tifandotme HADL DB Credentials
For HADL database work, get connection metadata as JSON:
mise run db-creds
Treat the command as a black box. Do not inspect credential storage unless the command is broken.
Pick the entry whose key, database, label, or tunnel matches the request. If more than one entry matches, ask. Each entry has host, port, database, user, sslmode, tunnel, and tunnel_task.
For password_source: "tableplus", use password. For password_source: "gcloud-access-token", run:
mise run gcloud-auth-check
mise run gcloud-access-token
and use the fresh token as the PostgreSQL password.
Before querying, check whether the needed local port is listening.
If not listening and inside herdr, run:
mise run tunnels-start
It finds or creates the exact tunnels workspace and runs mise run tunnels in its single tab. If duplicate tunnels workspaces exist, stop and ask the user to close or rename extras.
Outside herdr, ask the user to run:
mise run tunnels
Use sslmode=require for psql connections through these tunnels. Do not paste passwords, access tokens, or sensitive query results into chat unless the user explicitly asks.
These credentials reach live production data. Read freely; before any statement or admin API call that changes a production row, state the exact change and the rows it touches, then wait for the user to confirm. This holds even when the change looks like a cleanup that follows from a finding you just reported: the user asked for the finding, not for the write.