mysql_genius 0.1.0

data/app/controllers/concerns/mysql_genius/query_execution.rb

@@ -0,0 +1,129 @@
+module MysqlGenius
+  module QueryExecution
+    extend ActiveSupport::Concern
+
+    def execute
+      sql = params[:sql].to_s.strip
+      row_limit = if params[:row_limit].present?
+                    [[params[:row_limit].to_i, 1].max, mysql_genius_config.max_row_limit].min
+                  else
+                    mysql_genius_config.default_row_limit
+                  end
+
+      error = validate_sql(sql)
+      if error
+        audit(:rejection, sql: sql, reason: error)
+        return render json: { error: error }, status: :unprocessable_entity
+      end
+
+      limited_sql = apply_row_limit(sql, row_limit)
+      timed_sql = apply_timeout_hint(limited_sql)
+
+      start_time = Process.clock_gettime(Process::CLOCK_MONOTONIC)
+      begin
+        results = ActiveRecord::Base.connection.exec_query(timed_sql)
+        execution_time_ms = ((Process.clock_gettime(Process::CLOCK_MONOTONIC) - start_time) * 1000).round(1)
+
+        columns = results.columns
+        rows = results.rows.map do |row|
+          row.each_with_index.map do |value, i|
+            masked_column?(columns[i]) ? "[REDACTED]" : value
+          end
+        end
+
+        truncated = rows.length >= row_limit
+
+        audit(:query, sql: sql, execution_time_ms: execution_time_ms, row_count: rows.length)
+
+        render json: {
+          columns: columns,
+          rows: rows,
+          row_count: rows.length,
+          execution_time_ms: execution_time_ms,
+          truncated: truncated
+        }
+      rescue ActiveRecord::StatementInvalid => e
+        if timeout_error?(e)
+          audit(:error, sql: sql, error: "Query timeout")
+          render json: { error: "Query exceeded the #{mysql_genius_config.query_timeout_ms / 1000} second timeout limit.", timeout: true }, status: :unprocessable_entity
+        else
+          audit(:error, sql: sql, error: e.message)
+          render json: { error: "Query error: #{e.message.split(':').last.strip}" }, status: :unprocessable_entity
+        end
+      end
+    end
+
+    def explain
+      sql = params[:sql].to_s.strip
+      skip_validation = params[:from_slow_query] == "true"
+
+      unless skip_validation
+        error = validate_sql(sql)
+        return render json: { error: error }, status: :unprocessable_entity if error
+      end
+
+      # Reject truncated SQL (captured slow queries are capped at 2000 chars)
+      unless sql.match?(/\)\s*$/) || sql.match?(/\w\s*$/) || sql.match?(/['"`]\s*$/) || sql.match?(/\d\s*$/)
+        return render json: { error: "This query appears to be truncated and cannot be explained." }, status: :unprocessable_entity
+      end
+
+      explain_sql = "EXPLAIN #{sql.gsub(/;\s*\z/, '')}"
+      results = ActiveRecord::Base.connection.exec_query(explain_sql)
+
+      render json: { columns: results.columns, rows: results.rows }
+    rescue ActiveRecord::StatementInvalid => e
+      render json: { error: "Explain error: #{e.message.split(':').last.strip}" }, status: :unprocessable_entity
+    end
+
+    private
+
+    def validate_sql(sql)
+      SqlValidator.validate(sql, blocked_tables: mysql_genius_config.blocked_tables, connection: ActiveRecord::Base.connection)
+    end
+
+    def apply_timeout_hint(sql)
+      if mariadb?
+        timeout_seconds = mysql_genius_config.query_timeout_ms / 1000
+        "SET STATEMENT max_statement_time=#{timeout_seconds} FOR #{sql}"
+      else
+        sql.sub(/\bSELECT\b/i, "SELECT /*+ MAX_EXECUTION_TIME(#{mysql_genius_config.query_timeout_ms}) */")
+      end
+    end
+
+    def mariadb?
+      @mariadb ||= ActiveRecord::Base.connection.select_value("SELECT VERSION()").to_s.include?("MariaDB")
+    end
+
+    def apply_row_limit(sql, limit)
+      SqlValidator.apply_row_limit(sql, limit)
+    end
+
+    def timeout_error?(exception)
+      msg = exception.message
+      msg.include?("max_statement_time") || msg.include?("max_execution_time") || msg.include?("Query execution was interrupted")
+    end
+
+    def masked_column?(column_name)
+      SqlValidator.masked_column?(column_name, mysql_genius_config.masked_column_patterns)
+    end
+
+    def sanitize_ai_sql(sql)
+      sql.gsub(/```(?:sql)?\s*/i, "").gsub(/```/, "").strip
+    end
+
+    def audit(type, **attrs)
+      logger = mysql_genius_config.audit_logger
+      return unless logger
+
+      prefix = "[#{Time.current.iso8601}] [mysql_genius]"
+      case type
+      when :query
+        logger.info("#{prefix} rows=#{attrs[:row_count]} time=#{attrs[:execution_time_ms]}ms sql=#{attrs[:sql].squish}")
+      when :rejection
+        logger.warn("#{prefix} REJECTED reason=#{attrs[:reason]} sql=#{attrs[:sql].to_s.squish}")
+      when :error
+        logger.error("#{prefix} ERROR error=#{attrs[:error]} sql=#{attrs[:sql].to_s.squish}")
+      end
+    end
+  end
+end

data/app/controllers/mysql_genius/base_controller.rb

@@ -0,0 +1,18 @@
+module MysqlGenius
+  class BaseController < MysqlGenius.configuration.base_controller.constantize
+    layout "mysql_genius/application"
+    before_action :authenticate_mysql_genius!
+
+    private
+
+    def authenticate_mysql_genius!
+      unless MysqlGenius.configuration.authenticate.call(self)
+        render plain: "Not authorized", status: :unauthorized
+      end
+    end
+
+    def mysql_genius_config
+      MysqlGenius.configuration
+    end
+  end
+end

data/app/controllers/mysql_genius/queries_controller.rb

@@ -0,0 +1,54 @@
+module MysqlGenius
+  class QueriesController < BaseController
+    include QueryExecution
+    include DatabaseAnalysis
+    include AiFeatures
+
+    def index
+      @featured_tables = if mysql_genius_config.featured_tables.any?
+                           mysql_genius_config.featured_tables.sort
+                         else
+                           queryable_tables.sort
+                         end
+      @all_tables = queryable_tables.sort
+      @ai_enabled = mysql_genius_config.ai_enabled?
+    end
+
+    def columns
+      table = params[:table]
+      if mysql_genius_config.blocked_tables.include?(table)
+        return render json: { error: "Table '#{table}' is not available for querying." }, status: :forbidden
+      end
+
+      unless ActiveRecord::Base.connection.tables.include?(table)
+        return render json: { error: "Table '#{table}' does not exist." }, status: :not_found
+      end
+
+      defaults = mysql_genius_config.default_columns[table] || []
+      cols = ActiveRecord::Base.connection.columns(table).reject { |c| masked_column?(c.name) }.map do |c|
+        { name: c.name, type: c.type.to_s, default: defaults.empty? || defaults.include?(c.name) }
+      end
+      render json: cols
+    end
+
+    def slow_queries
+      unless mysql_genius_config.redis_url.present?
+        return render json: { error: "Slow query monitoring is not configured." }, status: :not_found
+      end
+
+      redis = Redis.new(url: mysql_genius_config.redis_url)
+      key = SlowQueryMonitor.redis_key
+      raw = redis.lrange(key, 0, 199)
+      queries = raw.map { |entry| JSON.parse(entry) rescue nil }.compact
+      render json: queries
+    rescue => e
+      render json: [], status: :ok
+    end
+
+    private
+
+    def queryable_tables
+      ActiveRecord::Base.connection.tables - mysql_genius_config.blocked_tables
+    end
+  end
+end

data/app/services/mysql_genius/ai_client.rb

@@ -0,0 +1,84 @@
+require "net/http"
+require "json"
+require "uri"
+
+module MysqlGenius
+  class AiClient
+    MAX_REDIRECTS = 3
+
+    def initialize
+      @config = MysqlGenius.configuration
+    end
+
+    def chat(messages:, temperature: 0)
+      if @config.ai_client
+        return @config.ai_client.call(messages: messages, temperature: temperature)
+      end
+
+      raise Error, "AI is not configured" unless @config.ai_endpoint && @config.ai_api_key
+
+      body = {
+        messages: messages,
+        response_format: { type: "json_object" },
+        temperature: temperature
+      }
+      body[:model] = @config.ai_model if @config.ai_model.present?
+
+      response = post_with_redirects(URI(@config.ai_endpoint), body.to_json)
+      parsed = JSON.parse(response.body)
+
+      if parsed["error"]
+        raise Error, "AI API error: #{parsed['error']['message'] || parsed['error']}"
+      end
+
+      content = parsed.dig("choices", 0, "message", "content")
+      raise Error, "No content in AI response" if content.nil?
+
+      parse_json_content(content)
+    end
+
+    private
+
+    def parse_json_content(content)
+      # Try direct parse first
+      JSON.parse(content)
+    rescue JSON::ParserError
+      # Strip markdown code fences that some models wrap around JSON
+      stripped = content.to_s
+        .gsub(/\A\s*```(?:json)?\s*/i, "")
+        .gsub(/\s*```\s*\z/, "")
+        .strip
+      begin
+        JSON.parse(stripped)
+      rescue JSON::ParserError
+        { "raw" => content.to_s }
+      end
+    end
+
+    def post_with_redirects(uri, body, redirects = 0)
+      raise Error, "Too many redirects" if redirects > MAX_REDIRECTS
+
+      http = Net::HTTP.new(uri.host, uri.port)
+      http.use_ssl = uri.scheme == "https"
+      http.open_timeout = 10
+      http.read_timeout = 60
+
+      request = Net::HTTP::Post.new(uri)
+      request["Content-Type"] = "application/json"
+      if @config.ai_auth_style == :bearer
+        request["Authorization"] = "Bearer #{@config.ai_api_key}"
+      else
+        request["api-key"] = @config.ai_api_key
+      end
+      request.body = body
+
+      response = http.request(request)
+
+      if response.is_a?(Net::HTTPRedirection)
+        post_with_redirects(URI(response["location"]), body, redirects + 1)
+      else
+        response
+      end
+    end
+  end
+end

data/app/services/mysql_genius/ai_optimization_service.rb

@@ -0,0 +1,56 @@
+module MysqlGenius
+  class AiOptimizationService
+    def call(sql, explain_rows, allowed_tables)
+      schema = build_schema_description(allowed_tables)
+      messages = [
+        { role: "system", content: system_prompt(schema) },
+        { role: "user", content: user_prompt(sql, explain_rows) }
+      ]
+
+      AiClient.new.chat(messages: messages)
+    end
+
+    private
+
+    def system_prompt(schema_description)
+      <<~PROMPT
+        You are a MySQL query optimization expert. Given a SQL query and its EXPLAIN output, analyze the query execution plan and provide actionable optimization suggestions.
+
+        Available schema:
+        #{schema_description}
+
+        Respond with JSON:
+        {
+          "suggestions": "Markdown-formatted analysis and suggestions. Include: 1) Summary of current execution plan (scan types, rows examined). 2) Specific recommendations such as indexes to add (provide exact CREATE INDEX statements), query rewrites, or structural changes. 3) Expected impact of each suggestion."
+        }
+      PROMPT
+    end
+
+    def user_prompt(sql, explain_rows)
+      <<~PROMPT
+        SQL Query:
+        #{sql}
+
+        EXPLAIN Output:
+        #{format_explain(explain_rows)}
+      PROMPT
+    end
+
+    def format_explain(explain_rows)
+      return explain_rows if explain_rows.is_a?(String)
+      explain_rows.map { |row| row.join(" | ") }.join("\n")
+    end
+
+    def build_schema_description(allowed_tables)
+      connection = ActiveRecord::Base.connection
+      allowed_tables.map do |table|
+        next unless connection.tables.include?(table)
+        columns = connection.columns(table).map { |c| "#{c.name} (#{c.type})" }
+        indexes = connection.indexes(table).map { |idx| "#{idx.name}: [#{idx.columns.join(', ')}]#{idx.unique ? ' UNIQUE' : ''}" }
+        desc = "#{table}: #{columns.join(', ')}"
+        desc += "\n  Indexes: #{indexes.join('; ')}" if indexes.any?
+        desc
+      end.compact.join("\n")
+    end
+  end
+end

data/app/services/mysql_genius/ai_suggestion_service.rb

@@ -0,0 +1,56 @@
+module MysqlGenius
+  class AiSuggestionService
+    def call(user_prompt, allowed_tables)
+      schema = build_schema_description(allowed_tables)
+      messages = [
+        { role: "system", content: system_prompt(schema) },
+        { role: "user", content: user_prompt }
+      ]
+
+      AiClient.new.chat(messages: messages)
+    end
+
+    private
+
+    def system_prompt(schema_description)
+      custom_context = MysqlGenius.configuration.ai_system_context
+
+      prompt = <<~PROMPT
+        You are a SQL query assistant for a MySQL database.
+      PROMPT
+
+      if custom_context.present?
+        prompt += <<~PROMPT
+
+          Domain context:
+          #{custom_context}
+        PROMPT
+      end
+
+      prompt += <<~PROMPT
+
+        Rules:
+        - Only generate SELECT statements. Never generate INSERT, UPDATE, DELETE, or any other mutation.
+        - Only reference the tables and columns listed in the schema below. Do not guess or invent column names.
+        - Use backticks for table and column names.
+        - Include a LIMIT 100 unless the user specifies otherwise.
+
+        Available schema:
+        #{schema_description}
+
+        Respond with JSON: {"sql": "the SQL query", "explanation": "brief explanation of what the query does"}
+      PROMPT
+
+      prompt
+    end
+
+    def build_schema_description(allowed_tables)
+      connection = ActiveRecord::Base.connection
+      allowed_tables.map do |table|
+        next unless connection.tables.include?(table)
+        columns = connection.columns(table).map { |c| "#{c.name} (#{c.type})" }
+        "#{table}: #{columns.join(', ')}"
+      end.compact.join("\n")
+    end
+  end
+end

data/app/views/layouts/mysql_genius/application.html.erb

@@ -0,0 +1,116 @@
+<!DOCTYPE html>
+<html>
+<head>
+  <title>MySQLGenius</title>
+  <meta name="viewport" content="width=device-width, initial-scale=1">
+  <meta name="csrf-token" content="<%= form_authenticity_token %>">
+  <style>
+    *, *::before, *::after { box-sizing: border-box; }
+    body { font-family: -apple-system, BlinkMacSystemFont, "Segoe UI", Roboto, Helvetica, Arial, sans-serif; background: #f5f5f5; color: #333; margin: 0; font-size: 14px; line-height: 1.5; }
+    .mg-container { max-width: 1400px; margin: 0 auto; padding: 20px; }
+    h4 { margin: 0 0 16px; font-size: 18px; }
+
+    /* Tabs */
+    .mg-tabs { display: flex; border-bottom: 2px solid #dee2e6; margin-bottom: 0; }
+    .mg-tab { padding: 8px 16px; cursor: pointer; border: 1px solid transparent; border-bottom: none; margin-bottom: -2px; border-radius: 4px 4px 0 0; background: none; font-size: 14px; color: #555; }
+    .mg-tab:hover { color: #000; }
+    .mg-tab.active { background: #fff; border-color: #dee2e6; border-bottom-color: #fff; color: #000; font-weight: 500; }
+    .mg-tab-content { display: none; background: #fff; border: 1px solid #dee2e6; border-top: none; padding: 16px; }
+    .mg-tab-content.active { display: block; }
+
+    /* Forms */
+    label { display: block; font-weight: 500; margin-bottom: 4px; font-size: 13px; }
+    select, input[type="number"], input[type="text"], textarea { border: 1px solid #ced4da; border-radius: 4px; padding: 6px 10px; font-size: 13px; width: 100%; font-family: inherit; }
+    select:focus, input:focus, textarea:focus { outline: none; border-color: #80bdff; box-shadow: 0 0 0 2px rgba(0,123,255,.15); }
+    textarea { font-family: "SF Mono", "Fira Code", "Fira Mono", Menlo, Consolas, monospace; resize: vertical; }
+    textarea[readonly] { background: #f8f9fa; }
+
+    /* Grid helpers */
+    .mg-row { display: flex; gap: 12px; align-items: flex-end; flex-wrap: wrap; }
+    .mg-col-1 { flex: 0 0 80px; }
+    .mg-col-2 { flex: 0 0 160px; }
+    .mg-col-3 { flex: 0 0 240px; }
+    .mg-col-4 { flex: 0 0 320px; }
+    .mg-col-grow { flex: 1 1 200px; }
+    .mg-field { margin-bottom: 12px; }
+
+    /* Buttons */
+    .mg-btn { display: inline-flex; align-items: center; gap: 6px; padding: 6px 14px; border: 1px solid transparent; border-radius: 4px; font-size: 13px; cursor: pointer; font-family: inherit; white-space: nowrap; }
+    .mg-btn:disabled { opacity: .5; cursor: not-allowed; }
+    .mg-btn-primary { background: #007bff; color: #fff; border-color: #007bff; }
+    .mg-btn-primary:hover:not(:disabled) { background: #0069d9; }
+    .mg-btn-outline { background: #fff; color: #007bff; border-color: #007bff; }
+    .mg-btn-outline:hover:not(:disabled) { background: #e7f1ff; }
+    .mg-btn-outline-secondary { background: #fff; color: #6c757d; border-color: #6c757d; }
+    .mg-btn-outline-secondary:hover:not(:disabled) { background: #f8f9fa; }
+    .mg-btn-outline-danger { background: #fff; color: #dc3545; border-color: #dc3545; padding: 4px 8px; }
+    .mg-btn-outline-danger:hover:not(:disabled) { background: #ffeef0; }
+    .mg-btn-sm { padding: 3px 8px; font-size: 12px; }
+
+    /* Badge */
+    .mg-badge { display: inline-block; padding: 2px 8px; border-radius: 10px; font-size: 12px; font-weight: 500; }
+    .mg-badge-info { background: #d1ecf1; color: #0c5460; }
+    .mg-badge-warning { background: #fff3cd; color: #856404; }
+    .mg-badge-danger { background: #f8d7da; color: #721c24; }
+    .mg-badge-secondary { background: #e2e3e5; color: #383d41; }
+
+    /* Alert */
+    .mg-alert { padding: 10px 14px; border-radius: 4px; margin-bottom: 12px; font-size: 13px; }
+    .mg-alert-danger { background: #f8d7da; color: #721c24; border: 1px solid #f5c6cb; }
+    .mg-alert-warning { background: #fff3cd; color: #856404; border: 1px solid #ffeeba; }
+    .mg-alert-info { background: #d1ecf1; color: #0c5460; border: 1px solid #bee5eb; }
+
+    /* Card */
+    .mg-card { border: 1px solid #dee2e6; border-radius: 4px; margin-bottom: 12px; }
+    .mg-card-header { padding: 8px 12px; background: #f8f9fa; border-bottom: 1px solid #dee2e6; display: flex; justify-content: space-between; align-items: center; font-size: 13px; }
+    .mg-card-body { padding: 12px; }
+    .mg-card-toggle { cursor: pointer; color: #007bff; text-decoration: none; font-size: 13px; }
+    .mg-card-toggle:hover { text-decoration: underline; }
+
+    /* Stat grid */
+    .mg-stat-grid { display: grid; grid-template-columns: 1fr auto; gap: 4px 12px; font-size: 13px; }
+    .mg-stat-grid .mg-stat-label { color: #666; }
+    .mg-stat-grid .mg-stat-value { text-align: right; font-weight: 500; }
+    .mg-usage-bar { background: #e9ecef; border-radius: 4px; height: 20px; position: relative; overflow: hidden; }
+    .mg-usage-bar-fill { height: 100%; border-radius: 4px; transition: width 0.3s; }
+    .mg-usage-bar-text { position: absolute; top: 0; left: 0; right: 0; text-align: center; line-height: 20px; font-size: 11px; font-weight: 500; }
+
+    /* Table */
+    .mg-table-wrap { overflow-x: auto; }
+    table.mg-table { width: 100%; border-collapse: collapse; font-size: 13px; }
+    .mg-table th, .mg-table td { padding: 4px 8px; border: 1px solid #dee2e6; text-align: left; }
+    .mg-table th { background: #f8f9fa; font-weight: 500; white-space: nowrap; }
+    .mg-table tr:nth-child(even) { background: #f8f9fa; }
+    .mg-table em.null { color: #999; font-style: italic; }
+    .mg-table .redacted { color: #999; }
+
+    /* Checkbox grid */
+    .mg-checks { display: flex; flex-wrap: wrap; gap: 4px 16px; }
+    .mg-check { display: flex; align-items: center; gap: 4px; font-size: 13px; cursor: pointer; }
+    .mg-check input { margin: 0; }
+    .mg-check .type-hint { color: #999; font-size: 11px; }
+
+    /* Inline links */
+    .mg-link { color: #007bff; cursor: pointer; text-decoration: none; font-size: 12px; margin-left: 8px; }
+    .mg-link:hover { text-decoration: underline; }
+
+    /* Spinner */
+    @keyframes mg-spin { to { transform: rotate(360deg); } }
+    .mg-spinner { display: inline-block; width: 14px; height: 14px; border: 2px solid #ccc; border-top-color: #007bff; border-radius: 50%; animation: mg-spin .6s linear infinite; }
+
+    /* Utilities */
+    .mg-hidden { display: none !important; }
+    .mg-mt { margin-top: 16px; }
+    .mg-mb { margin-bottom: 12px; }
+    .mg-text-muted { color: #888; font-size: 13px; }
+    .mg-text-center { text-align: center; padding: 24px 0; }
+    code { font-size: 12px; word-break: break-all; background: #f4f4f4; padding: 1px 4px; border-radius: 2px; }
+    pre.mg-pre { background: #f4f4f4; padding: 10px; border-radius: 4px; overflow-x: auto; font-size: 12px; }
+  </style>
+</head>
+<body>
+  <div class="mg-container">
+    <%= yield %>
+  </div>
+</body>
+</html>

data/app/views/mysql_genius/queries/_shared_results.html.erb

@@ -0,0 +1,56 @@
+<!-- Explain Results -->
+<div id="explain-results" class="mg-mt mg-hidden">
+  <div class="mg-card">
+    <div class="mg-card-header">
+      <span><strong>&#128270; EXPLAIN Output</strong></span>
+      <div>
+        <% if @ai_enabled %>
+          <button id="explain-optimize" class="mg-btn mg-btn-outline mg-btn-sm">&#9889; AI Optimization</button>
+          <button id="explain-index-advisor" class="mg-btn mg-btn-outline mg-btn-sm">&#9889; Index Advisor</button>
+        <% end %>
+        <button id="explain-close" class="mg-btn mg-btn-outline-secondary mg-btn-sm">&#10005; Close</button>
+      </div>
+    </div>
+    <div class="mg-card-body">
+      <div class="mg-table-wrap">
+        <table class="mg-table">
+          <thead id="explain-thead"></thead>
+          <tbody id="explain-tbody"></tbody>
+        </table>
+      </div>
+      <div id="optimize-results" class="mg-hidden mg-mt">
+        <div id="optimize-content" class="mg-alert mg-alert-info"></div>
+      </div>
+    </div>
+  </div>
+</div>
+
+<!-- Results Area -->
+<div id="query-results" class="mg-mt">
+  <div id="results-alert" class="mg-hidden"></div>
+  <div id="results-stats" class="mg-mb mg-hidden">
+    <span id="results-row-count" class="mg-badge mg-badge-info"></span>
+    <span id="results-time" class="mg-badge mg-badge-secondary"></span>
+    <span id="results-truncated" class="mg-badge mg-badge-warning mg-hidden">Results truncated</span>
+  </div>
+  <div id="results-table-wrapper" class="mg-table-wrap mg-hidden">
+    <table class="mg-table">
+      <thead id="results-thead"></thead>
+      <tbody id="results-tbody"></tbody>
+    </table>
+  </div>
+  <div id="results-empty" class="mg-text-center mg-text-muted mg-hidden">No rows returned.</div>
+</div>
+
+<!-- AI Query Analysis Results -->
+<div id="ai-query-result" class="mg-mt mg-hidden">
+  <div class="mg-card">
+    <div class="mg-card-header">
+      <span id="ai-query-title"><strong>&#9889; AI Analysis</strong></span>
+      <button id="ai-query-close" class="mg-btn mg-btn-outline-secondary mg-btn-sm">&#10005;</button>
+    </div>
+    <div class="mg-card-body">
+      <div id="ai-query-content" style="font-size:13px;"></div>
+    </div>
+  </div>
+</div>

data/app/views/mysql_genius/queries/_tab_ai_tools.html.erb

@@ -0,0 +1,43 @@
+<!-- AI Tools Tab -->
+<div class="mg-tab-content" id="tab-aitools">
+  <!-- Schema Review -->
+  <div class="mg-card mg-mb">
+    <div class="mg-card-header"><strong>&#9889; Schema Review</strong></div>
+    <div class="mg-card-body">
+      <div class="mg-text-muted mg-mb" style="font-size:12px;">Analyze your schema for anti-patterns: inappropriate column types, missing indexes, naming inconsistencies, and more.</div>
+      <div class="mg-row" style="align-items:flex-end;">
+        <div class="mg-col-4 mg-field">
+          <label for="schema-table">Table (leave blank for all)</label>
+          <select id="schema-table">
+            <option value="">All tables (top 20)</option>
+            <% @all_tables.each do |table| %>
+              <option value="<%= table %>"><%= table %></option>
+            <% end %>
+          </select>
+        </div>
+        <div class="mg-field">
+          <button id="schema-review-btn" class="mg-btn mg-btn-primary mg-btn-sm">&#9889; Analyze Schema</button>
+        </div>
+      </div>
+      <div id="schema-result" class="mg-mt mg-hidden">
+        <div id="schema-result-content" style="font-size:13px;"></div>
+      </div>
+    </div>
+  </div>
+
+  <!-- Migration Risk Assessment -->
+  <div class="mg-card">
+    <div class="mg-card-header"><strong>&#9889; Migration Risk Assessment</strong></div>
+    <div class="mg-card-body">
+      <div class="mg-text-muted mg-mb" style="font-size:12px;">Paste a Rails migration or DDL and get a risk assessment: lock duration, impact on active queries, deployment strategy.</div>
+      <div class="mg-field">
+        <textarea id="migration-input" rows="8" placeholder="class AddIndexToUsers < ActiveRecord::Migration[7.0]&#10;  def change&#10;    add_index :users, :email, unique: true&#10;  end&#10;end"></textarea>
+      </div>
+      <button id="migration-assess-btn" class="mg-btn mg-btn-primary mg-btn-sm">&#9889; Assess Risk</button>
+      <div id="migration-result" class="mg-mt mg-hidden">
+        <div id="migration-risk-badge" style="margin-bottom:8px;"></div>
+        <div id="migration-result-content" style="font-size:13px;"></div>
+      </div>
+    </div>
+  </div>
+</div>

data/app/views/mysql_genius/queries/_tab_duplicate_indexes.html.erb

@@ -0,0 +1,24 @@
+<!-- Duplicate Indexes Tab -->
+<div class="mg-tab-content" id="tab-indexes">
+  <div class="mg-row" style="justify-content:space-between;align-items:center;margin-bottom:12px;">
+    <div class="mg-text-muted">Indexes whose columns are a left-prefix of another index on the same table. These are redundant and can safely be dropped. <span id="dup-count" class="mg-badge mg-badge-secondary"></span></div>
+    <button id="dup-refresh" class="mg-btn mg-btn-outline-secondary mg-btn-sm">&#8635; Refresh</button>
+  </div>
+  <div id="dup-loading" class="mg-text-center mg-hidden"><span class="mg-spinner"></span> Scanning indexes...</div>
+  <div id="dup-empty" class="mg-text-center mg-text-muted mg-hidden">No duplicate indexes found.</div>
+  <div id="dup-table-wrapper" class="mg-table-wrap mg-hidden">
+    <table class="mg-table">
+      <thead>
+        <tr>
+          <th>Table</th>
+          <th>Duplicate Index</th>
+          <th>Columns</th>
+          <th>Covered By</th>
+          <th>Covered Columns</th>
+          <th>DROP Statement</th>
+        </tr>
+      </thead>
+      <tbody id="dup-tbody"></tbody>
+    </table>
+  </div>
+</div>