Add kagent db migrate CLI for out-of-band migrations

go/core/cli/cmd/kagent/main.go

@@ -5,6 +5,7 @@ import (
 	"fmt"
 	"os"
 	"os/signal"
+	"strconv"
 	"syscall"
 
 	cli "github.com/kagent-dev/kagent/go/core/cli/internal/cli/agent"
@@ -13,6 +14,8 @@ import (
 	"github.com/kagent-dev/kagent/go/core/cli/internal/config"
 	"github.com/kagent-dev/kagent/go/core/cli/internal/profiles"
 	"github.com/kagent-dev/kagent/go/core/cli/internal/tui"
+	dbcli "github.com/kagent-dev/kagent/go/core/pkg/cli/db"
+	"github.com/kagent-dev/kagent/go/core/pkg/migrations"
 	"github.com/spf13/cobra"
 	"sigs.k8s.io/controller-runtime/pkg/client"
 )
@@ -449,11 +452,37 @@ Examples:
 	runCmd.Flags().StringVar(&runCfg.ProjectDir, "project-dir", "", "Project directory (default: current directory)")
 	runCmd.Flags().BoolVar(&runCfg.Build, "build", false, "Rebuild the Docker image before running")
 
-	rootCmd.AddCommand(installCmd, uninstallCmd, invokeCmd, bugReportCmd, versionCmd, dashboardCmd, getCmd, initCmd, buildCmd, deployCmd, addMcpCmd, runCmd, mcp.NewMCPCmd(), envdoc.NewEnvCmd())
+	rootCmd.AddCommand(installCmd, uninstallCmd, invokeCmd, bugReportCmd, versionCmd, dashboardCmd, getCmd, initCmd, buildCmd, deployCmd, addMcpCmd, runCmd, mcp.NewMCPCmd(), envdoc.NewEnvCmd(), newDBCommand())
 
 	return rootCmd
 }
 
+// newDBCommand builds the `kagent db` command over the built-in migration
+// tracks. The vector track is gated on the same DATABASE_VECTOR_ENABLED env
+// var the controller reads for --database-vector-enabled, with the same
+// default (enabled), so the CLI operates on the tracks the server migrates.
+// An invalid value is reported only when a db subcommand actually runs, so
+// unrelated commands aren't polluted by warnings during construction.
+func newDBCommand() *cobra.Command {
+	vectorEnabled := true
+	var envWarning string
+	if v := os.Getenv("DATABASE_VECTOR_ENABLED"); v != "" {
+		b, err := strconv.ParseBool(v)
+		if err != nil {
+			envWarning = fmt.Sprintf("warning: invalid DATABASE_VECTOR_ENABLED=%q; assuming true\n", v)
+		} else {
+			vectorEnabled = b
+		}
+	}
+	cmd := dbcli.NewCommand(migrations.BuiltinSources(vectorEnabled)...)
+	if envWarning != "" {
+		cmd.PersistentPreRun = func(c *cobra.Command, _ []string) {
+			fmt.Fprint(c.ErrOrStderr(), envWarning)
+		}
+	}
+	return cmd
+}
+
 func runInteractive(cmd *cobra.Command, args []string, cfg *config.Config) {
 	client := cfg.Client()
 

go/core/pkg/cli/db/db.go

@@ -0,0 +1,43 @@
+// Package db hosts the `kagent db` parent command and its subcommands.
+// Currently only `migrate` is wired; future siblings attach here.
+package db
+
+import (
+	"github.com/spf13/cobra"
+	"github.com/spf13/pflag"
+
+	"github.com/kagent-dev/kagent/go/core/pkg/cli/db/migrate"
+	"github.com/kagent-dev/kagent/go/core/pkg/migrations"
+)
+
+// NewCommand returns the `db` parent command with `migrate` attached. The
+// given sources define the migration tracks the subcommands operate on, in
+// orchestrator registration order.
+func NewCommand(sources ...migrations.Source) *cobra.Command {
+	cmd := &cobra.Command{
+		Use:   "db",
+		Short: "Database operations (migrations, inspection)",
+	}
+	cmd.AddCommand(migrate.NewCommand(sources...))
+
+	// Hide the root's API-oriented persistent flags from help across the
+	// entire `db` subtree. They target the kagent server / Kubernetes,
+	// but db commands talk to Postgres directly via --db-url.
+	//
+	// Hidden is a property of the flag itself (shared across the whole
+	// tree), so we can't flip it permanently. The HelpFunc override
+	// toggles it for the duration of the help render and restores it
+	// after. Children of `db` that don't set their own HelpFunc walk the
+	// parent chain and pick this one up.
+	cmd.SetHelpFunc(func(c *cobra.Command, args []string) {
+		for _, name := range []string{"config", "kagent-url", "namespace", "output-format", "timeout", "verbose"} {
+			if f := c.InheritedFlags().Lookup(name); f != nil {
+				f.Hidden = true
+				defer func(f *pflag.Flag) { f.Hidden = false }(f)
+			}
+		}
+		c.Root().HelpFunc()(c, args)
+	})
+
+	return cmd
+}