| name | hadl-db-creds |
| description | Provides the local command contract for HADL database credentials and tunnels. Use when an agent needs to inspect, traverse, or query HADL, Aquasense, Backoffice, staging, production, or windmill databases. |
HADL DB Credentials
For HADL database work, get connection metadata as JSON:
mise run db-creds
Treat the command as a black box. Do not inspect credential storage unless the command is broken.
Pick the entry whose key, database, label, or tunnel matches the request. If more than one entry matches, ask. Each entry has host, port, database, user, sslmode, tunnel, and tunnel_task.
For password_source: "tableplus", use password. For password_source: "gcloud-access-token", run:
mise run gcloud-auth-check
mise run gcloud-access-token
and use the fresh token as the PostgreSQL password.
Before querying, check whether the needed local port is listening.
If not listening and inside herdr, run:
mise run tunnels-start
It finds or creates the exact tunnels workspace and runs mise run tunnels in its single tab. If duplicate tunnels workspaces exist, stop and ask the user to close or rename extras.
Outside herdr, ask the user to run:
mise run tunnels
Use sslmode=require for psql connections through these tunnels. Do not paste passwords, access tokens, or sensitive query results into chat unless the user explicitly asks.
