@bytebase/dbhub 0.13.2 → 0.15.0

package/dist/index.js

@@ -5,7 +5,6 @@ import {
   ConnectorManager,
   ConnectorRegistry,
   SafeURL,
-  buildDSNFromSource,
   getDatabaseTypeFromDSN,
   getDefaultPortForType,
   getToolRegistry,
@@ -13,12 +12,11 @@ import {
   mapArgumentsToArray,
   obfuscateDSNPassword,
   parseConnectionInfoFromDSN,
-  redactDSN,
   resolvePort,
   resolveSourceConfigs,
   resolveTransport,
   stripCommentsAndStrings
-} from "./chunk-KBVJEDZF.js";
+} from "./chunk-TPHNNFR5.js";
 
 // src/connectors/postgres/index.ts
 import pg from "pg";
@@ -148,6 +146,7 @@ var { Pool } = pg;
 var PostgresDSNParser = class {
   async parse(dsn, config) {
     const connectionTimeoutSeconds = config?.connectionTimeoutSeconds;
+    const queryTimeoutSeconds = config?.queryTimeoutSeconds;
     if (!this.isValidDSN(dsn)) {
       const obfuscatedDSN = obfuscateDSNPassword(dsn);
       const expectedFormat = this.getSampleDSN();
@@ -159,7 +158,7 @@ Expected: ${expectedFormat}`
     }
     try {
       const url = new SafeURL(dsn);
-      const config2 = {
+      const poolConfig = {
         host: url.hostname,
         port: url.port ? parseInt(url.port) : 5432,
         database: url.pathname ? url.pathname.substring(1) : "",
@@ -170,18 +169,21 @@ Expected: ${expectedFormat}`
       url.forEachSearchParam((value, key) => {
         if (key === "sslmode") {
           if (value === "disable") {
-            config2.ssl = false;
+            poolConfig.ssl = false;
           } else if (value === "require") {
-            config2.ssl = { rejectUnauthorized: false };
+            poolConfig.ssl = { rejectUnauthorized: false };
           } else {
-            config2.ssl = true;
+            poolConfig.ssl = true;
           }
         }
       });
       if (connectionTimeoutSeconds !== void 0) {
-        config2.connectionTimeoutMillis = connectionTimeoutSeconds * 1e3;
+        poolConfig.connectionTimeoutMillis = connectionTimeoutSeconds * 1e3;
       }
-      return config2;
+      if (queryTimeoutSeconds !== void 0) {
+        poolConfig.query_timeout = queryTimeoutSeconds * 1e3;
+      }
+      return poolConfig;
     } catch (error) {
       throw new Error(
         `Failed to parse PostgreSQL DSN: ${error instanceof Error ? error.message : String(error)}`
@@ -475,22 +477,26 @@ var PostgresConnector = class _PostgresConnector {
       const statements = sql2.split(";").map((statement) => statement.trim()).filter((statement) => statement.length > 0);
       if (statements.length === 1) {
         const processedStatement = SQLRowLimiter.applyMaxRows(statements[0], options.maxRows);
+        let result;
         if (parameters && parameters.length > 0) {
           try {
-            return await client.query(processedStatement, parameters);
+            result = await client.query(processedStatement, parameters);
           } catch (error) {
             console.error(`[PostgreSQL executeSQL] ERROR: ${error.message}`);
             console.error(`[PostgreSQL executeSQL] SQL: ${processedStatement}`);
             console.error(`[PostgreSQL executeSQL] Parameters: ${JSON.stringify(parameters)}`);
             throw error;
           }
+        } else {
+          result = await client.query(processedStatement);
         }
-        return await client.query(processedStatement);
+        return { rows: result.rows, rowCount: result.rowCount ?? result.rows.length };
       } else {
         if (parameters && parameters.length > 0) {
           throw new Error("Parameters are not supported for multi-statement queries in PostgreSQL");
         }
         let allRows = [];
+        let totalRowCount = 0;
         await client.query("BEGIN");
         try {
           for (let statement of statements) {
@@ -499,13 +505,16 @@ var PostgresConnector = class _PostgresConnector {
             if (result.rows && result.rows.length > 0) {
               allRows.push(...result.rows);
             }
+            if (result.rowCount) {
+              totalRowCount += result.rowCount;
+            }
           }
           await client.query("COMMIT");
         } catch (error) {
           await client.query("ROLLBACK");
           throw error;
         }
-        return { rows: allRows };
+        return { rows: allRows, rowCount: totalRowCount };
       }
     } finally {
       client.release();
@@ -521,7 +530,7 @@ import { DefaultAzureCredential } from "@azure/identity";
 var SQLServerDSNParser = class {
   async parse(dsn, config) {
     const connectionTimeoutSeconds = config?.connectionTimeoutSeconds;
-    const requestTimeoutSeconds = config?.requestTimeoutSeconds;
+    const queryTimeoutSeconds = config?.queryTimeoutSeconds;
     if (!this.isValidDSN(dsn)) {
       const obfuscatedDSN = obfuscateDSNPassword(dsn);
       const expectedFormat = this.getSampleDSN();
@@ -541,8 +550,16 @@ Expected: ${expectedFormat}`
           options.sslmode = value;
         } else if (key === "instanceName") {
           options.instanceName = value;
+        } else if (key === "domain") {
+          options.domain = value;
         }
       });
+      if (options.authentication === "ntlm" && !options.domain) {
+        throw new Error("NTLM authentication requires 'domain' parameter");
+      }
+      if (options.domain && options.authentication !== "ntlm") {
+        throw new Error("Parameter 'domain' requires 'authentication=ntlm'");
+      }
       if (options.sslmode) {
         if (options.sslmode === "disable") {
           options.encrypt = false;
@@ -553,8 +570,6 @@ Expected: ${expectedFormat}`
         }
       }
       const config2 = {
-        user: url.username,
-        password: url.password,
         server: url.hostname,
         port: url.port ? parseInt(url.port) : 1433,
         // Default SQL Server port
@@ -567,27 +582,44 @@ Expected: ${expectedFormat}`
           ...connectionTimeoutSeconds !== void 0 && {
             connectTimeout: connectionTimeoutSeconds * 1e3
           },
-          ...requestTimeoutSeconds !== void 0 && {
-            requestTimeout: requestTimeoutSeconds * 1e3
+          ...queryTimeoutSeconds !== void 0 && {
+            requestTimeout: queryTimeoutSeconds * 1e3
           },
           instanceName: options.instanceName
           // Add named instance support
         }
       };
-      if (options.authentication === "azure-active-directory-access-token") {
-        try {
-          const credential = new DefaultAzureCredential();
-          const token = await credential.getToken("https://database.windows.net/");
+      switch (options.authentication) {
+        case "azure-active-directory-access-token": {
+          try {
+            const credential = new DefaultAzureCredential();
+            const token = await credential.getToken("https://database.windows.net/");
+            config2.authentication = {
+              type: "azure-active-directory-access-token",
+              options: {
+                token: token.token
+              }
+            };
+          } catch (error) {
+            const errorMessage = error instanceof Error ? error.message : String(error);
+            throw new Error(`Failed to get Azure AD token: ${errorMessage}`);
+          }
+          break;
+        }
+        case "ntlm":
           config2.authentication = {
-            type: "azure-active-directory-access-token",
+            type: "ntlm",
             options: {
-              token: token.token
+              domain: options.domain,
+              userName: url.username,
+              password: url.password
             }
           };
-        } catch (error) {
-          const errorMessage = error instanceof Error ? error.message : String(error);
-          throw new Error(`Failed to get Azure AD token: ${errorMessage}`);
-        }
+          break;
+        default:
+          config2.user = url.username;
+          config2.password = url.password;
+          break;
       }
       return config2;
     } catch (error) {
@@ -904,9 +936,6 @@ var SQLServerConnector = class _SQLServerConnector {
       }
       return {
         rows: result.recordset || [],
-        fields: result.recordset && result.recordset.length > 0 ? Object.keys(result.recordset[0]).map((key) => ({
-          name: key
-        })) : [],
         rowCount: result.rowsAffected[0] || 0
       };
     } catch (error) {
@@ -1190,7 +1219,7 @@ var SQLiteConnector = class _SQLiteConnector {
           if (parameters && parameters.length > 0) {
             try {
               const rows = this.db.prepare(processedStatement).all(...parameters);
-              return { rows };
+              return { rows, rowCount: rows.length };
             } catch (error) {
               console.error(`[SQLite executeSQL] ERROR: ${error.message}`);
               console.error(`[SQLite executeSQL] SQL: ${processedStatement}`);
@@ -1199,12 +1228,13 @@ var SQLiteConnector = class _SQLiteConnector {
             }
           } else {
             const rows = this.db.prepare(processedStatement).all();
-            return { rows };
+            return { rows, rowCount: rows.length };
           }
         } else {
+          let result;
           if (parameters && parameters.length > 0) {
             try {
-              this.db.prepare(processedStatement).run(...parameters);
+              result = this.db.prepare(processedStatement).run(...parameters);
             } catch (error) {
               console.error(`[SQLite executeSQL] ERROR: ${error.message}`);
               console.error(`[SQLite executeSQL] SQL: ${processedStatement}`);
@@ -1212,9 +1242,9 @@ var SQLiteConnector = class _SQLiteConnector {
               throw error;
             }
           } else {
-            this.db.prepare(processedStatement).run();
+            result = this.db.prepare(processedStatement).run();
           }
-          return { rows: [] };
+          return { rows: [], rowCount: result.changes };
         }
       } else {
         if (parameters && parameters.length > 0) {
@@ -1230,8 +1260,10 @@ var SQLiteConnector = class _SQLiteConnector {
             writeStatements.push(statement);
           }
         }
-        if (writeStatements.length > 0) {
-          this.db.exec(writeStatements.join("; "));
+        let totalChanges = 0;
+        for (const statement of writeStatements) {
+          const result = this.db.prepare(statement).run();
+          totalChanges += result.changes;
         }
         let allRows = [];
         for (let statement of readStatements) {
@@ -1239,7 +1271,7 @@ var SQLiteConnector = class _SQLiteConnector {
           const result = this.db.prepare(statement).all();
           allRows.push(...result);
         }
-        return { rows: allRows };
+        return { rows: allRows, rowCount: totalChanges + allRows.length };
       }
     } catch (error) {
       throw error;
@@ -1278,6 +1310,26 @@ function extractRowsFromMultiStatement(results) {
   }
   return allRows;
 }
+function extractAffectedRows(results) {
+  if (isMetadataObject(results)) {
+    return results.affectedRows || 0;
+  }
+  if (!Array.isArray(results)) {
+    return 0;
+  }
+  if (isMultiStatementResult(results)) {
+    let totalAffected = 0;
+    for (const result of results) {
+      if (isMetadataObject(result)) {
+        totalAffected += result.affectedRows || 0;
+      } else if (Array.isArray(result)) {
+        totalAffected += result.length;
+      }
+    }
+    return totalAffected;
+  }
+  return results.length;
+}
 function parseQueryResults(results) {
   if (!Array.isArray(results)) {
     return [];
@@ -1374,6 +1426,9 @@ var MySQLConnector = class _MySQLConnector {
     try {
       const connectionOptions = await this.dsnParser.parse(dsn, config);
       this.pool = mysql.createPool(connectionOptions);
+      if (config?.queryTimeoutSeconds !== void 0) {
+        this.queryTimeoutMs = config.queryTimeoutSeconds * 1e3;
+      }
       const [rows] = await this.pool.query("SELECT 1");
     } catch (err) {
       console.error("Failed to connect to MySQL database:", err);
@@ -1676,7 +1731,7 @@ var MySQLConnector = class _MySQLConnector {
       let results;
       if (parameters && parameters.length > 0) {
         try {
-          results = await conn.query(processedSQL, parameters);
+          results = await conn.query({ sql: processedSQL, timeout: this.queryTimeoutMs }, parameters);
         } catch (error) {
           console.error(`[MySQL executeSQL] ERROR: ${error.message}`);
           console.error(`[MySQL executeSQL] SQL: ${processedSQL}`);
@@ -1684,11 +1739,12 @@ var MySQLConnector = class _MySQLConnector {
           throw error;
         }
       } else {
-        results = await conn.query(processedSQL);
+        results = await conn.query({ sql: processedSQL, timeout: this.queryTimeoutMs });
       }
       const [firstResult] = results;
       const rows = parseQueryResults(firstResult);
-      return { rows };
+      const rowCount = extractAffectedRows(firstResult);
+      return { rows, rowCount };
     } catch (error) {
       console.error("Error executing query:", error);
       throw error;
@@ -1705,6 +1761,7 @@ import mariadb from "mariadb";
 var MariadbDSNParser = class {
   async parse(dsn, config) {
     const connectionTimeoutSeconds = config?.connectionTimeoutSeconds;
+    const queryTimeoutSeconds = config?.queryTimeoutSeconds;
     if (!this.isValidDSN(dsn)) {
       const obfuscatedDSN = obfuscateDSNPassword(dsn);
       const expectedFormat = this.getSampleDSN();
@@ -1716,7 +1773,7 @@ Expected: ${expectedFormat}`
     }
     try {
       const url = new SafeURL(dsn);
-      const config2 = {
+      const connectionConfig = {
         host: url.hostname,
         port: url.port ? parseInt(url.port) : 3306,
         database: url.pathname ? url.pathname.substring(1) : "",
@@ -1727,25 +1784,28 @@ Expected: ${expectedFormat}`
         // Enable native multi-statement support
         ...connectionTimeoutSeconds !== void 0 && {
           connectTimeout: connectionTimeoutSeconds * 1e3
+        },
+        ...queryTimeoutSeconds !== void 0 && {
+          queryTimeout: queryTimeoutSeconds * 1e3
         }
       };
       url.forEachSearchParam((value, key) => {
         if (key === "sslmode") {
           if (value === "disable") {
-            config2.ssl = void 0;
+            connectionConfig.ssl = void 0;
           } else if (value === "require") {
-            config2.ssl = { rejectUnauthorized: false };
+            connectionConfig.ssl = { rejectUnauthorized: false };
           } else {
-            config2.ssl = {};
+            connectionConfig.ssl = {};
           }
         }
       });
       if (url.password && url.password.includes("X-Amz-Credential")) {
-        if (config2.ssl === void 0) {
-          config2.ssl = { rejectUnauthorized: false };
+        if (connectionConfig.ssl === void 0) {
+          connectionConfig.ssl = { rejectUnauthorized: false };
         }
       }
-      return config2;
+      return connectionConfig;
     } catch (error) {
       throw new Error(
         `Failed to parse MariaDB DSN: ${error instanceof Error ? error.message : String(error)}`
@@ -2095,7 +2155,8 @@ var MariaDBConnector = class _MariaDBConnector {
         results = await conn.query(processedSQL);
       }
       const rows = parseQueryResults(results);
-      return { rows };
+      const rowCount = extractAffectedRows(results);
+      return { rows, rowCount };
     } catch (error) {
       console.error("Error executing query:", error);
       throw error;
@@ -2242,9 +2303,30 @@ function getClientIdentifier(extra) {
   return "stdio";
 }
 
+// src/utils/tool-handler-helpers.ts
+function getEffectiveSourceId(sourceId) {
+  return sourceId || "default";
+}
+function createReadonlyViolationMessage(toolName, sourceId, connectorType) {
+  return `Tool '${toolName}' cannot execute in readonly mode for source '${sourceId}'. Only read-only SQL operations are allowed: ${allowedKeywords[connectorType]?.join(", ") || "none"}`;
+}
+function trackToolRequest(metadata, startTime, extra, success, error) {
+  requestStore.add({
+    id: crypto.randomUUID(),
+    timestamp: (/* @__PURE__ */ new Date()).toISOString(),
+    sourceId: metadata.sourceId,
+    toolName: metadata.toolName,
+    sql: metadata.sql,
+    durationMs: Date.now() - startTime,
+    client: getClientIdentifier(extra),
+    success,
+    error
+  });
+}
+
 // src/tools/execute-sql.ts
 var executeSqlSchema = {
-  sql: z.string().describe("SQL query or multiple SQL statements to execute (separated by semicolons)")
+  sql: z.string().describe("SQL to execute (multiple statements separated by ;)")
 };
 function splitSQLStatements(sql2) {
   return sql2.split(";").map((statement) => statement.trim()).filter((statement) => statement.length > 0);
@@ -2257,7 +2339,7 @@ function createExecuteSqlToolHandler(sourceId) {
   return async (args, extra) => {
     const { sql: sql2 } = args;
     const startTime = Date.now();
-    const effectiveSourceId = sourceId || "default";
+    const effectiveSourceId = getEffectiveSourceId(sourceId);
     let success = true;
     let errorMessage;
     let result;
@@ -2268,18 +2350,18 @@ function createExecuteSqlToolHandler(sourceId) {
       const toolConfig = registry.getBuiltinToolConfig(BUILTIN_TOOL_EXECUTE_SQL, actualSourceId);
       const isReadonly = toolConfig?.readonly === true;
       if (isReadonly && !areAllStatementsReadOnly(sql2, connector.id)) {
-        errorMessage = `Read-only mode is enabled for source '${actualSourceId}'. Only the following SQL operations are allowed: ${allowedKeywords[connector.id]?.join(", ") || "none"}`;
+        errorMessage = `Read-only mode is enabled. Only the following SQL operations are allowed: ${allowedKeywords[connector.id]?.join(", ") || "none"}`;
         success = false;
         return createToolErrorResponse(errorMessage, "READONLY_VIOLATION");
       }
       const executeOptions = {
-        readonly: isReadonly,
-        max_rows: toolConfig?.max_rows
+        readonly: toolConfig?.readonly,
+        maxRows: toolConfig?.max_rows
       };
       result = await connector.executeSQL(sql2, executeOptions);
       const responseData = {
         rows: result.rows,
-        count: result.rows.length,
+        count: result.rowCount,
         source_id: effectiveSourceId
       };
       return createToolSuccessResponse(responseData);
@@ -2288,17 +2370,17 @@ function createExecuteSqlToolHandler(sourceId) {
       errorMessage = error.message;
       return createToolErrorResponse(errorMessage, "EXECUTION_ERROR");
     } finally {
-      requestStore.add({
-        id: crypto.randomUUID(),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        sourceId: effectiveSourceId,
-        toolName: effectiveSourceId === "default" ? "execute_sql" : `execute_sql_${effectiveSourceId}`,
-        sql: sql2,
-        durationMs: Date.now() - startTime,
-        client: getClientIdentifier(extra),
+      trackToolRequest(
+        {
+          sourceId: effectiveSourceId,
+          toolName: effectiveSourceId === "default" ? "execute_sql" : `execute_sql_${effectiveSourceId}`,
+          sql: sql2
+        },
+        startTime,
+        extra,
         success,
-        error: errorMessage
-      });
+        errorMessage
+      );
     }
   };
 }
@@ -2306,12 +2388,12 @@ function createExecuteSqlToolHandler(sourceId) {
 // src/tools/search-objects.ts
 import { z as z2 } from "zod";
 var searchDatabaseObjectsSchema = {
-  object_type: z2.enum(["schema", "table", "column", "procedure", "index"]).describe("Type of database object to search for"),
-  pattern: z2.string().optional().default("%").describe("Search pattern (SQL LIKE syntax: % for wildcard, _ for single char). Case-insensitive. Defaults to '%' (match all)."),
-  schema: z2.string().optional().describe("Filter results to a specific schema/database (exact match)"),
-  table: z2.string().optional().describe("Filter to a specific table (exact match). Requires schema parameter. Only applies to columns and indexes."),
-  detail_level: z2.enum(["names", "summary", "full"]).default("names").describe("Level of detail to return: names (minimal), summary (with metadata), full (complete structure)"),
-  limit: z2.number().int().positive().max(1e3).default(100).describe("Maximum number of results to return (default: 100, max: 1000)")
+  object_type: z2.enum(["schema", "table", "column", "procedure", "index"]).describe("Object type to search"),
+  pattern: z2.string().optional().default("%").describe("LIKE pattern (% = any chars, _ = one char). Default: %"),
+  schema: z2.string().optional().describe("Filter to schema"),
+  table: z2.string().optional().describe("Filter to table (requires schema; column/index only)"),
+  detail_level: z2.enum(["names", "summary", "full"]).default("names").describe("Detail: names (minimal), summary (metadata), full (all)"),
+  limit: z2.number().int().positive().max(1e3).default(100).describe("Max results (default: 100, max: 1000)")
 };
 function likePatternToRegex(pattern) {
   const escaped = pattern.replace(/[.*+?^${}()|[\]\\]/g, "\\$&").replace(/%/g, ".*").replace(/_/g, ".");
@@ -2585,7 +2667,7 @@ async function searchIndexes(connector, pattern, schemaFilter, tableFilter, deta
   return results;
 }
 function createSearchDatabaseObjectsToolHandler(sourceId) {
-  return async (args, _extra) => {
+  return async (args, extra) => {
     const {
       object_type,
       pattern = "%",
@@ -2594,29 +2676,30 @@ function createSearchDatabaseObjectsToolHandler(sourceId) {
       detail_level = "names",
       limit = 100
     } = args;
+    const startTime = Date.now();
+    const effectiveSourceId = getEffectiveSourceId(sourceId);
+    let success = true;
+    let errorMessage;
     try {
       const connector = ConnectorManager.getCurrentConnector(sourceId);
       if (table) {
         if (!schema) {
-          return createToolErrorResponse(
-            "The 'table' parameter requires 'schema' to be specified",
-            "SCHEMA_REQUIRED"
-          );
+          success = false;
+          errorMessage = "The 'table' parameter requires 'schema' to be specified";
+          return createToolErrorResponse(errorMessage, "SCHEMA_REQUIRED");
         }
         if (!["column", "index"].includes(object_type)) {
-          return createToolErrorResponse(
-            `The 'table' parameter only applies to object_type 'column' or 'index', not '${object_type}'`,
-            "INVALID_TABLE_FILTER"
-          );
+          success = false;
+          errorMessage = `The 'table' parameter only applies to object_type 'column' or 'index', not '${object_type}'`;
+          return createToolErrorResponse(errorMessage, "INVALID_TABLE_FILTER");
         }
       }
       if (schema) {
         const schemas = await connector.getSchemas();
         if (!schemas.includes(schema)) {
-          return createToolErrorResponse(
-            `Schema '${schema}' does not exist. Available schemas: ${schemas.join(", ")}`,
-            "SCHEMA_NOT_FOUND"
-          );
+          success = false;
+          errorMessage = `Schema '${schema}' does not exist. Available schemas: ${schemas.join(", ")}`;
+          return createToolErrorResponse(errorMessage, "SCHEMA_NOT_FOUND");
         }
       }
       let results = [];
@@ -2637,10 +2720,9 @@ function createSearchDatabaseObjectsToolHandler(sourceId) {
           results = await searchIndexes(connector, pattern, schema, table, detail_level, limit);
           break;
         default:
-          return createToolErrorResponse(
-            `Unsupported object_type: ${object_type}`,
-            "INVALID_OBJECT_TYPE"
-          );
+          success = false;
+          errorMessage = `Unsupported object_type: ${object_type}`;
+          return createToolErrorResponse(errorMessage, "INVALID_OBJECT_TYPE");
       }
       return createToolSuccessResponse({
         object_type,
@@ -2653,10 +2735,24 @@ function createSearchDatabaseObjectsToolHandler(sourceId) {
         truncated: results.length === limit
       });
     } catch (error) {
+      success = false;
+      errorMessage = error.message;
       return createToolErrorResponse(
-        `Error searching database objects: ${error.message}`,
+        `Error searching database objects: ${errorMessage}`,
         "SEARCH_ERROR"
       );
+    } finally {
+      trackToolRequest(
+        {
+          sourceId: effectiveSourceId,
+          toolName: effectiveSourceId === "default" ? "search_objects" : `search_objects_${effectiveSourceId}`,
+          sql: `search_objects(object_type=${object_type}, pattern=${pattern}, schema=${schema || "all"}, table=${table || "all"}, detail_level=${detail_level})`
+        },
+        startTime,
+        extra,
+        success,
+        errorMessage
+      );
     }
   };
 }
@@ -2699,14 +2795,19 @@ function zodToParameters(schema) {
 function getExecuteSqlMetadata(sourceId) {
   const sourceIds = ConnectorManager.getAvailableSourceIds();
   const sourceConfig = ConnectorManager.getSourceConfig(sourceId);
-  const executeOptions = ConnectorManager.getCurrentExecuteOptions(sourceId);
   const dbType = sourceConfig.type;
-  const toolName = sourceId === "default" ? "execute_sql" : `execute_sql_${normalizeSourceId(sourceId)}`;
-  const isDefault = sourceIds[0] === sourceId;
-  const title = isDefault ? `Execute SQL (${dbType})` : `Execute SQL on ${sourceId} (${dbType})`;
+  const isSingleSource = sourceIds.length === 1;
+  const registry = getToolRegistry();
+  const toolConfig = registry.getBuiltinToolConfig(BUILTIN_TOOL_EXECUTE_SQL, sourceId);
+  const executeOptions = {
+    readonly: toolConfig?.readonly,
+    maxRows: toolConfig?.max_rows
+  };
+  const toolName = isSingleSource ? "execute_sql" : `execute_sql_${normalizeSourceId(sourceId)}`;
+  const title = isSingleSource ? `Execute SQL (${dbType})` : `Execute SQL on ${sourceId} (${dbType})`;
   const readonlyNote = executeOptions.readonly ? " [READ-ONLY MODE]" : "";
   const maxRowsNote = executeOptions.maxRows ? ` (limited to ${executeOptions.maxRows} rows)` : "";
-  const description = `Execute SQL queries on the '${sourceId}' ${dbType} database${isDefault ? " (default)" : ""}${readonlyNote}${maxRowsNote}`;
+  const description = isSingleSource ? `Execute SQL queries on the ${dbType} database${readonlyNote}${maxRowsNote}` : `Execute SQL queries on the '${sourceId}' ${dbType} database${readonlyNote}${maxRowsNote}`;
   const isReadonly = executeOptions.readonly === true;
   const annotations = {
     title,
@@ -2726,10 +2827,14 @@ function getExecuteSqlMetadata(sourceId) {
     annotations
   };
 }
-function getSearchObjectsMetadata(sourceId, dbType, isDefault) {
-  const toolName = sourceId === "default" ? "search_objects" : `search_objects_${normalizeSourceId(sourceId)}`;
-  const title = isDefault ? `Search Database Objects (${dbType})` : `Search Database Objects on ${sourceId} (${dbType})`;
-  const description = `Search and list database objects (schemas, tables, columns, procedures, indexes) on the '${sourceId}' ${dbType} database${isDefault ? " (default)" : ""}. Supports SQL LIKE patterns (default: '%' for all), filtering, and token-efficient progressive disclosure.`;
+function getSearchObjectsMetadata(sourceId) {
+  const sourceIds = ConnectorManager.getAvailableSourceIds();
+  const sourceConfig = ConnectorManager.getSourceConfig(sourceId);
+  const dbType = sourceConfig.type;
+  const isSingleSource = sourceIds.length === 1;
+  const toolName = isSingleSource ? "search_objects" : `search_objects_${normalizeSourceId(sourceId)}`;
+  const title = isSingleSource ? `Search Database Objects (${dbType})` : `Search Database Objects on ${sourceId} (${dbType})`;
+  const description = isSingleSource ? `Search and list database objects (schemas, tables, columns, procedures, indexes) on the ${dbType} database` : `Search and list database objects (schemas, tables, columns, procedures, indexes) on the '${sourceId}' ${dbType} database`;
   return {
     name: toolName,
     description,
@@ -2747,21 +2852,21 @@ function customParamsToToolParams(params) {
     description: param.description
   }));
 }
-function buildExecuteSqlTool(sourceId) {
+function buildExecuteSqlTool(sourceId, toolConfig) {
   const executeSqlMetadata = getExecuteSqlMetadata(sourceId);
   const executeSqlParameters = zodToParameters(executeSqlMetadata.schema);
+  const readonly = toolConfig && "readonly" in toolConfig ? toolConfig.readonly : void 0;
+  const max_rows = toolConfig && "max_rows" in toolConfig ? toolConfig.max_rows : void 0;
   return {
     name: executeSqlMetadata.name,
     description: executeSqlMetadata.description,
-    parameters: executeSqlParameters
+    parameters: executeSqlParameters,
+    readonly,
+    max_rows
   };
 }
 function buildSearchObjectsTool(sourceId) {
-  const sourceConfig = ConnectorManager.getSourceConfig(sourceId);
-  const dbType = sourceConfig.type;
-  const sourceIds = ConnectorManager.getAvailableSourceIds();
-  const isDefault = sourceIds[0] === sourceId;
-  const searchMetadata = getSearchObjectsMetadata(sourceId, dbType, isDefault);
+  const searchMetadata = getSearchObjectsMetadata(sourceId);
   return {
     name: searchMetadata.name,
     description: searchMetadata.description,
@@ -2770,40 +2875,51 @@ function buildSearchObjectsTool(sourceId) {
         name: "object_type",
         type: "string",
         required: true,
-        description: "Type of database object to search for (schema, table, column, procedure, index)"
+        description: "Object type to search"
       },
       {
         name: "pattern",
         type: "string",
         required: false,
-        description: "Search pattern (SQL LIKE syntax: % for wildcard, _ for single char). Case-insensitive. Defaults to '%' (match all)."
+        description: "LIKE pattern (% = any chars, _ = one char). Default: %"
       },
       {
         name: "schema",
         type: "string",
         required: false,
-        description: "Filter results to a specific schema/database"
+        description: "Filter to schema"
+      },
+      {
+        name: "table",
+        type: "string",
+        required: false,
+        description: "Filter to table (requires schema; column/index only)"
       },
       {
         name: "detail_level",
         type: "string",
         required: false,
-        description: "Level of detail to return: names (minimal), summary (with metadata), full (complete structure). Defaults to 'names'."
+        description: "Detail: names (minimal), summary (metadata), full (all)"
       },
       {
         name: "limit",
         type: "integer",
         required: false,
-        description: "Maximum number of results to return (default: 100, max: 1000)"
+        description: "Max results (default: 100, max: 1000)"
       }
-    ]
+    ],
+    readonly: true
+    // search_objects is always readonly
   };
 }
 function buildCustomTool(toolConfig) {
   return {
     name: toolConfig.name,
     description: toolConfig.description,
-    parameters: customParamsToToolParams(toolConfig.parameters)
+    parameters: customParamsToToolParams(toolConfig.parameters),
+    statement: toolConfig.statement,
+    readonly: toolConfig.readonly,
+    max_rows: toolConfig.max_rows
   };
 }
 function getToolsForSource(sourceId) {
@@ -2811,7 +2927,7 @@ function getToolsForSource(sourceId) {
   const enabledToolConfigs = registry.getEnabledToolConfigs(sourceId);
   return enabledToolConfigs.map((toolConfig) => {
     if (toolConfig.name === "execute_sql") {
-      return buildExecuteSqlTool(sourceId);
+      return buildExecuteSqlTool(sourceId, toolConfig);
     } else if (toolConfig.name === "search_objects") {
       return buildSearchObjectsTool(sourceId);
     } else {
@@ -2878,12 +2994,13 @@ function createCustomToolHandler(toolConfig) {
     try {
       const validatedArgs = zodSchema.parse(args);
       const connector = ConnectorManager.getCurrentConnector(toolConfig.source);
-      const executeOptions = ConnectorManager.getCurrentExecuteOptions(
-        toolConfig.source
-      );
+      const executeOptions = {
+        readonly: toolConfig.readonly,
+        maxRows: toolConfig.max_rows
+      };
       const isReadonly = executeOptions.readonly === true;
       if (isReadonly && !isReadOnlySQL(toolConfig.statement, connector.id)) {
-        errorMessage = `Tool '${toolConfig.name}' cannot execute in readonly mode for source '${toolConfig.source}'. Only read-only SQL operations are allowed: ${allowedKeywords[connector.id]?.join(", ") || "none"}`;
+        errorMessage = createReadonlyViolationMessage(toolConfig.name, toolConfig.source, connector.id);
         success = false;
         return createToolErrorResponse(errorMessage, "READONLY_VIOLATION");
       }
@@ -2898,7 +3015,7 @@ function createCustomToolHandler(toolConfig) {
       );
       const responseData = {
         rows: result.rows,
-        count: result.rows.length,
+        count: result.rowCount,
         source_id: toolConfig.source
       };
       return createToolSuccessResponse(responseData);
@@ -2916,17 +3033,17 @@ Parameters: ${JSON.stringify(paramValues)}`;
       }
       return createToolErrorResponse(errorMessage, "EXECUTION_ERROR");
     } finally {
-      requestStore.add({
-        id: crypto.randomUUID(),
-        timestamp: (/* @__PURE__ */ new Date()).toISOString(),
-        sourceId: toolConfig.source,
-        toolName: toolConfig.name,
-        sql: toolConfig.statement,
-        durationMs: Date.now() - startTime,
-        client: getClientIdentifier(extra),
+      trackToolRequest(
+        {
+          sourceId: toolConfig.source,
+          toolName: toolConfig.name,
+          sql: toolConfig.statement
+        },
+        startTime,
+        extra,
         success,
-        error: errorMessage
-      });
+        errorMessage
+      );
     }
   };
 }
@@ -2940,21 +3057,18 @@ function registerTools(server) {
   const registry = getToolRegistry();
   for (const sourceId of sourceIds) {
     const enabledTools = registry.getEnabledToolConfigs(sourceId);
-    const sourceConfig = ConnectorManager.getSourceConfig(sourceId);
-    const dbType = sourceConfig.type;
-    const isDefault = sourceIds[0] === sourceId;
     for (const toolConfig of enabledTools) {
       if (toolConfig.name === BUILTIN_TOOL_EXECUTE_SQL) {
-        registerExecuteSqlTool(server, sourceId, dbType);
+        registerExecuteSqlTool(server, sourceId);
       } else if (toolConfig.name === BUILTIN_TOOL_SEARCH_OBJECTS) {
-        registerSearchObjectsTool(server, sourceId, dbType, isDefault);
+        registerSearchObjectsTool(server, sourceId);
       } else {
-        registerCustomTool(server, toolConfig, dbType);
+        registerCustomTool(server, sourceId, toolConfig);
       }
     }
   }
 }
-function registerExecuteSqlTool(server, sourceId, dbType) {
+function registerExecuteSqlTool(server, sourceId) {
   const metadata = getExecuteSqlMetadata(sourceId);
   server.registerTool(
     metadata.name,
@@ -2966,8 +3080,8 @@ function registerExecuteSqlTool(server, sourceId, dbType) {
     createExecuteSqlToolHandler(sourceId)
   );
 }
-function registerSearchObjectsTool(server, sourceId, dbType, isDefault) {
-  const metadata = getSearchObjectsMetadata(sourceId, dbType, isDefault);
+function registerSearchObjectsTool(server, sourceId) {
+  const metadata = getSearchObjectsMetadata(sourceId);
   server.registerTool(
     metadata.name,
     {
@@ -2984,7 +3098,9 @@ function registerSearchObjectsTool(server, sourceId, dbType, isDefault) {
     createSearchDatabaseObjectsToolHandler(sourceId)
   );
 }
-function registerCustomTool(server, toolConfig, dbType) {
+function registerCustomTool(server, sourceId, toolConfig) {
+  const sourceConfig = ConnectorManager.getSourceConfig(sourceId);
+  const dbType = sourceConfig.type;
   const isReadOnly = isReadOnlySQL(toolConfig.statement, dbType);
   const zodSchema = buildZodSchemaFromParameters(toolConfig.parameters);
   server.registerTool(
@@ -3002,11 +3118,10 @@ function registerCustomTool(server, toolConfig, dbType) {
     },
     createCustomToolHandler(toolConfig)
   );
-  console.error(`  - ${toolConfig.name} \u2192 ${toolConfig.source} (${dbType})`);
 }
 
 // src/api/sources.ts
-function transformSourceConfig(source, isDefault) {
+function transformSourceConfig(source) {
   if (!source.type && source.dsn) {
     const inferredType = getDatabaseTypeFromDSN(source.dsn);
     if (inferredType) {
@@ -3018,8 +3133,7 @@ function transformSourceConfig(source, isDefault) {
   }
   const dataSource = {
     id: source.id,
-    type: source.type,
-    is_default: isDefault
+    type: source.type
   };
   if (source.host) {
     dataSource.host = source.host;
@@ -3033,12 +3147,6 @@ function transformSourceConfig(source, isDefault) {
   if (source.user) {
     dataSource.user = source.user;
   }
-  if (source.readonly !== void 0) {
-    dataSource.readonly = source.readonly;
-  }
-  if (source.max_rows !== void 0) {
-    dataSource.max_rows = source.max_rows;
-  }
   if (source.ssh_host) {
     const sshTunnel = {
       enabled: true,
@@ -3058,9 +3166,8 @@ function transformSourceConfig(source, isDefault) {
 function listSources(req, res) {
   try {
     const sourceConfigs = ConnectorManager.getAllSourceConfigs();
-    const sources = sourceConfigs.map((config, index) => {
-      const isDefault = index === 0;
-      return transformSourceConfig(config, isDefault);
+    const sources = sourceConfigs.map((config) => {
+      return transformSourceConfig(config);
     });
     res.json(sources);
   } catch (error) {
@@ -3074,7 +3181,6 @@ function listSources(req, res) {
 function getSource(req, res) {
   try {
     const sourceId = req.params.sourceId;
-    const sourceIds = ConnectorManager.getAvailableSourceIds();
     const sourceConfig = ConnectorManager.getSourceConfig(sourceId);
     if (!sourceConfig) {
       const errorResponse = {
@@ -3084,8 +3190,7 @@ function getSource(req, res) {
       res.status(404).json(errorResponse);
       return;
     }
-    const isDefault = sourceIds[0] === sourceId;
-    const dataSource = transformSourceConfig(sourceConfig, isDefault);
+    const dataSource = transformSourceConfig(sourceConfig);
     res.json(dataSource);
   } catch (error) {
     console.error(`Error getting source ${req.params.sourceId}:`, error);
@@ -3280,13 +3385,8 @@ See documentation for more details on configuring database connections.
     const connectorManager = new ConnectorManager();
     const sources = sourceConfigsData.sources;
     console.error(`Configuration source: ${sourceConfigsData.source}`);
-    console.error(`Connecting to ${sources.length} database source(s)...`);
-    for (const source of sources) {
-      const dsn = source.dsn || buildDSNFromSource(source);
-      console.error(`  - ${source.id}: ${redactDSN(dsn)}`);
-    }
     await connectorManager.connectWithSources(sources);
-    const { initializeToolRegistry } = await import("./registry-AWAIN6WO.js");
+    const { initializeToolRegistry } = await import("./registry-XXEL5IXH.js");
     initializeToolRegistry({
       sources: sourceConfigsData.sources,
       tools: sourceConfigsData.tools
@@ -3315,7 +3415,7 @@ See documentation for more details on configuring database connections.
     console.error(generateBanner(SERVER_VERSION, activeModes));
     const sourceDisplayInfos = buildSourceDisplayInfo(
       sources,
-      (sourceId) => getToolsForSource(sourceId).map((t) => t.name),
+      (sourceId) => getToolsForSource(sourceId).map((t) => t.readonly ? `\u{1F512} ${t.name}` : t.name),
       isDemo
     );
     console.error(generateStartupTable(sourceDisplayInfos));
@@ -3376,13 +3476,13 @@ See documentation for more details on configuring database connections.
       app.listen(port, "0.0.0.0", () => {
         if (process.env.NODE_ENV === "development") {
           console.error("Development mode detected!");
-          console.error("   Admin console dev server (with HMR): http://localhost:5173");
+          console.error("   Workbench dev server (with HMR): http://localhost:5173");
           console.error("   Backend API: http://localhost:8080");
           console.error("");
         } else {
-          console.error(`Admin console at http://0.0.0.0:${port}/`);
+          console.error(`Workbench at http://localhost:${port}/`);
         }
-        console.error(`MCP server endpoint at http://0.0.0.0:${port}/mcp`);
+        console.error(`MCP server endpoint at http://localhost:${port}/mcp`);
       });
     } else {
       const server = createServer();