Skip to content
Permalink

Comparing changes

Choose two branches to see what’s changed or to start a new pull request. If you need to, you can also or learn more about diff comparisons.

Open a pull request

Create a new pull request by comparing changes across two branches. If you need to, you can also . Learn more about diff comparisons here.
base repository: onecli/onecli-cli
Failed to load repositories. Confirm that selected base ref is valid, then try again.
Loading
base: main
Choose a base ref
...
head repository: onecli/onecli-cli
Failed to load repositories. Confirm that selected head ref is valid, then try again.
Loading
compare: feat/pg-proxy-interception
Choose a head ref
Checking mergeability… Don’t worry, you can still create the pull request.
  • 1 commit
  • 14 files changed
  • 1 contributor

Commits on Jul 30, 2026

  1. feat(run): govern registered Postgres databases via the gateway pg proxy 

    onecli run now scans the process env and project .env files for
postgres:// URLs, matches them by host against the project's registered
database connections (GET /v1/pg/connections — host/port only, never
credentials), mints a proxy session per matched connection
(POST /v1/pg/sessions), and swaps the matched env vars for gateway proxy
URLs (aoc_pg_<token> username, dummy password) that shadow .env for
default-precedence loaders. Real credentials never enter the agent env;
every statement lands in the OneCLI activity log.

Unmatched database hosts warn ('connect it in the dashboard') and are
left untouched. A detached sidecar (hidden __pg-sidecar mode, forked
before exec so TTY semantics are preserved) heartbeats the sessions and
reaps them when the agent exits; if the sidecar dies the gateway expires
sessions by TTL. Opt out with --no-pg-proxy.
    @johnnyfish
    johnnyfish committed Jul 30, 2026
    Configuration menu
    Copy the full SHA
    cdaa2db View commit details
    Browse the repository at this point in the history
Loading