(function* () {
+      const az = yield* AzService;
+      const profileName = Option.getOrUndefined(profile);
+
+      if (dryRun) {
+        const rendered = yield* az.renderCommand(cmd, profileName);
+        yield* logText(`[DRY-RUN] Would execute: ${rendered}`);
+        return;
+      }
+
+      const result = yield* az.runCommand(cmd, profileName);
+      yield* logText(formatAny(result.data, format));
+    }),
+).pipe(
+  Command.withDescription(
+    `Execute a read-only Azure platform command.
+
+The subscription is pinned by the selected profile — passing --subscription is rejected.
+Mutating verbs, unknown verbs, credential reads, and shell syntax are all blocked.
+
+EXAMPLES:
+  az-tool cmd --cmd "vm list"
+  az-tool cmd --cmd "webapp show --name my-app --resource-group my-rg"
+  az-tool cmd --cmd "aks list --query \\"[].{name:name,version:kubernetesVersion}\\""
+  az-tool cmd --cmd "storage account list" --profile prod --dry-run`,
+  ),
+);
+
+// ---------------------------------------------------------------------------
+// Main command
+// ---------------------------------------------------------------------------
+
+const commandsCommand = makeSchemaCommand(() => mainCommand);
+
+const mainCommand = Command.make("az-tool", {}).pipe(
+  Command.withDescription(
+    `Azure Platform Tool for Coding Agents (READ-ONLY)
+
+Inspects Azure PaaS resources — vm, webapp, storage, aks, acr, monitor, and the rest.
+For Azure DevOps pipelines, builds, and repos use azdo-tool instead.
+
+Typed subcommands:
+  az-tool subscription
+  az-tool groups
+  az-tool resources --group my-rg
+
+Raw az wrapper:
+  az-tool cmd --cmd "webapp list"`,
+  ),
+  Command.withSubcommands([
+    subscriptionCommand,
+    groupsCommand,
+    resourcesCommand,
+    cmdCommand,
+    commandsCommand,
+  ]),
+);
+
+const cli = Command.run(mainCommand, {
+  version: VERSION,
+});
+
+const MainLayer = AzServiceLayer.pipe(
+  Layer.provideMerge(ConfigServiceLayer),
+  Layer.provideMerge(BunServices.layer),
+  Layer.provideMerge(AuditServiceLayer),
+);
+
+const program = withAudit("az", cli).pipe(
+  Effect.provide(MainLayer),
+  Effect.tapCause(renderCauseToStderr),
+);
+
+BunRuntime.runMain(program, {
+  disableErrorReporting: true,
+});

package/src/azdo-tool/index.ts

@@ -1,222 +1,5 @@
 #!/usr/bin/env bun
-import { Command, Flag } from "effect/unstable/cli";
-import { BunRuntime, BunServices } from "@effect/platform-bun";
-import { Effect, Layer, Option } from "effect";
+import { checkEffectVersion } from "#shared/effect-version";
 
-import {
-  makeSchemaCommand,
-  formatAny,
-  formatOption,
-  formatOutput,
-  logText,
-  renderCauseToStderr,
-  VERSION,
-} from "#shared";
-import { AuditServiceLayer, withAudit } from "#shared/audit";
-import {
-  findFailedJobs,
-  getBuildJobSummary,
-  getBuildLogContent,
-  getBuildLogs,
-  getBuildTimeline,
-} from "./build";
-import { AzdoService, AzdoServiceLayer } from "./service";
-import { ConfigServiceLayer } from "#config";
-
-// ---------------------------------------------------------------------------
-// Common flags shared across build subcommands
-// ---------------------------------------------------------------------------
-
-const commonBuildFlags = {
-  format: formatOption,
-  profile: Flag.optional(Flag.String("profile")).pipe(
-    Flag.withDescription("Azure DevOps profile name (from agent-tools config)"),
-  ),
-};
-
-// ---------------------------------------------------------------------------
-// Build subcommands
-// ---------------------------------------------------------------------------
-
-const buildTimelineCommand = Command.make(
-  "timeline",
-  {
-    ...commonBuildFlags,
-    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
-  },
-  ({ buildId, format, profile: _profile }) =>
-    Effect.gen(function* () {
-      const result = yield* getBuildTimeline(buildId);
-      yield* logText(formatAny(result, format));
-    }),
-).pipe(Command.withDescription("Get build timeline with all records (jobs, stages, tasks)"));
-
-const buildFailedJobsCommand = Command.make(
-  "failed-jobs",
-  {
-    ...commonBuildFlags,
-    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
-  },
-  ({ buildId, format, profile: _profile }) =>
-    Effect.gen(function* () {
-      const failedJobs = yield* findFailedJobs(buildId);
-      yield* logText(formatAny({ buildId, failedJobs }, format));
-    }),
-).pipe(Command.withDescription("Find failed or canceled jobs in a build"));
-
-const buildLogsCommand = Command.make(
-  "logs",
-  {
-    ...commonBuildFlags,
-    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
-  },
-  ({ buildId, format, profile: _profile }) =>
-    Effect.gen(function* () {
-      const result = yield* getBuildLogs(buildId);
-      yield* logText(formatAny(result, format));
-    }),
-).pipe(Command.withDescription("Get list of build logs"));
-
-const buildLogContentCommand = Command.make(
-  "log-content",
-  {
-    ...commonBuildFlags,
-    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
-    logId: Flag.Int("log-id").pipe(Flag.withDescription("Log ID")),
-  },
-  ({ buildId, format, logId, profile: _profile }) =>
-    Effect.gen(function* () {
-      const content = yield* getBuildLogContent(buildId, logId);
-      yield* logText(formatAny({ buildId, logId, content }, format));
-    }),
-).pipe(Command.withDescription("Get specific log content by log ID"));
-
-const buildSummaryCommand = Command.make(
-  "summary",
-  {
-    ...commonBuildFlags,
-    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
-  },
-  ({ buildId, format, profile: _profile }) =>
-    Effect.gen(function* () {
-      const summary = yield* getBuildJobSummary(buildId);
-      yield* logText(formatAny({ buildId, summary }, format));
-    }),
-).pipe(Command.withDescription("Get job summaries with duration and status information"));
-
-// ---------------------------------------------------------------------------
-// Build parent command
-// ---------------------------------------------------------------------------
-
-const buildCommand = Command.make("build", {}).pipe(
-  Command.withDescription("Build helpers for Azure DevOps pipelines"),
-  Command.withSubcommands([
-    buildTimelineCommand,
-    buildFailedJobsCommand,
-    buildLogsCommand,
-    buildLogContentCommand,
-    buildSummaryCommand,
-  ]),
-);
-
-// ---------------------------------------------------------------------------
-// Raw command subcommand (preserves existing --cmd behavior)
-// ---------------------------------------------------------------------------
-
-const cmdCommand = Command.make(
-  "cmd",
-  {
-    profile: Flag.optional(Flag.String("profile")).pipe(
-      Flag.withDescription("Azure DevOps profile name (from agent-tools config)"),
-    ),
-    project: Flag.optional(Flag.String("project")).pipe(
-      Flag.withDescription("Azure DevOps project name (overrides config default)"),
-    ),
-    cmd: Flag.String("cmd").pipe(Flag.withDescription("az command (without 'az' prefix)")),
-    dryRun: Flag.Boolean("dry-run").pipe(
-      Flag.withDescription("Show command without executing"),
-      Flag.withDefault(false),
-    ),
-    format: formatOption,
-  },
-  ({ profile: _profile, project, cmd, dryRun, format }) =>
-    Effect.gen(function* () {
-      const projectName = project ? Option.getOrUndefined(project) : undefined;
-
-      if (dryRun) {
-        const fullCommand = `az ${cmd}`;
-        yield* logText(`[DRY-RUN] Would execute: ${fullCommand}`);
-        return;
-      }
-
-      const az = yield* AzdoService;
-
-      const startTime = Date.now();
-      const output = yield* az.runCommand(cmd, projectName);
-      const executionTimeMs = Date.now() - startTime;
-
-      yield* logText(
-        formatOutput(
-          {
-            success: true,
-            data: output,
-            executionTimeMs,
-          },
-          format,
-        ),
-      );
-    }),
-).pipe(
-  Command.withDescription(
-    `Execute raw az CLI commands directly.
-
-EXAMPLES:
-  agent-tools-azdo cmd --cmd "pipelines list"
-  agent-tools-azdo cmd --cmd "repos list" --project my-project
-  agent-tools-azdo cmd --cmd "pipelines runs list --output json"`,
-  ),
-);
-
-// ---------------------------------------------------------------------------
-// Main command with subcommands
-// ---------------------------------------------------------------------------
-
-const commandsCommand = makeSchemaCommand(() => mainCommand);
-
-const mainCommand = Command.make("azdo-tool", {}).pipe(
-  Command.withDescription(
-    `Azure DevOps Tool for Coding Agents (READ-ONLY)
-
-For Azure platform (PaaS) resources — vm, webapp, storage, aks, keyvault — use az-tool instead.
-
-Typed build subcommands:
-  azdo-tool build timeline --build-id 123
-  azdo-tool build failed-jobs --build-id 123
-  azdo-tool build logs --build-id 123
-  azdo-tool build log-content --build-id 123 --log-id 45
-  azdo-tool build summary --build-id 123
-
-Raw az wrapper:
-  azdo-tool cmd --cmd "pipelines list"`,
-  ),
-  Command.withSubcommands([buildCommand, cmdCommand, commandsCommand]),
-);
-
-const cli = Command.run(mainCommand, {
-  version: VERSION,
-});
-
-const MainLayer = AzdoServiceLayer.pipe(
-  Layer.provideMerge(ConfigServiceLayer),
-  Layer.provideMerge(BunServices.layer),
-  Layer.provideMerge(AuditServiceLayer),
-);
-
-const program = withAudit("azdo", cli).pipe(
-  Effect.provide(MainLayer),
-  Effect.tapCause(renderCauseToStderr),
-);
-
-BunRuntime.runMain(program, {
-  disableErrorReporting: true,
-});
+if (await checkEffectVersion()) await import("./main");
+else process.exitCode = 1;

package/src/azdo-tool/main.ts

@@ -0,0 +1,222 @@
+#!/usr/bin/env bun
+import { Command, Flag } from "effect/unstable/cli";
+import { BunRuntime, BunServices } from "@effect/platform-bun";
+import { Effect, Layer, Option } from "effect";
+
+import {
+  makeSchemaCommand,
+  formatAny,
+  formatOption,
+  formatOutput,
+  logText,
+  renderCauseToStderr,
+  VERSION,
+} from "#shared";
+import { AuditServiceLayer, withAudit } from "#shared/audit";
+import {
+  findFailedJobs,
+  getBuildJobSummary,
+  getBuildLogContent,
+  getBuildLogs,
+  getBuildTimeline,
+} from "./build";
+import { AzdoService, AzdoServiceLayer } from "./service";
+import { ConfigServiceLayer } from "#config";
+
+// ---------------------------------------------------------------------------
+// Common flags shared across build subcommands
+// ---------------------------------------------------------------------------
+
+const commonBuildFlags = {
+  format: formatOption,
+  profile: Flag.optional(Flag.String("profile")).pipe(
+    Flag.withDescription("Azure DevOps profile name (from agent-tools config)"),
+  ),
+};
+
+// ---------------------------------------------------------------------------
+// Build subcommands
+// ---------------------------------------------------------------------------
+
+const buildTimelineCommand = Command.make(
+  "timeline",
+  {
+    ...commonBuildFlags,
+    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
+  },
+  ({ buildId, format, profile: _profile }) =>
+    Effect.gen(function* () {
+      const result = yield* getBuildTimeline(buildId);
+      yield* logText(formatAny(result, format));
+    }),
+).pipe(Command.withDescription("Get build timeline with all records (jobs, stages, tasks)"));
+
+const buildFailedJobsCommand = Command.make(
+  "failed-jobs",
+  {
+    ...commonBuildFlags,
+    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
+  },
+  ({ buildId, format, profile: _profile }) =>
+    Effect.gen(function* () {
+      const failedJobs = yield* findFailedJobs(buildId);
+      yield* logText(formatAny({ buildId, failedJobs }, format));
+    }),
+).pipe(Command.withDescription("Find failed or canceled jobs in a build"));
+
+const buildLogsCommand = Command.make(
+  "logs",
+  {
+    ...commonBuildFlags,
+    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
+  },
+  ({ buildId, format, profile: _profile }) =>
+    Effect.gen(function* () {
+      const result = yield* getBuildLogs(buildId);
+      yield* logText(formatAny(result, format));
+    }),
+).pipe(Command.withDescription("Get list of build logs"));
+
+const buildLogContentCommand = Command.make(
+  "log-content",
+  {
+    ...commonBuildFlags,
+    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
+    logId: Flag.Int("log-id").pipe(Flag.withDescription("Log ID")),
+  },
+  ({ buildId, format, logId, profile: _profile }) =>
+    Effect.gen(function* () {
+      const content = yield* getBuildLogContent(buildId, logId);
+      yield* logText(formatAny({ buildId, logId, content }, format));
+    }),
+).pipe(Command.withDescription("Get specific log content by log ID"));
+
+const buildSummaryCommand = Command.make(
+  "summary",
+  {
+    ...commonBuildFlags,
+    buildId: Flag.Int("build-id").pipe(Flag.withDescription("Build ID")),
+  },
+  ({ buildId, format, profile: _profile }) =>
+    Effect.gen(function* () {
+      const summary = yield* getBuildJobSummary(buildId);
+      yield* logText(formatAny({ buildId, summary }, format));
+    }),
+).pipe(Command.withDescription("Get job summaries with duration and status information"));
+
+// ---------------------------------------------------------------------------
+// Build parent command
+// ---------------------------------------------------------------------------
+
+const buildCommand = Command.make("build", {}).pipe(
+  Command.withDescription("Build helpers for Azure DevOps pipelines"),
+  Command.withSubcommands([
+    buildTimelineCommand,
+    buildFailedJobsCommand,
+    buildLogsCommand,
+    buildLogContentCommand,
+    buildSummaryCommand,
+  ]),
+);
+
+// ---------------------------------------------------------------------------
+// Raw command subcommand (preserves existing --cmd behavior)
+// ---------------------------------------------------------------------------
+
+const cmdCommand = Command.make(
+  "cmd",
+  {
+    profile: Flag.optional(Flag.String("profile")).pipe(
+      Flag.withDescription("Azure DevOps profile name (from agent-tools config)"),
+    ),
+    project: Flag.optional(Flag.String("project")).pipe(
+      Flag.withDescription("Azure DevOps project name (overrides config default)"),
+    ),
+    cmd: Flag.String("cmd").pipe(Flag.withDescription("az command (without 'az' prefix)")),
+    dryRun: Flag.Boolean("dry-run").pipe(
+      Flag.withDescription("Show command without executing"),
+      Flag.withDefault(false),
+    ),
+    format: formatOption,
+  },
+  ({ profile: _profile, project, cmd, dryRun, format }) =>
+    Effect.gen(function* () {
+      const projectName = project ? Option.getOrUndefined(project) : undefined;
+
+      if (dryRun) {
+        const fullCommand = `az ${cmd}`;
+        yield* logText(`[DRY-RUN] Would execute: ${fullCommand}`);
+        return;
+      }
+
+      const az = yield* AzdoService;
+
+      const startTime = Date.now();
+      const output = yield* az.runCommand(cmd, projectName);
+      const executionTimeMs = Date.now() - startTime;
+
+      yield* logText(
+        formatOutput(
+          {
+            success: true,
+            data: output,
+            executionTimeMs,
+          },
+          format,
+        ),
+      );
+    }),
+).pipe(
+  Command.withDescription(
+    `Execute raw az CLI commands directly.
+
+EXAMPLES:
+  agent-tools-azdo cmd --cmd "pipelines list"
+  agent-tools-azdo cmd --cmd "repos list" --project my-project
+  agent-tools-azdo cmd --cmd "pipelines runs list --output json"`,
+  ),
+);
+
+// ---------------------------------------------------------------------------
+// Main command with subcommands
+// ---------------------------------------------------------------------------
+
+const commandsCommand = makeSchemaCommand(() => mainCommand);
+
+const mainCommand = Command.make("azdo-tool", {}).pipe(
+  Command.withDescription(
+    `Azure DevOps Tool for Coding Agents (READ-ONLY)
+
+For Azure platform (PaaS) resources — vm, webapp, storage, aks, keyvault — use az-tool instead.
+
+Typed build subcommands:
+  azdo-tool build timeline --build-id 123
+  azdo-tool build failed-jobs --build-id 123
+  azdo-tool build logs --build-id 123
+  azdo-tool build log-content --build-id 123 --log-id 45
+  azdo-tool build summary --build-id 123
+
+Raw az wrapper:
+  azdo-tool cmd --cmd "pipelines list"`,
+  ),
+  Command.withSubcommands([buildCommand, cmdCommand, commandsCommand]),
+);
+
+const cli = Command.run(mainCommand, {
+  version: VERSION,
+});
+
+const MainLayer = AzdoServiceLayer.pipe(
+  Layer.provideMerge(ConfigServiceLayer),
+  Layer.provideMerge(BunServices.layer),
+  Layer.provideMerge(AuditServiceLayer),
+);
+
+const program = withAudit("azdo", cli).pipe(
+  Effect.provide(MainLayer),
+  Effect.tapCause(renderCauseToStderr),
+);
+
+BunRuntime.runMain(program, {
+  disableErrorReporting: true,
+});