@agent-native/core 0.201.0-nightly-20261005153421 → 0.201.0

package/dist/scripts/db/patch.js

@@ -1,39 +1,12 @@
 import path from "node:path";
-import { getDatabaseUrl, toPostgresParams } from "../../db/client.js";
+import { getDatabaseUrl } from "../../db/client.js";
 import { parseArgs, fail } from "../utils.js";
 import { createPostgresScriptClient } from "./postgres-client.js";
-import { assertNoRawDbAccessControlPatchTarget, assertNoSensitiveFrameworkTables, } from "./safety.js";
+import { assertNoRawDbAccessControlPatchTarget, assertNoSensitiveFrameworkTables, finalRawDbSql, readRawDbPatchStatement, validateRawDbPatchWhere, verifyRawDbStatement, } from "./safety.js";
 import { buildScopingPostgres } from "./scoping.js";
 function isValidIdentifier(value) {
     return /^[A-Za-z_][A-Za-z0-9_]*$/.test(value);
 }
-function validateWhere(where) {
-    if (where.includes(";"))
-        fail("--where must not contain ';'");
-    const stripped = where
-        .replace(/'(?:''|[^'])*'/g, "''")
-        .replace(/"(?:""|[^"])*"/g, '""')
-        .toUpperCase();
-    const blocked = [
-        " INSERT ",
-        " UPDATE ",
-        " DELETE ",
-        " DROP ",
-        " ALTER ",
-        " CREATE ",
-        " TRUNCATE ",
-        " GRANT ",
-        " REVOKE ",
-        "--",
-        "/*",
-    ];
-    const padded = ` ${stripped} `;
-    for (const keyword of blocked) {
-        if (padded.includes(keyword)) {
-            fail(`--where must not contain "${keyword.trim()}"`);
-        }
-    }
-}
 function parseEdits(parsed) {
     let edits;
     if (parsed.edits) {
@@ -352,10 +325,12 @@ Options:
     if (!isValidIdentifier(table) || !isValidIdentifier(column)) {
         fail("--table and --column must be plain identifiers");
     }
-    validateWhere(where);
+    validateRawDbPatchWhere(where);
     assertNoSensitiveFrameworkTables(table, "patch");
     assertNoRawDbAccessControlPatchTarget(table, column);
-    assertNoSensitiveFrameworkTables(where, "read");
+    // `--where` is spliced into both statements, so each is read as a whole.
+    const select = finalRawDbSql(readRawDbPatchStatement(`SELECT "${column}" AS __val FROM "${table}" WHERE ${where}`, "select").sql, "read");
+    const update = finalRawDbSql(readRawDbPatchStatement(`UPDATE "${table}" SET "${column}" = ? WHERE ${where}`, "update").sql, "patch");
     const jsonOps = parseJsonOps(parsed);
     const options = {
         table,
@@ -377,8 +352,10 @@ Options:
             for (const statement of scoping.setup)
                 await tx.unsafe(statement);
             try {
-                const selectSql = `SELECT "${column}" AS __val FROM "${table}" WHERE ${where}`;
-                const selected = await tx.unsafe(selectSql);
+                await verifyRawDbStatement(tx, select.statement);
+                const selected = await tx.unsafe(select.sql, [], {
+                    singleStatement: true,
+                });
                 if (selected.length === 0) {
                     fail(`No rows matched: ${table} WHERE ${where}. ` +
                         "(Database scoping filters results to the current user; the row may exist but be owned by someone else.)");
@@ -392,7 +369,10 @@ Options:
                 }
                 const edited = applyEditsToValue(original, options);
                 if (edited.applied > 0) {
-                    await tx.unsafe(toPostgresParams(`UPDATE "${table}" SET "${column}" = ? WHERE ${where}`), [edited.content]);
+                    await verifyRawDbStatement(tx, update.statement);
+                    await tx.unsafe(update.sql, [edited.content], {
+                        singleStatement: true,
+                    });
                 }
                 output = {
                     table,

package/dist/scripts/db/postgres-client.d.ts

@@ -1,8 +1,15 @@
 export interface PostgresScriptRows extends Array<Record<string, unknown>> {
     count?: number;
 }
+export interface PostgresScriptQueryOptions {
+    /**
+     * Have the server refuse text with more than one statement. Set it for
+     * agent-written SQL, so the database enforces what the guards checked.
+     */
+    singleStatement?: boolean;
+}
 export interface PostgresScriptClient {
-    unsafe(sql: string, args?: unknown[]): Promise<PostgresScriptRows>;
+    unsafe(sql: string, args?: unknown[], options?: PostgresScriptQueryOptions): Promise<PostgresScriptRows>;
     begin<T>(fn: (tx: PostgresScriptClient) => Promise<T>): Promise<T>;
     end(): Promise<void>;
 }

package/dist/scripts/db/postgres-client.js

@@ -5,6 +5,8 @@ function rowsResult(rows, affectedRows) {
     result.count = affectedRows ?? 0;
     return result;
 }
+// PGlite's query() always uses the extended protocol, which runs one
+// statement, so singleStatement needs no handling here.
 function pgliteClient(client) {
     return {
         async unsafe(sql, args) {
@@ -30,16 +32,28 @@ export async function createPostgresScriptClient(url) {
     const { default: postgres } = await import("postgres");
     const client = postgres(url);
     return {
-        unsafe(sql, args) {
-            return args === undefined
-                ? client.unsafe(sql)
-                : client.unsafe(sql, args);
-        },
+        ...postgresJsQueries(client),
         async begin(fn) {
-            return client.begin((tx) => fn(tx));
+            return client.begin((tx) => fn({
+                ...postgresJsQueries(tx),
+                begin: () => {
+                    throw new Error("Nested transactions are not supported.");
+                },
+                end: async () => { },
+            }));
         },
         end() {
             return client.end();
         },
     };
 }
+function postgresJsQueries(sql) {
+    return {
+        unsafe(query, args, options) {
+            // postgres.js uses the simple protocol when there are no arguments, and
+            // that protocol runs every statement in the text. The extended protocol
+            // runs one.
+            return sql.unsafe(query, args ?? [], options?.singleStatement ? { simple: false } : undefined);
+        },
+    };
+}

package/dist/scripts/db/query.js

@@ -1,10 +1,10 @@
 import path from "node:path";
-import { assertHostedRuntimeDatabase, getLocalDatabaseUrl, toPostgresParams, } from "../../db/client.js";
+import { assertHostedRuntimeDatabase, getLocalDatabaseUrl, } from "../../db/client.js";
 import { getRequestOrgId, getRequestUserEmail, } from "../../server/request-context.js";
 import { parseArgs, fail } from "../utils.js";
 import { tryForwardDbQueryToDevServer } from "./dev-query-proxy.js";
 import { createPostgresScriptClient } from "./postgres-client.js";
-import { assertNoSchemaQualifiedTables, assertNoSensitiveFrameworkTables, } from "./safety.js";
+import { finalRawDbSql, readRawDbReadStatement, verifyRawDbStatement, } from "./safety.js";
 import { buildScopingPostgres } from "./scoping.js";
 function parseSqlArgs(raw) {
     if (!raw)
@@ -46,48 +46,46 @@ function printTable(rows, sql, format) {
             .join(" | "));
     }
 }
+// Thrown to end db-query's transaction with a rollback. The per-user views
+// are created inside it, and the read-only switch blocks dropping them.
+const READ_ONLY_ROLLBACK = Symbol("db-query rollback");
 export async function runDbQuery(options) {
     const sqlArgs = options.sqlArgs ?? [];
-    const stripped = options.sql
-        .replace(/^\s*--[^\n]*\n/gm, "")
-        .replace(/\/\*[\s\S]*?\*\//g, "")
-        .trim();
-    const upper = stripped.toUpperCase();
-    if (!upper.startsWith("SELECT") &&
-        !upper.startsWith("WITH") &&
-        !upper.startsWith("EXPLAIN")) {
-        fail("Only SELECT, WITH, and EXPLAIN queries are allowed. Use db-exec for writes.");
-    }
-    assertNoSensitiveFrameworkTables(stripped, "read");
-    assertNoSchemaQualifiedTables(stripped, "read");
-    let query = options.sql;
+    const statement = readRawDbReadStatement(options.sql);
+    let query = statement.sql;
     if (options.limit &&
-        (upper.startsWith("SELECT") || upper.startsWith("WITH")) &&
-        !/\bLIMIT\b/i.test(stripped)) {
-        query = `${options.sql} LIMIT ${options.limit}`;
+        (statement.keyword === "select" || statement.keyword === "with") &&
+        !statement.tokens.some((token) => token.kind === "word" && token.value === "limit")) {
+        query = `${statement.sql}\nLIMIT ${options.limit}`;
     }
+    const executed = finalRawDbSql(query, "read");
     if (!options.databaseUrl)
         assertHostedRuntimeDatabase();
     const url = options.databaseUrl ?? getLocalDatabaseUrl("pglite:./data/pglite");
     const client = await createPostgresScriptClient(url);
     try {
         let rows = [];
-        const finalSql = toPostgresParams(query);
-        await client.begin(async (tx) => {
-            const scoping = await buildScopingPostgres(tx);
-            for (const statement of scoping.setup)
-                await tx.unsafe(statement);
-            try {
-                const result = await tx.unsafe(finalSql, sqlArgs);
+        try {
+            await client.begin(async (tx) => {
+                const scoping = await buildScopingPostgres(tx);
+                for (const setup of scoping.setup)
+                    await tx.unsafe(setup);
+                // From here on the transaction cannot write, so a data-modifying CTE,
+                // SELECT INTO, or EXPLAIN ANALYZE of a write fails instead of running.
+                await tx.unsafe("SET TRANSACTION READ ONLY");
+                await verifyRawDbStatement(tx, executed.statement);
+                const result = await tx.unsafe(executed.sql, sqlArgs, {
+                    singleStatement: true,
+                });
                 rows = Array.from(result);
-            }
-            finally {
-                for (const statement of scoping.teardown) {
-                    await tx.unsafe(statement).catch(() => { });
-                }
-            }
-        });
-        return { rows, sql: finalSql };
+                throw READ_ONLY_ROLLBACK;
+            });
+        }
+        catch (error) {
+            if (error !== READ_ONLY_ROLLBACK)
+                throw error;
+        }
+        return { rows, sql: executed.sql };
     }
     finally {
         await client.end();

package/dist/scripts/db/safety.d.ts

@@ -1,4 +1,49 @@
+import { type AgentPostgresStatement, type AgentSqlQueryRunner } from "../../agent-sql/postgres.js";
 export declare function assertNoSensitiveFrameworkTables(sql: string, operation: "read" | "write" | "patch"): void;
-export declare function assertNoSchemaQualifiedTables(sql: string, operation: "read" | "write"): void;
-export declare function assertNoRawDbAccessControlWrite(sql: string): void;
+/**
+ * Reads one db-query statement and applies every check that needs no
+ * database. Returns the statement as it will run.
+ */
+export declare function readRawDbReadStatement(sql: string): AgentPostgresStatement;
+/**
+ * Reads one db-exec statement and applies every check that needs no
+ * database, including the access-control write rules. `label` prefixes
+ * errors, e.g. "Statement 2".
+ */
+export declare function readRawDbWriteStatement(sql: string, label?: string): AgentPostgresStatement;
+/**
+ * Converts `?` placeholders and re-reads the result, so the guards have seen
+ * exactly the text that executes. Refuses if converting again would change
+ * the text, since the PGlite client converts a second time.
+ */
+export declare function finalRawDbSql(sql: string, kind: "read" | "write" | "patch", label?: string): {
+    sql: string;
+    statement: AgentPostgresStatement;
+};
+/**
+ * The database-side checks: run inside the transaction, after the per-user
+ * views exist and immediately before the statement executes.
+ * `columnsByTable` comes from the scoping context; it lets an INSERT without a
+ * column list be refused when the table has access-control columns.
+ */
+export declare function verifyRawDbStatement(db: AgentSqlQueryRunner, statement: AgentPostgresStatement, options?: {
+    columnsByTable?: Map<string, string[]>;
+    label?: string;
+}): Promise<void>;
+/**
+ * The table an INSERT writes and the columns it lists, or null when the
+ * statement is not an INSERT the guards can read. `columns` is null when the
+ * INSERT has no column list.
+ */
+export declare function rawDbInsertTarget(statement: AgentPostgresStatement): {
+    table: string;
+    columns: string[] | null;
+} | null;
 export declare function assertNoRawDbAccessControlPatchTarget(table: string, column: string): void;
+/**
+ * Validates db-patch's `--where`, which is spliced into a SELECT and an
+ * UPDATE. Both full statements are read and verified again before they run.
+ */
+export declare function validateRawDbPatchWhere(where: string): void;
+/** Reads a statement db-patch built from its arguments. */
+export declare function readRawDbPatchStatement(sql: string, keyword: "select" | "update"): AgentPostgresStatement;